IOC Report
http://securityupdatehub-my.sharepoint.com

loading gif

Files

File Path
Type
Category
Malicious
Chrome Cache Entry: 59
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 190152
downloaded
Chrome Cache Entry: 60
HTML document, ASCII text, with very long lines (3450), with CRLF line terminators
downloaded
Chrome Cache Entry: 61
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 190152
dropped
Chrome Cache Entry: 62
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 3651
downloaded
Chrome Cache Entry: 63
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 3651
dropped
Chrome Cache Entry: 64
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 142367
dropped
Chrome Cache Entry: 65
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 450755
downloaded
Chrome Cache Entry: 66
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1592
downloaded
Chrome Cache Entry: 67
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 450755
dropped
Chrome Cache Entry: 68
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 142367
downloaded
Chrome Cache Entry: 69
ASCII text, with no line terminators
downloaded
Chrome Cache Entry: 70
ASCII text, with very long lines (45797)
downloaded
Chrome Cache Entry: 71
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1592
dropped
Chrome Cache Entry: 72
GIF image data, version 89a, 352 x 3
dropped
Chrome Cache Entry: 73
ASCII text, with very long lines (45797)
dropped
Chrome Cache Entry: 74
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 113769
dropped
Chrome Cache Entry: 75
MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
downloaded
Chrome Cache Entry: 76
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 57510
dropped
Chrome Cache Entry: 77
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1864
downloaded
Chrome Cache Entry: 78
GIF image data, version 89a, 352 x 3
dropped
Chrome Cache Entry: 79
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 113424
downloaded
Chrome Cache Entry: 80
GIF image data, version 89a, 352 x 3
downloaded
Chrome Cache Entry: 81
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 113769
downloaded
Chrome Cache Entry: 82
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 57510
downloaded
Chrome Cache Entry: 83
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1864
dropped
Chrome Cache Entry: 84
GIF image data, version 89a, 352 x 3
downloaded
Chrome Cache Entry: 85
MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
dropped
There are 18 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2136 --field-trial-handle=1988,i,7594917267722297499,11007387598272349058,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" "http://securityupdatehub-my.sharepoint.com"

URLs

Name
IP
Malicious
http://securityupdatehub-my.sharepoint.com
https://aadcdn.msftauth.net/shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_27cef08ca792f8e8b149.js
152.199.21.175
https://securityupdatehub-my.sharepoint.com/_layouts/15/authenticate.aspx?Source=%2F
13.107.138.10
https://login.microsoftonline.com
unknown
https://login.microsoftonline.com/9b82a082-52f4-44b9-a6c9-d3d75128b78b/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=ADE0690D93F719CF918CBB9C521182130797FDF54A0F08A1%2D03C14ECC01D987DB2D5375F0F48E93B6E757EE95005239FAA6916A25FD464BF3&redirect%5Furi=https%3A%2F%2Fsecurityupdatehub%2Dmy%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=4cbd6fa1%2D7032%2D7000%2D734f%2D6c042359b170&sso_reload=true
https://github.com/douglascrockford/JSON-js
unknown
https://login.microsoftonline.com/9b82a082-52f4-44b9-a6c9-d3d75128b78b/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=ADE0690D93F719CF918CBB9C521182130797FDF54A0F08A1%2D03C14ECC01D987DB2D5375F0F48E93B6E757EE95005239FAA6916A25FD464BF3&redirect%5Furi=https%3A%2F%2Fsecurityupdatehub%2Dmy%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=4cbd6fa1%2D7032%2D7000%2D734f%2D6c042359b170
https://login.windows-ppe.net
unknown
https://securityupdatehub-my.sharepoint.com/_forms/default.aspx?ReturnUrl=%2f_layouts%2f15%2fauthenticate.aspx%3fSource%3d%252F&Source=cookie
13.107.138.10
http://feross.org
unknown
http://securityupdatehub-my.sharepoint.com/
13.107.136.10
https://securityupdatehub-my.sharepoint.com/
13.107.138.10
There are 1 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
dual-spo-0005.spo-msedge.net
13.107.136.10
sni1gl.wpc.omegacdn.net
152.199.21.175
www.google.com
142.250.181.100
s-part-0035.t-0009.t-msedge.net
13.107.246.63
securityupdatehub-my.sharepoint.com
unknown
identity.nel.measure.office.net
unknown
aadcdn.msftauth.net
unknown
login.microsoftonline.com
unknown

IPs

IP
Domain
Country
Malicious
13.107.138.10
unknown
United States
13.107.136.10
dual-spo-0005.spo-msedge.net
United States
192.168.2.4
unknown
unknown
142.250.181.100
www.google.com
United States
239.255.255.250
unknown
Reserved
152.199.21.175
sni1gl.wpc.omegacdn.net
United States

DOM / HTML

URL
Malicious
https://login.microsoftonline.com/9b82a082-52f4-44b9-a6c9-d3d75128b78b/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=ADE0690D93F719CF918CBB9C521182130797FDF54A0F08A1%2D03C14ECC01D987DB2D5375F0F48E93B6E757EE95005239FAA6916A25FD464BF3&redirect%5Furi=https%3A%2F%2Fsecurityupdatehub%2Dmy%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=4cbd6fa1%2D7032%2D7000%2D734f%2D6c042359b170
https://login.microsoftonline.com/9b82a082-52f4-44b9-a6c9-d3d75128b78b/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=ADE0690D93F719CF918CBB9C521182130797FDF54A0F08A1%2D03C14ECC01D987DB2D5375F0F48E93B6E757EE95005239FAA6916A25FD464BF3&redirect%5Furi=https%3A%2F%2Fsecurityupdatehub%2Dmy%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=4cbd6fa1%2D7032%2D7000%2D734f%2D6c042359b170&sso_reload=true
https://login.microsoftonline.com/9b82a082-52f4-44b9-a6c9-d3d75128b78b/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=ADE0690D93F719CF918CBB9C521182130797FDF54A0F08A1%2D03C14ECC01D987DB2D5375F0F48E93B6E757EE95005239FAA6916A25FD464BF3&redirect%5Furi=https%3A%2F%2Fsecurityupdatehub%2Dmy%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=4cbd6fa1%2D7032%2D7000%2D734f%2D6c042359b170&sso_reload=true
https://login.microsoftonline.com/9b82a082-52f4-44b9-a6c9-d3d75128b78b/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=ADE0690D93F719CF918CBB9C521182130797FDF54A0F08A1%2D03C14ECC01D987DB2D5375F0F48E93B6E757EE95005239FAA6916A25FD464BF3&redirect%5Furi=https%3A%2F%2Fsecurityupdatehub%2Dmy%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=4cbd6fa1%2D7032%2D7000%2D734f%2D6c042359b170&sso_reload=true
https://login.microsoftonline.com/9b82a082-52f4-44b9-a6c9-d3d75128b78b/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=ADE0690D93F719CF918CBB9C521182130797FDF54A0F08A1%2D03C14ECC01D987DB2D5375F0F48E93B6E757EE95005239FAA6916A25FD464BF3&redirect%5Furi=https%3A%2F%2Fsecurityupdatehub%2Dmy%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=4cbd6fa1%2D7032%2D7000%2D734f%2D6c042359b170&sso_reload=true
https://login.microsoftonline.com/9b82a082-52f4-44b9-a6c9-d3d75128b78b/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=ADE0690D93F719CF918CBB9C521182130797FDF54A0F08A1%2D03C14ECC01D987DB2D5375F0F48E93B6E757EE95005239FAA6916A25FD464BF3&redirect%5Furi=https%3A%2F%2Fsecurityupdatehub%2Dmy%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=4cbd6fa1%2D7032%2D7000%2D734f%2D6c042359b170&sso_reload=true