Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
https://jmak-service.com/3225640388

Overview

General Information

Sample URL:https://jmak-service.com/3225640388
Analysis ID:1585932

Detection

HTMLPhisher
Score:60
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

AI detected phishing page
Yara detected HtmlPhish10
AI detected suspicious URL
HTML body contains low number of good links
HTML body contains password input but no form action
HTML title does not match URL
Invalid T&C link found
Stores files to the Windows start menu directory

Classification

  • System is w10x64_ra
  • chrome.exe (PID: 6840 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)
    • chrome.exe (PID: 7064 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 --field-trial-handle=2012,i,6001976476545217732,3726558075908552256,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)
  • chrome.exe (PID: 4420 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://jmak-service.com/3225640388" MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)
  • cleanup
SourceRuleDescriptionAuthorStrings
2.10.pages.csvJoeSecurity_HtmlPhish_10Yara detected HtmlPhish_10Joe Security
    No Sigma rule has matched
    No Suricata rule has matched

    Click to jump to signature section

    Show All Signature Results

    Phishing

    barindex
    Source: https://inbox-clearance.uscourtbusiness.com/iTY74/Joe Sandbox AI: Score: 9 Reasons: The brand 'Microsoft' is well-known and typically associated with the domain 'microsoft.com'., The URL 'inbox-clearance.uscourtbusiness.com' does not match the legitimate domain for Microsoft., The domain 'uscourtbusiness.com' is unrelated to Microsoft and could be a sign of phishing., The use of 'inbox-clearance' as a subdomain is suspicious and not typically associated with Microsoft., The presence of input fields for 'Email, phone, or Skype' suggests an attempt to collect sensitive information, which is common in phishing sites. DOM: 2.10.pages.csv
    Source: Yara matchFile source: 2.10.pages.csv, type: HTML
    Source: URLJoe Sandbox AI: AI detected Brand spoofing attempt in URL: https://inbox-clearance.uscourtbusiness.com
    Source: https://inbox-clearance.uscourtbusiness.com/iTY74/HTTP Parser: Number of links: 0
    Source: https://inbox-clearance.uscourtbusiness.com/iTY74/HTTP Parser: <input type="password" .../> found but no <form action="...
    Source: https://inbox-clearance.uscourtbusiness.com/iTY74/HTTP Parser: Title: Sign in to your account does not match URL
    Source: https://inbox-clearance.uscourtbusiness.com/iTY74/HTTP Parser: Invalid link: Privacy statement
    Source: https://inbox-clearance.uscourtbusiness.com/iTY74/HTTP Parser: <input type="password" .../> found
    Source: https://jmak-service.com/3225640388/HTTP Parser: No favicon
    Source: https://jmak-service.com/3225640388/HTTP Parser: No favicon
    Source: https://jmak-service.com/3225640388/HTTP Parser: No favicon
    Source: https://jmak-service.com/3225640388/HTTP Parser: No favicon
    Source: https://jmak-service.com/3225640388/HTTP Parser: No favicon
    Source: https://jmak-service.com/3225640388/HTTP Parser: No favicon
    Source: https://inbox-clearance.uscourtbusiness.com/iTY74/HTTP Parser: No favicon
    Source: https://inbox-clearance.uscourtbusiness.com/iTY74/HTTP Parser: No favicon
    Source: https://inbox-clearance.uscourtbusiness.com/iTY74/HTTP Parser: No favicon
    Source: https://inbox-clearance.uscourtbusiness.com/iTY74/HTTP Parser: No favicon
    Source: https://inbox-clearance.uscourtbusiness.com/iTY74/HTTP Parser: No <meta name="author".. found
    Source: https://inbox-clearance.uscourtbusiness.com/iTY74/HTTP Parser: No <meta name="copyright".. found
    Source: unknownHTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.17:49735 version: TLS 1.2
    Source: unknownHTTPS traffic detected: 23.56.254.164:443 -> 192.168.2.17:49765 version: TLS 1.2
    Source: unknownHTTPS traffic detected: 23.56.254.164:443 -> 192.168.2.17:49766 version: TLS 1.2
    Source: unknownHTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.17:49818 version: TLS 1.2
    Source: unknownHTTPS traffic detected: 13.107.5.88:443 -> 192.168.2.17:49823 version: TLS 1.2
    Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.200
    Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.200
    Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.200
    Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
    Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
    Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
    Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
    Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
    Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
    Source: unknownTCP traffic detected without corresponding DNS query: 172.202.163.200
    Source: unknownTCP traffic detected without corresponding DNS query: 172.202.163.200
    Source: unknownTCP traffic detected without corresponding DNS query: 172.202.163.200
    Source: unknownTCP traffic detected without corresponding DNS query: 172.202.163.200
    Source: unknownTCP traffic detected without corresponding DNS query: 172.202.163.200
    Source: unknownTCP traffic detected without corresponding DNS query: 172.202.163.200
    Source: unknownTCP traffic detected without corresponding DNS query: 172.202.163.200
    Source: unknownTCP traffic detected without corresponding DNS query: 172.202.163.200
    Source: unknownTCP traffic detected without corresponding DNS query: 172.202.163.200
    Source: unknownTCP traffic detected without corresponding DNS query: 172.202.163.200
    Source: unknownTCP traffic detected without corresponding DNS query: 172.202.163.200
    Source: unknownTCP traffic detected without corresponding DNS query: 172.202.163.200
    Source: unknownTCP traffic detected without corresponding DNS query: 172.202.163.200
    Source: unknownTCP traffic detected without corresponding DNS query: 172.202.163.200
    Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
    Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
    Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
    Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
    Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
    Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
    Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
    Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
    Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
    Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
    Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
    Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
    Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
    Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
    Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
    Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
    Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
    Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
    Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
    Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
    Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
    Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
    Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
    Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
    Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
    Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
    Source: unknownTCP traffic detected without corresponding DNS query: 23.56.254.164
    Source: global trafficDNS traffic detected: DNS query: jmak-service.com
    Source: global trafficDNS traffic detected: DNS query: img1.wsimg.com
    Source: global trafficDNS traffic detected: DNS query: hcaptcha.com
    Source: global trafficDNS traffic detected: DNS query: www.google.com
    Source: global trafficDNS traffic detected: DNS query: events.api.secureserver.net
    Source: global trafficDNS traffic detected: DNS query: newassets.hcaptcha.com
    Source: global trafficDNS traffic detected: DNS query: csp.secureserver.net
    Source: global trafficDNS traffic detected: DNS query: api.hcaptcha.com
    Source: global trafficDNS traffic detected: DNS query: imgs3.hcaptcha.com
    Source: global trafficDNS traffic detected: DNS query: inbox-clearance.uscourtbusiness.com
    Source: global trafficDNS traffic detected: DNS query: challenges.cloudflare.com
    Source: global trafficDNS traffic detected: DNS query: a.nel.cloudflare.com
    Source: global trafficDNS traffic detected: DNS query: code.jquery.com
    Source: global trafficDNS traffic detected: DNS query: cdnjs.cloudflare.com
    Source: global trafficDNS traffic detected: DNS query: maxcdn.bootstrapcdn.com
    Source: global trafficDNS traffic detected: DNS query: stackpath.bootstrapcdn.com
    Source: global trafficDNS traffic detected: DNS query: 5879537809-1323985617.cos.na-ashburn.myqcloud.com
    Source: global trafficDNS traffic detected: DNS query: 5879537809.businesslawoutlook.com
    Source: global trafficDNS traffic detected: DNS query: aadcdn.msftauth.net
    Source: unknownNetwork traffic detected: HTTP traffic on port 49708 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49744
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49743
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49742
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49741
    Source: unknownNetwork traffic detected: HTTP traffic on port 49789 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49800 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49766 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49743 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49795 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49738
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49737
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49735
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49734
    Source: unknownNetwork traffic detected: HTTP traffic on port 49772 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49733
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49732
    Source: unknownNetwork traffic detected: HTTP traffic on port 49675 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49732 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49812 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49784 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49749 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49806 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49823 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49729
    Source: unknownNetwork traffic detected: HTTP traffic on port 49777 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49790 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49723
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49722
    Source: unknownNetwork traffic detected: HTTP traffic on port 49748 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49760 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49805 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49719
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49718
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49717
    Source: unknownNetwork traffic detected: HTTP traffic on port 49715 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49680 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49715
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49713
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49711
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49710
    Source: unknownNetwork traffic detected: HTTP traffic on port 49709 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49765 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49796 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49709
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49708
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49707
    Source: unknownNetwork traffic detected: HTTP traffic on port 49811 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49754 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49825
    Source: unknownNetwork traffic detected: HTTP traffic on port 49737 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49823
    Source: unknownNetwork traffic detected: HTTP traffic on port 49771 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49701
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49788
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49787
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49786
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49785
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49784
    Source: unknownNetwork traffic detected: HTTP traffic on port 49813 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49676 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49783
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49782
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49781
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49780
    Source: unknownNetwork traffic detected: HTTP traffic on port 49785 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49807 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49701 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49776 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49713 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49791 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49759 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49779
    Source: unknownNetwork traffic detected: HTTP traffic on port 49753 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49778
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49777
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49776
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49775
    Source: unknownNetwork traffic detected: HTTP traffic on port 49707 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49774
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49773
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49772
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49771
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49770
    Source: unknownNetwork traffic detected: HTTP traffic on port 49742 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49780 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49802 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49769
    Source: unknownNetwork traffic detected: HTTP traffic on port 49718 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49768
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49767
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49766
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49765
    Source: unknownNetwork traffic detected: HTTP traffic on port 49758 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49764
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49763
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49762
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49761
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49760
    Source: unknownNetwork traffic detected: HTTP traffic on port 49741 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49764 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49770 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49719 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49797 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49801 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49759
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49758
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49757
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49756
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49755
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49754
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49753
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49752
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49751
    Source: unknownNetwork traffic detected: HTTP traffic on port 49818 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49786 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49747 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49775 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49749
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49748
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49747
    Source: unknownNetwork traffic detected: HTTP traffic on port 49792 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49746
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49745
    Source: unknownNetwork traffic detected: HTTP traffic on port 49746 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49781 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49769 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49717 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49820 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49711 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49691
    Source: unknownNetwork traffic detected: HTTP traffic on port 49763 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49752 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49798 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49735 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49819 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49787 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49729 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49745 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49793 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49751 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49774 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49757 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49782 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49799
    Source: unknownNetwork traffic detected: HTTP traffic on port 49734 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49798
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49797
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49796
    Source: unknownNetwork traffic detected: HTTP traffic on port 49677 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49795
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49794
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49793
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49792
    Source: unknownNetwork traffic detected: HTTP traffic on port 49814 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49791
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49790
    Source: unknownNetwork traffic detected: HTTP traffic on port 49768 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49723 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49825 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49808 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49789
    Source: unknownNetwork traffic detected: HTTP traffic on port 49733 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49821
    Source: unknownNetwork traffic detected: HTTP traffic on port 49710 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49820
    Source: unknownNetwork traffic detected: HTTP traffic on port 49779 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49691 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49762 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49819
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49818
    Source: unknownNetwork traffic detected: HTTP traffic on port 49799 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49816
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49815
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49814
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49813
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49812
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49811
    Source: unknownNetwork traffic detected: HTTP traffic on port 49816 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49788 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49767 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49794 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49809
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49808
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49807
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49806
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49805
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49804
    Source: unknownNetwork traffic detected: HTTP traffic on port 49773 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49802
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49801
    Source: unknownNetwork traffic detected: HTTP traffic on port 49756 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49800
    Source: unknownNetwork traffic detected: HTTP traffic on port 49783 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49678 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49821 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49815 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49722 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49809 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49778 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49755 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49738 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49761 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49804 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49744 -> 443
    Source: unknownHTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.17:49735 version: TLS 1.2
    Source: unknownHTTPS traffic detected: 23.56.254.164:443 -> 192.168.2.17:49765 version: TLS 1.2
    Source: unknownHTTPS traffic detected: 23.56.254.164:443 -> 192.168.2.17:49766 version: TLS 1.2
    Source: unknownHTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.17:49818 version: TLS 1.2
    Source: unknownHTTPS traffic detected: 13.107.5.88:443 -> 192.168.2.17:49823 version: TLS 1.2
    Source: classification engineClassification label: mal60.phis.win@20/6@72/180
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
    Source: unknownProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 --field-trial-handle=2012,i,6001976476545217732,3726558075908552256,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
    Source: unknownProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://jmak-service.com/3225640388"
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 --field-trial-handle=2012,i,6001976476545217732,3726558075908552256,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
    Source: Window RecorderWindow detected: More than 3 window changes detected
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk
    ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
    Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management Instrumentation1
    Browser Extensions
    1
    Process Injection
    1
    Masquerading
    OS Credential DumpingSystem Service DiscoveryRemote ServicesData from Local System2
    Encrypted Channel
    Exfiltration Over Other Network MediumAbuse Accessibility Features
    CredentialsDomainsDefault AccountsScheduled Task/Job1
    Registry Run Keys / Startup Folder
    1
    Registry Run Keys / Startup Folder
    1
    Process Injection
    LSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable Media1
    Non-Application Layer Protocol
    Exfiltration Over BluetoothNetwork Denial of Service
    Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared Drive2
    Application Layer Protocol
    Automated ExfiltrationData Encrypted for Impact

    This section contains all screenshots as thumbnails, including those not shown in the slideshow.


    windows-stand
    SourceDetectionScannerLabelLink
    https://jmak-service.com/32256403880%Avira URL Cloudsafe
    No Antivirus matches
    No Antivirus matches
    No Antivirus matches
    No Antivirus matches
    NameIPActiveMaliciousAntivirus DetectionReputation
    stackpath.bootstrapcdn.com
    104.18.11.207
    truefalse
      high
      a.nel.cloudflare.com
      35.190.80.1
      truefalse
        high
        api.hcaptcha.com
        104.19.230.21
        truefalse
          high
          cos.na-ashburn.myqcloud.com
          49.51.78.226
          truefalse
            unknown
            5879537809.businesslawoutlook.com
            162.241.149.91
            truefalse
              unknown
              s-part-0033.t-0009.t-msedge.net
              13.107.246.61
              truefalse
                high
                maxcdn.bootstrapcdn.com
                104.18.10.207
                truefalse
                  high
                  s-part-0017.t-0009.t-msedge.net
                  13.107.246.45
                  truefalse
                    high
                    imgs3.hcaptcha.com
                    104.19.230.21
                    truefalse
                      unknown
                      hcaptcha.com
                      104.19.230.21
                      truefalse
                        high
                        inbox-clearance.uscourtbusiness.com
                        104.21.18.69
                        truetrue
                          unknown
                          code.jquery.com
                          151.101.130.137
                          truefalse
                            high
                            cdnjs.cloudflare.com
                            104.17.25.14
                            truefalse
                              high
                              challenges.cloudflare.com
                              104.18.95.41
                              truefalse
                                high
                                sni1gl.wpc.omegacdn.net
                                152.199.21.175
                                truefalse
                                  high
                                  www.google.com
                                  142.250.185.196
                                  truefalse
                                    high
                                    newassets.hcaptcha.com
                                    104.19.229.21
                                    truefalse
                                      high
                                      jmak-service.com
                                      107.180.119.1
                                      truefalse
                                        unknown
                                        img1.wsimg.com
                                        unknown
                                        unknownfalse
                                          high
                                          events.api.secureserver.net
                                          unknown
                                          unknownfalse
                                            high
                                            aadcdn.msftauth.net
                                            unknown
                                            unknownfalse
                                              high
                                              csp.secureserver.net
                                              unknown
                                              unknownfalse
                                                high
                                                5879537809-1323985617.cos.na-ashburn.myqcloud.com
                                                unknown
                                                unknownfalse
                                                  unknown
                                                  NameMaliciousAntivirus DetectionReputation
                                                  https://jmak-service.com/3225640388/false
                                                    unknown
                                                    https://inbox-clearance.uscourtbusiness.com/iTY74/true
                                                      unknown
                                                      • No. of IPs < 25%
                                                      • 25% < No. of IPs < 50%
                                                      • 50% < No. of IPs < 75%
                                                      • 75% < No. of IPs
                                                      IPDomainCountryFlagASNASN NameMalicious
                                                      142.250.185.99
                                                      unknownUnited States
                                                      15169GOOGLEUSfalse
                                                      95.100.110.77
                                                      unknownEuropean Union
                                                      20940AKAMAI-ASN1EUfalse
                                                      104.102.33.222
                                                      unknownUnited States
                                                      16625AKAMAI-ASUSfalse
                                                      104.18.10.207
                                                      maxcdn.bootstrapcdn.comUnited States
                                                      13335CLOUDFLARENETUSfalse
                                                      13.107.246.45
                                                      s-part-0017.t-0009.t-msedge.netUnited States
                                                      8068MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                                                      142.250.186.174
                                                      unknownUnited States
                                                      15169GOOGLEUSfalse
                                                      2.23.227.198
                                                      unknownEuropean Union
                                                      8781QA-ISPQAfalse
                                                      13.107.246.61
                                                      s-part-0033.t-0009.t-msedge.netUnited States
                                                      8068MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                                                      142.250.185.106
                                                      unknownUnited States
                                                      15169GOOGLEUSfalse
                                                      49.51.78.226
                                                      cos.na-ashburn.myqcloud.comChina
                                                      132203TENCENT-NET-AP-CNTencentBuildingKejizhongyiAvenueCNfalse
                                                      151.101.130.137
                                                      code.jquery.comUnited States
                                                      54113FASTLYUSfalse
                                                      104.19.230.21
                                                      api.hcaptcha.comUnited States
                                                      13335CLOUDFLARENETUSfalse
                                                      23.38.98.78
                                                      unknownUnited States
                                                      16625AKAMAI-ASUSfalse
                                                      35.190.80.1
                                                      a.nel.cloudflare.comUnited States
                                                      15169GOOGLEUSfalse
                                                      151.101.194.137
                                                      unknownUnited States
                                                      54113FASTLYUSfalse
                                                      142.250.186.138
                                                      unknownUnited States
                                                      15169GOOGLEUSfalse
                                                      1.1.1.1
                                                      unknownAustralia
                                                      13335CLOUDFLARENETUSfalse
                                                      104.21.18.69
                                                      inbox-clearance.uscourtbusiness.comUnited States
                                                      13335CLOUDFLARENETUStrue
                                                      107.180.119.1
                                                      jmak-service.comUnited States
                                                      26496AS-26496-GO-DADDY-COM-LLCUSfalse
                                                      216.58.206.67
                                                      unknownUnited States
                                                      15169GOOGLEUSfalse
                                                      142.250.185.234
                                                      unknownUnited States
                                                      15169GOOGLEUSfalse
                                                      104.18.95.41
                                                      challenges.cloudflare.comUnited States
                                                      13335CLOUDFLARENETUSfalse
                                                      2.23.227.202
                                                      unknownEuropean Union
                                                      8781QA-ISPQAfalse
                                                      104.18.11.207
                                                      stackpath.bootstrapcdn.comUnited States
                                                      13335CLOUDFLARENETUSfalse
                                                      104.19.229.21
                                                      newassets.hcaptcha.comUnited States
                                                      13335CLOUDFLARENETUSfalse
                                                      239.255.255.250
                                                      unknownReserved
                                                      unknownunknownfalse
                                                      142.250.185.196
                                                      www.google.comUnited States
                                                      15169GOOGLEUSfalse
                                                      152.199.21.175
                                                      sni1gl.wpc.omegacdn.netUnited States
                                                      15133EDGECASTUSfalse
                                                      64.233.184.84
                                                      unknownUnited States
                                                      15169GOOGLEUSfalse
                                                      49.51.77.119
                                                      unknownChina
                                                      132203TENCENT-NET-AP-CNTencentBuildingKejizhongyiAvenueCNfalse
                                                      162.241.149.91
                                                      5879537809.businesslawoutlook.comUnited States
                                                      46606UNIFIEDLAYER-AS-1USfalse
                                                      142.250.185.74
                                                      unknownUnited States
                                                      15169GOOGLEUSfalse
                                                      104.17.25.14
                                                      cdnjs.cloudflare.comUnited States
                                                      13335CLOUDFLARENETUSfalse
                                                      IP
                                                      192.168.2.17
                                                      192.168.2.8
                                                      Joe Sandbox version:41.0.0 Charoite
                                                      Analysis ID:1585932
                                                      Start date and time:2025-01-08 14:30:30 +01:00
                                                      Joe Sandbox product:CloudBasic
                                                      Overall analysis duration:
                                                      Hypervisor based Inspection enabled:false
                                                      Report type:full
                                                      Cookbook file name:defaultwindowsinteractivecookbook.jbs
                                                      Sample URL:https://jmak-service.com/3225640388
                                                      Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                                      Number of analysed new started processes analysed:18
                                                      Number of new started drivers analysed:0
                                                      Number of existing processes analysed:0
                                                      Number of existing drivers analysed:0
                                                      Number of injected processes analysed:0
                                                      Technologies:
                                                      • EGA enabled
                                                      Analysis Mode:stream
                                                      Analysis stop reason:Timeout
                                                      Detection:MAL
                                                      Classification:mal60.phis.win@20/6@72/180
                                                      • Exclude process from analysis (whitelisted): TextInputHost.exe
                                                      • Excluded IPs from analysis (whitelisted): 142.250.185.99, 142.250.186.174, 64.233.184.84, 216.58.206.78, 23.38.98.78, 23.38.98.114, 142.250.186.46
                                                      • Excluded domains from analysis (whitelisted): e40258.g.akamaiedge.net, clients2.google.com, accounts.google.com, redirector.gvt1.com, clientservices.googleapis.com, clients.l.google.com, global-wildcard.wsimg.com.sni-only.edgekey.net
                                                      • Not all processes where analyzed, report is missing behavior information
                                                      • VT rate limit hit for: https://jmak-service.com/3225640388
                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                      File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Jan 8 12:31:03 2025, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
                                                      Category:dropped
                                                      Size (bytes):2677
                                                      Entropy (8bit):3.9884875744007973
                                                      Encrypted:false
                                                      SSDEEP:
                                                      MD5:7F6C4D7DAEE9B6D38BC81CB024A8A003
                                                      SHA1:B7E3E7B265017342B8297212D6E61FF183C6763C
                                                      SHA-256:DAB46F071853110BC780D746DE95FEFECE05BB7E7DE4BED466D8A27A7D4DD5C0
                                                      SHA-512:3ACED3D45C63685B63BC7309C26DA026EE9E504EF7ED38A22EFC6C2BFED1D2D9E16C8C592487ABA40B19002193040CB08158205721B6FD305DA2E13A0A1FA918
                                                      Malicious:false
                                                      Reputation:unknown
                                                      Preview:L..................F.@.. ...$+.,....L.2..a......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.I(Z.k....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V(Z.k....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.V(Z.k....M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.V(Z.k...........................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V(Z.k...........................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........;........C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F
                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                      File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Jan 8 12:31:03 2025, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
                                                      Category:dropped
                                                      Size (bytes):2679
                                                      Entropy (8bit):4.006128095737565
                                                      Encrypted:false
                                                      SSDEEP:
                                                      MD5:AFAED21295235866D4DDB53B9ACC4322
                                                      SHA1:5A53ED4934F94A05994BFCED3F2CC21FC3415EBB
                                                      SHA-256:187C5800DB434B317C471601E24A0AC55E5BC00F0FE1BB36B5AF7C6FFDA9B6E2
                                                      SHA-512:A351861B3FD8ADD959CAC244AA0EFAE9090C99B5520BD163D376B52C24117EE8885C7E1644CF0804882BEC8ACB3096FFA489B9ECC9CCAAAE42FC01850A9B96C9
                                                      Malicious:false
                                                      Reputation:unknown
                                                      Preview:L..................F.@.. ...$+.,....A.&..a......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.I(Z.k....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V(Z.k....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.V(Z.k....M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.V(Z.k...........................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V(Z.k...........................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........;........C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F
                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                      File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:54:41 2023, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
                                                      Category:dropped
                                                      Size (bytes):2693
                                                      Entropy (8bit):4.015895570435099
                                                      Encrypted:false
                                                      SSDEEP:
                                                      MD5:42B84AD684C4BB5F75CDADFE75A2E405
                                                      SHA1:A676C7EDFCEB2B5AF20C4B4852123E6F9357273E
                                                      SHA-256:B65DBC65A51056C9214C2DE4BB2CD55E2E37526371566DB852EB2F4BE8D3E0A6
                                                      SHA-512:951F9A991E2F1F60911AE9F9AA21B19FAA5BE87FB120E5A36BC8A47D48E1DDC58FB1032AB5498B8A8E443BA576A1C09FF6C718AEEAC7233C0FFEBC6E14D5F5BE
                                                      Malicious:false
                                                      Reputation:unknown
                                                      Preview:L..................F.@.. ...$+.,.....v. ;.......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.I(Z.k....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V(Z.k....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.V(Z.k....M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.V(Z.k...........................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.VFW.N...........................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........;........C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F
                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                      File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Jan 8 12:31:03 2025, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
                                                      Category:dropped
                                                      Size (bytes):2681
                                                      Entropy (8bit):4.001602699547471
                                                      Encrypted:false
                                                      SSDEEP:
                                                      MD5:405D72DAEFADE6895C536ECDCF68A0AC
                                                      SHA1:8F130C7EEFD19401AD17A290E1E2060A661296DE
                                                      SHA-256:87D7302D869C7684BBE5EF82C60ECB41C24AEC033574AFF080E9D6B8304E6633
                                                      SHA-512:C972ED424AEA79857DFB27771DF9F491D465CAC57239F0D385E9CA980A02AD66718216F74FB2B5CBDDA57561BAD6E6A44F894F47060965749BDB9869C0B0A2D4
                                                      Malicious:false
                                                      Reputation:unknown
                                                      Preview:L..................F.@.. ...$+.,..... ..a......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.I(Z.k....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V(Z.k....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.V(Z.k....M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.V(Z.k...........................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V(Z.k...........................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........;........C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F
                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                      File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Jan 8 12:31:03 2025, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
                                                      Category:dropped
                                                      Size (bytes):2681
                                                      Entropy (8bit):3.9929631229305707
                                                      Encrypted:false
                                                      SSDEEP:
                                                      MD5:93FB4DCF6A828F40F11DE62F992293D9
                                                      SHA1:680D80E0BA4EB7936F2700527F3C4808C9CF1D73
                                                      SHA-256:632F7639ADFF6C502AE39F2B97CA6DED951827035B6E4245EA432F31F566C00F
                                                      SHA-512:CC33B7C66379FCF6CBF4B140269D1AD7995C17E869AC31B103B3D054F1AD0472D23ABF8652125814E9AB37A01963F4B8E847EEFD1ECC166203416F71B75DB066
                                                      Malicious:false
                                                      Reputation:unknown
                                                      Preview:L..................F.@.. ...$+.,......,..a......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.I(Z.k....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V(Z.k....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.V(Z.k....M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.V(Z.k...........................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V(Z.k...........................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........;........C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F
                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                      File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Jan 8 12:31:03 2025, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
                                                      Category:dropped
                                                      Size (bytes):2683
                                                      Entropy (8bit):4.00558139715056
                                                      Encrypted:false
                                                      SSDEEP:
                                                      MD5:96DB2062892720549563E9162A05DC2A
                                                      SHA1:CEB59CDB93AD3CC2E3E3CD919B1364359025AD91
                                                      SHA-256:7EE04FF4CBE2DB707766EC17B0AD3D726271DE11FD14B5645E76CC0589ECBF66
                                                      SHA-512:F9EF042CF1BB012384932E83BCA7650C959E599422831428CB31E836AEC48B881DA66EF8C2C5041CFA554564DD482AAA6E1ED72447D6EF4CC3DA5009780EF4E3
                                                      Malicious:false
                                                      Reputation:unknown
                                                      Preview:L..................F.@.. ...$+.,.........a......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.I(Z.k....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V(Z.k....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.V(Z.k....M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.V(Z.k...........................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V(Z.k...........................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........;........C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F
                                                      No static file info