Edit tour

Windows Analysis Report
https://www.dcamarketintelligence.com/tdt

Overview

General Information

Sample URL:	https://www.dcamarketintelligence.com/tdt
Analysis ID:	1587360

Detection

Score:	48
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

AI detected suspicious Javascript

HTML page contains obfuscated javascript

Javascript checks online IP of machine

Stores files to the Windows start menu directory

Classification

Process Tree

System is w10x64_ra

chrome.exe (PID: 6924 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7144 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 --field-trial-handle=1868,i,15361327854135355758,18028467070960209463,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7484 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5176 --field-trial-handle=1868,i,15361327854135355758,18028467070960209463,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 4856 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://www.dcamarketintelligence.com/tdt" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Phishing

AI detected suspicious Javascript

Source: 0.26.id.script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://td.doubleclick.net/td/rul/16583961882?rand... The provided JavaScript snippet demonstrates several high-risk behaviors, including data exfiltration and the use of the `navigator.sendBeacon()` API to transmit potentially sensitive information to an external domain. While the script appears to be related to ad interest group management, the lack of transparency and the use of the `sendBeacon()` API to report errors raise concerns about potential data leakage or misuse.
Source: 0.35.id.script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://www.google.com/recaptcha/api2/anchor?ar=1&... The provided JavaScript snippet exhibits several high-risk behaviors, including dynamic code execution, data exfiltration, and obfuscated code/URLs. While the script may have a legitimate purpose, the combination of these factors suggests a medium to high risk level that requires further investigation.

HTML page contains obfuscated javascript

Source: https://d.plerdy.com/public/js/click/for_video/plerdy_page_recorder.js?v=0.696418354850542

HTTP Parser: var _0x550fdf=_0x2030;(function(_0x15cd13,_0x34bee0){var _0x1900a1=_0x2030,_0xd737fb=_0x15cd13();whi

Source: https://d.plerdy.com/public/assets/maskinput/maskinput.js

HTTP Parser: $(function () { /* * international telephone input v16.0.0 * https://github.com/jackocnr/intl-tel-input.git * licensed under the mit license */ var input = document.queryselectorall('input[type="tel"]'); var iti_el = $('.iti.iti--allow-dropdown.iti--separate-dial-code'); if(iti_el.length){ iti.destroy();// get the current number in the given format } for(var i = 0; i < input.length; i++){ iti = intltelinput(input[i], { autohidedialcode: false, autoplaceholder: "aggressive" , initialcountry: "auto", separatedialcode: true, preferredcountries: ['us','gb'], customplaceholder:function(selectedcountryplaceholder,selectedcountrydata){ return ''+selectedcountryplaceholder.replace(/[0-9]/g,'x'); }, geoiplookup: function(callback) { $.get(...

Source: https://www.dcamarketintelligence.com/tdt	HTTP Parser: No favicon
Source: https://www.dcamarketintelligence.com/tdt	HTTP Parser: No favicon
Source: https://www.dcamarketintelligence.com/tdt	HTTP Parser: No favicon
Source: https://www.dcamarketintelligence.com/tdt	HTTP Parser: No favicon
Source: https://www.dcamarketintelligence.com/tdt	HTTP Parser: No favicon

Source: unknown	HTTPS traffic detected: 2.23.242.162:443 -> 192.168.2.16:62537 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.23.242.162:443 -> 192.168.2.16:62552 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.16:62553 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.16:62651 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.242.162
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.242.162
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.242.162
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.242.162
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.242.162
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.242.162
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.242.162
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.242.162
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.242.162
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.242.162
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.242.162
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.242.162
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.242.162
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.242.162
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.242.162
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.242.162
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.242.162
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.242.162
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.242.162
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50

Source: global traffic	DNS traffic detected: DNS query: www.dcamarketintelligence.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: dcamarketintelligence.alhans.nl
Source: global traffic	DNS traffic detected: DNS query: d.plerdy.com
Source: global traffic	DNS traffic detected: DNS query: conversations-widget.brevo.com
Source: global traffic	DNS traffic detected: DNS query: sibautomation.com
Source: global traffic	DNS traffic detected: DNS query: snap.licdn.com
Source: global traffic	DNS traffic detected: DNS query: in-automate.brevo.com
Source: global traffic	DNS traffic detected: DNS query: d13sozod7hpim.cloudfront.net
Source: global traffic	DNS traffic detected: DNS query: a.plerdy.com
Source: global traffic	DNS traffic detected: DNS query: googleads.g.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: td.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: px.ads.linkedin.com
Source: global traffic	DNS traffic detected: DNS query: www.linkedin.com
Source: global traffic	DNS traffic detected: DNS query: a.nel.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: ucarecdn.com

Source: unknown	Network traffic detected: HTTP traffic on port 62458 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62435 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62653 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62515 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62676 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62493 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62618 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62585 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62609
Source: unknown	Network traffic detected: HTTP traffic on port 62629 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62642 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62602
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62603
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62605
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62606
Source: unknown	Network traffic detected: HTTP traffic on port 62688 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62550 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62607
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62608
Source: unknown	Network traffic detected: HTTP traffic on port 62596 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62600
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62612
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62613
Source: unknown	Network traffic detected: HTTP traffic on port 62687 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62614
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62615
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62616
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62617
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62618
Source: unknown	Network traffic detected: HTTP traffic on port 62526 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62619
Source: unknown	Network traffic detected: HTTP traffic on port 62597 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62631 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62574 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62654 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62610
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62611
Source: unknown	Network traffic detected: HTTP traffic on port 62606 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62492 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62502
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62623
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62503
Source: unknown	Network traffic detected: HTTP traffic on port 62447 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62504
Source: unknown	Network traffic detected: HTTP traffic on port 62504 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62625
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62505
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62626
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62627
Source: unknown	Network traffic detected: HTTP traffic on port 62665 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62507
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62628
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62508
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62629
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62509
Source: unknown	Network traffic detected: HTTP traffic on port 62617 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62620
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62621
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62501
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62622
Source: unknown	Network traffic detected: HTTP traffic on port 62483 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62548 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62620 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62586 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62448 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62652 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62537 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62608 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62494 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62459 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62663 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62619 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62502 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62575 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62607 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62641 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62437 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62503 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62664 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62536 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62559 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62587 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62471 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62686 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62598 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62630 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62680
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62557
Source: unknown	Network traffic detected: HTTP traffic on port 62662 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62678
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62558
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62437
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62679
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62559
Source: unknown	Network traffic detected: HTTP traffic on port 62685 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62670
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62550
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62671
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62551
Source: unknown	Network traffic detected: HTTP traffic on port 62501 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62672
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62552
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62673
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62553
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62674
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62554
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62555
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62676
Source: unknown	Network traffic detected: HTTP traffic on port 62599 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62556
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62677
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62435
Source: unknown	Network traffic detected: HTTP traffic on port 62673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62690
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62570
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62691
Source: unknown	Network traffic detected: HTTP traffic on port 62512 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62447
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62568
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62689
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62569
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62448
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62681
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62682
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62562
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62683
Source: unknown	Network traffic detected: HTTP traffic on port 62558 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62563
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62684
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62443
Source: unknown	Network traffic detected: HTTP traffic on port 62462 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62564
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62685
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62444
Source: unknown	Network traffic detected: HTTP traffic on port 62615 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62686
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62445
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62687
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62446
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62567
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62688
Source: unknown	Network traffic detected: HTTP traffic on port 62674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62626 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62651 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62546 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62580
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62581
Source: unknown	Network traffic detected: HTTP traffic on port 62513 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62569 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62588 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62603 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62458
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62579
Source: unknown	Network traffic detected: HTTP traffic on port 62472 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62459
Source: unknown	Network traffic detected: HTTP traffic on port 62639 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62571
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62572
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62573
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62452
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62453
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62574
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62454
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62575
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62455
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62577
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62457
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62578
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62471
Source: unknown	Network traffic detected: HTTP traffic on port 62640 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62495 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62577 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62535 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62582
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62462
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62583
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62463
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62584
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62585
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62586
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62466
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62587
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62467
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62588
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62468
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62589
Source: unknown	Network traffic detected: HTTP traffic on port 62628 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62511 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62605 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62513
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62634
Source: unknown	Network traffic detected: HTTP traffic on port 62637 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62635
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62515
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62636
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62516
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62637
Source: unknown	Network traffic detected: HTTP traffic on port 62557 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62638
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62518
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62639
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62519
Source: unknown	Network traffic detected: HTTP traffic on port 62534 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62486 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62630
Source: unknown	Network traffic detected: HTTP traffic on port 62463 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62631
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62511
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62632
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62512
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62633
Source: unknown	Network traffic detected: HTTP traffic on port 62568 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62522 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62589 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62645
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62646
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62526
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62647
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62648
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62649
Source: unknown	Network traffic detected: HTTP traffic on port 62684 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62640
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62641
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62521
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62642
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62522
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62643
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62644
Source: unknown	Network traffic detected: HTTP traffic on port 62649 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62452 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62535
Source: unknown	Network traffic detected: HTTP traffic on port 62578 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62656
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62536
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62537
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62658
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62659
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62539
Source: unknown	Network traffic detected: HTTP traffic on port 62683 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62650
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62530
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62651
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62531
Source: unknown	Network traffic detected: HTTP traffic on port 62616 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62652
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62653
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62533
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62654
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62534
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62655
Source: unknown	Network traffic detected: HTTP traffic on port 62650 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62627 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62474 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62546
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62667
Source: unknown	Network traffic detected: HTTP traffic on port 62638 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62668
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62548
Source: unknown	Network traffic detected: HTTP traffic on port 62661 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62669
Source: unknown	Network traffic detected: HTTP traffic on port 62556 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62660
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62540
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62661
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62541
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62662
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62542
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62663
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62543
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62664
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62544
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62665
Source: unknown	Network traffic detected: HTTP traffic on port 62485 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62666
Source: unknown	Network traffic detected: HTTP traffic on port 62567 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62521 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62647 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62544 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62509 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62476 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62579 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62636 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62533 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62670 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62475 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62555 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62660 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62612 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62671 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62648 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62453 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62623 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62580 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62682 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62659 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62519 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62477 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62454 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62614 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62472
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62593
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62594
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62474
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62595
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62475
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62596
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62476
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62597
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62477
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62598
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62478
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62599
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62479
Source: unknown	Network traffic detected: HTTP traffic on port 62625 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62490
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62491
Source: unknown	Network traffic detected: HTTP traffic on port 62646 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62492
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62493
Source: unknown	Network traffic detected: HTTP traffic on port 62543 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62681 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62554 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62483
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62485
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62486
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62488
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62489
Source: unknown	Network traffic detected: HTTP traffic on port 62466 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62542 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62680 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62635 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62581 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62658 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62494
Source: unknown	Network traffic detected: HTTP traffic on port 62488 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62495
Source: unknown	Network traffic detected: HTTP traffic on port 62570 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62669 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62602 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62613 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62531 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62508 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62443 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62609 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62530 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62444 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62553 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62656 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62633 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62610 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62467 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62593 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62564 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62490 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62455 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62621 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62582 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62691 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62667 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62571 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62645 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62690 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62507 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62668 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62541 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62518 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62679 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62583 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62478 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62552 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62489 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62634 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62594 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62563 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62540 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62643 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62505 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62689 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62666 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62572 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62595 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62677 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62516 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62600 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62445 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62632 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62611 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62584 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62479 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62622 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62491 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62446 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62551 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62539 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62562 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62644 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62457 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62573 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62655 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62468 -> 443

Source: unknown	HTTPS traffic detected: 2.23.242.162:443 -> 192.168.2.16:62537 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.23.242.162:443 -> 192.168.2.16:62552 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.16:62553 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.16:62651 version: TLS 1.2

Source: classification engine

Classification label: mal48.phis.win@24/6@72/485

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 --field-trial-handle=1868,i,15361327854135355758,18028467070960209463,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://www.dcamarketintelligence.com/tdt"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 --field-trial-handle=1868,i,15361327854135355758,18028467070960209463,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5176 --field-trial-handle=1868,i,15361327854135355758,18028467070960209463,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5176 --field-trial-handle=1868,i,15361327854135355758,18028467070960209463,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Browser Extensions	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Registry Run Keys / Startup Folder	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact

Source	Detection	Scanner	Label	Link
https://www.dcamarketintelligence.com/tdt	0%	Avira URL Cloud	safe

Name	IP	Active	Malicious	Reputation
a.nel.cloudflare.com	35.190.80.1	true	false	high
www.dcamarketintelligence.com	185.50.174.34	true	false	unknown
d.plerdy.com	104.26.14.92	true	false	unknown
ucarecdn.com	151.101.130.132	true	false	high
dcamarketintelligence.alhans.nl	185.105.205.71	true	false	unknown
conversations-widget.brevo.com	172.64.150.216	true	false	unknown
in-automate.brevo.com	172.64.150.216	true	false	high
googleads.g.doubleclick.net	142.250.186.66	true	false	high
d13sozod7hpim.cloudfront.net	18.66.121.183	true	false	unknown
a.plerdy.com	104.26.14.92	true	false	unknown
www.google.com	172.217.16.196	true	false	high
td.doubleclick.net	172.217.18.2	true	false	high
sibautomation.com	104.18.39.141	true	false	high
www.linkedin.com	unknown	unknown	false	high
px.ads.linkedin.com	unknown	unknown	false	high
snap.licdn.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://www.dcamarketintelligence.com/tdt	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.185.99	unknown	United States	15169	GOOGLEUS	false
142.250.186.67	unknown	United States	15169	GOOGLEUS	false
142.250.185.78	unknown	United States	15169	GOOGLEUS	false
142.250.186.170	unknown	United States	15169	GOOGLEUS	false
172.67.73.224	unknown	United States	13335	CLOUDFLARENETUS	false
151.101.130.132	ucarecdn.com	United States	54113	FASTLYUS	false
185.105.205.71	dcamarketintelligence.alhans.nl	Netherlands	48635	ASTRALUSNL	false
142.250.185.100	unknown	United States	15169	GOOGLEUS	false
185.50.174.34	www.dcamarketintelligence.com	Netherlands	202075	MOBITION-ASNL	false
216.58.206.35	unknown	United States	15169	GOOGLEUS	false
104.18.39.141	sibautomation.com	United States	13335	CLOUDFLARENETUS	false
142.250.186.110	unknown	United States	15169	GOOGLEUS	false
35.190.80.1	a.nel.cloudflare.com	United States	15169	GOOGLEUS	false
172.64.150.216	conversations-widget.brevo.com	United States	13335	CLOUDFLARENETUS	false
104.26.14.92	d.plerdy.com	United States	13335	CLOUDFLARENETUS	false
142.250.186.74	unknown	United States	15169	GOOGLEUS	false
151.101.194.132	unknown	United States	54113	FASTLYUS	false
142.250.186.99	unknown	United States	15169	GOOGLEUS	false
66.102.1.84	unknown	United States	15169	GOOGLEUS	false
88.221.110.136	unknown	European Union	20940	AKAMAI-ASN1EU	false
142.250.186.138	unknown	United States	15169	GOOGLEUS	false
172.217.16.200	unknown	United States	15169	GOOGLEUS	false
142.250.184.195	unknown	United States	15169	GOOGLEUS	false
142.250.186.78	unknown	United States	15169	GOOGLEUS	false
104.18.41.41	unknown	United States	13335	CLOUDFLARENETUS	false
1.1.1.1	unknown	Australia	13335	CLOUDFLARENETUS	false
142.250.185.232	unknown	United States	15169	GOOGLEUS	false
172.217.18.2	td.doubleclick.net	United States	15169	GOOGLEUS	false
13.107.42.14	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
18.66.121.183	d13sozod7hpim.cloudfront.net	United States	3	MIT-GATEWAYSUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.250.185.174	unknown	United States	15169	GOOGLEUS	false
172.217.18.106	unknown	United States	15169	GOOGLEUS	false
142.250.186.164	unknown	United States	15169	GOOGLEUS	false
88.221.110.227	unknown	European Union	20940	AKAMAI-ASN1EU	false
142.250.184.238	unknown	United States	15169	GOOGLEUS	false
172.217.16.196	www.google.com	United States	15169	GOOGLEUS	false
104.26.15.92	unknown	United States	13335	CLOUDFLARENETUS	false
142.250.186.42	unknown	United States	15169	GOOGLEUS	false
142.250.186.168	unknown	United States	15169	GOOGLEUS	false
142.250.186.66	googleads.g.doubleclick.net	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.17
192.168.2.16
192.168.2.5

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1587360
Start date and time:	2025-01-10 09:18:36 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Sample URL:	https://www.dcamarketintelligence.com/tdt
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled
Analysis Mode:	stream
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal48.phis.win@24/6@72/485

Warnings

Exclude process from analysis (whitelisted): svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.186.67, 142.250.186.110, 66.102.1.84, 142.250.186.174, 172.217.18.106, 142.250.186.74, 142.250.185.99, 142.250.186.46, 142.250.186.42, 142.250.185.232
Excluded domains from analysis (whitelisted): fonts.googleapis.com, clients2.google.com, accounts.google.com, redirector.gvt1.com, ajax.googleapis.com, fonts.gstatic.com, www.googletagmanager.com, clientservices.googleapis.com, clients.l.google.com
Not all processes where analyzed, report is missing behavior information
VT rate limit hit for: https://www.dcamarketintelligence.com/tdt

LLM Input / Output

Input	Output
URL: https://www.dcamarketintelligence.com Model: Joe Sandbox AI	{ "typosquatting": false, "unusual_query_string": false, "suspicious_tld": false, "ip_in_url": false, "long_subdomain": false, "malicious_keywords": false, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": false, "brand_spoofing_attempt": false, "third_party_hosting": false }
URL: https://www.dcamarketintelligence.com
URL: https://www.dcamarketintelligence.com/tdt... Model: Joe Sandbox AI	{ "risk_score": 2, "reasoning": "The provided JavaScript snippet appears to be a legitimate implementation of a cookie consent management system. It dynamically loads a cookie consent script from a local path, and then configures the consent options and policies. This behavior is consistent with common web privacy practices and does not exhibit any high-risk indicators. The script may be considered low-risk with some minor concerns around the use of dynamic script loading." }
var cscript = document.createElement("script"); cscript.src = "/js/cookie-consent_4.1.0.js"; document.documentElement.firstChild.appendChild(cscript); cscript.onload = function () { cookieconsent.run({"notice_banner_type":"headline","consent_type":"implied","palette":"light","language":"en","page_load_consent_levels":["strictly-necessary","functionality","tracking","targeting"],"notice_banner_reject_button_hide":false,"preferences_center_close_button_hide":false,"page_refresh_confirmation_buttons":false,"website_privacy_policy_url":"https://privacy.dca-multimedia.nl/privacy-statement"}); }
URL: https://www.dcamarketintelligence.com/tdt... Model: Joe Sandbox AI	{ "risk_score": 4, "reasoning": "The script appears to be loading a third-party script from 'd.plerdy.com', which could potentially be used for tracking or data collection purposes. However, the script does not exhibit any high-risk behaviors like dynamic code execution or data exfiltration. The use of a random query parameter in the script URL is a moderate-risk indicator, but the overall behavior seems to be consistent with typical analytics or tracking functionality. Further review may be necessary to determine the full extent of the script's capabilities and potential risks." }
var _protocol="https:"==document.location.protocol?" https://":" http://"; _site_hash_code = "509817096509554c03ea41456b8cd493",_suid=44089, plerdyScript=document.createElement("script"); plerdyScript.setAttribute("defer",""),plerdyScript.dataset.plerdymainscript="plerdymainscript", plerdyScript.src="https://d.plerdy.com/public/js/click/main.js?v="+Math.random(); var plerdymainscript=document.querySelector("[data-plerdymainscript='plerdymainscript']"); plerdymainscript&&plerdymainscript.parentNode.removeChild(plerdymainscript); try{document.head.appendChild(plerdyScript)}catch(t){console.log(t,"unable add script tag")}
URL: https://www.dcamarketintelligence.com/tdt... Model: Joe Sandbox AI	{ "risk_score": 2, "reasoning": "This script appears to be setting up a conversational widget from the Brevo platform, which is a legitimate marketing and customer engagement service. While it uses some dynamic code execution, the behavior is consistent with the expected functionality of a conversational widget, and there are no clear indicators of malicious intent. The script is likely low-risk, with some minor concerns around the use of dynamic code execution." }
(function(d, w, c) { w.BrevoConversationsID = '5c77df9da4c08421d473f0ca'; w[c] = w[c] \|\| function() { (w[c].q = w[c].q \|\| []).push(arguments); }; var s = d.createElement('script'); s.async = true; s.src = 'https://conversations-widget.brevo.com/brevo-conversations.js'; if (d.head) d.head.appendChild(s); })(document, window, 'BrevoConversations');
URL: https://www.dcamarketintelligence.com/tdt... Model: Joe Sandbox AI	{ "risk_score": 2, "reasoning": "The provided JavaScript snippet appears to be a legitimate integration with the Sendinblue email marketing and automation platform. It sets up the necessary variables and functions to track user interactions and send data to the Sendinblue service. While it uses some dynamic code execution techniques, these are common practices for integrating with third-party services and do not appear to be used for malicious purposes. The script's behavior is consistent with typical analytics and marketing functionality, and it does not exhibit any high-risk indicators like data exfiltration or redirects to suspicious domains." }
(function() { window.sib = { equeue: [], client_key: 'pcna2ywu3ph9we68e4j7ltwj' }; /* OPTIONAL: email for identify request*/ // window.sib.email_id = 'example@domain.com'; window.sendinblue = {}; for (var j = ['track', 'identify', 'trackLink', 'page'], i = 0; i < j.length; i++) { (function(k) { window.sendinblue[k] = function() { var arg = Array.prototype.slice.call(arguments); (window.sib[k] \|\| function() { var t = {}; t[k] = arg; window.sib.equeue.push(t); })(arg[0], arg[1], arg[2], arg[3]); }; })(j[i]); } var n = document.createElement('script'), i = document.getElementsByTagName('script')[0]; n.type = 'text/javascript', n.id = 'sendinblue-js', n.async = !0, n.src = 'https://sibautomation.com/sa.js?key=' + window.sib.client_key, i.parentNode.insertBefore(n, i), window.sendinblue.page(); })();
URL: https://ajax.googleapis.com/ajax/libs/jquery/3.5.1... Model: Joe Sandbox AI	{ "risk_score": 1, "reasoning": "This appears to be the jQuery library, which is a widely used and trusted JavaScript library. The code does not contain any high-risk indicators such as dynamic code execution, data exfiltration, or suspicious redirects. The behaviors observed are typical of a legitimate JavaScript library, including DOM manipulation, event handling, and utility functions. While the code uses some legacy practices like `XDomainRequest`, these pose minor risks and are not inherently malicious. Overall, this script is likely benign and does not demonstrate any suspicious or malicious behavior." }
/! jQuery v3.5.1 \| (c) JS Foundation and other contributors \| jquery.org/license / !function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery requires a window with a document");return t(e)}:t(e)}("undefined"!=typeof window?window:this,function(C,e){"use strict";var t=[],r=Object.getPrototypeOf,s=t.slice,g=t.flat?function(e){return t.flat.call(e)}:function(e){return t.concat.apply([],e)},u=t.push,i=t.indexOf,n={},o=n.toString,v=n.hasOwnProperty,a=v.toString,l=a.call(Object),y={},m=function(e){return"function"==typeof e&&"number"!=typeof e.nodeType},x=function(e){return null!=e&&e===e.window},E=C.document,c={type:!0,src:!0,nonce:!0,noModule:!0};function b(e,t,n){var r,i,o=(n=n\|\|E).createElement("script");if(o.text=e,t)for(r in c)(i=t[r]\|\|t.getAttribute&&t.getAttribute(r))&&o.setAttribute(r,i);n.head.appendChild(o).parentNode.removeChild(o)}function w(e){return null==e?e+"":"object"==typeof e\|\|"function"==typeof e?n[o.call(e)]\|\|"object":typeof e}var f="3.5.1",S=function(e,t){return new S.fn.init(e,t)};function p(e){var t=!!e&&"length"in e&&e.length,n=w(e);return!m(e)&&!x(e)&&("array"===n\|\|0===t\|\|"number"==typeof t&&0<t&&t-1 in e)}S.fn=S.prototype={jquery:f,constructor:S,length:0,toArray:function(){return s.call(this)},get:function(e){return null==e?s.call(this):e<0?this[e+this.length]:this[e]},pushStack:function(e){var t=S.merge(this.constructor(),e);return t.prevObject=this,t},each:function(e){return S.each(this,e)},map:function(n){return this.pushStack(S.map(this,function(e,t){return n.call(e,t,e)}))},slice:function(){return this.pushStack(s.apply(this,arguments))},first:function(){return this.eq(0)},last:function(){return this.eq(-1)},even:function(){return this.pushStack(S.grep(this,function(e,t){return(t+1)%2}))},odd:function(){return this.pushStack(S.grep(this,function(e,t){return t%2}))},eq:function(e){var t=this.length,n=+e+(e<0?t:0);return this.pushStack(0<=n&&n<t?[this[n]]:[])},end:function(){return this.prevObject\|\|this.constructor()},push:u,sort:t.sort,splice:t.splice},S.extend=S.fn.extend=function(){var e,t,n,r,i,o,a=arguments[0]\|\|{},s=1,u=arguments.length,l=!1;for("boolean"==typeof a&&(l=a,a=arguments[s]\|\|{},s++),"object"==typeof a\|\|m(a)\|\|(a={}),s===u&&(a=this,s--);s<u;s++)if(null!=(e=arguments[s]))for(t in e)r=e[t],"__proto__"!==t&&a!==r&&(l&&r&&(S.isPlainObject(r)\|\|(i=Array.isArray(r)))?(n=a[t],o=i&&!Array.isArray(n)?[]:i\|\|S.isPlainObject(n)?n:{},i=!1,a[t]=S.extend(l,o,r)):void 0!==r&&(a[t]=r));return a},S.extend({expando:"jQuery"+(f+Math.random()).replace(/\D/g,""),isReady:!0,error:function(e){throw new Error(e)},noop:function(){},isPlainObject:function(e){var t,n;return!(!e\|\|"[object Object]"!==o.call(e))&&(!(t=r(e))\|\|"function"==typeof(n=v.call(t,"constructor")&&t.constructor)&&a.call(n)===l)},isEmptyObject:function(e){var t;for(t in e)return!1;return!0},globalEval:function(e,t,n){b(e,{nonce:t&&t.nonce},n)},each:function(e,t){var n,r=0;if(p(e)){for(n=e.length;r<n;r++)if(!1===t.call(e[r],r,e[r]))break}else for(r in e)if(!1===t.call(e[r],r,e[r]))break;return e},makeArray:function(e,t){var n=t\|\|[];return null!=e&&(p(Object(e))?S.merge(n,"string"==typeof e?[e]:e):u.call(n,e)),n},inArray:function(e,t,n){return null==t?-1:i.call(t,e,n)},merge:function(e,t){for(var n=+t.length,r=0,i=e.length;r<n;r++)e[i++]=t[r];return e.length=i,e},grep:function(e,t,n){for(var r=[],i=0,o=e.length,a=!n;i<o;i++)!t(e[i],i)!==a&&r.push(e[i]);return r},map:function(e,t,n){var r,i,o=0,a=[];if(p(e))for(r=e.length;o<r;o++)null!=(i=t(e[o],o,n))&&a.push(i);else for(o in e)null!=(i=t(e[o],o,n))&&a.push(i);return g(a)},guid:1,support:y}),"function"==typeof Symbol&&(S.fn[Symbol.iterator]=t[Symbol.iterator]),S.each("Boolean Number String Function Array Date RegExp Object Error Symbol".split(" "),function(e,t){n["[object "+t+"]"]=t.toLowerCase()});var d=function(n){var e,d,b,o,i,h,f,g,w,u,l,T,C,a,E,v,s,c,y,S="sizzle"+1*new Date,p=n.document,
URL: https://www.dcamarketintelligence.com/tdt... Model: Joe Sandbox AI	{ "risk_score": 2, "reasoning": "This script appears to be a legitimate LinkedIn analytics script. It sets up a global `lintrk` function and loads the LinkedIn analytics script from a trusted domain (`snap.licdn.com`). While it uses some dynamic behavior, this is common for analytics scripts, and there are no clear indicators of malicious intent." }
(function(l) { if (!l){window.lintrk = function(a,b){window.lintrk.q.push([a,b])}; window.lintrk.q=[]} var s = document.getElementsByTagName("script")[0]; var b = document.createElement("script"); b.type = "text/javascript";b.async = true; b.src = "https://snap.licdn.com/li.lms-analytics/insight.min.js"; s.parentNode.insertBefore(b, s);})(window.lintrk);
URL: https://td.doubleclick.net/td/rul/16583961882?rand... Model: Joe Sandbox AI	{ "risk_score": 7, "reasoning": "The provided JavaScript snippet demonstrates several high-risk behaviors, including data exfiltration and the use of the `navigator.sendBeacon()` API to transmit potentially sensitive information to an external domain. While the script appears to be related to ad interest group management, the lack of transparency and the use of the `sendBeacon()` API to report errors raise concerns about potential data leakage or misuse." }
for(let i of ig_list.interestGroups){try{if(i.action==0){navigator.joinAdInterestGroup(i.interestGroupAttributes,i.expirationTimeInSeconds);}else if(i.action==1){navigator.leaveAdInterestGroup(i.interestGroupAttributes);}}catch(e){navigator.sendBeacon(`https://pagead2.googlesyndication.com/pagead/gen_204/?id=turtlex_join_ig&tx_jig=${encodeURIComponent(JSON.stringify(i))}&tx_jem=${e.message}&tx_jen=${e.name}`);}}
URL: https://www.google.com/recaptcha/api2/anchor?ar=1&... Model: Joe Sandbox AI	{ "risk_score": 7, "reasoning": "The provided JavaScript snippet exhibits several high-risk behaviors, including dynamic code execution, data exfiltration, and obfuscated code/URLs. While the script may have a legitimate purpose, the combination of these factors suggests a medium to high risk level that requires further investigation." }
recaptcha.anchor.Main.init("[\x22ainput\x22,[\x22bgdata\x22,\x22Ly93d3cuZ29vZ2xlLmNvbS9qcy9iZy8xSnRmeEVvT0hZaXBIRFNvNlZHRnJoaHdXTjUtbkliQ2V4cmJvcUxkWjR3Lmpz\x22,\x22\x22,\x22TlVaK0FQRFVKN2FFR1FQUnFlUDZSVzFkL0VqMEZWR3IyeXc5cXluajNYYUo5R3diREdaNWFENEt1QWN4cldyR1ROUEt3OWd4SWRoeTBNZm9zT1RVbDBuaUJnalZ3U2tMcmZsWTNvWUpteXc0NnNUWXpvYTI2YXpXc09hTjh3bit6RUFrY3I5dzk1akNEN2hlK0lhanRRbFcwdUl0Ty9XNE1MVU5pek92Rm92aHNWemN3enJZN0dOZ3FodU4vOEQ3azZYdGF6V0VwUkQ2d3RnM0wyWFdMNnoxUGVCdTFiYjU4ZDY5bTc3c0hTM0J4QnRBdHRKSzM3Wjc1Um9PdHBCV3REcHZ4TThycWFmU1h2UmU0QkI0TkRaVGhEaU01MkFEOFIzS3Nhb3FHbUpWbDVFY1RMWW1LYkZEQldkdzM1REtVSG5PdzRwbFJ6T0ZYOU9FMjVFb0ZZQUszUXVkdWNleHByRnB1VnhYU2Zldkt0NjBxbnBtQUZBTnJnaDFGMTRGV20weFFYWVVaMmRaZ3NiSm8rVXREelhLanNqQmtKaW5PVUpEaW12MUd4NDk0Mkx1OEF2b3d5MGw2ZHplaGwva1hCZFczbVdwckpxRGRCazl0RU5kWVBCNXZOa0UySGJVZkRqUVVoYlZaRk1iZndxd0U1eHcyclpMTmJITXo5cERHcWU5NWcxazNXeXpuclJUall5ajMxRXNkZmZGOGVwZm1rTyswYzh1emZENXErRm1kQnBoTU43a2RmaVZJb2RiUEFuMGZyN3N5b2kzYnNCZkdnNldCTHB0OWRQNk41Z2kweUhHZ1ZsSlVyV0JQcmhYaWhteVFaQ2pxMThIOXA3bFc4aC9Hbjh4SHA1N0F3WU04cDZQK2ZjMEFCMndyUXg0ZXdhSTlqeTJWQUZNYkFueHJkSGZzRnhIc2Rya1JleUVJSEdqaTNvcFdscSs1bXIycGY5MGxlb2JGajltNVlzWWZUNDBTWVhCUisrcmNReU9yeC9CSm9XS2l4VWltampLT0FVZElVSktKRWFaVTlUeXc4YTBBaXZrbG1heEVRdkZXbm96bWFqTkRndzB1SFdGTkw3SWNyY05xZ2w4b2pJczRUQllLbk9QREhEM21VUzd4R2trL1hYcllhM00zWWFwUXpJYURQWUFCRkh5RWJkQ0dwTWlVeFRDQ3NCeEpZTGs1UXE5NmExbXFLenFyUWQxOFYrcHF2YXdwUTFBYWpLandjcTRpVzlwbmVZbWwwUDdldENNd0dxUjhpTmFlTXFHZG9RSWpVRnFoUFJYeDI3ek1RZm1rZ0tLd0lub2hEWTZiQm5IN1hSRG9ZTzczZnB1MFE5UXJnM1JwREVkcXR1WlJJcU9ZNVlyVW05bitUQlYxL3NHbm1iSmxWQWhUbVhzMHMrYzVOVUhjSzlCWG9LTDIwRjNKSFVkazMyWVJneVloSUhDTzdFL1Nlb2RCaU5TTUNNNkVVQWhYREdyYWp5MGpJN1h6bVRWc2FYd1ZuWUExOEErV1NCS3d0YVVRRDNFQm9FQkZqZzlCK2dZMnE4YjZubzZJdzE1cDFib0FqT20rZkRCWVB0b1JpSWdNbGFzcDhmck16cUJSa2hYRSs4ZU1CWUpDM3J0WkdtWjRFNTNTMFg4NTk4NjNaVW00Y2t3K1czOWgwc0gxTUFmN3U4TXhoZ0Y4RVljcGxGUzVVNXR1NlF4SUN0Mm5oNGVLRHlHVnozL3RHRnZ0bTFwZ1lMclpSWFZKTTRFWmgzTXd4OGdnbXBtV0J1SmJmL0lDZVVZRGZmQnhhK2FnQVVyclJvUU9kRzZyNTBRLzBrUm8zYm40SXBrVm5TdWFZY1dhaWJlbVlhQ05TREdmclZFNlFxZlBDdGlLeVluUkh0THdpQ3pSMmxPYWZ1dGJvLzV4bFMwWDdtOHpHaitEN0ZKL3c0N2NaYmNraDZKTDVMcmpoQTJaNmVHZ0dmVUhUWm5RTzJCZHVzbzJaSHljMElDVVVyMmVvYU1McWd1TFRua3hycFRicWdURzJOZzhDOEIrWGVGd3p0Y0x3K0tUTnBxNzJ6RGlxRm1uVHdYLzVjU0tTbVhZaG9CWnRJK2p0RzFLb3FaYWdCcHVrWmJUSzkxN0FXYXMyMHRNS3NvSDBJOExEbTZlOE1vcm1CUXRoeWlJWTErRExvUEdXNTBoaW9UcDM3VjBEMjNKWENtaFA5cDlNc1JXakpLQjZ3QVJMcVByTHNGSVl2RjFJVkFoMDRBU3FMUmc3UXo5ZVk2OG5udWx2R1BGcHlpekVHWkVsYmxpeUt4RXc2MGpoN0docUl5eFVNV0RBWTFORnZ4djBBN0x3bUNsM1h4RmhsOURyNWRHeEdsSEJRck9iWE9KSWpkM0NLWlNWSnJ4Rnh3ZTZaNDZZN1NjSFJHbVo2Z1RZNTEwRFZZU2ErSWo1NVRxNFdVUklkdTJmS1hIbURkb3BhdTRCcDh1SlZoTzYvZURTeXVuY1NvV0JKMENpdHkyU2NvSGxjWjA0Y2FUOVhOZmhzdXdqZXJjbTFaempKSmwwN1d5T0NibytxNlcxelZyaVQzSGRvNVpraUFEeVRVbisvREdvR3dBenRBKzFKWExBcmV3bWxsem0vRFFLbTF0MFQyNGlTNXVXQXIraXkzV0VPRWRSTXByVDlJaWVQZUpGZHZ1dVI3RVROQi9IRFhydVNGcHJQOENUWjVRRXZNU01yMkhNdHJQUm5Hb3I2c01vOXVhRitiSGlCczV1Z1ZXamhYZXVMR1lhVW15ZGMzYmZPN3ptbFZBOXQrb0J2QmQ1U2I0a3FvWVNJL1Q2WThqREFISTExNDhQOEFQMnc0SzF0TTJPdk1JenI1UnJlbWlyNG9HblBLMXI4bi9zcmFVZTdsVWFyZ0w3Y1NYeVFHU2ErS3lkNkhVdVFQMWJCWmVreGVyalNoZ3RBZUJwVXhVcVZyazVKMm1MOFAxM3R1VG55YzBaYnp4N256ZXVWWkVFTlRlQVpaRThXZWdrTDhtc2I0RVZneWFqeWZnbkx3MjNRdGxlK1VYd1R2YW95bDBFUTFBLzUrY2RtWVZCUjh4SllSY1JJb0dHSTdLMFZIaGxxT3NJdkpYNUpLZDV2cXcxODNBNG5QZ0xsU2lWYTZTWTB0bGo5ZEk2S2FIMDhTQ2xLY0hSblkwbkxuZVFWUXAwbktYc0Nwek5qR2JsRVhOcWVDUmsrN25WZ2xMelpDTm1EbzlHd1pLbDZQNGxDTWo2UUtFRFJVdVdlSUVROGE4bEZVc05zcVN6MzVaU05oYThQRkNhRWtzQ0lnTExWODhVVjI4QlozMXorNjViRzdyaXRWUmZaUFM3alByTXZ6YW9jM3A1cGpjSWhseEhVaHdpNVhwSjVFa0ZWQk9ocVdiYWZLNE9Dd21hMHlvdnlpWTVaREZ4ZFUrYXZXcEhsa0hQbERZWnZCWXVlTUNycTZONWxtWFdwRVJ3N2hjTnQ3RmRrZmRROVNJdjdNYm5ieHF2OUtWOXRESnJaMkxnVTRIN2ppbTkrVUU5S0lseUVLdFJqK0ZvOGE0WkE2ZXkzcUJRT08xMHh2TW5RcTg4cit4WHlueGVQay9RRDdKYlVBakxFWkorY1IvQTM5azdMUkgwK1kvTWlyNWZvdzg0L09XNWdMcjVPM0d4MFlUa1h5eEZNSUlPeVZUbEpKUDI2UUZReTNMM0RaWlBETE9USEtiVTRjLzhTZXEwR01BUEhKT1lmYWhlQnc3SzlBZllNSkFPRk5wZmwrQ2VNTGlnbjhjVzBUeEk0aTRhd2cyRURIeDVHWkx5VkR0NVV
URL: https://www.googletagmanager.com/static/service_wo... Model: Joe Sandbox AI	{ "risk_score": 5, "reasoning": "The script contains a mix of behaviors that require further review. While it appears to be related to service worker registration and messaging, it also exhibits some moderate-risk indicators such as external data transmission and the use of legacy APIs. Additional context is needed to fully assess the risk." }
'use strict';class m{constructor(a){this.j=a;this.g={};this.h={};this.i=0;this.id=String(Math.floor(Number.MAX_SAFE_INTEGERMath.random()))}}function n(a){return a.performance&&a.performance.now()\|\|Date.now()} var p=function(a,b){class d{constructor(c,g,f){this.failureType=c;this.data=g;this.g=f;this.h=new m(n(f))}s(c,g){const f=c.clientId;if(c.type===0){c.isDead=!0;var e=this.h,h=n(this.g);e.g[f]==null&&(e.g[f]=0,e.h[f]=h,e.i++);e.g[f]++;c.stats={targetId:e.id,clientCount:e.i,totalLifeMs:Math.round(h-e.j),heartbeatCount:e.g[f],clientLifeMs:Math.round(h-e.h[f])}}c.failure={failureType:this.failureType,data:this.data};g(c)}}return new d(5,a,b)};/ Copyright Google LLC SPDX-License-Identifier: Apache-2.0 / let q=globalThis.trustedTypes,r;function t(){let a=null;if(!q)return a;try{const b=d=>d;a=q.createPolicy("goog#html",{createHTML:b,createScript:b,createScriptURL:b})}catch(b){}return a};var u=class{constructor(a){this.g=a}toString(){return this.g+""}};function v(a){const b=a;var d;r===void 0&&(r=t());d=r;return new u(d?d.createScriptURL(b):b)}function w(a){if(a instanceof u)return a.g;throw Error("");};function x(a,...b){if(b.length===0)return v(a[0]);let d=a[0];for(let c=0;c<b.length;c++)d+=encodeURIComponent(b[c])+a[c+1];return v(d)}function y(a){var b=x`sw.js`,d=w(b).toString();const c=d.split(/[?#]/),g=/[?]/.test(d)?"?"+c[1]:"";return z(c[0],g,/[#]/.test(d)?"#"+(g?c[2]:c[1]):"",a)} function z(a,b,d,c){function g(e,h){e!=null&&(Array.isArray(e)?e.forEach(l=>g(l,h)):(b+=f+encodeURIComponent(h)+"="+encodeURIComponent(e),f="&"))}let f=b.length?"&":"?";c.constructor===Object&&(c=Object.entries(c));Array.isArray(c)?c.forEach(e=>g(e[1],e[0])):c.forEach(g);return v(a+b+d)};const A=/Chrome\/(\d+)/;var C=function(a){const b=a.origin;if(b){var d=a.o?"swe.js":"sw.js",c=a.g?x`/static/service_worker/${a.g}/${d}?origin=${b}`:x`/gtm/static/${d}?origin=${b}`,g=new Map([["origin",b]]);a.h&&g.set("path",a.h);var f=a.l?y(g):c,e=()=>{const k=A.exec(a.window.navigator.userAgent);return k&&Number(k[1])<119},h=a.window.document.location.href;a.g&&(a.l?h=`${a.h}/_/service_worker`:e()\|\|(h="/static/service_worker"));var l={scope:h};a.g&&(l.updateViaCache="all");a.window.navigator.serviceWorker.register(w(f), l).then(()=>{a.window.navigator.serviceWorker.ready.then(k=>{a.i=k.active;B(a)})},k=>{a.j=p(k==null?void 0:k.toString(),a.window);B(a)});a.window.navigator.serviceWorker.addEventListener("message",k=>{a.window.parent.postMessage(k.data,a.origin)})}},B=function(a){const b=a.m.slice();a.m=[];for(const d of b)a.handleEvent(d)}; (function(a){if((f=>{try{return f!==f.top}catch(e){return!0}})(a.window)){var b=new URL(a.window.document.location.href),d=b.searchParams.get("origin");if(d){a.origin=d;a.l=!!b.searchParams.get("1p");a.o=!!b.searchParams.get("e");a.h=b.searchParams.get("path")\|\|"";var c=b.pathname.match(RegExp("./service_worker/(\\w+)/"));c&&c.length&&(a.g=c[1]);var g=a.window.document.location.ancestorOrigins;g&&g[0]!==a.origin\|\|(C(a),a.window.addEventListener("message",f=>{a.handleEvent(f)}))}}})(new class{constructor(a){this.window= a;this.origin="";this.o=this.l=!1;this.h="";this.j=this.i=null;this.m=[];this.g=""}handleEvent(a){a.origin===this.origin&&(this.i?this.i.postMessage(a.data):this.j?this.j.s(a.data,b=>{this.window.parent.postMessage(b,this.origin)}):this.m.push(a))}}(window));
URL: https://www.dcamarketintelligence.com/tdt Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "Alert DCA introduces benchmark price for Cagliat", "prominent_button_name": "Start your free trial", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://d.plerdy.com/click/get_custom_form?params=... Model: Joe Sandbox AI	```json { "risk_score": 2, "reasoning": "The script includes moderate-risk behavior by sending data to the parent window using postMessage, which can be a security concern if not properly validated. However, there are no high-risk indicators such as dynamic code execution or data exfiltration to external servers. The script appears to be manipulating styles and visibility, which aligns with typical web functionality, reducing the overall risk." }
var combinations = {"7":101,"6":102,"6,7":103,"5":104,"5,7":105,"5,6":106,"5,6,7":107,"4":108,"4,7":109,"4,6":110,"4,6,7":111,"4,5":112,"4,5,7":113,"4,5,6":114,"4,5,6,7":115,"3":116,"3,7":117,"3,6":118,"3,6,7":119,"3,5":120,"3,5,7":121,"3,5,6":122,"3,5,6,7":123,"3,4":124,"3,4,7":125,"3,4,6":126,"3,4,6,7":127,"3,4,5":128,"3,4,5,7":129,"3,4,5,6":130,"3,4,5,6,7":131,"2":132,"2,7":133,"2,6":134,"2,6,7":135,"2,5":136,"2,5,7":137,"2,5,6":138,"2,5,6,7":139,"2,4":140,"2,4,7":141,"2,4,6":142,"2,4,6,7":143,"2,4,5":144,"2,4,5,7":145,"2,4,5,6":146,"2,4,5,6,7":147,"2,3":148,"2,3,7":149,"2,3,6":150,"2,3,6,7":151,"2,3,5":152,"2,3,5,7":153,"2,3,5,6":154,"2,3,5,6,7":155,"2,3,4":156,"2,3,4,7":157,"2,3,4,6":158,"2,3,4,6,7":159,"2,3,4,5":160,"2,3,4,5,7":161,"2,3,4,5,6":162,"2,3,4,5,6,7":163,"1":164,"1,7":165,"1,6":166,"1,6,7":167,"1,5":168,"1,5,7":169,"1,5,6":170,"1,5,6,7":171,"1,4":172,"1,4,7":173,"1,4,6":174,"1,4,6,7":175,"1,4,5":176,"1,4,5,7":177,"1,4,5,6":178,"1,4,5,6,7":179,"1,3":180,"1,3,7":181,"1,3,6":182,"1,3,6,7":183,"1,3,5":184,"1,3,5,7":185,"1,3,5,6":186,"1,3,5,6,7":187,"1,3,4":188,"1,3,4,7":189,"1,3,4,6":190,"1,3,4,6,7":191,"1,3,4,5":192,"1,3,4,5,7":193,"1,3,4,5,6":194,"1,3,4,5,6,7":195,"1,2":196,"1,2,7":197,"1,2,6":198,"1,2,6,7":199,"1,2,5":200,"1,2,5,7":201,"1,2,5,6":202,"1,2,5,6,7":203,"1,2,4":204,"1,2,4,7":205,"1,2,4,6":206,"1,2,4,6,7":207,"1,2,4,5":208,"1,2,4,5,7":209,"1,2,4,5,6":210,"1,2,4,5,6,7":211,"1,2,3":212,"1,2,3,7":213,"1,2,3,6":214,"1,2,3,6,7":215,"1,2,3,5":216,"1,2,3,5,7":217,"1,2,3,5,6":218,"1,2,3,5,6,7":219,"1,2,3,4":220,"1,2,3,4,7":221,"1,2,3,4,6":222,"1,2,3,4,6,7":223,"1,2,3,4,5":224,"1,2,3,4,5,7":225,"1,2,3,4,5,6":226,"1,2,3,4,5,6,7":227}; var DataForSendWheel={}; var anamationWeel; var banerF = 0; function sendStylesToMainWindow(st) { data = {}; data.styles = {}; data.test = '0'; data.function = 'styles'; data.test = '0'; var keys = Object.keys(st); for (var i = 0; i < keys.length; i += 1) { if(keys[i] == 'width' \|\| keys[i] == 'height'){ st[keys[i]] = st[keys[i]].replace('px',''); st[keys[i]] = Math.floor(st[keys[i]] / 2) * 2; st[keys[i]] = st[keys[i]] + "px"; } data.styles[keys[i]] = st[keys[i]]; } //console.log(data); window.parent.postMessage(data, "*"); } (function () { var vis = (function(){ var stateKey, eventKey, keys = { hidden: "visibilitychange", webkitHidden: "webkitvisibilitychange", mozHidden: "mozvisibilitychange", msHidden: "msvisibilitychange" }; for (stateKey in keys) { if (stateKey in document) { eventKey = keys[stateKey]; break; } } return function(c) { if (c) document.addEventListener(eventKey, c); return !document[stateKey]; } })(); window.addEventListener('load', function () { var doingrequest = 0; var clicked = 0; var Countdown = setInterval(function(){ if (vis()) { clearInterval(Countdown); el = document.querySelector('.plerdy-modal__inner'); if (el) { if (el.dataset.form && el.dataset.form == 'baner') { konstructor = 1; banerF = 1; } else { konstructor = 0; } } else { el = document.querySelector('#plerdy_form_for_get_data_close'); konstructor = 1; } styles_i = getComputedStyle(el); my_styles = {};
URL: https://www.dcamarketintelligence.com/tdt Model: Joe Sandbox AI	{ "brands": [ "DCA Market Intelligence" ] }
	{ "brands": [ "DCA Market Intelligence" ] }
URL: https://www.dcamarketintelligence.com/tdt Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "Alert DCA introduces benchmark price for Cagliata", "prominent_button_name": "Start your free trial", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://www.dcamarketintelligence.com/tdt Model: Joe Sandbox AI	{ "brands": [ "DCA Market Intelligence" ] }
	{ "brands": [ "DCA Market Intelligence" ] }
URL: https://www.dcamarketintelligence.com/tdt Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "Alert DCA introduces b", "prominent_button_name": "Start your free trial", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://www.dcamarketintelligence.com/tdt Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "DCA Market introduces the source for less biased benchmark prices", "prominent_button_name": "Start your free trial", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://www.dcamarketintelligence.com/tdt Model: Joe Sandbox AI	{ "brands": [ "Trigona Dairy Trade" ] }
	{ "brands": [ "Trigona Dairy Trade" ] }
URL: https://www.dcamarketintelligence.com/tdt Model: Joe Sandbox AI	{ "brands": [ "Trigona Dairy Trade" ] }
	{ "brands": [ "Trigona Dairy Trade" ] }

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Jan 10 07:19:07 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2673
Entropy (8bit):	3.984511120280544
Encrypted:	false
SSDEEP:
MD5:	F336ECFD945E6A46362C1F0321A8E580
SHA1:	50B73BA7B6E5AE3484E9F13B322C844606CE8200
SHA-256:	DC662F5ED0B7FD7E78AC788DE5FB42F873F412EE62DE26AADD76F0C892E8154C
SHA-512:	A6B6EAC0CF560D70ECAFAA295AD6F0F335A7541D8AC3A31C313040A1BCDC8FBE8D1805DB2ED80CA0732F29295C162AB46EE1395B342A54A819F1A44C154D135C
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,......[Q8c..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IZWB....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VZcB....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VZcB....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VZcB..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VZdB...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............%.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e..C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Jan 10 07:19:07 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2675
Entropy (8bit):	3.9969796395554065
Encrypted:	false
SSDEEP:
MD5:	FB53E7A8373754490031D979E6D3875E
SHA1:	F1145C0120FBCE2355020CF81ED2C4FC584DE387
SHA-256:	99F9D0A86C40F2B64F59B3B2EA806EF2088C70BFBDF547E930792A7CB575A79C
SHA-512:	0FEB1B83576EE19754B1BA5E7AE4D045676A8CC2AF182B18C82EC89F4851B38A5BB590EC8026D81758F6206BB4721F7A896670FBBAE239D58FA4AAFB39D20424
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,......OQ8c..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IZWB....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VZcB....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VZcB....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VZcB..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VZdB...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............%.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e..C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2689
Entropy (8bit):	4.009526463185836
Encrypted:	false
SSDEEP:
MD5:	E975F46FE02497175C4B95C3283DE667
SHA1:	BC202D214C2B1F71A863FAAC41D82C370D626BA2
SHA-256:	CBF1B9CCC0180E680AE3B192FF76EE01C35E7E4622D49ABF20CDA80D74EDADBC
SHA-512:	EC71FF64703C09434F7CA680547BCFD17598A5E82588E90396182FD28A3D96BB48479395DDAE3F71A21C5DDEE80B2DA8E2E11F7626EAC6FDEDEB06C501C68ADA
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.....Y.04...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IZWB....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VZcB....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VZcB....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VZcB..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VFW.E...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............%.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Jan 10 07:19:07 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9982889613075248
Encrypted:	false
SSDEEP:
MD5:	D6846F17A827319F4C0753C24B4E8C9D
SHA1:	736466B0A672E0B2FA37BD2CD5F1A57D45E27DA8
SHA-256:	3C914D816D63E716B4E33F7A93F0D652C261C28782D2E74C0D391A21A1753E13
SHA-512:	4055FA5A896B9E5D9BB9EF36080FDC268662040BC058FB37C146D3DE8E28C6A538B7AC9E5D081A3039DBEBB97B8911157D8F057B61E704A5FC18C4AB1F84F8C4
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.....:IQ8c..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IZWB....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VZcB....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VZcB....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VZcB..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VZdB...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............%.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e..C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Jan 10 07:19:07 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.986064189739769
Encrypted:	false
SSDEEP:
MD5:	A01B2E2D6A0C3789F695152FF83AB69D
SHA1:	A6D07F3D6E690473F0118FEBBD0FFFFFBE6693BD
SHA-256:	4A656DCB1AD201302A9F37366CC217515836C36FB905FF26E3054BF1067FB8A2
SHA-512:	130E6858AD073005CB0FFA1FA6FF587B5765EA9439F868F4C4EEF0BFFCFCB6B99004BB3309C04D0E9CE0D4991F5B0A8153E575FF2D56D56C107D293FD8378E48
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,....`!UQ8c..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IZWB....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VZcB....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VZcB....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VZcB..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VZdB...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............%.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e..C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Jan 10 07:19:07 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.995772768149732
Encrypted:	false
SSDEEP:
MD5:	E58CC1029D96539CC78C2CEB9E69FC45
SHA1:	6DF8FA6C36779C81FFB023AC170316784F7B4791
SHA-256:	6F5B370C33227293B3ED0D73985D52DF94AB191999FA767F067AA733FAA92867
SHA-512:	0E81A67B0A5E6F25FF5D8F9C51E02EA8B5FD038DF948392215BB4069CD1190843910C7E6EAB6F9BD0C78F6D5FABDCAAEDB367744476D51B9C4EEAAC9BE7D7167
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,....($AQ8c..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IZWB....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VZcB....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VZcB....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VZcB..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VZdB...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............%.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e..C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Static File Info

⊘No static file info

Description:	Adversaries may abuse Internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality and customize aspects of Internet browsers. They can be installed directly or through a browser's app store and generally have access and permissions to everything that the browser can access.
Tactics:	Persistence
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Process: Process Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://www.dcamarketintelligence.com/tdt

Overview

General Information

Detection

Signatures

Classification

Process Tree

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Boot Survival

Mitre Att&ck Matrix

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

LLM Input / Output

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Static File Info

Windows Analysis Report
https://www.dcamarketintelligence.com/tdt