Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
Chrome Cache Entry: 100
|
JSON data
|
dropped
|
||
|
Chrome Cache Entry: 101
|
ASCII text, with very long lines (45797)
|
dropped
|
||
|
Chrome Cache Entry: 102
|
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1864
|
downloaded
|
||
|
Chrome Cache Entry: 103
|
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 90678
|
dropped
|
||
|
Chrome Cache Entry: 104
|
SVG Scalable Vector Graphics image
|
dropped
|
||
|
Chrome Cache Entry: 105
|
MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
|
dropped
|
||
|
Chrome Cache Entry: 106
|
HTML document, ASCII text, with very long lines (918)
|
downloaded
|
||
|
Chrome Cache Entry: 107
|
ASCII text, with very long lines (64616)
|
dropped
|
||
|
Chrome Cache Entry: 108
|
ASCII text, with very long lines (61177)
|
downloaded
|
||
|
Chrome Cache Entry: 109
|
ASCII text, with very long lines (45797)
|
downloaded
|
||
|
Chrome Cache Entry: 110
|
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 90678
|
downloaded
|
||
|
Chrome Cache Entry: 111
|
Unicode text, UTF-8 text, with very long lines (32057)
|
dropped
|
||
|
Chrome Cache Entry: 112
|
MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
|
dropped
|
||
|
Chrome Cache Entry: 70
|
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 3651
|
dropped
|
||
|
Chrome Cache Entry: 71
|
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 3651
|
downloaded
|
||
|
Chrome Cache Entry: 72
|
HTML document, ASCII text, with very long lines (3450), with CRLF line terminators
|
downloaded
|
||
|
Chrome Cache Entry: 73
|
MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
|
downloaded
|
||
|
Chrome Cache Entry: 74
|
SVG Scalable Vector Graphics image
|
downloaded
|
||
|
Chrome Cache Entry: 75
|
HTML document, ASCII text, with very long lines (2626), with CRLF line terminators
|
downloaded
|
||
|
Chrome Cache Entry: 76
|
ASCII text, with very long lines (65402)
|
downloaded
|
||
|
Chrome Cache Entry: 77
|
ASCII text, with very long lines (46090)
|
downloaded
|
||
|
Chrome Cache Entry: 78
|
HTML document, Unicode text, UTF-8 text, with very long lines (23166), with CRLF line terminators
|
downloaded
|
||
|
Chrome Cache Entry: 79
|
SVG Scalable Vector Graphics image
|
downloaded
|
||
|
Chrome Cache Entry: 80
|
SVG Scalable Vector Graphics image
|
dropped
|
||
|
Chrome Cache Entry: 81
|
SVG Scalable Vector Graphics image
|
downloaded
|
||
|
Chrome Cache Entry: 82
|
ASCII text, with very long lines (64612)
|
downloaded
|
||
|
Chrome Cache Entry: 83
|
JSON data
|
dropped
|
||
|
Chrome Cache Entry: 84
|
Unicode text, UTF-8 text, with very long lines (32057)
|
downloaded
|
||
|
Chrome Cache Entry: 85
|
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 901881
|
downloaded
|
||
|
Chrome Cache Entry: 86
|
ASCII text, with no line terminators
|
downloaded
|
||
|
Chrome Cache Entry: 87
|
ASCII text, with very long lines (64612)
|
dropped
|
||
|
Chrome Cache Entry: 88
|
ASCII text, with no line terminators
|
dropped
|
||
|
Chrome Cache Entry: 89
|
ASCII text, with very long lines (65402)
|
dropped
|
||
|
Chrome Cache Entry: 90
|
MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
|
downloaded
|
||
|
Chrome Cache Entry: 91
|
ASCII text, with no line terminators
|
downloaded
|
||
|
Chrome Cache Entry: 92
|
ASCII text, with very long lines (46090)
|
dropped
|
||
|
Chrome Cache Entry: 93
|
ASCII text, with no line terminators
|
downloaded
|
||
|
Chrome Cache Entry: 94
|
SVG Scalable Vector Graphics image
|
dropped
|
||
|
Chrome Cache Entry: 95
|
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 901881
|
dropped
|
||
|
Chrome Cache Entry: 96
|
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1864
|
dropped
|
||
|
Chrome Cache Entry: 97
|
ASCII text, with no line terminators
|
downloaded
|
||
|
Chrome Cache Entry: 98
|
ASCII text, with very long lines (64616)
|
downloaded
|
||
|
Chrome Cache Entry: 99
|
ASCII text, with no line terminators
|
dropped
|
There are 34 hidden files, click here to show them.
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Program Files\Google\Chrome\Application\chrome.exe
|
"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
|
||
|
C:\Program Files\Google\Chrome\Application\chrome.exe
|
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US
--service-sandbox-type=none --mojo-platform-channel-handle=1712 --field-trial-handle=1988,i,17100991338385188231,16201762972204157628,262144
--disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction
/prefetch:8
|
||
|
C:\Program Files\Google\Chrome\Application\chrome.exe
|
"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://nam.safelink.emails.azure.net/redirect/?destination=https%3A%2F%2Fadmin.microsoft.com%2Fadminportal%2Fhome%3F%23%2Fsubscriptions&p=bT01OWM4ZTNjMy03YjVmLTQxNTgtOWVjYS0yZWJkZDNiYzZkZDEmcz0wMDAwMDAwMC0wMDAwLTAwMDAtMDAwMC0wMDAwMDAwMDAwMDAmdT1hZW8mbD1ob21l"
|
URLs
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
https://nam.safelink.emails.azure.net/redirect/?destination=https%3A%2F%2Fadmin.microsoft.com%2Fadminportal%2Fhome%3F%23%2Fsubscriptions&p=bT01OWM4ZTNjMy03YjVmLTQxNTgtOWVjYS0yZWJkZDNiYzZkZDEmcz0wMDAwMDAwMC0wMDAwLTAwMDAtMDAwMC0wMDAwMDAwMDAwMDAmdT1hZW8mbD1ob21l
|
|||
|
https://aadcdn.msftauth.net/ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_tzwwq6wdslxjdiwzdatg6a2.js
|
152.199.21.175
|
||
|
https://login.microsoftonline.com
|
unknown
|
||
|
http://www.opensource.org/licenses/mit-license.php)
|
unknown
|
||
|
https://aadcdn.msftauth.net/shared/1.0/content/js/BssoInterrupt_Core_JQnUxWSvwsd9FrpspQmznw2.js
|
152.199.21.175
|
||
|
https://aadcdn.msftauth.net/shared/1.0/content/js/asyncchunk/convergedlogin_pstringcustomizationhelper_92013fd9f2f609d397ae.js
|
152.199.21.175
|
||
|
https://stk.hsprotect.net/ns?c=e08423a0-6639-11ef-b978-41df4618b98d
|
34.107.199.61
|
||
|
https://aadcdn.msftauth.net/shared/1.0/content/js/ConvergedLogin_PCore_2P9n4TNNrWcgKwW6Mt6tGA2.js
|
152.199.21.175
|
||
|
https://collector-pxzc5j78di.hsprotect.net/api/v2/msft
|
35.190.10.96
|
||
|
https://aadcdn.msftauth.net/shared/1.0/content/images/backgrounds/2_11d9e3bcdfede9ce5ce5ace2d129f1c4.svg
|
152.199.21.175
|
||
|
https://aadcdn.msftauth.net/shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico
|
152.199.21.175
|
||
|
https://aadcdn.msftauth.net/shared/1.0/content/images/signin-options_3e3f6b73c3f310c31d2c4d131a8ab8c6.svg
|
152.199.21.175
|
||
|
http://knockoutjs.com/
|
unknown
|
||
|
https://client.hsprotect.net/PXzC5j78di/main.min.js
|
unknown
|
||
|
https://aadcdn.msftauth.net/shared/1.0/content/images/microsoft_logo_564db913a7fa0ca42727161c6d031bef.svg
|
152.199.21.175
|
||
|
https://github.com/douglascrockford/JSON-js
|
unknown
|
||
|
https://login.windows-ppe.net
|
unknown
|
||
|
https://fpt.live.com/
|
unknown
|
||
|
https://aadcdn.msftauth.net/shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_6c7dc46bb93924417b57.js
|
152.199.21.175
|
||
|
http://feross.org
|
unknown
|
There are 9 hidden URLs, click here to show them.
Domains
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
s-part-0014.t-0009.t-msedge.net
|
13.107.246.42
|
||
|
inbound-weighted.protechts.net
|
35.190.10.96
|
||
|
sni1gl.wpc.alphacdn.net
|
152.199.21.175
|
||
|
sni1gl.wpc.omegacdn.net
|
152.199.21.175
|
||
|
s-part-0017.t-0009.t-msedge.net
|
13.107.246.45
|
||
|
www.google.com
|
172.217.23.100
|
||
|
stk.hsprotect.net
|
34.107.199.61
|
||
|
s-part-0032.t-0009.t-msedge.net
|
13.107.246.60
|
||
|
fp2e7a.wpc.phicdn.net
|
192.229.221.95
|
||
|
s-part-0029.t-0009.t-msedge.net
|
13.107.246.57
|
||
|
nam.safelink.emails.azure.net
|
unknown
|
||
|
signup.live.com
|
unknown
|
||
|
client.hsprotect.net
|
unknown
|
||
|
identity.nel.measure.office.net
|
unknown
|
||
|
msft.hsprotect.net
|
unknown
|
||
|
aadcdn.msftauth.net
|
unknown
|
||
|
collector-pxzc5j78di.hsprotect.net
|
unknown
|
||
|
logincdn.msftauth.net
|
unknown
|
||
|
login.microsoftonline.com
|
unknown
|
||
|
fpt.live.com
|
unknown
|
There are 10 hidden domains, click here to show them.
IPs
|
IP
|
Domain
|
Country
|
Malicious
|
|
|---|---|---|---|---|
|
13.107.246.42
|
s-part-0014.t-0009.t-msedge.net
|
United States
|
||
|
35.190.10.96
|
inbound-weighted.protechts.net
|
United States
|
||
|
13.107.246.45
|
s-part-0017.t-0009.t-msedge.net
|
United States
|
||
|
192.168.2.4
|
unknown
|
unknown
|
||
|
13.107.246.60
|
s-part-0032.t-0009.t-msedge.net
|
United States
|
||
|
34.107.199.61
|
stk.hsprotect.net
|
United States
|
||
|
239.255.255.250
|
unknown
|
Reserved
|
||
|
172.217.23.100
|
www.google.com
|
United States
|
||
|
152.199.21.175
|
sni1gl.wpc.alphacdn.net
|
United States
|
DOM / HTML
|
URL
|
Malicious
|
|
|---|---|---|
|
https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000006-0000-0ff1-ce00-000000000000&response_type=code%20id_token&scope=openid%20profile&state=OpenIdConnect.AuthenticationProperties%3DRmXnM9c-7sCzD76JZetXQuJbYrdMyOzD--MwrVIFszgGi4bEPFL_VM8ehwY42PbRGU4OyAqgUv6Wln_Bg4vCmNT-1xwhKF2R2rnNVa-8cmDAzT4YkUIy7XVTCF2QhN6KnZV0_LQO_h6W8P1HDtSgo3-LkX6NKQA5sTd98sAObTV64JNkx8f785hrGtz-Y0Am&response_mode=form_post&nonce=638605551999502916.MDRkZTkyYjktODU5OC00OTNiLWE2ZDktYmRiNDYxZmJjYmNlMzUzY2M0OTctZDIyNS00NWRiLTk5N2ItMzk2YzViYmNjOWZm&redirect_uri=https%3A%2F%2Fadmin.microsoft.com%2Flanding&ui_locales=en-US&mkt=en-US&client-request-id=6d3bf4d6-c3d7-45de-9238-f8e90bfb3dbe&x-client-SKU=ID_NET472&x-client-ver=7.6.2.0
|
||
|
https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000006-0000-0ff1-ce00-000000000000&response_type=code%20id_token&scope=openid%20profile&state=OpenIdConnect.AuthenticationProperties%3DRmXnM9c-7sCzD76JZetXQuJbYrdMyOzD--MwrVIFszgGi4bEPFL_VM8ehwY42PbRGU4OyAqgUv6Wln_Bg4vCmNT-1xwhKF2R2rnNVa-8cmDAzT4YkUIy7XVTCF2QhN6KnZV0_LQO_h6W8P1HDtSgo3-LkX6NKQA5sTd98sAObTV64JNkx8f785hrGtz-Y0Am&response_mode=form_post&nonce=638605551999502916.MDRkZTkyYjktODU5OC00OTNiLWE2ZDktYmRiNDYxZmJjYmNlMzUzY2M0OTctZDIyNS00NWRiLTk5N2ItMzk2YzViYmNjOWZm&redirect_uri=https%3A%2F%2Fadmin.microsoft.com%2Flanding&ui_locales=en-US&mkt=en-US&client-request-id=6d3bf4d6-c3d7-45de-9238-f8e90bfb3dbe&x-client-SKU=ID_NET472&x-client-ver=7.6.2.0&sso_reload=true
|
||
|
https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000006-0000-0ff1-ce00-000000000000&response_type=code%20id_token&scope=openid%20profile&state=OpenIdConnect.AuthenticationProperties%3DRmXnM9c-7sCzD76JZetXQuJbYrdMyOzD--MwrVIFszgGi4bEPFL_VM8ehwY42PbRGU4OyAqgUv6Wln_Bg4vCmNT-1xwhKF2R2rnNVa-8cmDAzT4YkUIy7XVTCF2QhN6KnZV0_LQO_h6W8P1HDtSgo3-LkX6NKQA5sTd98sAObTV64JNkx8f785hrGtz-Y0Am&response_mode=form_post&nonce=638605551999502916.MDRkZTkyYjktODU5OC00OTNiLWE2ZDktYmRiNDYxZmJjYmNlMzUzY2M0OTctZDIyNS00NWRiLTk5N2ItMzk2YzViYmNjOWZm&redirect_uri=https%3A%2F%2Fadmin.microsoft.com%2Flanding&ui_locales=en-US&mkt=en-US&client-request-id=6d3bf4d6-c3d7-45de-9238-f8e90bfb3dbe&x-client-SKU=ID_NET472&x-client-ver=7.6.2.0&sso_reload=true
|
||
|
https://signup.live.com/signup?sru=https%3a%2f%2flogin.live.com%2foauth20_authorize.srf%3flc%3d1033%26mkt%3den-US%26client_id%3d51483342-085c-4d86-bf88-cf50c7252078%26opid%3d47192B24BF4B2C89%26opidt%3d1724958418%26uaid%3d6d3bf4d6c3d745de9238f8e90bfb3dbe%26contextid%3dEF328B64715126DC%26opignore%3d1&mkt=EN-US&uiflavor=web&lw=1&fl=easi2&client_id=51483342-085c-4d86-bf88-cf50c7252078&uaid=6d3bf4d6c3d745de9238f8e90bfb3dbe&suc=00000006-0000-0ff1-ce00-000000000000&lic=1
|
||
|
https://signup.live.com/signup?sru=https%3a%2f%2flogin.live.com%2foauth20_authorize.srf%3flc%3d1033%26mkt%3den-US%26client_id%3d51483342-085c-4d86-bf88-cf50c7252078%26opid%3d47192B24BF4B2C89%26opidt%3d1724958418%26uaid%3d6d3bf4d6c3d745de9238f8e90bfb3dbe%26contextid%3dEF328B64715126DC%26opignore%3d1&mkt=EN-US&uiflavor=web&lw=1&fl=easi2&client_id=51483342-085c-4d86-bf88-cf50c7252078&uaid=6d3bf4d6c3d745de9238f8e90bfb3dbe&suc=00000006-0000-0ff1-ce00-000000000000&lic=1
|
||
|
https://signup.live.com/signup?sru=https%3a%2f%2flogin.live.com%2foauth20_authorize.srf%3flc%3d1033%26mkt%3den-US%26client_id%3d51483342-085c-4d86-bf88-cf50c7252078%26opid%3d47192B24BF4B2C89%26opidt%3d1724958418%26uaid%3d6d3bf4d6c3d745de9238f8e90bfb3dbe%26contextid%3dEF328B64715126DC%26opignore%3d1&mkt=EN-US&uiflavor=web&lw=1&fl=easi2&client_id=51483342-085c-4d86-bf88-cf50c7252078&uaid=6d3bf4d6c3d745de9238f8e90bfb3dbe&suc=00000006-0000-0ff1-ce00-000000000000&lic=1
|
||
|
https://signup.live.com/signup?sru=https%3a%2f%2flogin.live.com%2foauth20_authorize.srf%3flc%3d1033%26mkt%3den-US%26client_id%3d51483342-085c-4d86-bf88-cf50c7252078%26opid%3d47192B24BF4B2C89%26opidt%3d1724958418%26uaid%3d6d3bf4d6c3d745de9238f8e90bfb3dbe%26contextid%3dEF328B64715126DC%26opignore%3d1&mkt=EN-US&uiflavor=web&lw=1&fl=easi2&client_id=51483342-085c-4d86-bf88-cf50c7252078&uaid=6d3bf4d6c3d745de9238f8e90bfb3dbe&suc=00000006-0000-0ff1-ce00-000000000000&lic=1
|
||
|
https://signup.live.com/signup?sru=https%3a%2f%2flogin.live.com%2foauth20_authorize.srf%3flc%3d1033%26mkt%3den-US%26client_id%3d51483342-085c-4d86-bf88-cf50c7252078%26opid%3d47192B24BF4B2C89%26opidt%3d1724958418%26uaid%3d6d3bf4d6c3d745de9238f8e90bfb3dbe%26contextid%3dEF328B64715126DC%26opignore%3d1&mkt=EN-US&uiflavor=web&lw=1&fl=easi2&client_id=51483342-085c-4d86-bf88-cf50c7252078&uaid=6d3bf4d6c3d745de9238f8e90bfb3dbe&suc=00000006-0000-0ff1-ce00-000000000000&lic=1
|
||
|
https://signup.live.com/signup?sru=https%3a%2f%2flogin.live.com%2foauth20_authorize.srf%3flc%3d1033%26mkt%3den-US%26client_id%3d51483342-085c-4d86-bf88-cf50c7252078%26opid%3d47192B24BF4B2C89%26opidt%3d1724958418%26uaid%3d6d3bf4d6c3d745de9238f8e90bfb3dbe%26contextid%3dEF328B64715126DC%26opignore%3d1&mkt=EN-US&uiflavor=web&lw=1&fl=easi2&client_id=51483342-085c-4d86-bf88-cf50c7252078&uaid=6d3bf4d6c3d745de9238f8e90bfb3dbe&suc=00000006-0000-0ff1-ce00-000000000000&lic=1
|