Edit tour

Windows Analysis Report
https://secure-tracking-support.de/ch/?c=002918883

Overview

General Information

Sample URL:	https://secure-tracking-support.de/ch/?c=002918883
Analysis ID:	1523273
Infos:

Detection

Score:	3
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Connects to several IPs in different countries

HTML body with high number of embedded SVGs detected

HTML page contains hidden javascript code

HTML page contains string obfuscation

Program does not show much activity (idle)

Stores files to the Windows start menu directory

Classification

Process Tree

System is w10x64_ra

chrome.exe (PID: 5948 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6692 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 --field-trial-handle=1892,i,14550875244211589576,9012345206392933397,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 8040 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3592 --field-trial-handle=1892,i,14550875244211589576,9012345206392933397,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6344 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://secure-tracking-support.de/ch/?c=002918883" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Binary string: Ndb=function(a){if(!Edb.has(a)){Edb.size||(Fdb=new _.ah);Edb.add(a);const b=Fdb.resolve;a.requestAnimationFrame(c=>{Edb.clear();const d=Cdb[Ddb];Ddb=(Ddb+1)%2;try{Odb(d,c)}finally{_.Jdb=0,d.length=0}b()})}return Fdb.promise};_.Pdb=function(a,b){const c=_.Jdb;try{return _.Jdb=2,a.apply(b)}finally{_.Jdb=c}}; source: chromecache_551.1.dr, chromecache_548.1.dr

Source: https://5d11c261a793afc000e43f02abc53098.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html	HTTP Parser: Found new string: script (function() {var u = 'https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-BGkMzlcSr9vypXoQcclcRqXPCuv-yKKhbfUlBpyUL1W1PQWZbEfIKlKctFgVON-jU0QSaFwfOBCdKDyRe8V2zTl81eHeWNXpzq9NHY9rdPyJEBnE2dTEgJcbF-LpNVHGN9HbZCOECZdoBWh3vz8iAPSJrXKIdbUs_SF5oWzQNpwxFXlhKcnSgJ1MqOCqwZKDkIjt3ldvVcRwIRJTWDpMuizbf7X5ppN6nbQNDrEySTrXFJ4xE&cry=1&dbm_d=AKAmf-CrxMewui5Ux-RT-VHq9sd0YyAewI3V47rxtWhW84Hxub7fVI3_x_OPV2QzhruWMMR5lH2KdajriIYVHmmTkSCCZ_HxdTv37eNu884CwkviSPOqXvob7P2j3kuIXPFSFcFH1KmEE80AwsnQ46CECQjLs69Wy1AHhWUjbTKGuv13ck5HVRS2ssaH467p8e3epMp86ZXEicdiW4AiN8B9tkmyASYus-iIoPqE6sGEJJma8N_bKoHuCX7xhsToIQf1qY8GqDgvHVOlCalFNM4pOFG1ERkb6_wmXlV6ctRlPR25H0WT3XtpXBilLx4Lgg91an5V0_GI8m7x4QHSsOhlqv_LFIkIDM6F7L0U8SxB0JgkMcLRA8tenOhJ1hcqxaZccX8_XFl4yYhQhHVm3aw2LtYDWnnoKgTJgIk6-Rq4mZmxsrxfQ2vgapj4_OQCxHasOxo5rzALCmNu9lKC0-Vbey_W9usGCGrvtxZklBIbQw2laXxa76SBOW8Rb17tQvd_r5F32N9CSE52nFSaeukSRRCFnK9HMCIhntlJQJdlm9byYIzbUs179CRmt5y5TIqmibxZFCh1StPnbpjc2enwc-SuyUNGDSxEow1P9i3C-IR6Nlw0K4L11hVkh6fB9IaQ3DnEmxuaekeUoRQyltbQfKRT10nFnT6quNWBpDQUDrHs6Jk63...
Source: https://www.speedtest.net/	HTTP Parser: Found new string: script . if (window.isBlocked) {. (function(){. window.aax =window.aax \|\| {};. const btloaderEndpoint = "//btloader.com/tag?o=5075500865683456&upapi=true". . function isSSL(){. return('https:' == window.location.protocol);. }. . function getProtocol(){. return isSSL() ? 'https:' : 'http:'. }. . function writeBlockThroughScript(endpoint){. const source = getProtocol() + endpoint;. document.write('<scr'+'ipt src="' + source + '" async></scr' + 'ipt>');. }. . writeBlockThroughScript(btloaderEndpoint);. })();. }. ..

Source: https://secure-tracking-support.de/ch/?c=002918883	HTTP Parser: No favicon
Source: https://www.speedtest.net/	HTTP Parser: No favicon
Source: https://www.speedtest.net/	HTTP Parser: No favicon
Source: https://www.speedtest.net/	HTTP Parser: No favicon
Source: https://www.speedtest.net/	HTTP Parser: No favicon
Source: https://www.speedtest.net/	HTTP Parser: No favicon
Source: https://www.speedtest.net/	HTTP Parser: No favicon
Source: https://www.speedtest.net/	HTTP Parser: No favicon
Source: https://www.speedtest.net/	HTTP Parser: No favicon
Source: https://www.speedtest.net/	HTTP Parser: No favicon
Source: https://www.speedtest.net/	HTTP Parser: No favicon
Source: https://www.speedtest.net/	HTTP Parser: No favicon
Source: https://www.speedtest.net/	HTTP Parser: No favicon
Source: https://www.speedtest.net/	HTTP Parser: No favicon
Source: https://www.speedtest.net/	HTTP Parser: No favicon
Source: https://www.speedtest.net/	HTTP Parser: No favicon
Source: https://www.speedtest.net/	HTTP Parser: No favicon
Source: https://www.speedtest.net/	HTTP Parser: No favicon
Source: https://www.speedtest.net/	HTTP Parser: No favicon
Source: https://www.speedtest.net/	HTTP Parser: No favicon
Source: https://www.speedtest.net/	HTTP Parser: No favicon
Source: https://www.speedtest.net/	HTTP Parser: No favicon
Source: https://www.speedtest.net/	HTTP Parser: No favicon
Source: https://www.speedtest.net/	HTTP Parser: No favicon
Source: https://www.speedtest.net/	HTTP Parser: No favicon
Source: https://www.speedtest.net/	HTTP Parser: No favicon
Source: https://www.speedtest.net/	HTTP Parser: No favicon
Source: https://www.speedtest.net/	HTTP Parser: No favicon
Source: https://www.speedtest.net/	HTTP Parser: No favicon
Source: https://www.speedtest.net/	HTTP Parser: No favicon
Source: https://www.speedtest.net/	HTTP Parser: No favicon
Source: https://www.speedtest.net/	HTTP Parser: No favicon
Source: https://www.speedtest.net/	HTTP Parser: No favicon
Source: https://www.speedtest.net/	HTTP Parser: No favicon
Source: https://www.speedtest.net/	HTTP Parser: No favicon
Source: https://www.speedtest.net/	HTTP Parser: No favicon
Source: https://www.speedtest.net/	HTTP Parser: No favicon
Source: https://www.speedtest.net/	HTTP Parser: No favicon

Source: chromecache_755.1.dr	String found in binary or memory: <a target="_blank" href="https://www.facebook.com/speedtest" aria-label="Facebook - This link opens in a new tab"> equals www.facebook.com (Facebook)
Source: chromecache_537.1.dr	String found in binary or memory: </sup>","Follow Ookla":"Volg Ookla",Twitter:"Twitter",Facebook:"Facebook",Account:"Account","My Results":"Mijn resultaten","Create Account":"Maak een account aan",Ookla:"Ookla",accessibility_modal:{link:"Toegankelijkheid",header:"Ookla Toegankelijkheidsverklaring",body:'<p>Bij Ookla zorgen we er toegewijd voor dat mensen met beperkingen alle content op www.speedtest.net kunnen bereiken. We streven er ook naar om alle content in de Speedtest app toegankelijk te maken.</p> <p>Als u problemen heeft om www.speedtest.net of Speedtest apps te bereiken, stuur dan een mail naar <a target="_blank" href="mailto:legal@ziffdavis.com">legal@ziffdavis.com</a> voor hulp. Noem dan graag "ADA Inquiry" in de onderwerpregel van je mail.</p>'},Login:"Log in",Logout:"Log uit","Email address":"E-mailadres",Password:"Wachtwoord","Remember Me":"Onthoud mij","Forgot Password":"Wachtwoord vergeten","Mobile Apps":"Mobiele apps",Copyright:"Auteursrecht","Install Flash":"Installeer Flash","Login successful.":"Succesvol ingelogd.","The email or password provided is incorrect. Forgot your password?":"Het e-mailadres of wachtwoord dat je hebt ingevoerd is onjuist. Ben je je wachtwoord vergeten?","try our apps":"Alternatively, check out our free <a href='https://www.speedtest.net/apps/desktop' class='link-desktop-apps' target='_blank'>Speedtest for Desktop</a> apps for more reliable testing.","You must confirm your account registration before you can login.":"Je moet je account de registratie van je account bevestigen, voordat je kunt inloggen.","Your password was successfully changed.":"Je wachtwoord is succesvol gewijzigd.","The password you provided is incorrect.":"Het wachtwoord dat je hebt opgegeven is onjuist.","New password cannot be blank.":"Veld voor nieuw wachtwoord mag niet leeg zijn.","Passwords do not match.":"Wachtwoorden komen niet overeen.","Password must be at least 6 characters.":"Wachtwoord moet minstens 6 tekens lang zijn.","Password change failed.":"Wachtwoord wijzigen niet gelukt.","Thank you for confirming your registration.":"Bedankt voor het bevestigen van je registratie.","We are unable to confirm your account registration. Please contact support.":"We konden de registratie van je account niet bevestigen. Neem alsjeblieft contact op met de ondersteuning.","This account has already been confirmed.":"Dit account is al bevestigd.","A confirmation email has been sent. If you don't receive an email make sure to check your junk folder.":"A confirmation email has been sent. If you don't receive an email make sure to check your junk folder. Een bevestigingsmail is verzonden. Als je de mail niet ontvangt, controleer dan je spamfolder.","Failed to register account. Please contact support.":"Niet gelukt om het account te registreren. Neem alsjeblieft contact op met de ondersteuning.","Please enter a valid email address.":"Voer alsjeblieft een geldig e-mailadres in.","Email is required.":"E-mailadres is verplicht.","This email address has already been registered.":
Source: chromecache_639.1.dr, chromecache_457.1.dr	String found in binary or memory: Math.round(q);u["gtm.videoElapsedTime"]=Math.round(f);u["gtm.videoPercent"]=r;u["gtm.videoVisible"]=t;return u},dk:function(){e=zb()},od:function(){d()}}};var gc=ja(["data-gtm-yt-inspected-"]),KC=["www.youtube.com","www.youtube-nocookie.com"],LC,MC=!1; equals www.youtube.com (Youtube)
Source: chromecache_639.1.dr, chromecache_457.1.dr	String found in binary or memory: if(!(e\|\|f\|\|g\|\|k.length\|\|m.length))return;var p={ih:e,gh:f,hh:g,Sh:k,Th:m,Ie:n,Bb:b},q=C.YT;if(q)return q.ready&&q.ready(d),b;var r=C.onYouTubeIframeAPIReady;C.onYouTubeIframeAPIReady=function(){r&&r();d()};F(function(){for(var t=E.getElementsByTagName("script"),v=t.length,u=0;u<v;u++){var w=t[u].getAttribute("src");if(VC(w,"iframe_api")\|\|VC(w,"player_api"))return b}for(var x=E.getElementsByTagName("iframe"),y=x.length,A=0;A<y;A++)if(!MC&&TC(x[A],p.Ie))return wc("https://www.youtube.com/iframe_api"), equals www.youtube.com (Youtube)
Source: chromecache_516.1.dr, chromecache_1109.1.dr, chromecache_609.1.dr, chromecache_368.1.dr	String found in binary or memory: return b}IC.F="internal.enableAutoEventOnTimer";var gc=ja(["data-gtm-yt-inspected-"]),KC=["www.youtube.com","www.youtube-nocookie.com"],LC,MC=!1; equals www.youtube.com (Youtube)

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 --field-trial-handle=1892,i,14550875244211589576,9012345206392933397,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://secure-tracking-support.de/ch/?c=002918883"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3592 --field-trial-handle=1892,i,14550875244211589576,9012345206392933397,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 --field-trial-handle=1892,i,14550875244211589576,9012345206392933397,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3592 --field-trial-handle=1892,i,14550875244211589576,9012345206392933397,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service

Source	Detection	Scanner	Label	Link
https://stats.g.doubleclick.net/g/collect	0%	URL Reputation	safe
https://stats.g.doubleclick.net/g/collect	0%	URL Reputation	safe
https://ampcid.google.com/v1/publisher:getClientId	0%	URL Reputation	safe
https://stats.g.doubleclick.net/j/collect	0%	URL Reputation	safe
https://dsp-ap.eskimi.com/pixelGet?ex=50&gdpr=	0%	URL Reputation	safe
https://dsp-cookie.adfarm1.adition.com/?ssp=9&gdpr=0&gdpr_consent=	0%	URL Reputation	safe
https://greensock.com/standard-license	0%	URL Reputation	safe
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM3MDcmdGw9MjAxNjA=&piggybackCoo	0%	URL Reputation	safe
https://cdn.cookielaw.org/scripttemplates/otSDKStub.js	0%	URL Reputation	safe
https://lens.google.com	0%	URL Reputation	safe
https://www.merriam-webster.com/thesaurus/test	0%	Virustotal		Browse
https://rtb.openx.net/sync/prebid?r=https%3A%2F%2Fu-ams03.e-planning.net%2Fum%3Fdc%3Dff96d1aa62deeeb	0%	Virustotal		Browse
https://ad.360yield.com/ux?&publisher_dmp_id=15&r=https%3A%2F%2Fids.ad.gt%2Fapi%2Fv1%2Fimpr_match%3F	0%	Virustotal		Browse
https://www.speedtest.net/images/share-logo.png	0%	Virustotal		Browse
https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?&p=12186&endpoint=eu	0%	Virustotal		Browse
https://ids.ad.gt/api/v1/g_hosted?id=	0%	Virustotal		Browse
https://x.bidswitch.net/sync?ssp=eplanning	0%	Virustotal		Browse
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm	0%	Virustotal		Browse
https://www.speedtest.net/ru	0%	Virustotal		Browse
https://cdn.ziffstatic.com/ajs.php?id=a	0%	Virustotal		Browse
https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_sc	0%	Virustotal		Browse
https://ipac.ctnsnet.com/int/cm?exc=14&redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR	0%	Virustotal		Browse
https://www.ziffdavis.com/cookie-policy	0%	Virustotal		Browse
https://www.speedtest.net/zh-Hant	0%	Virustotal		Browse
https://opt-out.ziffdavis.com/local-optout	0%	Virustotal		Browse
https://www.speedtest.net/zh-Hans	0%	Virustotal		Browse
https://github.com/conversant/pubcid.js/blob/master/LICENSE	0%	Virustotal		Browse
https://d.turn.com/r/dd/id/L2NzaWQvMS9jaWQvMTc0ODI0MTY1OC90LzA/url/https%3A%2F%2Fids.ad.gt%2Fapi%2Fv	0%	Virustotal		Browse
https://www.speedtest.net/ar	0%	Virustotal		Browse
https://creativecdn.com/cm-notify?pi=pubmatic&gdpr=0&gdpr_consent=	0%	Virustotal		Browse
https://ib.adnxs.com/getuid?https%3A%2F%2Fssp.api.tappx.com%2Fcs%2Fusync%3Fidmn%3D32%26type%3Diframe	0%	Virustotal		Browse
https://matching.truffle.bid/sync/pub?sid=161&suid=https://simage2.pubmatic.com/AdServer/Pug?vcode=b	0%	Virustotal		Browse
https://dpm.demdex.net/ibs:dpid=348447&dpuuid=	0%	Virustotal		Browse
https://cookies.nextmillmedia.com/sync?type=image&gdpr=	0%	Virustotal		Browse
https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_cm&google_dbm&gdpr=0	0%	Virustotal		Browse
https://www.google.com/pagead/1p-conversion/16521530460/?gad_source=1&adview_type=5	0%	Virustotal		Browse
https://www.ookla.com/network	0%	Virustotal		Browse
https://pxl.iqm.com/i/ck/equativ?cid=SMART_USER_ID&redir=https%3A%2F%2Frtb-csync.smartadserver.com%2	0%	Virustotal		Browse
https://cm.adgrx.com/bridge?AG_PID=pubmatic&AG_SETCOOKIE&gdpr=0&gdpr_consent=	0%	Virustotal		Browse
https://www.speedtest.net/pl	0%	Virustotal		Browse
https://dictionary.cambridge.org	0%	Virustotal		Browse
https://sync.1rx.io/usersync2/pubmatic&gdpr=0&gdpr_consent=	0%	Virustotal		Browse
https://www.speedtest.net/apps/android	0%	Virustotal		Browse

Name	Source	Malicious	Antivirus Detection	Reputation
https://rtb.openx.net/sync/prebid?r=https%3A%2F%2Fu-ams03.e-planning.net%2Fum%3Fdc%3Dff96d1aa62deeeb	chromecache_662.1.dr	false	0%, Virustotal, Browse	unknown
https://ad.360yield.com/ux?&publisher_dmp_id=15&r=https%3A%2F%2Fids.ad.gt%2Fapi%2Fv1%2Fimpr_match%3F	chromecache_989.1.dr, chromecache_1002.1.dr	false	0%, Virustotal, Browse	unknown
https://stats.g.doubleclick.net/g/collect	chromecache_516.1.dr, chromecache_639.1.dr, chromecache_609.1.dr, chromecache_457.1.dr	false	URL Reputation: safe URL Reputation: safe	unknown
https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?&p=12186&endpoint=eu	chromecache_662.1.dr	false	0%, Virustotal, Browse	unknown
https://www.merriam-webster.com/thesaurus/test	chromecache_878.1.dr	false	0%, Virustotal, Browse	unknown
https://www.speedtest.net/images/share-logo.png	chromecache_755.1.dr	false	0%, Virustotal, Browse	unknown
https://x.bidswitch.net/sync?ssp=eplanning	chromecache_662.1.dr	false	0%, Virustotal, Browse	unknown
https://cdn.ziffstatic.com/ajs.php?id=a	chromecache_575.1.dr, chromecache_520.1.dr	false	0%, Virustotal, Browse	unknown
https://ids.ad.gt/api/v1/g_hosted?id=	chromecache_989.1.dr, chromecache_1002.1.dr	false	0%, Virustotal, Browse	unknown
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm	chromecache_742.1.dr	false	0%, Virustotal, Browse	unknown
https://ipac.ctnsnet.com/int/cm?exc=14&redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR	chromecache_465.1.dr, chromecache_677.1.dr	false	0%, Virustotal, Browse	unknown
https://x.bidswitch.net/syncd?dsp_id=16&user_group=1&gdpr=0&redir=https%3A%2F%2Fcm.g.doubleclick.net	chromecache_521.1.dr	false		unknown
https://www.ziffdavis.com/cookie-policy	chromecache_537.1.dr	false	0%, Virustotal, Browse	unknown
https://ampcid.google.com/v1/publisher:getClientId	chromecache_679.1.dr, chromecache_799.1.dr	false	URL Reputation: safe	unknown
https://ups.analytics.yahoo.com/ups/58294/sync?_origin=1&uid=a5b52a0f-a1a7-4c16-acbc-930e2162ecf3	chromecache_686.1.dr	false		unknown
https://aax-eu.amazon-adsystem.com/s/iu3?cm3ppd=1&d=dtb-pub&csif=t&dl=n-sharethrough_n-onetag_ppt_rx	chromecache_907.1.dr, chromecache_364.1.dr	false		unknown
https://www.speedtest.net/ru	chromecache_755.1.dr	false	0%, Virustotal, Browse	unknown
https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_sc	chromecache_892.1.dr	false	0%, Virustotal, Browse	unknown
https://www.merriam-webster.com/thesaurus/test&ved=2ahUKEwjF06LN9OyIAxVw8bsIHWtkKZMQ0gIoAHoECBYQ	chromecache_878.1.dr	false		unknown
https://www.speedtest.net/zh-Hant	chromecache_755.1.dr	false	0%, Virustotal, Browse	unknown
https://ib.adnxs.com/getuid?https%3A%2F%2Fssp.api.tappx.com%2Fcs%2Fusync%3Fidmn%3D32%26type%3Diframe	chromecache_475.1.dr	false	0%, Virustotal, Browse	unknown
https://www.speedtest.net/zh-Hans	chromecache_755.1.dr	false	0%, Virustotal, Browse	unknown
https://opt-out.ziffdavis.com/local-optout	chromecache_575.1.dr, chromecache_520.1.dr	false	0%, Virustotal, Browse	unknown
https://d.turn.com/r/dd/id/L2NzaWQvMS9jaWQvMTc0ODI0MTY1OC90LzA/url/https%3A%2F%2Fids.ad.gt%2Fapi%2Fv	chromecache_989.1.dr, chromecache_1002.1.dr	false	0%, Virustotal, Browse	unknown
https://github.com/conversant/pubcid.js/blob/master/LICENSE	chromecache_1064.1.dr, chromecache_1063.1.dr	false	0%, Virustotal, Browse	unknown
https://dpm.demdex.net/ibs:dpid=348447&dpuuid=	chromecache_989.1.dr, chromecache_1002.1.dr	false	0%, Virustotal, Browse	unknown
https://stats.g.doubleclick.net/j/collect	chromecache_799.1.dr	false	URL Reputation: safe	unknown
https://www.speedtest.net/ar	chromecache_755.1.dr	false	0%, Virustotal, Browse	unknown
https://matching.truffle.bid/sync/pub?sid=161&suid=https://simage2.pubmatic.com/AdServer/Pug?vcode=b	chromecache_465.1.dr, chromecache_677.1.dr	false	0%, Virustotal, Browse	unknown
https://creativecdn.com/cm-notify?pi=pubmatic&gdpr=0&gdpr_consent=	chromecache_465.1.dr, chromecache_926.1.dr	false	0%, Virustotal, Browse	unknown
https://aax-eu.amazon-adsystem.com/s/iu3?cm3ppd=1&d=dtb-pub&csif=t&dl=n-index_rx_n-MediaNet_ox-db5_n	chromecache_582.1.dr, chromecache_697.1.dr	false		unknown
https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_cm&google_dbm&gdpr=0	chromecache_521.1.dr	false	0%, Virustotal, Browse	unknown
https://cookies.nextmillmedia.com/sync?type=image&gdpr=	chromecache_662.1.dr	false	0%, Virustotal, Browse	unknown
https://cm.adgrx.com/bridge?AG_PID=pubmatic&AG_SETCOOKIE&gdpr=0&gdpr_consent=	chromecache_465.1.dr, chromecache_677.1.dr	false	0%, Virustotal, Browse	unknown
https://pxl.iqm.com/i/ck/equativ?cid=SMART_USER_ID&redir=https%3A%2F%2Frtb-csync.smartadserver.com%2	chromecache_800.1.dr	false	0%, Virustotal, Browse	unknown
https://www.google.com/pagead/1p-conversion/16521530460/?gad_source=1&adview_type=5	chromecache_878.1.dr	false	0%, Virustotal, Browse	unknown
https://www.ookla.com/network	chromecache_755.1.dr	false	0%, Virustotal, Browse	unknown
https://sync.1rx.io/usersync2/pubmatic&gdpr=0&gdpr_consent=	chromecache_465.1.dr, chromecache_677.1.dr	false	0%, Virustotal, Browse	unknown
https://www.speedtest.net/apps/android	chromecache_878.1.dr	false	0%, Virustotal, Browse	unknown
https://dsp-ap.eskimi.com/pixelGet?ex=50&gdpr=	chromecache_465.1.dr, chromecache_926.1.dr	false	URL Reputation: safe	unknown
https://play.google.com/store/apps/details?id=org.zwanoo.android.speedtest&referrer=utm_source%3Dstn	chromecache_743.1.dr, chromecache_537.1.dr	false		unknown
https://www.speedtest.net/pl	chromecache_755.1.dr	false	0%, Virustotal, Browse	unknown
https://dictionary.cambridge.org	chromecache_878.1.dr	false	0%, Virustotal, Browse	unknown
https://dsp-cookie.adfarm1.adition.com/?ssp=9&gdpr=0&gdpr_consent=	chromecache_465.1.dr, chromecache_926.1.dr	false	URL Reputation: safe	unknown
https://aax-eu.amazon-adsystem.com/s/ecm3?ex=tappx.com&id=c2d39274-f47c-4e2f-9106-bb075c7641b2f1a	chromecache_475.1.dr	false		unknown
https://www.16personalities.com/free-personality-test	chromecache_878.1.dr	false		unknown
https://www.speedtest.net/apps&ved=2ahUKEwjF06LN9OyIAxVw8bsIHWtkKZMQ0gIoAXoECBUQAg	chromecache_878.1.dr	false		unknown
https://bh.contextweb.com/bh/rtset?pid=562316&ev=1&rurl=https://ids.ad.gt/api/v1/ppnt_match?uid=%%VG	chromecache_989.1.dr, chromecache_1002.1.dr	false		unknown
https://github.com/pure-css/pure/blob/master/LICENSE	chromecache_482.1.dr	false		unknown
https://implicit.harvard.edu	chromecache_878.1.dr	false		unknown
https://match.adsrvr.org/track/cmf/generic?ttd_pid=8gkxb6n&ttd_tpi=1&ttd_puid=	chromecache_989.1.dr, chromecache_1002.1.dr	false		unknown
https://sync.teads.tv/um?eid=3&uid=&fb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dtea	chromecache_1059.1.dr	false		unknown
https://p.ad.gt	chromecache_1004.1.dr	false		unknown
https://ups.analytics.yahoo.com/ups/58292/sync?_origin=1&uid=F4BF7411-0F55-464D-80DD-0D8D7374E039&re	chromecache_699.1.dr	false		unknown
https://match.sharethrough.com/universal/v1?supply_id=49574e61&gdpr=0&gdpr_consent=&tappx=1	chromecache_475.1.dr	false		unknown
https://securepubads.g.doubleclick.net/pagead/js/cocar.js	chromecache_526.1.dr	false		unknown
https://ads.us.e-planning.net/uspd/1/5165e75550a79751?ruimd=1&du=https%3A%2F%2Fssp.api.tappx.com%2Fc	chromecache_475.1.dr	false		unknown
https://green.erne.co/pubmatic/cm?gdpr=0&gdpr_consent=	chromecache_465.1.dr, chromecache_677.1.dr	false		unknown
https://www.speedtest.net/pt	chromecache_755.1.dr	false		unknown
https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=tappx&endpoint=us-east	chromecache_475.1.dr	false		unknown
https://www.cloudflare.com/5xx-error-landing	chromecache_970.1.dr, chromecache_430.1.dr	false		unknown
https://token.rubiconproject.com/token?pid=50242&puid=	chromecache_989.1.dr, chromecache_1002.1.dr	false		unknown
https://b.cdnst.net/images/favicon-192.png	chromecache_817.1.dr	false		unknown
https://greensock.com/standard-license	chromecache_447.1.dr, chromecache_1113.1.dr	false	URL Reputation: safe	unknown
https://core.iprom.net/cookiesync?gdpr=0&gdpr_consent=	chromecache_465.1.dr, chromecache_677.1.dr	false		unknown
https://match.adsrvr.org/track/cmf/openx?oxid=8b71a986-79cd-765f-ff9b-5204b6c1189a&gdpr=0	chromecache_892.1.dr	false		unknown
https://cms.quantserve.com/pixel/p-5aWVS_roA1dVM.gif?idmatch=0&gdpr=0&gdpr_consent=	chromecache_699.1.dr	false		unknown
https://sync.richaudience.com/f7872c90c5d3791e2b51f7edce1a0a5d/?p=skJudSCZ30&r=https%3A%2F%2Fssp.api	chromecache_475.1.dr	false		unknown
https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpix	chromecache_742.1.dr	false		unknown
https://onetag-sys.com/match/?int_id=180&uid=	chromecache_989.1.dr, chromecache_1002.1.dr	false		unknown
https://pr-bh.ybp.yahoo.com/sync/openx/1fb6cfc2-e961-e416-ce4c-44f14996d5d3?gdpr=0	chromecache_892.1.dr	false		unknown
https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_cm&google_dbm&gdpr=0	chromecache_915.1.dr	false		unknown
https://www.merriam-webster.com/dictionary/litmus%20test	chromecache_878.1.dr	false		unknown
https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_cm&google_dbm	chromecache_1059.1.dr	false		unknown
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM3MDcmdGw9MjAxNjA=&piggybackCoo	chromecache_465.1.dr, chromecache_926.1.dr	false	URL Reputation: safe	unknown
https://www.16personalities.com/infj-personality&ved=2ahUKEwjF06LN9OyIAxVw8bsIHWtkKZMQ0gIoAXoECD	chromecache_878.1.dr	false		unknown
https://www.merriam-webster.com/dictionary/Bechdel%20Test	chromecache_878.1.dr	false		unknown
https://sb.scorecardresearch.com/b?c1=2&c2=	chromecache_1109.1.dr, chromecache_368.1.dr	false		unknown
https://cm.g.doubleclick.net/pixel?google_nid=tremor_video_dbm&google_cm&google_dbm	chromecache_650.1.dr	false		unknown
https://cdn.cookielaw.org/scripttemplates/otSDKStub.js	chromecache_575.1.dr, chromecache_520.1.dr	false	URL Reputation: safe	unknown
https://ssc-cms.33across.com/ps/?m=xch&rt=html&id=0010b00001siQHqAAM&ru=https%3A%2F%2Fssp.api.tappx.	chromecache_475.1.dr	false		unknown
https://sync.admanmedia.com/pbs.gif?redir=https%3A%2F%2Fu-ams03.e-planning.net%2Fum%3Fdc%3D9937b3fd6	chromecache_662.1.dr	false		unknown
https://prebid.a-mo.net/cchain/0?gdpr=	chromecache_662.1.dr	false		unknown
https://www.speedtest.net/nl	chromecache_755.1.dr	false		unknown
https://sync.search.spotxchange.com/partner?adv_id=7025&redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fp	chromecache_650.1.dr	false		unknown
https://gum.criteo.com/sid/json?origin=prebid	chromecache_957.1.dr, chromecache_897.1.dr	false		unknown
https://sync.srv.stackadapt.com/sync?nid=lotame&gdpr=0	chromecache_654.1.dr	false		unknown
https://sync.1rx.io/usersync2/rmphb?gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fssp.api.tappx.com%2Fcs%	chromecache_475.1.dr	false		unknown
https://github.com/blueimp/JavaScript-MD5	chromecache_667.1.dr, chromecache_376.1.dr	false		unknown
https://easylist.to/	chromecache_537.1.dr	false		unknown
https://googleads.g.doubleclick.net/	chromecache_890.1.dr, chromecache_342.1.dr	false		unknown
https://sync.adotmob.com/cookie/smart?r=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%	chromecache_800.1.dr	false		unknown
https://www.google.com/interests/saved	chromecache_551.1.dr, chromecache_548.1.dr	false		unknown
https://www.google.com/log?format=json&hasfast=true	chromecache_551.1.dr, chromecache_548.1.dr	false		unknown
https://lens.google.com	chromecache_551.1.dr, chromecache_548.1.dr	false	URL Reputation: safe	unknown
https://cdn.hadronid.net/hadron.js	chromecache_412.1.dr, chromecache_611.1.dr	false		unknown
https://ad.doubleclick.net/	chromecache_890.1.dr, chromecache_342.1.dr	false		unknown
https://github.com/google/safevalues/issues	chromecache_890.1.dr, chromecache_526.1.dr, chromecache_342.1.dr	false		unknown
https://www.speedtest.net/apps	chromecache_878.1.dr	false		unknown
https://cm-supply-web.gammaplatform.com/adx/usersyncsupply?pid=7&t=pixel	chromecache_465.1.dr, chromecache_677.1.dr	false		unknown

IP	Domain	Country	ASN	ASN Name	Malicious
45.130.86.29	unknown	United Kingdom	1299	TELIANETTeliaCarrierEU	false
142.250.74.206	unknown	United States	15169	GOOGLEUS	false
91.228.74.200	unknown	United Kingdom	27281	QUANTCASTUS	false
63.224.243.204	unknown	United States	209	CENTURYLINK-US-LEGACY-QWESTUS	false
104.18.34.214	unknown	United States	13335	CLOUDFLARENETUS	false
99.80.51.253	unknown	United States	16509	AMAZON-02US	false
52.23.3.73	unknown	United States	14618	AMAZON-AESUS	false
52.4.129.193	unknown	United States	14618	AMAZON-AESUS	false
52.210.91.197	unknown	United States	16509	AMAZON-02US	false
185.89.210.20	unknown	Germany	29990	ASN-APPNEXUS	false
54.154.40.84	unknown	United States	16509	AMAZON-02US	false
52.31.202.74	unknown	United States	16509	AMAZON-02US	false
65.9.66.97	unknown	United States	16509	AMAZON-02US	false
198.47.127.205	unknown	United States	62713	AS-PUBMATICUS	false
104.17.148.22	unknown	United States	13335	CLOUDFLARENETUS	false
35.71.131.137	unknown	United States	237	MERIT-AS-14US	false
65.9.66.104	unknown	United States	16509	AMAZON-02US	false
204.79.197.237	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
34.254.143.3	unknown	United States	16509	AMAZON-02US	false
35.214.199.88	unknown	United States	19527	GOOGLE-2US	false
172.217.18.8	unknown	United States	15169	GOOGLEUS	false
104.22.53.173	unknown	United States	13335	CLOUDFLARENETUS	false
74.125.133.84	unknown	United States	15169	GOOGLEUS	false
172.217.18.6	unknown	United States	15169	GOOGLEUS	false
142.250.185.110	unknown	United States	15169	GOOGLEUS	false
172.217.18.2	unknown	United States	15169	GOOGLEUS	false
13.33.173.196	unknown	United States	16509	AMAZON-02US	false
107.178.254.65	unknown	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
54.194.192.48	unknown	United States	16509	AMAZON-02US	false
34.243.210.180	unknown	United States	16509	AMAZON-02US	false
134.122.57.34	unknown	United States	14061	DIGITALOCEAN-ASNUS	false
18.159.212.21	unknown	United States	16509	AMAZON-02US	false
3.229.202.201	unknown	United States	14618	AMAZON-AESUS	false
23.88.86.2	unknown	United States	18978	ENZUINC-US	false
18.245.60.110	unknown	United States	16509	AMAZON-02US	false
5.135.209.105	unknown	France	16276	OVHFR	false
95.101.149.233	unknown	European Union	20940	AKAMAI-ASN1EU	false
142.250.185.206	unknown	United States	15169	GOOGLEUS	false
18.245.31.92	unknown	United States	16509	AMAZON-02US	false
3.74.73.187	unknown	United States	16509	AMAZON-02US	false
142.250.186.130	unknown	United States	15169	GOOGLEUS	false
37.157.6.231	unknown	Denmark	198622	ADFORMDK	false
34.90.215.194	unknown	United States	15169	GOOGLEUS	false
208.93.169.131	unknown	United States	26228	SERVEPATHUS	false
35.214.156.26	unknown	United States	19527	GOOGLE-2US	false
216.58.206.35	unknown	United States	15169	GOOGLEUS	false
162.19.138.120	unknown	United States	209	CENTURYLINK-US-LEGACY-QWESTUS	false
151.101.194.219	unknown	United States	54113	FASTLYUS	false
35.204.77.129	unknown	United States	15169	GOOGLEUS	false
18.172.112.109	unknown	United States	3	MIT-GATEWAYSUS	false
52.215.155.11	unknown	United States	16509	AMAZON-02US	false
185.89.210.46	unknown	Germany	29990	ASN-APPNEXUS	false
54.87.157.158	unknown	United States	14618	AMAZON-AESUS	false
104.22.4.69	unknown	United States	13335	CLOUDFLARENETUS	false
178.250.1.9	unknown	France	44788	ASN-CRITEO-EUROPEFR	false
35.186.154.107	unknown	United States	15169	GOOGLEUS	false
18.66.112.27	unknown	United States	3	MIT-GATEWAYSUS	false
178.250.1.3	unknown	France	44788	ASN-CRITEO-EUROPEFR	false
18.172.112.84	unknown	United States	3	MIT-GATEWAYSUS	false
24.29.97.13	unknown	United States	12271	TWC-12271-NYCUS	false
34.102.163.6	unknown	United States	15169	GOOGLEUS	false
142.250.181.227	unknown	United States	15169	GOOGLEUS	false
142.250.181.225	unknown	United States	15169	GOOGLEUS	false
34.204.184.124	unknown	United States	14618	AMAZON-AESUS	false
104.22.50.98	unknown	United States	13335	CLOUDFLARENETUS	false
35.204.91.170	unknown	United States	15169	GOOGLEUS	false
57.129.39.243	unknown	Belgium	2686	ATGS-MMD-ASUS	false
172.217.16.130	unknown	United States	15169	GOOGLEUS	false
162.19.138.118	unknown	United States	209	CENTURYLINK-US-LEGACY-QWESTUS	false
18.198.84.9	unknown	United States	16509	AMAZON-02US	false
52.73.131.117	unknown	United States	14618	AMAZON-AESUS	false
46.228.174.117	unknown	United Kingdom	56396	TURNGB	false
34.238.62.66	unknown	United States	14618	AMAZON-AESUS	false
104.17.147.22	unknown	United States	13335	CLOUDFLARENETUS	false
162.19.138.116	unknown	United States	209	CENTURYLINK-US-LEGACY-QWESTUS	false
37.252.171.21	unknown	European Union	29990	ASN-APPNEXUS	false
213.180.193.90	unknown	Russian Federation	13238	YANDEXRU	false
35.190.0.66	unknown	United States	15169	GOOGLEUS	false
52.215.101.103	unknown	United States	16509	AMAZON-02US	false
18.66.112.19	unknown	United States	3	MIT-GATEWAYSUS	false
35.214.174.141	unknown	United States	19527	GOOGLE-2US	false
151.101.193.108	unknown	United States	54113	FASTLYUS	false
104.18.37.193	unknown	United States	13335	CLOUDFLARENETUS	false
13.32.99.20	unknown	United States	16509	AMAZON-02US	false
103.67.200.72	unknown	United States	7575	AARNET-AS-APAustralianAcademicandResearchNetworkAARNe	false
3.125.70.222	unknown	United States	16509	AMAZON-02US	false
172.64.153.42	unknown	United States	13335	CLOUDFLARENETUS	false
209.254.101.138	unknown	United States	7029	WINDSTREAMUS	false
3.160.150.74	unknown	United States	16509	AMAZON-02US	false
63.215.202.137	unknown	United States	41041	VCLK-EU-SE	false
104.102.34.86	unknown	United States	16625	AKAMAI-ASUS	false
45.137.176.88	unknown	Spain	60350	VPFR	false
2.23.197.190	unknown	European Union	1273	CWVodafoneGroupPLCEU	false
37.157.5.132	unknown	Denmark	198622	ADFORMDK	false
142.250.185.142	unknown	United States	15169	GOOGLEUS	false
104.17.208.58	unknown	United States	13335	CLOUDFLARENETUS	false
154.54.250.80	unknown	United States	26558	FREEWHEELUS	false
69.173.146.5	unknown	United States	26667	RUBICONPROJECTUS	false
154.54.250.81	unknown	United States	26558	FREEWHEELUS	false

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1523273
Start date and time:	2024-10-01 11:51:34 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 39s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Sample URL:	https://secure-tracking-support.de/ch/?c=002918883
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	CLEAN
Classification:	clean3.win@89/1236@0/100
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0

Input	Output
URL: https://www.speedtest.net/ Model: jbxai	{ "brand":["SPEEDTEST"], "contains_trigger_text":false, "trigger_text":"", "prominent_button_name":"Create an Account", "text_input_field_labels":"unknown", "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://www.speedtest.net/ Model: jbxai	{ "brand":["SPEEDTEST", "ZIFF DAVIS", "OOKLA\\u00ae BRANDS"], "contains_trigger_text":false, "trigger_text":"", "prominent_button_name":"unknown", "text_input_field_labels":"unknown", "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://www.speedtest.net/ Model: jbxai	{ "brand":["SPEEDTEST"], "contains_trigger_text":false, "trigger_text":"", "prominent_button_name":"Create an Account", "text_input_field_labels":"unknown", "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://secure-tracking-support.de/ch/?c=002918883 Model: jbxai	{ "brand":[], "contains_trigger_text":true, "trigger_text":"You are unable to access secure-tracking-support.de", "prominent_button_name":"unknown", "text_input_field_labels":"unknown", "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://secure-tracking-support.de/ch/?c=002918883 Model: jbxai	{ "brand":[], "contains_trigger_text":true, "trigger_text":"You are unable to access secure-tracking-support.de", "prominent_button_name":"unknown", "text_input_field_labels":"unknown", "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://www.speedtest.net/ Model: jbxai	{ "brand":["SPEEDTEST"], "contains_trigger_text":false, "trigger_text":"", "prominent_button_name":"Create an Account", "text_input_field_labels":"unknown", "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://www.speedtest.net/ Model: jbxai	{ "brand":["SPEEDTEST"], "contains_trigger_text":false, "trigger_text":"", "prominent_button_name":"Create an Account", "text_input_field_labels":"unknown", "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://www.speedtest.net/ Model: jbxai	{ "brand":["SPEEDTEST"], "contains_trigger_text":false, "trigger_text":"", "prominent_button_name":"Create an Account", "text_input_field_labels":"unknown", "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://www.speedtest.net/ Model: jbxai	{ "brand":["CenturyLink", "Surfshark Ltd"], "contains_trigger_text":false, "trigger_text":"", "prominent_button_name":"Create an Account", "text_input_field_labels":"unknown", "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://www.speedtest.net/ Model: jbxai	{ "brand":["CenturyLink", "Surfshark Ltd"], "contains_trigger_text":false, "trigger_text":"", "prominent_button_name":"Create an Account", "text_input_field_labels":"unknown", "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://www.speedtest.net/ Model: jbxai	{ "brand":["CenturyLink", "Surfshark Ltd"], "contains_trigger_text":false, "trigger_text":"", "prominent_button_name":"Create an Account", "text_input_field_labels":"unknown", "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://www.speedtest.net/ Model: jbxai	{ "brand":["T-Mobile", "Apple"], "contains_trigger_text":true, "trigger_text":"GET IT TODAY", "prominent_button_name":"Create an Account", "text_input_field_labels":["Create an Account"], "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://www.speedtest.net/ Model: jbxai	{ "brand":["CenturyLink", "Surfshark Ltd"], "contains_trigger_text":false, "trigger_text":"", "prominent_button_name":"Create an Account", "text_input_field_labels":"unknown", "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://www.speedtest.net/ Model: jbxai	{ "brand":["T-Mobile"], "contains_trigger_text":true, "trigger_text":"GET IT TODAY", "prominent_button_name":"Create an Account", "text_input_field_labels":["Create an Account", "Results History"], "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":true, "has_visible_qrcode":false}

URL: https://www.speedtest.net/ Model: jbxai	{ "brand":["T-Mobile", "Apple"], "contains_trigger_text":true, "trigger_text":"GET IT TODAY ON US", "prominent_button_name":"Create an Account", "text_input_field_labels":["Create an Account"], "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://www.speedtest.net/ Model: jbxai	{ "brand":["T-Mobile"], "contains_trigger_text":true, "trigger_text":"ON US", "prominent_button_name":"Create an Account", "text_input_field_labels":["Create an Account", "Results History"], "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://www.speedtest.net/ Model: jbxai	{ "brand":["T-Mobile"], "contains_trigger_text":true, "trigger_text":"OVER $1500 IN ANNUAL BENEFITS.", "prominent_button_name":"Create an Account", "text_input_field_labels":["Create an Account"], "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://www.speedtest.net/ Model: jbxai	{ "brand":["T-Mobile"], "contains_trigger_text":true, "trigger_text":"ON US", "prominent_button_name":"Create an Account", "text_input_field_labels":["Create an Account", "Results History"], "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://www.speedtest.net/ Model: jbxai	{ "brand":["T-Mobile"], "contains_trigger_text":true, "trigger_text":"OVER $1500 IN ANNUAL BENEFITS.", "prominent_button_name":"Create an Account", "text_input_field_labels":["Create an Account"], "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://www.speedtest.net/ Model: jbxai	{ "brand":["T-Mobile"], "contains_trigger_text":true, "trigger_text":"THIS IS GETTING MORE, ALL ON US", "prominent_button_name":"Create an Account", "text_input_field_labels":["CenturyLink", "Surfshark Ltd"], "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":true, "has_visible_qrcode":false}

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Oct 1 08:52:06 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2673
Entropy (8bit):	3.98166781871271
Encrypted:	false
SSDEEP:	48:8KdoQTI01bVHgidAKZdA1FehwiZUklqeh1y+3:8QbAey
MD5:	9F31AAA03C488E2B3166746C8AB7D851
SHA1:	2314FBC2B6C88BFC280902C541121C27A9440713
SHA-256:	711CAB86F37DF13BFCF0D77B3196AE64E715BF2D6F8C9AE8D44489C8F40AC4A9
SHA-512:	8BD4C4706BEEB8B23CBEB7FDADE397A8324D3122CEA315278D4460366DC5BC8B787FD2DE5712AD7BDD37BF871986E2C3EAD859F645E35ECBD086BA5ABC735AA9
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,......0.....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IAYxN....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VAY.N....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VAY.N....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VAY.N..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VAY.N...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............hq......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Oct 1 08:52:06 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2675
Entropy (8bit):	3.9960680621936824
Encrypted:	false
SSDEEP:	48:8gdoQTI01bVHgidAKZdA1seh/iZUkAQkqehOy+2:8GbW9QLy
MD5:	4893198AC86612317FA0BF6444D2BB09
SHA1:	E6EB93CD8CC6500EAAECA7DE9EFC5DEBD7934609
SHA-256:	CBC4371D617452FAAD82B0069952B97EA589BC62DFB13822EA1293F1442D8AB2
SHA-512:	FD2799D5338895F45544D3AB568D11E2C2CC892A30D4C27B86C5DCB353C1CFD0834D9DBF7A122B0F8970AF34309AC311F63603D0AAA124188FD534EEA4EF8297
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,......#.....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IAYxN....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VAY.N....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VAY.N....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VAY.N..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VAY.N...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............hq......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Target ID:	0
Start time:	05:52:03
Start date:	01/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff7f9810000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	2
Start time:	05:52:04
Start date:	01/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://secure-tracking-support.de/ch/?c=002918883"
Imagebase:	0x7ff7f9810000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	11
Start time:	05:53:05
Start date:	01/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3592 --field-trial-handle=1892,i,14550875244211589576,9012345206392933397,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff7f9810000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://secure-tracking-support.de/ch/?c=002918883

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Boot Survival

Malware Analysis System Evasion

Anti Debugging

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Chrome Cache Entry: 1000

Chrome Cache Entry: 1001

Chrome Cache Entry: 1002

Chrome Cache Entry: 1003

Chrome Cache Entry: 1004

Chrome Cache Entry: 1005

Chrome Cache Entry: 1006

Chrome Cache Entry: 1007

Chrome Cache Entry: 1008

Chrome Cache Entry: 1009

Chrome Cache Entry: 1010

Chrome Cache Entry: 1011

Chrome Cache Entry: 1012

Chrome Cache Entry: 1013

Chrome Cache Entry: 1014

Chrome Cache Entry: 1015

Chrome Cache Entry: 1016

Chrome Cache Entry: 1017

Chrome Cache Entry: 1018

Chrome Cache Entry: 1019

Chrome Cache Entry: 1020

Windows Analysis Report
https://secure-tracking-support.de/ch/?c=002918883