Windows Analysis Report
https://url.uk.m.mimecastprotect.com/s/p9wVCXBDigoJJS6f7CWGkad?domain=ouakninelegal-my.sharepoint.com

Overview

General Information

Sample URL:	https://url.uk.m.mimecastprotect.com/s/p9wVCXBDigoJJS6f7CWGkad?domain=ouakninelegal-my.sharepoint.com
Analysis ID:	1524241
Infos:

Detection

Score:	2
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Detected non-DNS traffic on DNS port

HTML body contains low number of good links

HTML title does not match URL

Stores files to the Windows start menu directory

Submit button contains javascript call

Classification

Signatures

HTML body contains low number of good links

Source: https://ouakninelegal-my.sharepoint.com/:o:/g/personal/elisabeth_ouakninelegal_ca/EmqBVPVvWZJPmAegR7MbWQoBK84JXk9jPvROW6zOsaUoTw?e=5%3ajmYUjO&at=9

HTTP Parser: Number of links: 0

HTML title does not match URL

Source: https://ouakninelegal-my.sharepoint.com/:o:/g/personal/elisabeth_ouakninelegal_ca/EmqBVPVvWZJPmAegR7MbWQoBK84JXk9jPvROW6zOsaUoTw?e=5%3ajmYUjO&at=9

HTTP Parser: Title: Sharing Link Validation does not match URL

Submit button contains javascript call

Source: https://ouakninelegal-my.sharepoint.com/:o:/g/personal/elisabeth_ouakninelegal_ca/EmqBVPVvWZJPmAegR7MbWQoBK84JXk9jPvROW6zOsaUoTw?e=5%3ajmYUjO&at=9

HTTP Parser: On click: javascript:WebForm_DoPostBackWithOptions(new WebForm_PostBackOptions("btnSubmitEmail", "", true, "", "", false, true))

Source: https://ouakninelegal-my.sharepoint.com/:o:/g/personal/elisabeth_ouakninelegal_ca/EmqBVPVvWZJPmAegR7MbWQoBK84JXk9jPvROW6zOsaUoTw?e=5%3ajmYUjO&at=9

HTTP Parser: No <meta name="author".. found

Source: https://ouakninelegal-my.sharepoint.com/:o:/g/personal/elisabeth_ouakninelegal_ca/EmqBVPVvWZJPmAegR7MbWQoBK84JXk9jPvROW6zOsaUoTw?e=5%3ajmYUjO&at=9

HTTP Parser: No <meta name="copyright".. found

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.8:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.8:49728 version: TLS 1.2

Detected non-DNS traffic on DNS port

Source: global traffic

TCP traffic: 192.168.2.8:58443 -> 1.1.1.1:53

Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /s/p9wVCXBDigoJJS6f7CWGkad?domain=ouakninelegal-my.sharepoint.com HTTP/1.1Host: url.uk.m.mimecastprotect.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /r/0R1m48Tzb1Q0D0KK5UBysaN3hg_s33vGp3gIfwyDrnon_BzEGOLqUl7SE_z2ATPbFdovSuF88NouIjn1r_3AUxZfAIeKqLftxKz97o9x5YgTozN7dKxMy8G7be9g4NYO3SJotb4sPIWR3dwfP0YqqZmnR-LF7ewi6hgOCwZaXG_6NQj8qFGdUuL-ynr3IkH9O6yFF2VZiErOKszwInFki4sy59mRDCPKpBfW2GjauOUj3WGoGhT12c6Ej4wKWwtz9uFb7cRoPrCfkeKC7YmHRXnASq9IUOmMlWHp_ny8nbIAn7sAOkFi_EfhykfDhrpa06HA_8p73b7VhXYOINDmUNj8Fg-jMVdSG-a2On5BovbggS6os6OacaztqSmIGXJgMufeq4B156NPGZRyBGX8gfaixiy_QJQ05UfmhSkf4KFWbJD_tiLukn1D3lA6HKcG9SXq2ctt1Ji1Xod8nsYL_Z4Zvnc-eu1ykouVDnNjXvt-aK2Olk_36azd4S80-dWeTHOcPPk8Eq_a8ECNDw7GBCNZH8qdFwgJIjlaXkDyoAgKi7QecU8sZwOQrQBzxdNNT4ykqNWcTNdF1s05fUZ-AvK0Rq6Uaqnb9wW1G5V6Ecle301Bmkt3O5mEWeBx8r0u0TeyG-HrzhyKaExrdAD0zKfbzsPp0wSjW4QMAQzsMbr5bPidv_m5843ndvaxeZWaBo3yu01U5x-rV2h-SRmSPC3cUyNoTnMtl2i3vSArH1Hwu2J-5cl5v8J2bJ3wKtr6GKWi7VDiuqbjqXEyFBvw-aRWmiQ_8fd5_mYKgYz69b_tVU9J1CHLJ5AUjxb0F_u2FxFDZm7VFPspwd7FUfyU2JG3Z20yP2DNEFBRRVlxDlV7wf3_SgFaiwUttpbGNAy33YYkrGs8U3vFCtd8EmwytNAYticPk4cDIp-YzqmZpQm4Cyh3shXbdld_16XINuYzkmJ30sI6MFgxMZcV37smojb272ebF1Ivue5vnswPo9vaNqiF0xLaty7x8UgCypb1DxVv0k_1AP5iITBXGvuY5Yuw9WhDm5igeTiJHFU70kpQd_MOkrif-N7kdq9JCezie1gpeZ1kvNXmoW21RP7_ZRCLnAqouUpxGmDAijn53Cfng0-Y0YasgtV8lZLT_O2d2CFwW8ntxtt-8KGDx7zpM9PPlhQhEQP-lK560FPLM1UT_iSJ_dMr58ISZXeTw_rQenMjSkDyQf0_ClFaKgNJQgJO8FGdGYmJ0-2XN93WC2inviz-5qzHhtDdfv4s362KhfO-agKki400Ny_EIYAQOOcVvVMkTKBXPiIn_XZiUWXSKl-iz3p3Uu0ZE2S9sbP7VoGYNC0lGOMxv2LPvgJa5-9-UJwbfByEYWeS-uhnU_-dCAVTMkMueLNJoKi2AkkmDFAnzxiLPds04m9aum2PzFl3j7azLCnlEDOVgEXvkAl0Kp6c-nH8W-wIMXRgWzGS9fb382HuNp6qQ7VzsGR_S93ZvYidGvnCEm2HBB-7KM1jbPfGWUdycHwPKGLmPaebD3EyJw8nPTTbh4hsMUaD45gpjfkdPt0WavWNqdmp-EeByR-T16WC_UQfY1FwJFKyISk3ofYIs5E9KDJBA7PvW-6yCzV8ORwl4szA_BRazmcf6O8F1qIKQzAxmIt4-GQfFgXtbsNCSOBPYh43Xh6F6OGbO-bMc3BaOOzqCsBnDsCiaJAvKcRry6xeI-QInoBrLO5TI7mNix7EYxMDkRnaDKtHzB6MNiUCXc427v66zKF8d5vn6fgDrEXHbaCMm6FZDE7rsP4KrGhdhP0hqoKA2Pv835CrTS_bbgL-YjYAZOq27sGFVwSKHxdzLuC4GLKOpajiIxXTH9wTfx3GR4eBvwBkV7arD58i1I9ppR-v9gJKcyVI762gNJXcAusiUECZs5lKWpcZMSv52pFyHKfrmG0CGpnypppminiHkRcCtC0WniY9mvGD5yVZ64b8Xa5eHwo8a8H3oM74HyH2jDPeSkSzy-Nq0Xixf8JHueZFXayC0wRjAnVx35JhmhZakNznFMnEtqQ9L7k1JOUu8axKERX0BK7RB3H4o9itikVlLAvgCmWLCDBIDVKqlTEQ7wbqJlE4pR2e-fG_zYXEGx7on_CpW7zpVcaSiTImK4nJdE5kbWI1G1SlhGoXtwhNyVLBScXRxhCRxHVgHxz9idDaDk0QmIkGvCO_vUdcFqQrFm2Tvhp0yZns1hZ_2P5OvtiTS3_R6LM8nf-FLPTvYTMF7TnI7cM4SolqI4gdT9ApQfwuSM2_FdCFICNoTK8Qgs5xSRaWSgBtB2-_-aEHtkt9cNkSMR-MP_nDNxNw_R5UXojVHSnlgBaVlCU1EuKtDWCRaW_MIoFcLQr70v3bFCrSNddYXRcIzTWpkr4WMCSFfMU76ZC2MECulYsn5nfAkfMc1exuZNLeZLxP9gCaehT7PxJH_-7FwAyOOLXYim2OVvpdQb8LhWDadL7SnaoDAckfs8U-4cuovac9pVKCQnecN_f1sy208ciAQzy7C6gsTtMJRohEA5W81IRCSGxFhQqrd5R9L-NYrfhG1V8HplGUzd2E9rhKU5eOCewL_8SI3vylxNrep-p2m7Tr2s5Snk05gHbgumc9B4QOPWmTJJ7w2n7KvRfyJVpcqZQD05M8JhM HTTP/1.1Host: url.uk.m.mimecastprotect.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q
Source: global traffic	HTTP traffic detected: GET /:o:/g/personal/elisabeth_ouakninelegal_ca/EmqBVPVvWZJPmAegR7MbWQoBK84JXk9jPvROW6zOsaUoTw?e=5%3ajmYUjO&at=9 HTTP/1.1Host: ouakninelegal-my.sharepoint.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /WebResource.axd?d=qQ-tsNsY4mzceTE_EyU_iyYmxhBmhJQ11sIHbeZBeYWZ920rM_8XSM8h6w0d7nZzAqphgK7kxnUp1T49uzhq7d6T_lBlQDlyYG01kIVRFXs1&t=638611486345608193 HTTP/1.1Host: ouakninelegal-my.sharepoint.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://ouakninelegal-my.sharepoint.com/:o:/g/personal/elisabeth_ouakninelegal_ca/EmqBVPVvWZJPmAegR7MbWQoBK84JXk9jPvROW6zOsaUoTw?e=5%3ajmYUjO&at=9Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ScriptResource.axd?d=hJ44vuhbtoSZwKYpWYi2Os4fHRzb9eqVf-wdDuNmOlzwXf3aF3e-32cvUQ6qUscl1DefVS-9XQfsOH5bhkfGOW9rRadWFYNu7cBvGAXrUbhUh2e32G539sj0LZJzaXe4u09IYuWJMhNNxvvT-t99dvqbCwaUdbg47CJr44HW75Q1&t=ffffffffedc3492c HTTP/1.1Host: ouakninelegal-my.sharepoint.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://ouakninelegal-my.sharepoint.com/:o:/g/personal/elisabeth_ouakninelegal_ca/EmqBVPVvWZJPmAegR7MbWQoBK84JXk9jPvROW6zOsaUoTw?e=5%3ajmYUjO&at=9Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ScriptResource.axd?d=wmWRPBwCSCbXmH9wx4hANJPbt_WhqygGvO6NcEWl1oVpupqRi-ao3qQ3zmmEjMzOSNXEl_4NRPQKYeJ-beiVZKSI09JHBSVwjy8PMxTiiYnHsZJVp_eFqIAV0ipY5vU8HRJVFTUF072VuSPGT5fEb2bv8rIy2pQ1WMrY-t1l707a0mPuaNnzpPBWOhmeqRkT0&t=7a0cc936 HTTP/1.1Host: ouakninelegal-my.sharepoint.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://ouakninelegal-my.sharepoint.com/:o:/g/personal/elisabeth_ouakninelegal_ca/EmqBVPVvWZJPmAegR7MbWQoBK84JXk9jPvROW6zOsaUoTw?e=5%3ajmYUjO&at=9Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ScriptResource.axd?d=lLkI1JciGSXohcyoCrHUL3KfmlB_NcNkFjN62kxsxtXMxSbjKr_j5kBv1T1i38u6XGY9_Y1SXRtoAKy30iH7CXRXn0S3wcbALrMmHk9jxHGIr1SgGSD9-FBF30Ac-Mc0eHrWx2GQ88ktj6J1daJm6jTP0F4BiFJWWFBOg_UTCdqCw2iYHuVvlza9HVLVDZHS0&t=7a0cc936 HTTP/1.1Host: ouakninelegal-my.sharepoint.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://ouakninelegal-my.sharepoint.com/:o:/g/personal/elisabeth_ouakninelegal_ca/EmqBVPVvWZJPmAegR7MbWQoBK84JXk9jPvROW6zOsaUoTw?e=5%3ajmYUjO&at=9Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_layouts/15/images/microsoft-logo.png HTTP/1.1Host: ouakninelegal-my.sharepoint.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ouakninelegal-my.sharepoint.com/:o:/g/personal/elisabeth_ouakninelegal_ca/EmqBVPVvWZJPmAegR7MbWQoBK84JXk9jPvROW6zOsaUoTw?e=5%3ajmYUjO&at=9Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /_layouts/15/images/favicon.ico?rev=47 HTTP/1.1Host: ouakninelegal-my.sharepoint.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ouakninelegal-my.sharepoint.com/:o:/g/personal/elisabeth_ouakninelegal_ca/EmqBVPVvWZJPmAegR7MbWQoBK84JXk9jPvROW6zOsaUoTw?e=5%3ajmYUjO&at=9Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_layouts/15/images/microsoft-logo.png HTTP/1.1Host: ouakninelegal-my.sharepoint.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /WebResource.axd?d=qQ-tsNsY4mzceTE_EyU_iyYmxhBmhJQ11sIHbeZBeYWZ920rM_8XSM8h6w0d7nZzAqphgK7kxnUp1T49uzhq7d6T_lBlQDlyYG01kIVRFXs1&t=638611486345608193 HTTP/1.1Host: ouakninelegal-my.sharepoint.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ScriptResource.axd?d=wmWRPBwCSCbXmH9wx4hANJPbt_WhqygGvO6NcEWl1oVpupqRi-ao3qQ3zmmEjMzOSNXEl_4NRPQKYeJ-beiVZKSI09JHBSVwjy8PMxTiiYnHsZJVp_eFqIAV0ipY5vU8HRJVFTUF072VuSPGT5fEb2bv8rIy2pQ1WMrY-t1l707a0mPuaNnzpPBWOhmeqRkT0&t=7a0cc936 HTTP/1.1Host: ouakninelegal-my.sharepoint.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ScriptResource.axd?d=lLkI1JciGSXohcyoCrHUL3KfmlB_NcNkFjN62kxsxtXMxSbjKr_j5kBv1T1i38u6XGY9_Y1SXRtoAKy30iH7CXRXn0S3wcbALrMmHk9jxHGIr1SgGSD9-FBF30Ac-Mc0eHrWx2GQ88ktj6J1daJm6jTP0F4BiFJWWFBOg_UTCdqCw2iYHuVvlza9HVLVDZHS0&t=7a0cc936 HTTP/1.1Host: ouakninelegal-my.sharepoint.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ScriptResource.axd?d=hJ44vuhbtoSZwKYpWYi2Os4fHRzb9eqVf-wdDuNmOlzwXf3aF3e-32cvUQ6qUscl1DefVS-9XQfsOH5bhkfGOW9rRadWFYNu7cBvGAXrUbhUh2e32G539sj0LZJzaXe4u09IYuWJMhNNxvvT-t99dvqbCwaUdbg47CJr44HW75Q1&t=ffffffffedc3492c HTTP/1.1Host: ouakninelegal-my.sharepoint.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_layouts/15/images/favicon.ico?rev=47 HTTP/1.1Host: ouakninelegal-my.sharepoint.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: global traffic	DNS traffic detected: DNS query: url.uk.m.mimecastprotect.com
Source: global traffic	DNS traffic detected: DNS query: ouakninelegal-my.sharepoint.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: m365cdn.nel.measure.office.net

Source: chromecache_144.2.dr, chromecache_145.2.dr	String found in binary or memory: http://github.com/jrburke/requirejs
Source: chromecache_143.2.dr	String found in binary or memory: https://ouakninelegal-my.sharepoint.com/personal/elisabeth_ouakninelegal_ca/_layouts/15/images/256_i
Source: chromecache_146.2.dr, chromecache_151.2.dr	String found in binary or memory: https://reactjs.org/docs/error-decoder.html?invariant=
Source: chromecache_143.2.dr	String found in binary or memory: https://res-1.cdn.office.net
Source: chromecache_143.2.dr	String found in binary or memory: https://res-1.cdn.office.net/bld/_layouts/15/16.0.25311.12012/require.js
Source: chromecache_143.2.dr	String found in binary or memory: https://res-1.cdn.office.net/files/odsp-web-prod_2024-09-20.007/
Source: chromecache_143.2.dr	String found in binary or memory: https://res-2.cdn.office.net/files/odsp-web-prod_2024-09-20.007/
Source: chromecache_143.2.dr	String found in binary or memory: https://spoprod-a.akamaihd.net/files/odsp-common-library-prod_2019-02-15_20190219.002/require.js

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49676 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58447 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58447
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.8:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.8:49728 version: TLS 1.2

Source: classification engine

Classification label: clean2.win@22/34@10/7

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2252 --field-trial-handle=1860,i,14895830932961628612,13025139479554271904,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://url.uk.m.mimecastprotect.com/s/p9wVCXBDigoJJS6f7CWGkad?domain=ouakninelegal-my.sharepoint.com"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2252 --field-trial-handle=1860,i,14895830932961628612,13025139479554271904,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Stores files to the Windows start menu directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
13.107.136.10	dual-spo-0005.spo-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
91.220.42.63	url.uk.m.mimecastprotect.com	United Kingdom	42427	MIMECAST-UKGB	false
52.104.49.55	194291-ipv4v6.farm.dprodmgd105.aa-rt.sharepoint.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.250.186.100	www.google.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.8
192.168.2.10

Contacted Domains

Name	IP	Active
dual-spo-0005.spo-msedge.net	13.107.136.10	true
194291-ipv4v6.farm.dprodmgd105.aa-rt.sharepoint.com	52.104.49.55	true
url.uk.m.mimecastprotect.com	91.220.42.63	true
www.google.com	142.250.186.100	true
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	84.201.210.34	true
fp2e7a.wpc.phicdn.net	192.229.221.95	true
windowsupdatebg.s.llnwi.net	46.228.146.128	true
ouakninelegal-my.sharepoint.com	unknown	unknown
m365cdn.nel.measure.office.net	unknown	unknown

Contacted URLs

Name	Malicious	Reputation
https://ouakninelegal-my.sharepoint.com/ScriptResource.axd?d=hJ44vuhbtoSZwKYpWYi2Os4fHRzb9eqVf-wdDuNmOlzwXf3aF3e-32cvUQ6qUscl1DefVS-9XQfsOH5bhkfGOW9rRadWFYNu7cBvGAXrUbhUh2e32G539sj0LZJzaXe4u09IYuWJMhNNxvvT-t99dvqbCwaUdbg47CJr44HW75Q1&t=ffffffffedc3492c	false	unknown
https://ouakninelegal-my.sharepoint.com/WebResource.axd?d=qQ-tsNsY4mzceTE_EyU_iyYmxhBmhJQ11sIHbeZBeYWZ920rM_8XSM8h6w0d7nZzAqphgK7kxnUp1T49uzhq7d6T_lBlQDlyYG01kIVRFXs1&t=638611486345608193	false	unknown
https://ouakninelegal-my.sharepoint.com/ScriptResource.axd?d=lLkI1JciGSXohcyoCrHUL3KfmlB_NcNkFjN62kxsxtXMxSbjKr_j5kBv1T1i38u6XGY9_Y1SXRtoAKy30iH7CXRXn0S3wcbALrMmHk9jxHGIr1SgGSD9-FBF30Ac-Mc0eHrWx2GQ88ktj6J1daJm6jTP0F4BiFJWWFBOg_UTCdqCw2iYHuVvlza9HVLVDZHS0&t=7a0cc936	false	unknown
https://ouakninelegal-my.sharepoint.com/_layouts/15/images/microsoft-logo.png	false	unknown
https://ouakninelegal-my.sharepoint.com/:o:/g/personal/elisabeth_ouakninelegal_ca/EmqBVPVvWZJPmAegR7MbWQoBK84JXk9jPvROW6zOsaUoTw?e=5%3ajmYUjO&at=9	false	unknown
https://url.uk.m.mimecastprotect.com/s/p9wVCXBDigoJJS6f7CWGkad?domain=ouakninelegal-my.sharepoint.com	false	unknown
https://ouakninelegal-my.sharepoint.com/_layouts/15/images/favicon.ico?rev=47	false	unknown
https://ouakninelegal-my.sharepoint.com/ScriptResource.axd?d=wmWRPBwCSCbXmH9wx4hANJPbt_WhqygGvO6NcEWl1oVpupqRi-ao3qQ3zmmEjMzOSNXEl_4NRPQKYeJ-beiVZKSI09JHBSVwjy8PMxTiiYnHsZJVp_eFqIAV0ipY5vU8HRJVFTUF072VuSPGT5fEb2bv8rIy2pQ1WMrY-t1l707a0mPuaNnzpPBWOhmeqRkT0&t=7a0cc936	false	unknown

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 2 13:32:28 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	18F94F3D6BED63FB6262716D29E7EEB8	FBEE1D433EF611F126BF5F8608732C8AEBFA8D50	6384EE3C062285AAB83566905E262236D4F27AF31A04AC294FCFCD1EFCC4BE28
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 2 13:32:28 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	5519E4A72B604052D131914140C47BE9	C6C12DDE1591EC4B14CEE201516BAE2597CA5A1C	BD2FC2C2C1A86482E2AD06200F16E3224F8FA822EDD4078E6013A33827A31CE5
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 5 07:00:51 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	3B253C315E7B6877C0402B36660C895D	05D42A7AD219C04CE1E1A7F7BD6D4E2A2F8B3F98	94B8F7DD9D59EBF4DACE8FC8344342FFAB9CA028C86862DFC5A11AA1FD140CD2
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 2 13:32:28 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	459863BEA17ED613A2CB1CAA3726100D	12AFF10EF48248572FD19886EA91E2C7B8CBEF83	23CB87E6CA8CD83D7908ECBA9D477018D61D595164CD7E85E3B3D6FD657318AA
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 2 13:32:28 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	3B6874D0552048E34BF15A871D32348B	6ABADC4069D16067B5C2F745E2BA1B64D47B1EB5	349D74DA7CE3DEA978C990EAE043634A65C8B6C2FC8172053B4FC1D91E07517F
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 2 13:32:27 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	230D66FB5A9467C8B67BBA03EA627108	1B480BB49D4A56C69AF9FFFB84BC84798B3AB84D	854DA9D0721C8354365CBC9BFD9AC72AA63C7E17D97DA53A00C1EB635F0C65F0
Chrome Cache Entry: 136	ASCII text, with CRLF line terminators	B3D7A123BE5203A1A3F0F10233ED373F	F4C61F321D8F79A805B356C6EC94090C0D96215C	EF9453F74B2617D43DCEF4242CF5845101FCFB57289C81BCEB20042B0023A192
Chrome Cache Entry: 137	MS Windows icon resource - 3 icons, 32x32, 32 bits/pixel, 24x24, 32 bits/pixel	0B60F3C9E4DA6E807E808DA7360F24F2	9AFC7ABB910DE855EFB426206E547574A1E074B7	ADDEEDEEEF393B6B1BE5BBB099B656DCD797334FF972C495CCB09CFCB1A78341
Chrome Cache Entry: 138	ASCII text, with very long lines (39257), with CRLF line terminators	DA9DC1C32E89C02FC1E9EEB7E5AAB91E	3EFB110EFA6068CE6B586A67F87DA5125310BC30	398CDF1B27EF247E5BC77805F266BB441E60355463FC3D1776F41AAE58B08CF1
Chrome Cache Entry: 139	ASCII text, with no line terminators	858372DD32511CB4DD08E48A93B4F175	CE4555B7B2EFBBD644D8E34CF3453A0E8CAA3C43	3D18F3E1469C83D62CF3A39BA93F8EAA5B22447FE630E59F39DC1B7747635359
Chrome Cache Entry: 140	ASCII text, with CRLF line terminators	B3D7A123BE5203A1A3F0F10233ED373F	F4C61F321D8F79A805B356C6EC94090C0D96215C	EF9453F74B2617D43DCEF4242CF5845101FCFB57289C81BCEB20042B0023A192
Chrome Cache Entry: 141	PNG image data, 226 x 48, 8-bit/color RGBA, non-interlaced	EF884BDEDEF280DF97A4C5604058D8DB	6F04244B51AD2409659E267D308B97E09CE9062B	825DE044D5AC6442A094FF95099F9F67E9249A8110A2FBD57128285776632ADB
Chrome Cache Entry: 142	ASCII text, with very long lines (65329), with CRLF line terminators	C89EAA5B28DF1E17376BE71D71649173	2B34DF4C66BB57DE5A24A2EF0896271DFCA4F4CD	66B804E7A96A87C11E1DD74EA04AC2285DF5AD9043F48046C3E5000114D39B1C
Chrome Cache Entry: 143	HTML document, ASCII text, with very long lines (30522), with CRLF, LF line terminators	D28ED8315B91AE0798DC358D16B110F4	AE8E00035B2331D8F783B74D9BE72127032A5AAD	32AAEB236253064086079D9DCF95CB67899C8546592D8A1F5A9ED4611AAEA10D
Chrome Cache Entry: 144	ASCII text, with very long lines (17444)	6EFDDF589864D2E146A55C01C6764A35	EFA8BBA46CB97877EEC5430C43F0AC32585B6B2F	2D92F0CE8491D2F9A27EA16D261A15089C4A9BE879D1EEDCB6F4A3859E7F1999
Chrome Cache Entry: 145	ASCII text, with very long lines (17444)	6EFDDF589864D2E146A55C01C6764A35	EFA8BBA46CB97877EEC5430C43F0AC32585B6B2F	2D92F0CE8491D2F9A27EA16D261A15089C4A9BE879D1EEDCB6F4A3859E7F1999
Chrome Cache Entry: 146	ASCII text, with very long lines (37521)	8DCE60169BA666CA03A31D123DB49908	956C46BB6058C23D35440DCC656CE61C7B151399	F9F5A40C01C6D569373CE61EE77849F30E4176E1310652FF17D458C68680CF75
Chrome Cache Entry: 147	ASCII text, with very long lines (39257), with CRLF line terminators	DA9DC1C32E89C02FC1E9EEB7E5AAB91E	3EFB110EFA6068CE6B586A67F87DA5125310BC30	398CDF1B27EF247E5BC77805F266BB441E60355463FC3D1776F41AAE58B08CF1
Chrome Cache Entry: 148	ASCII text, with CRLF line terminators	90EA7274F19755002360945D54C2A0D7	647B5D8BF7D119A2C97895363A07A0C6EB8CD284	40732E9DCFA704CF615E4691BB07AECFD1CC5E063220A46E4A7FF6560C77F5DB
Chrome Cache Entry: 149	ASCII text, with CRLF line terminators	90EA7274F19755002360945D54C2A0D7	647B5D8BF7D119A2C97895363A07A0C6EB8CD284	40732E9DCFA704CF615E4691BB07AECFD1CC5E063220A46E4A7FF6560C77F5DB
Chrome Cache Entry: 150	ASCII text, with very long lines (65329), with CRLF line terminators	C89EAA5B28DF1E17376BE71D71649173	2B34DF4C66BB57DE5A24A2EF0896271DFCA4F4CD	66B804E7A96A87C11E1DD74EA04AC2285DF5AD9043F48046C3E5000114D39B1C
Chrome Cache Entry: 151	ASCII text, with very long lines (37521)	8DCE60169BA666CA03A31D123DB49908	956C46BB6058C23D35440DCC656CE61C7B151399	F9F5A40C01C6D569373CE61EE77849F30E4176E1310652FF17D458C68680CF75
Chrome Cache Entry: 152	PNG image data, 226 x 48, 8-bit/color RGBA, non-interlaced	EF884BDEDEF280DF97A4C5604058D8DB	6F04244B51AD2409659E267D308B97E09CE9062B	825DE044D5AC6442A094FF95099F9F67E9249A8110A2FBD57128285776632ADB
Chrome Cache Entry: 153	MS Windows icon resource - 3 icons, 32x32, 32 bits/pixel, 24x24, 32 bits/pixel	0B60F3C9E4DA6E807E808DA7360F24F2	9AFC7ABB910DE855EFB426206E547574A1E074B7	ADDEEDEEEF393B6B1BE5BBB099B656DCD797334FF972C495CCB09CFCB1A78341

HTML body contains low number of good links

Source: https://ouakninelegal-my.sharepoint.com/:o:/g/personal/elisabeth_ouakninelegal_ca/EmqBVPVvWZJPmAegR7MbWQoBK84JXk9jPvROW6zOsaUoTw?e=5%3ajmYUjO&at=9

HTTP Parser: Number of links: 0

HTML title does not match URL

Source: https://ouakninelegal-my.sharepoint.com/:o:/g/personal/elisabeth_ouakninelegal_ca/EmqBVPVvWZJPmAegR7MbWQoBK84JXk9jPvROW6zOsaUoTw?e=5%3ajmYUjO&at=9

HTTP Parser: Title: Sharing Link Validation does not match URL

Submit button contains javascript call

Source: https://ouakninelegal-my.sharepoint.com/:o:/g/personal/elisabeth_ouakninelegal_ca/EmqBVPVvWZJPmAegR7MbWQoBK84JXk9jPvROW6zOsaUoTw?e=5%3ajmYUjO&at=9

HTTP Parser: On click: javascript:WebForm_DoPostBackWithOptions(new WebForm_PostBackOptions("btnSubmitEmail", "", true, "", "", false, true))

Source: https://ouakninelegal-my.sharepoint.com/:o:/g/personal/elisabeth_ouakninelegal_ca/EmqBVPVvWZJPmAegR7MbWQoBK84JXk9jPvROW6zOsaUoTw?e=5%3ajmYUjO&at=9

HTTP Parser: No <meta name="author".. found

Source: https://ouakninelegal-my.sharepoint.com/:o:/g/personal/elisabeth_ouakninelegal_ca/EmqBVPVvWZJPmAegR7MbWQoBK84JXk9jPvROW6zOsaUoTw?e=5%3ajmYUjO&at=9

HTTP Parser: No <meta name="copyright".. found

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.8:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.8:49728 version: TLS 1.2

Detected non-DNS traffic on DNS port

Source: global traffic

TCP traffic: 192.168.2.8:58443 -> 1.1.1.1:53

Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /s/p9wVCXBDigoJJS6f7CWGkad?domain=ouakninelegal-my.sharepoint.com HTTP/1.1Host: url.uk.m.mimecastprotect.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /r/0R1m48Tzb1Q0D0KK5UBysaN3hg_s33vGp3gIfwyDrnon_BzEGOLqUl7SE_z2ATPbFdovSuF88NouIjn1r_3AUxZfAIeKqLftxKz97o9x5YgTozN7dKxMy8G7be9g4NYO3SJotb4sPIWR3dwfP0YqqZmnR-LF7ewi6hgOCwZaXG_6NQj8qFGdUuL-ynr3IkH9O6yFF2VZiErOKszwInFki4sy59mRDCPKpBfW2GjauOUj3WGoGhT12c6Ej4wKWwtz9uFb7cRoPrCfkeKC7YmHRXnASq9IUOmMlWHp_ny8nbIAn7sAOkFi_EfhykfDhrpa06HA_8p73b7VhXYOINDmUNj8Fg-jMVdSG-a2On5BovbggS6os6OacaztqSmIGXJgMufeq4B156NPGZRyBGX8gfaixiy_QJQ05UfmhSkf4KFWbJD_tiLukn1D3lA6HKcG9SXq2ctt1Ji1Xod8nsYL_Z4Zvnc-eu1ykouVDnNjXvt-aK2Olk_36azd4S80-dWeTHOcPPk8Eq_a8ECNDw7GBCNZH8qdFwgJIjlaXkDyoAgKi7QecU8sZwOQrQBzxdNNT4ykqNWcTNdF1s05fUZ-AvK0Rq6Uaqnb9wW1G5V6Ecle301Bmkt3O5mEWeBx8r0u0TeyG-HrzhyKaExrdAD0zKfbzsPp0wSjW4QMAQzsMbr5bPidv_m5843ndvaxeZWaBo3yu01U5x-rV2h-SRmSPC3cUyNoTnMtl2i3vSArH1Hwu2J-5cl5v8J2bJ3wKtr6GKWi7VDiuqbjqXEyFBvw-aRWmiQ_8fd5_mYKgYz69b_tVU9J1CHLJ5AUjxb0F_u2FxFDZm7VFPspwd7FUfyU2JG3Z20yP2DNEFBRRVlxDlV7wf3_SgFaiwUttpbGNAy33YYkrGs8U3vFCtd8EmwytNAYticPk4cDIp-YzqmZpQm4Cyh3shXbdld_16XINuYzkmJ30sI6MFgxMZcV37smojb272ebF1Ivue5vnswPo9vaNqiF0xLaty7x8UgCypb1DxVv0k_1AP5iITBXGvuY5Yuw9WhDm5igeTiJHFU70kpQd_MOkrif-N7kdq9JCezie1gpeZ1kvNXmoW21RP7_ZRCLnAqouUpxGmDAijn53Cfng0-Y0YasgtV8lZLT_O2d2CFwW8ntxtt-8KGDx7zpM9PPlhQhEQP-lK560FPLM1UT_iSJ_dMr58ISZXeTw_rQenMjSkDyQf0_ClFaKgNJQgJO8FGdGYmJ0-2XN93WC2inviz-5qzHhtDdfv4s362KhfO-agKki400Ny_EIYAQOOcVvVMkTKBXPiIn_XZiUWXSKl-iz3p3Uu0ZE2S9sbP7VoGYNC0lGOMxv2LPvgJa5-9-UJwbfByEYWeS-uhnU_-dCAVTMkMueLNJoKi2AkkmDFAnzxiLPds04m9aum2PzFl3j7azLCnlEDOVgEXvkAl0Kp6c-nH8W-wIMXRgWzGS9fb382HuNp6qQ7VzsGR_S93ZvYidGvnCEm2HBB-7KM1jbPfGWUdycHwPKGLmPaebD3EyJw8nPTTbh4hsMUaD45gpjfkdPt0WavWNqdmp-EeByR-T16WC_UQfY1FwJFKyISk3ofYIs5E9KDJBA7PvW-6yCzV8ORwl4szA_BRazmcf6O8F1qIKQzAxmIt4-GQfFgXtbsNCSOBPYh43Xh6F6OGbO-bMc3BaOOzqCsBnDsCiaJAvKcRry6xeI-QInoBrLO5TI7mNix7EYxMDkRnaDKtHzB6MNiUCXc427v66zKF8d5vn6fgDrEXHbaCMm6FZDE7rsP4KrGhdhP0hqoKA2Pv835CrTS_bbgL-YjYAZOq27sGFVwSKHxdzLuC4GLKOpajiIxXTH9wTfx3GR4eBvwBkV7arD58i1I9ppR-v9gJKcyVI762gNJXcAusiUECZs5lKWpcZMSv52pFyHKfrmG0CGpnypppminiHkRcCtC0WniY9mvGD5yVZ64b8Xa5eHwo8a8H3oM74HyH2jDPeSkSzy-Nq0Xixf8JHueZFXayC0wRjAnVx35JhmhZakNznFMnEtqQ9L7k1JOUu8axKERX0BK7RB3H4o9itikVlLAvgCmWLCDBIDVKqlTEQ7wbqJlE4pR2e-fG_zYXEGx7on_CpW7zpVcaSiTImK4nJdE5kbWI1G1SlhGoXtwhNyVLBScXRxhCRxHVgHxz9idDaDk0QmIkGvCO_vUdcFqQrFm2Tvhp0yZns1hZ_2P5OvtiTS3_R6LM8nf-FLPTvYTMF7TnI7cM4SolqI4gdT9ApQfwuSM2_FdCFICNoTK8Qgs5xSRaWSgBtB2-_-aEHtkt9cNkSMR-MP_nDNxNw_R5UXojVHSnlgBaVlCU1EuKtDWCRaW_MIoFcLQr70v3bFCrSNddYXRcIzTWpkr4WMCSFfMU76ZC2MECulYsn5nfAkfMc1exuZNLeZLxP9gCaehT7PxJH_-7FwAyOOLXYim2OVvpdQb8LhWDadL7SnaoDAckfs8U-4cuovac9pVKCQnecN_f1sy208ciAQzy7C6gsTtMJRohEA5W81IRCSGxFhQqrd5R9L-NYrfhG1V8HplGUzd2E9rhKU5eOCewL_8SI3vylxNrep-p2m7Tr2s5Snk05gHbgumc9B4QOPWmTJJ7w2n7KvRfyJVpcqZQD05M8JhM HTTP/1.1Host: url.uk.m.mimecastprotect.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q
Source: global traffic	HTTP traffic detected: GET /:o:/g/personal/elisabeth_ouakninelegal_ca/EmqBVPVvWZJPmAegR7MbWQoBK84JXk9jPvROW6zOsaUoTw?e=5%3ajmYUjO&at=9 HTTP/1.1Host: ouakninelegal-my.sharepoint.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /WebResource.axd?d=qQ-tsNsY4mzceTE_EyU_iyYmxhBmhJQ11sIHbeZBeYWZ920rM_8XSM8h6w0d7nZzAqphgK7kxnUp1T49uzhq7d6T_lBlQDlyYG01kIVRFXs1&t=638611486345608193 HTTP/1.1Host: ouakninelegal-my.sharepoint.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://ouakninelegal-my.sharepoint.com/:o:/g/personal/elisabeth_ouakninelegal_ca/EmqBVPVvWZJPmAegR7MbWQoBK84JXk9jPvROW6zOsaUoTw?e=5%3ajmYUjO&at=9Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ScriptResource.axd?d=hJ44vuhbtoSZwKYpWYi2Os4fHRzb9eqVf-wdDuNmOlzwXf3aF3e-32cvUQ6qUscl1DefVS-9XQfsOH5bhkfGOW9rRadWFYNu7cBvGAXrUbhUh2e32G539sj0LZJzaXe4u09IYuWJMhNNxvvT-t99dvqbCwaUdbg47CJr44HW75Q1&t=ffffffffedc3492c HTTP/1.1Host: ouakninelegal-my.sharepoint.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://ouakninelegal-my.sharepoint.com/:o:/g/personal/elisabeth_ouakninelegal_ca/EmqBVPVvWZJPmAegR7MbWQoBK84JXk9jPvROW6zOsaUoTw?e=5%3ajmYUjO&at=9Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ScriptResource.axd?d=wmWRPBwCSCbXmH9wx4hANJPbt_WhqygGvO6NcEWl1oVpupqRi-ao3qQ3zmmEjMzOSNXEl_4NRPQKYeJ-beiVZKSI09JHBSVwjy8PMxTiiYnHsZJVp_eFqIAV0ipY5vU8HRJVFTUF072VuSPGT5fEb2bv8rIy2pQ1WMrY-t1l707a0mPuaNnzpPBWOhmeqRkT0&t=7a0cc936 HTTP/1.1Host: ouakninelegal-my.sharepoint.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://ouakninelegal-my.sharepoint.com/:o:/g/personal/elisabeth_ouakninelegal_ca/EmqBVPVvWZJPmAegR7MbWQoBK84JXk9jPvROW6zOsaUoTw?e=5%3ajmYUjO&at=9Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ScriptResource.axd?d=lLkI1JciGSXohcyoCrHUL3KfmlB_NcNkFjN62kxsxtXMxSbjKr_j5kBv1T1i38u6XGY9_Y1SXRtoAKy30iH7CXRXn0S3wcbALrMmHk9jxHGIr1SgGSD9-FBF30Ac-Mc0eHrWx2GQ88ktj6J1daJm6jTP0F4BiFJWWFBOg_UTCdqCw2iYHuVvlza9HVLVDZHS0&t=7a0cc936 HTTP/1.1Host: ouakninelegal-my.sharepoint.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://ouakninelegal-my.sharepoint.com/:o:/g/personal/elisabeth_ouakninelegal_ca/EmqBVPVvWZJPmAegR7MbWQoBK84JXk9jPvROW6zOsaUoTw?e=5%3ajmYUjO&at=9Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_layouts/15/images/microsoft-logo.png HTTP/1.1Host: ouakninelegal-my.sharepoint.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ouakninelegal-my.sharepoint.com/:o:/g/personal/elisabeth_ouakninelegal_ca/EmqBVPVvWZJPmAegR7MbWQoBK84JXk9jPvROW6zOsaUoTw?e=5%3ajmYUjO&at=9Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /_layouts/15/images/favicon.ico?rev=47 HTTP/1.1Host: ouakninelegal-my.sharepoint.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ouakninelegal-my.sharepoint.com/:o:/g/personal/elisabeth_ouakninelegal_ca/EmqBVPVvWZJPmAegR7MbWQoBK84JXk9jPvROW6zOsaUoTw?e=5%3ajmYUjO&at=9Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_layouts/15/images/microsoft-logo.png HTTP/1.1Host: ouakninelegal-my.sharepoint.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /WebResource.axd?d=qQ-tsNsY4mzceTE_EyU_iyYmxhBmhJQ11sIHbeZBeYWZ920rM_8XSM8h6w0d7nZzAqphgK7kxnUp1T49uzhq7d6T_lBlQDlyYG01kIVRFXs1&t=638611486345608193 HTTP/1.1Host: ouakninelegal-my.sharepoint.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ScriptResource.axd?d=wmWRPBwCSCbXmH9wx4hANJPbt_WhqygGvO6NcEWl1oVpupqRi-ao3qQ3zmmEjMzOSNXEl_4NRPQKYeJ-beiVZKSI09JHBSVwjy8PMxTiiYnHsZJVp_eFqIAV0ipY5vU8HRJVFTUF072VuSPGT5fEb2bv8rIy2pQ1WMrY-t1l707a0mPuaNnzpPBWOhmeqRkT0&t=7a0cc936 HTTP/1.1Host: ouakninelegal-my.sharepoint.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ScriptResource.axd?d=lLkI1JciGSXohcyoCrHUL3KfmlB_NcNkFjN62kxsxtXMxSbjKr_j5kBv1T1i38u6XGY9_Y1SXRtoAKy30iH7CXRXn0S3wcbALrMmHk9jxHGIr1SgGSD9-FBF30Ac-Mc0eHrWx2GQ88ktj6J1daJm6jTP0F4BiFJWWFBOg_UTCdqCw2iYHuVvlza9HVLVDZHS0&t=7a0cc936 HTTP/1.1Host: ouakninelegal-my.sharepoint.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ScriptResource.axd?d=hJ44vuhbtoSZwKYpWYi2Os4fHRzb9eqVf-wdDuNmOlzwXf3aF3e-32cvUQ6qUscl1DefVS-9XQfsOH5bhkfGOW9rRadWFYNu7cBvGAXrUbhUh2e32G539sj0LZJzaXe4u09IYuWJMhNNxvvT-t99dvqbCwaUdbg47CJr44HW75Q1&t=ffffffffedc3492c HTTP/1.1Host: ouakninelegal-my.sharepoint.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_layouts/15/images/favicon.ico?rev=47 HTTP/1.1Host: ouakninelegal-my.sharepoint.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: global traffic	DNS traffic detected: DNS query: url.uk.m.mimecastprotect.com
Source: global traffic	DNS traffic detected: DNS query: ouakninelegal-my.sharepoint.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: m365cdn.nel.measure.office.net

Source: chromecache_144.2.dr, chromecache_145.2.dr	String found in binary or memory: http://github.com/jrburke/requirejs
Source: chromecache_143.2.dr	String found in binary or memory: https://ouakninelegal-my.sharepoint.com/personal/elisabeth_ouakninelegal_ca/_layouts/15/images/256_i
Source: chromecache_146.2.dr, chromecache_151.2.dr	String found in binary or memory: https://reactjs.org/docs/error-decoder.html?invariant=
Source: chromecache_143.2.dr	String found in binary or memory: https://res-1.cdn.office.net
Source: chromecache_143.2.dr	String found in binary or memory: https://res-1.cdn.office.net/bld/_layouts/15/16.0.25311.12012/require.js
Source: chromecache_143.2.dr	String found in binary or memory: https://res-1.cdn.office.net/files/odsp-web-prod_2024-09-20.007/
Source: chromecache_143.2.dr	String found in binary or memory: https://res-2.cdn.office.net/files/odsp-web-prod_2024-09-20.007/
Source: chromecache_143.2.dr	String found in binary or memory: https://spoprod-a.akamaihd.net/files/odsp-common-library-prod_2019-02-15_20190219.002/require.js

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49676 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58447 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58447
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.8:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.8:49728 version: TLS 1.2

Source: classification engine

Classification label: clean2.win@22/34@10/7

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2252 --field-trial-handle=1860,i,14895830932961628612,13025139479554271904,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://url.uk.m.mimecastprotect.com/s/p9wVCXBDigoJJS6f7CWGkad?domain=ouakninelegal-my.sharepoint.com"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2252 --field-trial-handle=1860,i,14895830932961628612,13025139479554271904,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Stores files to the Windows start menu directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

ID:	1524241
Product:	CloudBasic
Start time:	16:31:24
Start date:	02.10.2024
Cookbook:	browseurl.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS

Windows Analysis Report
https://url.uk.m.mimecastprotect.com/s/p9wVCXBDigoJJS6f7CWGkad?domain=ouakninelegal-my.sharepoint.com

Overview

General Information

Detection

Signatures

Classification

Signatures

Phishing

Compliance

Networking

System Summary

Boot Survival

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs

Windows Analysis Report https://url.uk.m.mimecastprotect.com/s/p9wVCXBDigoJJS6f7CWGkad?domain=ouakninelegal-my.sharepoint.com

Overview

General Information

Detection

Signatures

Classification

Signatures

Phishing

Compliance

Networking

System Summary

Boot Survival

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs

Windows Analysis Report
https://url.uk.m.mimecastprotect.com/s/p9wVCXBDigoJJS6f7CWGkad?domain=ouakninelegal-my.sharepoint.com