IOC Report
https://dev.azure.com/PHSI-DigitalTransformation/

loading gif

Files

File Path
Type
Category
Malicious
Chrome Cache Entry: 100
MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
dropped
Chrome Cache Entry: 101
ASCII text, with very long lines (32628), with CRLF line terminators
downloaded
Chrome Cache Entry: 102
ASCII text, with very long lines (61177)
downloaded
Chrome Cache Entry: 103
ASCII text, with CRLF line terminators
downloaded
Chrome Cache Entry: 104
Unicode text, UTF-8 text, with very long lines (32009)
downloaded
Chrome Cache Entry: 105
PNG image data, 260 x 48, 8-bit/color RGBA, non-interlaced
downloaded
Chrome Cache Entry: 106
ASCII text, with CRLF line terminators
downloaded
Chrome Cache Entry: 107
ASCII text, with very long lines (65334), with CRLF line terminators
dropped
Chrome Cache Entry: 108
MS Windows icon resource - 7 icons, 32x32, 8 bits/pixel, 16x16, 8 bits/pixel
dropped
Chrome Cache Entry: 72
HTML document, ASCII text, with very long lines (3450), with CRLF line terminators
downloaded
Chrome Cache Entry: 73
MS Windows icon resource - 7 icons, 32x32, 8 bits/pixel, 16x16, 8 bits/pixel
downloaded
Chrome Cache Entry: 74
ASCII text, with very long lines (46090)
downloaded
Chrome Cache Entry: 75
Unicode text, UTF-8 text, with very long lines (14323), with CRLF line terminators
downloaded
Chrome Cache Entry: 76
SVG Scalable Vector Graphics image
downloaded
Chrome Cache Entry: 77
ASCII text, with very long lines (64616)
dropped
Chrome Cache Entry: 78
Unicode text, UTF-8 text, with very long lines (31550), with CRLF line terminators
dropped
Chrome Cache Entry: 79
Unicode text, UTF-8 text, with very long lines (31550), with CRLF line terminators
downloaded
Chrome Cache Entry: 80
JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1420x1080, components 3
dropped
Chrome Cache Entry: 81
ASCII text, with very long lines (65506), with CRLF line terminators
downloaded
Chrome Cache Entry: 82
JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1420x1080, components 3
downloaded
Chrome Cache Entry: 83
ASCII text, with very long lines (64612)
dropped
Chrome Cache Entry: 84
ASCII text, with very long lines (64612)
downloaded
Chrome Cache Entry: 85
MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
downloaded
Chrome Cache Entry: 86
ASCII text, with very long lines (46090)
dropped
Chrome Cache Entry: 87
ASCII text, with CRLF line terminators
dropped
Chrome Cache Entry: 88
SVG Scalable Vector Graphics image
dropped
Chrome Cache Entry: 89
ASCII text, with very long lines (786), with CRLF line terminators
dropped
Chrome Cache Entry: 90
ASCII text, with no line terminators
downloaded
Chrome Cache Entry: 91
ASCII text, with very long lines (45797)
downloaded
Chrome Cache Entry: 92
ASCII text, with very long lines (64616)
downloaded
Chrome Cache Entry: 93
ASCII text, with very long lines (786), with CRLF line terminators
downloaded
Chrome Cache Entry: 94
ASCII text, with very long lines (65334), with CRLF line terminators
downloaded
Chrome Cache Entry: 95
Unicode text, UTF-8 text, with very long lines (32009)
dropped
Chrome Cache Entry: 96
ASCII text, with very long lines (45797)
dropped
Chrome Cache Entry: 97
Unicode text, UTF-8 text, with very long lines (14323), with CRLF line terminators
dropped
Chrome Cache Entry: 98
Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
downloaded
Chrome Cache Entry: 99
PNG image data, 260 x 48, 8-bit/color RGBA, non-interlaced
dropped
There are 28 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2344 --field-trial-handle=2284,i,7784049537558466087,3955747996882176276,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://dev.azure.com/PHSI-DigitalTransformation/"

URLs

Name
IP
Malicious
https://dev.azure.com/PHSI-DigitalTransformation/
http://www.apache.org/licenses/LICENSE-2.0
unknown
https://aadcdn.msftauthimages.net/dbd5a2dd-z-2qvmj22194acscljz4wqnbpvszabyxqsyzqchxr-u/logintenantbranding/0/bannerlogo?ts=635977565823235111
13.107.246.45
http://jquery.org/license
unknown
http://jqueryui.com
unknown
https://spsprodcus5.vssps.visualstudio.com/_static/tfs/M245_20240917.4/_content/Combined.css
13.107.42.18
http://knockoutjs.com/
unknown
https://github.com/douglascrockford/JSON-js
unknown
https://spsprodcus5.vssps.visualstudio.com/_static/tfs/M245_20240917.4/_scripts/TFS/min/jQueryUI/version.js
13.107.42.18
https://login.windows-ppe.net
unknown
https://dev.azure.com/PHSI-DigitalTransformation/
13.107.42.20
https://spsprodcus5.vssps.visualstudio.com/_public/_Bundling/Content?bundle=vss-bundle-common-vqskrZmqV9Y8Ba3TvxfO3_AsqhD5HzEWWv45nA_svAXw=
13.107.42.18
https://spsprodcus5.vssps.visualstudio.com/_static/tfs/M245_20240917.4/_content/big-progress.gif
13.107.42.18
https://spsprodcus5.vssps.visualstudio.com/_static/tfs/M245_20240917.4/_cssbundles/Default/vss-bundle-commoncss-vuiSc9pHdDbcT8LzK_3fJ2kEsn4_fRqmPx_6IdU0oXHc=
13.107.42.18
https://spsprodcus5.vssps.visualstudio.com/_static/tfs/M245_20240917.4/_content/Authentication.css
13.107.42.18
http://github.com/kriskowal/q/raw/master/LICENSE
unknown
https://spsprodcus5.vssps.visualstudio.com/_signin?realm=dev.azure.com&reply_to=https%3A%2F%2Fdev.azure.com%2FPHSI-DigitalTransformation%2F&redirect=1&hid=472a1331-131d-4ab9-a222-3eb2b631d349&context=eyJodCI6MiwiaGlkIjoiMjc0YzVjODgtMzA1My00YzA0LTk4MGItZTBjNWY3YWMzODgwIiwicXMiOnt9LCJyciI6IiIsInZoIjoiIiwiY3YiOiIiLCJjcyI6IiJ90
13.107.42.18
http://github.com/jrburke/requirejs
unknown
http://www.opensource.org/licenses/mit-license.html
unknown
https://raw.githubusercontent.com/stefanpenner/es6-promise/master/LICENSE
unknown
https://login.microsoftonline.com
unknown
https://aadcdn.msftauth.net/shared/1.0/content/js/ConvergedLogin_PCore_ELtAAt2Ya8ISGuc0PJcBKA2.js
152.199.21.175
https://aadcdn.msftauth.net/shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_117b650bccea354984d8.js
152.199.21.175
http://www.opensource.org/licenses/mit-license.php)
unknown
https://aadcdn.msftauth.net/shared/1.0/content/js/BssoInterrupt_Core_JQnUxWSvwsd9FrpspQmznw2.js
152.199.21.175
http://jqueryui.com/themeroller/?scope=&folderName=smoothness&cornerRadiusShadow=8px&offsetLeftShado
unknown
https://spsprodcus5.vssps.visualstudio.com/_static/tfs/M245_20240917.4/_cssbundles/Default/vss-bundle-viewcss-vKzCQ2wRcxozUbM0wmGy9QGeur1Tf6QGMY1-4Cznv5pQ=
13.107.42.18
https://aadcdn.msftauthimages.net/dbd5a2dd-z-2qvmj22194acscljz4wqnbpvszabyxqsyzqchxr-u/logintenantbranding/0/illustration?ts=636468241007282920
13.107.246.45
https://github.com/MoonScript/jQuery-ajaxTransport-XDomainRequest
unknown
https://spsprodcus5.vssps.visualstudio.com/_static/tfs/M245_20240917.4/_scripts/TFS/min/jQueryUI/focusable.js
13.107.42.18
https://aadcdn.msftauth.net/shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico
152.199.21.175
https://aadcdn.msftauth.net/shared/1.0/content/images/signin-options_3e3f6b73c3f310c31d2c4d131a8ab8c6.svg
152.199.21.175
https://spsprodcus5.vssps.visualstudio.com/favicon.ico
13.107.42.18
https://marketplace.visualstudio.com/vsts
unknown
https://aadcdn.msftauth.net/ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_1yb3e7oii5t28dgo4xrtow2.js
152.199.21.175
http://feross.org
unknown
https://spsprodcus5.vssps.visualstudio.com/_public/_Bundling/Content?bundle=vss-bundle-basejs-vx38JYf0FTtFkI9k88H54KYCLs9sIP_6xJwgWGnd-xvw=
13.107.42.18
https://aadcdn.msftauth.net/shared/1.0/content/js/asyncchunk/convergedlogin_pstringcustomizationhelper_4285088f1dbaf52a876d.js
152.199.21.175
https://spsprodcus5.vssps.visualstudio.com/_signin?realm=dev.azure.com&reply_to=https%3A%2F%2Fdev.azure.com%2FPHSI-DigitalTransformation%2F&redirect=1&hid=472a1331-131d-4ab9-a222-3eb2b631d349&context=eyJodCI6MiwiaGlkIjoiMjc0YzVjODgtMzA1My00YzA0LTk4MGItZTBjNWY3YWMzODgwIiwicXMiOnt9LCJyciI6IiIsInZoIjoiIiwiY3YiOiIiLCJjcyI6IiJ90#ctx=eyJTaWduSW5Db29raWVEb21haW5zIjpbImh0dHBzOi8vbG9naW4ubWljcm9zb2Z0b25saW5lLmNvbSIsImh0dHBzOi8vbG9naW4ubWljcm9zb2Z0b25saW5lLmNvbSJdfQ2
https://spsprodcus5.vssps.visualstudio.com/_public/_Bundling/Content?bundle=vss-bundle-view-v9-kuR6PS7EbXOJtBsbgEb5Ud7EwTuQ_Qn6hkxbWhB7g=
13.107.42.18
There are 29 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
bg.microsoft.map.fastly.net
199.232.214.172
spsprodcus5.vssps.visualstudio.com
13.107.42.18
sni1gl.wpc.omegacdn.net
152.199.21.175
s-part-0017.t-0009.t-msedge.net
13.107.246.45
s-part-0017.t-0009.fb-t-msedge.net
13.107.253.45
www.google.com
142.250.186.36
fp2e7a.wpc.phicdn.net
192.229.221.95
dev.azure.com
13.107.42.20
identity.nel.measure.office.net
unknown
aadcdn.msftauth.net
unknown
login.microsoftonline.com
unknown
aadcdn.msftauthimages.net
unknown
There are 2 hidden domains, click here to show them.

IPs

IP
Domain
Country
Malicious
142.250.186.36
www.google.com
United States
13.107.246.45
s-part-0017.t-0009.t-msedge.net
United States
13.107.253.45
s-part-0017.t-0009.fb-t-msedge.net
United States
13.107.42.18
spsprodcus5.vssps.visualstudio.com
United States
192.168.2.4
unknown
unknown
13.107.42.20
dev.azure.com
United States
239.255.255.250
unknown
Reserved
192.168.2.13
unknown
unknown
192.168.2.14
unknown
unknown
152.199.21.175
sni1gl.wpc.omegacdn.net
United States

DOM / HTML

URL
Malicious
https://spsprodcus5.vssps.visualstudio.com/_signin?realm=dev.azure.com&reply_to=https%3A%2F%2Fdev.azure.com%2FPHSI-DigitalTransformation%2F&redirect=1&hid=472a1331-131d-4ab9-a222-3eb2b631d349&context=eyJodCI6MiwiaGlkIjoiMjc0YzVjODgtMzA1My00YzA0LTk4MGItZTBjNWY3YWMzODgwIiwicXMiOnt9LCJyciI6IiIsInZoIjoiIiwiY3YiOiIiLCJjcyI6IiJ90#ctx=eyJTaWduSW5Db29raWVEb21haW5zIjpbImh0dHBzOi8vbG9naW4ubWljcm9zb2Z0b25saW5lLmNvbSIsImh0dHBzOi8vbG9naW4ubWljcm9zb2Z0b25saW5lLmNvbSJdfQ2
https://login.microsoftonline.com/465f7561-2862-4fde-afcc-817388e07e5c/oauth2/authorize?client_id=499b84ac-1321-427f-aa17-267ca6975798&site_id=501454&response_mode=form_post&response_type=code+id_token&redirect_uri=https%3A%2F%2Fspsprodcus5.vssps.visualstudio.com%2F_signedin&nonce=e3ca22f4-59f7-4a5a-b232-b83bdbe0de7d&state=realm%3Ddev.azure.com%26reply_to%3Dhttps%253A%252F%252Fdev.azure.com%252FPHSI-DigitalTransformation%252F%26ht%3D2%26hid%3D472a1331-131d-4ab9-a222-3eb2b631d349%26nonce%3De3ca22f4-59f7-4a5a-b232-b83bdbe0de7d&resource=https%3A%2F%2Fmanagement.core.windows.net%2F&cid=e3ca22f4-59f7-4a5a-b232-b83bdbe0de7d&wsucxt=1&sso_reload=true
https://login.microsoftonline.com/465f7561-2862-4fde-afcc-817388e07e5c/oauth2/authorize?client_id=499b84ac-1321-427f-aa17-267ca6975798&site_id=501454&response_mode=form_post&response_type=code+id_token&redirect_uri=https%3A%2F%2Fspsprodcus5.vssps.visualstudio.com%2F_signedin&nonce=e3ca22f4-59f7-4a5a-b232-b83bdbe0de7d&state=realm%3Ddev.azure.com%26reply_to%3Dhttps%253A%252F%252Fdev.azure.com%252FPHSI-DigitalTransformation%252F%26ht%3D2%26hid%3D472a1331-131d-4ab9-a222-3eb2b631d349%26nonce%3De3ca22f4-59f7-4a5a-b232-b83bdbe0de7d&resource=https%3A%2F%2Fmanagement.core.windows.net%2F&cid=e3ca22f4-59f7-4a5a-b232-b83bdbe0de7d&wsucxt=1&sso_reload=true