Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
https://floodlegal-my.sharepoint.com/:b:/g/personal/kylie_hallett_floodlegal_com_au/EQpBOsaNhlhFs8gEtPFDY68BpGE8a4DMlMr4X71WKk6UpQ?e=4%3aPPfj3k&at=9

Overview

General Information

Sample URL:	https://floodlegal-my.sharepoint.com/:b:/g/personal/kylie_hallett_floodlegal_com_au/EQpBOsaNhlhFs8gEtPFDY68BpGE8a4DMlMr4X71WKk6UpQ?e=4%3aPPfj3k&at=9
Analysis ID:	1531320

Detection

Score:	2
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

HTML body contains low number of good links

HTML title does not match URL

Stores files to the Windows start menu directory

Submit button contains javascript call

Classification

×

Process Tree

System is w10x64_ra

chrome.exe (PID: 2940 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7032 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 --field-trial-handle=1936,i,2546397638988206362,13203984276742432444,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6580 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://floodlegal-my.sharepoint.com/:b:/g/personal/kylie_hallett_floodlegal_com_au/EQpBOsaNhlhFs8gEtPFDY68BpGE8a4DMlMr4X71WKk6UpQ?e=4%3aPPfj3k&at=9" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: https://floodlegal-my.sharepoint.com/:b:/g/personal/kylie_hallett_floodlegal_com_au/EQpBOsaNhlhFs8gEtPFDY68BpGE8a4DMlMr4X71WKk6UpQ?e=4%3aPPfj3k&at=9

HTTP Parser: Number of links: 0

Source: https://floodlegal-my.sharepoint.com/:b:/g/personal/kylie_hallett_floodlegal_com_au/EQpBOsaNhlhFs8gEtPFDY68BpGE8a4DMlMr4X71WKk6UpQ?e=4%3aPPfj3k&at=9

HTTP Parser: Title: Sharing Link Validation does not match URL

Source: https://floodlegal-my.sharepoint.com/:b:/g/personal/kylie_hallett_floodlegal_com_au/EQpBOsaNhlhFs8gEtPFDY68BpGE8a4DMlMr4X71WKk6UpQ?e=4%3aPPfj3k&at=9

HTTP Parser: On click: javascript:WebForm_DoPostBackWithOptions(new WebForm_PostBackOptions("btnSubmitEmail", "", true, "", "", false, true))

Source: https://floodlegal-my.sharepoint.com/:b:/g/personal/kylie_hallett_floodlegal_com_au/EQpBOsaNhlhFs8gEtPFDY68BpGE8a4DMlMr4X71WKk6UpQ?e=4%3aPPfj3k&at=9

HTTP Parser: No <meta name="author".. found

Source: https://floodlegal-my.sharepoint.com/:b:/g/personal/kylie_hallett_floodlegal_com_au/EQpBOsaNhlhFs8gEtPFDY68BpGE8a4DMlMr4X71WKk6UpQ?e=4%3aPPfj3k&at=9

HTTP Parser: No <meta name="copyright".. found

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries

Source: unknown	HTTPS traffic detected: 104.102.46.111:443 -> 192.168.2.16:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.102.46.111:443 -> 192.168.2.16:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.16:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.16:49735 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 104.102.46.111
Source: unknown	TCP traffic detected without corresponding DNS query: 104.102.46.111
Source: unknown	TCP traffic detected without corresponding DNS query: 104.102.46.111
Source: unknown	TCP traffic detected without corresponding DNS query: 104.102.46.111
Source: unknown	TCP traffic detected without corresponding DNS query: 104.102.46.111
Source: unknown	TCP traffic detected without corresponding DNS query: 104.102.46.111
Source: unknown	TCP traffic detected without corresponding DNS query: 104.102.46.111
Source: unknown	TCP traffic detected without corresponding DNS query: 104.102.46.111
Source: unknown	TCP traffic detected without corresponding DNS query: 104.102.46.111
Source: unknown	TCP traffic detected without corresponding DNS query: 104.102.46.111
Source: unknown	TCP traffic detected without corresponding DNS query: 104.102.46.111
Source: unknown	TCP traffic detected without corresponding DNS query: 104.102.46.111
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 104.102.46.111
Source: unknown	TCP traffic detected without corresponding DNS query: 104.102.46.111
Source: unknown	TCP traffic detected without corresponding DNS query: 104.102.46.111
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 104.102.46.111
Source: unknown	TCP traffic detected without corresponding DNS query: 104.102.46.111
Source: unknown	TCP traffic detected without corresponding DNS query: 104.102.46.111
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108

Source: global traffic	DNS traffic detected: DNS query: floodlegal-my.sharepoint.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: m365cdn.nel.measure.office.net

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 104.102.46.111:443 -> 192.168.2.16:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.102.46.111:443 -> 192.168.2.16:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.16:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.16:49735 version: TLS 1.2

Source: classification engine

Classification label: clean2.win@17/6@14/165

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Program Files\Google\Chrome\Application\Dictionaries

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 --field-trial-handle=1936,i,2546397638988206362,13203984276742432444,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://floodlegal-my.sharepoint.com/:b:/g/personal/kylie_hallett_floodlegal_com_au/EQpBOsaNhlhFs8gEtPFDY68BpGE8a4DMlMr4X71WKk6UpQ?e=4%3aPPfj3k&at=9"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 --field-trial-handle=1936,i,2546397638988206362,13203984276742432444,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	Windows Management Instrumentation	1 Scripting	1 Process Injection	3 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Registry Run Keys / Startup Folder	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

⊘No Antivirus matches

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
dual-spo-0005.spo-msedge.net	0%	Virustotal		Browse
www.google.com	0%	Virustotal		Browse
m365cdn.nel.measure.office.net	0%	Virustotal		Browse

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
dual-spo-0005.spo-msedge.net	13.107.136.10	true	false	0%, Virustotal, Browse	unknown
www.google.com	142.250.186.36	true	false	0%, Virustotal, Browse	unknown
floodlegal-my.sharepoint.com	unknown	unknown	false		unknown
m365cdn.nel.measure.office.net	unknown	unknown	false	0%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://floodlegal-my.sharepoint.com/personal/kylie_hallett_floodlegal_com_au/_layouts/15/guestaccess.aspx?e=4%3aPPfj3k&at=9&share=EQpBOsaNhlhFs8gEtPFDY68BpGE8a4DMlMr4X71WKk6UpQ	false		unknown
https://floodlegal-my.sharepoint.com/:b:/g/personal/kylie_hallett_floodlegal_com_au/EQpBOsaNhlhFs8gEtPFDY68BpGE8a4DMlMr4X71WKk6UpQ?e=4%3aPPfj3k&at=9	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
142.250.186.35	unknown	United States		15169	GOOGLEUS	false
1.1.1.1	unknown	Australia		13335	CLOUDFLARENETUS	false
13.107.136.10	dual-spo-0005.spo-msedge.net	United States		8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.250.186.36	www.google.com	United States		15169	GOOGLEUS	false
142.250.74.206	unknown	United States		15169	GOOGLEUS	false
2.16.241.17	unknown	European Union		20940	AKAMAI-ASN1EU	false
142.250.185.138	unknown	United States		15169	GOOGLEUS	false
142.250.185.238	unknown	United States		15169	GOOGLEUS	false
2.19.126.146	unknown	European Union		16625	AKAMAI-ASUS	false
2.17.22.113	unknown	European Union		16625	AKAMAI-ASUS	false
142.251.168.84	unknown	United States		15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved		unknown	unknown	false
142.250.185.195	unknown	United States		15169	GOOGLEUS	false
2.19.122.9	unknown	European Union		16625	AKAMAI-ASUS	false
2.21.22.43	unknown	European Union		20940	AKAMAI-ASN1EU	false
142.250.184.234	unknown	United States		15169	GOOGLEUS	false

Private

IP
192.168.2.16

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1531320
Start date and time:	2024-10-11 02:01:25 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Sample URL:	https://floodlegal-my.sharepoint.com/:b:/g/personal/kylie_hallett_floodlegal_com_au/EQpBOsaNhlhFs8gEtPFDY68BpGE8a4DMlMr4X71WKk6UpQ?e=4%3aPPfj3k&at=9
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	13
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled
Analysis Mode:	stream
Analysis stop reason:	Timeout
Detection:	CLEAN
Classification:	clean2.win@17/6@14/165

Warnings

Exclude process from analysis (whitelisted): svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.186.35, 142.250.185.238, 142.251.168.84, 34.104.35.123, 2.21.22.43, 23.10.249.65, 2.19.122.9, 2.19.122.46, 142.250.185.138, 142.250.185.234, 216.58.212.138, 172.217.18.106, 216.58.206.42, 142.250.185.74, 216.58.206.74, 142.250.185.106, 142.250.186.106, 142.250.186.170, 142.250.184.202, 172.217.16.202, 142.250.185.202, 142.250.186.42, 172.217.18.10, 142.250.184.234
Excluded domains from analysis (whitelisted): clients2.google.com, accounts.google.com, edgedl.me.gvt1.com, content-autofill.googleapis.com, e40491.dscd.akamaiedge.net, clientservices.googleapis.com, 196257-ipv4v6e.farm.dprodmgd106.sharepointonline.com.akadns.net, res-1.cdn.office.net, clients.l.google.com, res-1.cdn.office.net-c.edgekey.net, res-1.cdn.office.net-c.edgekey.net.globalredir.akadns.net
Not all processes where analyzed, report is missing behavior information

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 10 23:01:59 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2673
Entropy (8bit):	3.96813741612607
Encrypted:	false
SSDEEP:
MD5:	5C691584A2C9819F799D77A2AC5005EB
SHA1:	C8EE368311EEB3CC2D68F0958D0BA211998E50AC
SHA-256:	E8418EEC179CCC4547D8C24CF6AD623785DF8A2293CD90E1D4AEDA7C432DC154
SHA-512:	A721F7FF7404BDC143EF4792AF096CE2F96872D4CF0A32D2EF78083C183F2A82CFA734B56FBEFD7438F5A83744B098B3EA88CEB0713D32C2D5FF0A06A8584659
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,....C..p...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IKY3.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VKY=.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VKY=.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VKY=............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VKY@............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............H.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e..C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 10 23:01:59 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2675
Entropy (8bit):	3.986162060339979
Encrypted:	false
SSDEEP:
MD5:	BC15A73432AA5570953C207BD54F67C0
SHA1:	FFAF65BC9E68EEF5AC3A9FCBB4F837232C97CA12
SHA-256:	798A9E3757BD78D0912B2854D60B723C2D60ADDC5E689EC1EBE27576D4549449
SHA-512:	1F6201165E6FDAFEF6C75430DA11E6E80BD1CC7893212286A1786C6716661A83186128D1BE2C5E97C58F48F3E3B90B0167FC1B6DA4DA63FC89BE88AF8AE2ECDF
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,........p...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IKY3.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VKY=.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VKY=.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VKY=............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VKY@............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............H.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2689
Entropy (8bit):	3.996101893615872
Encrypted:	false
SSDEEP:
MD5:	4E73DDB29BBD6B72D64965151A8DD569
SHA1:	4412E6A5594DFF2DD2F1D98AF83129FD6683A68D
SHA-256:	2033C27B51DE017EF0CF390F11AECEF2BFC46DE390240C76DABF0A8F19062C16
SHA-512:	C35B15A6EEB8C5786676B3CC4334B6D5946A71FE52C9D3333D3438A1A019C6AC92E555D3028FE2AD430C23ED2D09EA11A7A4FFE5CE603267BC945EE591B94ABE
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.....Y.04...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IKY3.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VKY=.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VKY=.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VKY=............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VFW.E...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............H.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 10 23:01:59 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.981685636874898
Encrypted:	false
SSDEEP:
MD5:	45731E35C145FCD1C819ED09882BECAD
SHA1:	5F25E95F8BEECC683DDA50222563120670D17057
SHA-256:	D62DA62B8D7C3C1D092DD5FBEEB418074CF1ED9A43126D003E5D2F2D17D0BA8C
SHA-512:	5C345F197990CE1E3A833FE5CD1B02FC46CC30FFD4BE370915B7EF6E8FBF925349CE2415A9C5B6F9BBC9A130C54B86FEB867D8BA7D5C1371A9C0CC64E2763821
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,........p...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IKY3.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VKY=.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VKY=.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VKY=............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VKY@............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............H.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 10 23:01:59 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.971468597438709
Encrypted:	false
SSDEEP:
MD5:	0DE6DEBB723E412690D042B0C02FBA42
SHA1:	6840F20F45BDCADE2F5B5F8ABFC218FEFD43273C
SHA-256:	FEF38BFFB53EE884C1BAE9AED42C371F8257CC218F6F6A2B7AE6DCE757FE7684
SHA-512:	C67E98AC6CA56A409E9ED55BAB6B1364B4F8F0C5B1701890DF3E14BFB1E927C14BF634558A44DE257AEB4D76CF371ABD33A2A8F037290B1B7C525F24C51CABCA
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.....4$.p...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IKY3.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VKY=.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VKY=.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VKY=............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VKY@............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............H.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 10 23:01:59 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.982772327042279
Encrypted:	false
SSDEEP:
MD5:	99BC0EA431695E1952151973FD8E5340
SHA1:	5031C73622148C1EB994A2AA35C72CBBF9E407FC
SHA-256:	56CC5E324BB564FAECE863AD9ED8F32761BEC6833F56F8424A20E8E1CEF9AF9F
SHA-512:	85310FBA775D8B08345220AB98A50191C5AB2FDB6E757A73B7E9F9FBD9E23395E0D53AE3721206384B7426B59B7F7C871900D39ABD5A5794FF424FF4DC3DB3D5
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,....JQ..p...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IKY3.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VKY=.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VKY=.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VKY=............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VKY@............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............H.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Static File Info

⊘No static file info