Edit tour

Windows Analysis Report
https://eu.knowbe4.com/auth/saml/91b6f5903c38

Overview

General Information

Sample URL:	https://eu.knowbe4.com/auth/saml/91b6f5903c38
Analysis ID:	1541363

Detection

Score:	1
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

HTML body contains low number of good links

HTML title does not match URL

Stores files to the Windows start menu directory

Classification

Process Tree

System is w10x64_ra

chrome.exe (PID: 2200 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6816 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 --field-trial-handle=1736,i,1474601239279698102,4990120423817348364,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6436 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://eu.knowbe4.com/auth/saml/91b6f5903c38" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: https://login.microsoftonline.com/c765d391-7aad-4c45-8362-df4ece7a3fd4/saml2/?SAMLRequest=fZJPT9wwEMW%2FSm4%2BOc4fJ9lYm5VSVpVWQIWg7aGXataZFAvHXjxOgW9PNqiCHtrr03u%2FN5qZLcFkT6qf4727xccZKSY9EYZovLvwjuYJwx2G30bjt9urjt3HeCIlBM7pg%2FNPR5Sp9pOABSDOLNHmx3qs2qzU5UZosPYI%2BoEl%2B4VsHJyx7xDrfxmXTkYHT36M3lnjcOXppq6Gss15AzBwqWXFN2Vd8GGUqLGBchzk2lcIlhz2Hfu5aTW0VQa8llmxJKqSH0epeZOVC0tik9dysRLNeHAUwcWOFVkheZ7xQn7Na1XkSpY%2FWPIdA61jFmnGkufJOlLnqo7NwSkPZEg5mJBU1Oquv75Si1HBn619jJz%2BnzkFH732lu22Z7dapwu7y2Wxn1BuxUdx%2B3apLwvksL%2Fx1uiXpLfWP10EhIgdi2FGlnz2YYL479o8zVfFDHxcrQonMLYfhoBETOzeWv9%2Bid0r	HTTP Parser: Number of links: 0
Source: https://login.microsoftonline.com/c765d391-7aad-4c45-8362-df4ece7a3fd4/saml2/?SAMLRequest=fZJPT9wwEMW%2FSm4%2BOc4fJ9lYm5VSVpVWQIWg7aGXataZFAvHXjxOgW9PNqiCHtrr03u%2FN5qZLcFkT6qf4727xccZKSY9EYZovLvwjuYJwx2G30bjt9urjt3HeCIlBM7pg%2FNPR5Sp9pOABSDOLNHmx3qs2qzU5UZosPYI%2BoEl%2B4VsHJyx7xDrfxmXTkYHT36M3lnjcOXppq6Gss15AzBwqWXFN2Vd8GGUqLGBchzk2lcIlhz2Hfu5aTW0VQa8llmxJKqSH0epeZOVC0tik9dysRLNeHAUwcWOFVkheZ7xQn7Na1XkSpY%2FWPIdA61jFmnGkufJOlLnqo7NwSkPZEg5mJBU1Oquv75Si1HBn619jJz%2BnzkFH732lu22Z7dapwu7y2Wxn1BuxUdx%2B3apLwvksL%2Fx1uiXpLfWP10EhIgdi2FGlnz2YYL479o8zVfFDHxcrQonMLYfhoBETOzeWv9%2Bid0r&sso_reload=true	HTTP Parser: Number of links: 0

Source: https://login.microsoftonline.com/c765d391-7aad-4c45-8362-df4ece7a3fd4/saml2/?SAMLRequest=fZJPT9wwEMW%2FSm4%2BOc4fJ9lYm5VSVpVWQIWg7aGXataZFAvHXjxOgW9PNqiCHtrr03u%2FN5qZLcFkT6qf4727xccZKSY9EYZovLvwjuYJwx2G30bjt9urjt3HeCIlBM7pg%2FNPR5Sp9pOABSDOLNHmx3qs2qzU5UZosPYI%2BoEl%2B4VsHJyx7xDrfxmXTkYHT36M3lnjcOXppq6Gss15AzBwqWXFN2Vd8GGUqLGBchzk2lcIlhz2Hfu5aTW0VQa8llmxJKqSH0epeZOVC0tik9dysRLNeHAUwcWOFVkheZ7xQn7Na1XkSpY%2FWPIdA61jFmnGkufJOlLnqo7NwSkPZEg5mJBU1Oquv75Si1HBn619jJz%2BnzkFH732lu22Z7dapwu7y2Wxn1BuxUdx%2B3apLwvksL%2Fx1uiXpLfWP10EhIgdi2FGlnz2YYL479o8zVfFDHxcrQonMLYfhoBETOzeWv9%2Bid0r	HTTP Parser: Title: Redirecting does not match URL
Source: https://login.microsoftonline.com/c765d391-7aad-4c45-8362-df4ece7a3fd4/saml2/?SAMLRequest=fZJPT9wwEMW%2FSm4%2BOc4fJ9lYm5VSVpVWQIWg7aGXataZFAvHXjxOgW9PNqiCHtrr03u%2FN5qZLcFkT6qf4727xccZKSY9EYZovLvwjuYJwx2G30bjt9urjt3HeCIlBM7pg%2FNPR5Sp9pOABSDOLNHmx3qs2qzU5UZosPYI%2BoEl%2B4VsHJyx7xDrfxmXTkYHT36M3lnjcOXppq6Gss15AzBwqWXFN2Vd8GGUqLGBchzk2lcIlhz2Hfu5aTW0VQa8llmxJKqSH0epeZOVC0tik9dysRLNeHAUwcWOFVkheZ7xQn7Na1XkSpY%2FWPIdA61jFmnGkufJOlLnqo7NwSkPZEg5mJBU1Oquv75Si1HBn619jJz%2BnzkFH732lu22Z7dapwu7y2Wxn1BuxUdx%2B3apLwvksL%2Fx1uiXpLfWP10EhIgdi2FGlnz2YYL479o8zVfFDHxcrQonMLYfhoBETOzeWv9%2Bid0r&sso_reload=true	HTTP Parser: Title: Sign in to your account does not match URL

Source: https://login.microsoftonline.com/c765d391-7aad-4c45-8362-df4ece7a3fd4/saml2/?SAMLRequest=fZJPT9wwEMW%2FSm4%2BOc4fJ9lYm5VSVpVWQIWg7aGXataZFAvHXjxOgW9PNqiCHtrr03u%2FN5qZLcFkT6qf4727xccZKSY9EYZovLvwjuYJwx2G30bjt9urjt3HeCIlBM7pg%2FNPR5Sp9pOABSDOLNHmx3qs2qzU5UZosPYI%2BoEl%2B4VsHJyx7xDrfxmXTkYHT36M3lnjcOXppq6Gss15AzBwqWXFN2Vd8GGUqLGBchzk2lcIlhz2Hfu5aTW0VQa8llmxJKqSH0epeZOVC0tik9dysRLNeHAUwcWOFVkheZ7xQn7Na1XkSpY%2FWPIdA61jFmnGkufJOlLnqo7NwSkPZEg5mJBU1Oquv75Si1HBn619jJz%2BnzkFH732lu22Z7dapwu7y2Wxn1BuxUdx%2B3apLwvksL%2Fx1uiXpLfWP10EhIgdi2FGlnz2YYL479o8zVfFDHxcrQonMLYfhoBETOzeWv9%2Bid0r&sso_reload=true

HTTP Parser: <input type="password" .../> found

HTTP Parser: No favicon

Source: https://login.microsoftonline.com/c765d391-7aad-4c45-8362-df4ece7a3fd4/saml2/?SAMLRequest=fZJPT9wwEMW%2FSm4%2BOc4fJ9lYm5VSVpVWQIWg7aGXataZFAvHXjxOgW9PNqiCHtrr03u%2FN5qZLcFkT6qf4727xccZKSY9EYZovLvwjuYJwx2G30bjt9urjt3HeCIlBM7pg%2FNPR5Sp9pOABSDOLNHmx3qs2qzU5UZosPYI%2BoEl%2B4VsHJyx7xDrfxmXTkYHT36M3lnjcOXppq6Gss15AzBwqWXFN2Vd8GGUqLGBchzk2lcIlhz2Hfu5aTW0VQa8llmxJKqSH0epeZOVC0tik9dysRLNeHAUwcWOFVkheZ7xQn7Na1XkSpY%2FWPIdA61jFmnGkufJOlLnqo7NwSkPZEg5mJBU1Oquv75Si1HBn619jJz%2BnzkFH732lu22Z7dapwu7y2Wxn1BuxUdx%2B3apLwvksL%2Fx1uiXpLfWP10EhIgdi2FGlnz2YYL479o8zVfFDHxcrQonMLYfhoBETOzeWv9%2Bid0r	HTTP Parser: No <meta name="author".. found
Source: https://login.microsoftonline.com/c765d391-7aad-4c45-8362-df4ece7a3fd4/saml2/?SAMLRequest=fZJPT9wwEMW%2FSm4%2BOc4fJ9lYm5VSVpVWQIWg7aGXataZFAvHXjxOgW9PNqiCHtrr03u%2FN5qZLcFkT6qf4727xccZKSY9EYZovLvwjuYJwx2G30bjt9urjt3HeCIlBM7pg%2FNPR5Sp9pOABSDOLNHmx3qs2qzU5UZosPYI%2BoEl%2B4VsHJyx7xDrfxmXTkYHT36M3lnjcOXppq6Gss15AzBwqWXFN2Vd8GGUqLGBchzk2lcIlhz2Hfu5aTW0VQa8llmxJKqSH0epeZOVC0tik9dysRLNeHAUwcWOFVkheZ7xQn7Na1XkSpY%2FWPIdA61jFmnGkufJOlLnqo7NwSkPZEg5mJBU1Oquv75Si1HBn619jJz%2BnzkFH732lu22Z7dapwu7y2Wxn1BuxUdx%2B3apLwvksL%2Fx1uiXpLfWP10EhIgdi2FGlnz2YYL479o8zVfFDHxcrQonMLYfhoBETOzeWv9%2Bid0r&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://login.microsoftonline.com/c765d391-7aad-4c45-8362-df4ece7a3fd4/saml2/?SAMLRequest=fZJPT9wwEMW%2FSm4%2BOc4fJ9lYm5VSVpVWQIWg7aGXataZFAvHXjxOgW9PNqiCHtrr03u%2FN5qZLcFkT6qf4727xccZKSY9EYZovLvwjuYJwx2G30bjt9urjt3HeCIlBM7pg%2FNPR5Sp9pOABSDOLNHmx3qs2qzU5UZosPYI%2BoEl%2B4VsHJyx7xDrfxmXTkYHT36M3lnjcOXppq6Gss15AzBwqWXFN2Vd8GGUqLGBchzk2lcIlhz2Hfu5aTW0VQa8llmxJKqSH0epeZOVC0tik9dysRLNeHAUwcWOFVkheZ7xQn7Na1XkSpY%2FWPIdA61jFmnGkufJOlLnqo7NwSkPZEg5mJBU1Oquv75Si1HBn619jJz%2BnzkFH732lu22Z7dapwu7y2Wxn1BuxUdx%2B3apLwvksL%2Fx1uiXpLfWP10EhIgdi2FGlnz2YYL479o8zVfFDHxcrQonMLYfhoBETOzeWv9%2Bid0r&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://login.microsoftonline.com/c765d391-7aad-4c45-8362-df4ece7a3fd4/saml2/?SAMLRequest=fZJPT9wwEMW%2FSm4%2BOc4fJ9lYm5VSVpVWQIWg7aGXataZFAvHXjxOgW9PNqiCHtrr03u%2FN5qZLcFkT6qf4727xccZKSY9EYZovLvwjuYJwx2G30bjt9urjt3HeCIlBM7pg%2FNPR5Sp9pOABSDOLNHmx3qs2qzU5UZosPYI%2BoEl%2B4VsHJyx7xDrfxmXTkYHT36M3lnjcOXppq6Gss15AzBwqWXFN2Vd8GGUqLGBchzk2lcIlhz2Hfu5aTW0VQa8llmxJKqSH0epeZOVC0tik9dysRLNeHAUwcWOFVkheZ7xQn7Na1XkSpY%2FWPIdA61jFmnGkufJOlLnqo7NwSkPZEg5mJBU1Oquv75Si1HBn619jJz%2BnzkFH732lu22Z7dapwu7y2Wxn1BuxUdx%2B3apLwvksL%2Fx1uiXpLfWP10EhIgdi2FGlnz2YYL479o8zVfFDHxcrQonMLYfhoBETOzeWv9%2Bid0r&sso_reload=true	HTTP Parser: No <meta name="author".. found

Source: https://login.microsoftonline.com/c765d391-7aad-4c45-8362-df4ece7a3fd4/saml2/?SAMLRequest=fZJPT9wwEMW%2FSm4%2BOc4fJ9lYm5VSVpVWQIWg7aGXataZFAvHXjxOgW9PNqiCHtrr03u%2FN5qZLcFkT6qf4727xccZKSY9EYZovLvwjuYJwx2G30bjt9urjt3HeCIlBM7pg%2FNPR5Sp9pOABSDOLNHmx3qs2qzU5UZosPYI%2BoEl%2B4VsHJyx7xDrfxmXTkYHT36M3lnjcOXppq6Gss15AzBwqWXFN2Vd8GGUqLGBchzk2lcIlhz2Hfu5aTW0VQa8llmxJKqSH0epeZOVC0tik9dysRLNeHAUwcWOFVkheZ7xQn7Na1XkSpY%2FWPIdA61jFmnGkufJOlLnqo7NwSkPZEg5mJBU1Oquv75Si1HBn619jJz%2BnzkFH732lu22Z7dapwu7y2Wxn1BuxUdx%2B3apLwvksL%2Fx1uiXpLfWP10EhIgdi2FGlnz2YYL479o8zVfFDHxcrQonMLYfhoBETOzeWv9%2Bid0r	HTTP Parser: No <meta name="copyright".. found
Source: https://login.microsoftonline.com/c765d391-7aad-4c45-8362-df4ece7a3fd4/saml2/?SAMLRequest=fZJPT9wwEMW%2FSm4%2BOc4fJ9lYm5VSVpVWQIWg7aGXataZFAvHXjxOgW9PNqiCHtrr03u%2FN5qZLcFkT6qf4727xccZKSY9EYZovLvwjuYJwx2G30bjt9urjt3HeCIlBM7pg%2FNPR5Sp9pOABSDOLNHmx3qs2qzU5UZosPYI%2BoEl%2B4VsHJyx7xDrfxmXTkYHT36M3lnjcOXppq6Gss15AzBwqWXFN2Vd8GGUqLGBchzk2lcIlhz2Hfu5aTW0VQa8llmxJKqSH0epeZOVC0tik9dysRLNeHAUwcWOFVkheZ7xQn7Na1XkSpY%2FWPIdA61jFmnGkufJOlLnqo7NwSkPZEg5mJBU1Oquv75Si1HBn619jJz%2BnzkFH732lu22Z7dapwu7y2Wxn1BuxUdx%2B3apLwvksL%2Fx1uiXpLfWP10EhIgdi2FGlnz2YYL479o8zVfFDHxcrQonMLYfhoBETOzeWv9%2Bid0r&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://login.microsoftonline.com/c765d391-7aad-4c45-8362-df4ece7a3fd4/saml2/?SAMLRequest=fZJPT9wwEMW%2FSm4%2BOc4fJ9lYm5VSVpVWQIWg7aGXataZFAvHXjxOgW9PNqiCHtrr03u%2FN5qZLcFkT6qf4727xccZKSY9EYZovLvwjuYJwx2G30bjt9urjt3HeCIlBM7pg%2FNPR5Sp9pOABSDOLNHmx3qs2qzU5UZosPYI%2BoEl%2B4VsHJyx7xDrfxmXTkYHT36M3lnjcOXppq6Gss15AzBwqWXFN2Vd8GGUqLGBchzk2lcIlhz2Hfu5aTW0VQa8llmxJKqSH0epeZOVC0tik9dysRLNeHAUwcWOFVkheZ7xQn7Na1XkSpY%2FWPIdA61jFmnGkufJOlLnqo7NwSkPZEg5mJBU1Oquv75Si1HBn619jJz%2BnzkFH732lu22Z7dapwu7y2Wxn1BuxUdx%2B3apLwvksL%2Fx1uiXpLfWP10EhIgdi2FGlnz2YYL479o8zVfFDHxcrQonMLYfhoBETOzeWv9%2Bid0r&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://login.microsoftonline.com/c765d391-7aad-4c45-8362-df4ece7a3fd4/saml2/?SAMLRequest=fZJPT9wwEMW%2FSm4%2BOc4fJ9lYm5VSVpVWQIWg7aGXataZFAvHXjxOgW9PNqiCHtrr03u%2FN5qZLcFkT6qf4727xccZKSY9EYZovLvwjuYJwx2G30bjt9urjt3HeCIlBM7pg%2FNPR5Sp9pOABSDOLNHmx3qs2qzU5UZosPYI%2BoEl%2B4VsHJyx7xDrfxmXTkYHT36M3lnjcOXppq6Gss15AzBwqWXFN2Vd8GGUqLGBchzk2lcIlhz2Hfu5aTW0VQa8llmxJKqSH0epeZOVC0tik9dysRLNeHAUwcWOFVkheZ7xQn7Na1XkSpY%2FWPIdA61jFmnGkufJOlLnqo7NwSkPZEg5mJBU1Oquv75Si1HBn619jJz%2BnzkFH732lu22Z7dapwu7y2Wxn1BuxUdx%2B3apLwvksL%2Fx1uiXpLfWP10EhIgdi2FGlnz2YYL479o8zVfFDHxcrQonMLYfhoBETOzeWv9%2Bid0r&sso_reload=true	HTTP Parser: No <meta name="copyright".. found

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.16:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.16:49750 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212

Source: global traffic	DNS traffic detected: DNS query: eu.knowbe4.com
Source: global traffic	DNS traffic detected: DNS query: login.microsoftonline.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: identity.nel.measure.office.net
Source: global traffic	DNS traffic detected: DNS query: aadcdn.msftauth.net
Source: global traffic	DNS traffic detected: DNS query: aadcdn.msftauthimages.net
Source: global traffic	DNS traffic detected: DNS query: autologon.microsoftazuread-sso.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49700
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49699 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49699
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.16:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.16:49750 version: TLS 1.2

Source: classification engine

Classification label: clean1.win@18/21@24/206

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 --field-trial-handle=1736,i,1474601239279698102,4990120423817348364,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://eu.knowbe4.com/auth/saml/91b6f5903c38"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 --field-trial-handle=1736,i,1474601239279698102,4990120423817348364,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact

Name	IP	Active	Malicious	Reputation
eu.knowbe4.com	52.222.236.7	true	false	unknown
s-part-0017.t-0009.t-msedge.net	13.107.246.45	true	false	unknown
sni1gl.wpc.omegacdn.net	152.199.21.175	true	false	unknown
s-part-0017.t-0009.fb-t-msedge.net	13.107.253.45	true	false	unknown
www.google.com	142.250.186.132	true	false	unknown
s-part-0032.t-0009.t-msedge.net	13.107.246.60	true	false	unknown
autologon.microsoftazuread-sso.com	20.190.159.23	true	false	unknown
identity.nel.measure.office.net	unknown	unknown	false	unknown
aadcdn.msftauth.net	unknown	unknown	false	unknown
login.microsoftonline.com	unknown	unknown	false	unknown
aadcdn.msftauthimages.net	unknown	unknown	false	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.110.84	unknown	United States	15169	GOOGLEUS	false
142.250.186.67	unknown	United States	15169	GOOGLEUS	false
13.107.246.45	s-part-0017.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
13.107.253.45	s-part-0017.t-0009.fb-t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
20.190.159.71	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
13.107.246.60	s-part-0032.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.250.185.106	unknown	United States	15169	GOOGLEUS	false
2.19.126.146	unknown	European Union	16625	AKAMAI-ASUS	false
216.58.206.46	unknown	United States	15169	GOOGLEUS	false
20.190.159.23	autologon.microsoftazuread-sso.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
2.19.126.143	unknown	European Union	16625	AKAMAI-ASUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
152.199.21.175	sni1gl.wpc.omegacdn.net	United States	15133	EDGECASTUS	false
142.250.186.131	unknown	United States	15169	GOOGLEUS	false
142.250.186.132	www.google.com	United States	15169	GOOGLEUS	false
142.250.186.110	unknown	United States	15169	GOOGLEUS	false
20.190.160.20	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
40.126.31.69	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
52.222.236.7	eu.knowbe4.com	United States	16509	AMAZON-02US	false

Private

IP
192.168.2.16

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1541363
Start date and time:	2024-10-24 18:21:11 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Sample URL:	https://eu.knowbe4.com/auth/saml/91b6f5903c38
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	13
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled
Analysis Mode:	stream
Analysis stop reason:	Timeout
Detection:	CLEAN
Classification:	clean1.win@18/21@24/206

Warnings

Exclude process from analysis (whitelisted): svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.186.131, 216.58.206.46, 142.250.110.84, 34.104.35.123, 20.190.159.71, 20.190.159.2, 20.190.159.23, 40.126.31.71, 40.126.31.73, 40.126.31.69, 20.190.159.68, 20.190.159.73, 88.221.110.91, 199.232.210.172, 2.19.126.143, 2.19.126.146, 20.190.160.20, 40.126.32.140, 20.190.160.17, 40.126.32.133, 40.126.32.136, 20.190.160.14, 40.126.32.138, 40.126.32.72
Excluded domains from analysis (whitelisted): www.tm.ak.prd.aadg.trafficmanager.net, prdv4a.aadg.msidentity.com, fs.microsoft.com, accounts.google.com, aadcdnoriginwus2.azureedge.net, www.tm.v4.a.prd.aadg.akadns.net, ctldl.windowsupdate.com, clientservices.googleapis.com, aadcdn.msauth.net, ak.privatelink.msidentity.com, a1894.dscb.akamai.net, firstparty-azurefd-prod.trafficmanager.net, login.msa.msidentity.com, clients2.google.com, edgedl.me.gvt1.com, nel.measure.office.net.edgesuite.net, login.live.com, aadcdnoriginwus2.afd.azureedge.net, login.mso.msidentity.com, clients.l.google.com, www.tm.lg.prod.aadmsa.trafficmanager.net
Not all processes where analyzed, report is missing behavior information
VT rate limit hit for: https://eu.knowbe4.com/auth/saml/91b6f5903c38

LLM Input / Output

Input	Output
URL: https://login.microsoftonline.com/c765d391-7aad-4c45-8362-df4ece7a3fd4/saml2/?SAMLRequest=fZJPT9wwEMW%2FSm4%2BOc4fJ9lYm5VSVpVWQIWg7aGXataZFAvHXjxOgW9PNqiCHtrr03u%2FN5qZLcFkT6qf4727xccZKSY9EYZovLvwjuYJwx2G30bjt9urjt3HeCIlBM7pg%2FNPR5Sp9pOABSDOLNHmx3qs2qzU5 Model: claude-3-haiku-20240307	```json { "contains_trigger_text": true, "trigger_text": "VIEW SHARED FILE", "prominent_button_name": "VIEW SHARED FILE", "text_input_field_labels": [ "Email Address" ], "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false }

URL: https://login.microsoftonline.com/c765d391-7aad-4c45-8362-df4ece7a3fd4/saml2/?SAMLRequest=fZJPT9wwEMW%2FSm4%2BOc4fJ9lYm5VSVpVWQIWg7aGXataZFAvHXjxOgW9PNqiCHtrr03u%2FN5qZLcFkT6qf4727xccZKSY9EYZovLvwjuYJwx2G30bjt9urjt3HeCIlBM7pg%2FNPR5Sp9pOABSDOLNHmx3qs2qzU5 Model: claude-3-haiku-20240307	```json { "brands": [] }
	```json { "brands": [] }
URL: https://login.microsoftonline.com/c765d391-7aad-4c45-8362-df4ece7a3fd4/saml2/?SAMLRequest=fZJPT9wwEMW%2FSm4%2BOc4fJ9lYm5VSVpVWQIWg7aGXataZFAvHXjxOgW9PNqiCHtrr03u%2FN5qZLcFkT6qf4727xccZKSY9EYZovLvwjuYJwx2G30bjt9urjt3HeCIlBM7pg%2FNPR5Sp9pOABSDOLNHmx3qs2qzU5 Model: claude-3-haiku-20240307	```json { "contains_trigger_text": true, "trigger_text": "Sign in", "prominent_button_name": "Next", "text_input_field_labels": [ "Email, phone, or Skype" ], "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false }

URL: https://login.microsoftonline.com/c765d391-7aad-4c45-8362-df4ece7a3fd4/saml2/?SAMLRequest=fZJPT9wwEMW%2FSm4%2BOc4fJ9lYm5VSVpVWQIWg7aGXataZFAvHXjxOgW9PNqiCHtrr03u%2FN5qZLcFkT6qf4727xccZKSY9EYZovLvwjuYJwx2G30bjt9urjt3HeCIlBM7pg%2FNPR5Sp9pOABSDOLNHmx3qs2qzU5 Model: claude-3-haiku-20240307	```json { "brands": [ "Miller" ] }
	```json { "brands": [ "Miller" ] }

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 24 15:21:43 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2673
Entropy (8bit):	3.9881213968944964
Encrypted:	false
SSDEEP:
MD5:	1F0EF6D6D6511268ACF03F44D365311E
SHA1:	4A44A9A94822BA5282109FDC175CEBF7CE13813F
SHA-256:	B0C9DAE0110AD039B234CF87882B6C46AA4A1E528777E35C471021A1D1968B49
SHA-512:	8B8C5AE41E70C21CD9874532E0576D604FED8FE1C31763044FE30AD20433B30ABD336A4CCE2884A483EF1C58767C568085F51B3D19B049E5DB67B04A647A907E
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,....\|...0&..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IXY......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VXY......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VXY......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VXY............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VXY.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............-'.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 24 15:21:42 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2675
Entropy (8bit):	4.004327042050754
Encrypted:	false
SSDEEP:
MD5:	AC5531858A8030635A7465A3BC586AED
SHA1:	B5371BCA051FB8581ED14AB3DF1497A1A4489B19
SHA-256:	D7F64F338098C13C15D0AF7C0B6ABE4FE019D98935C1E12743E4A7D79C776B60
SHA-512:	95E12B13992A61FE2674735C6E4847F07C053F2331B5CD3F613B1A158324C45BAC383B6DFE1227F067F4F7B2AF94E57983162CD43EC521F889BC3CA0289609E4
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,....TL!.0&..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IXY......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VXY......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VXY......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VXY............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VXY.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............-'.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2689
Entropy (8bit):	4.013136759668211
Encrypted:	false
SSDEEP:
MD5:	3BFB86F7E90617F317564B4BD473EF20
SHA1:	ACFE0EF199AF9DB528A2A5E19D5A9E61C32C829D
SHA-256:	A777E98833568992613FE779F5620F27732859B656E362870FDD8B2AC6A47D26
SHA-512:	58C4FD6A2F342969C69B9C55DA72AFE8248F99D02D02C9D856D7D41EDE0FE06FF4C2A913AF0337C4EEF1C3835CE69A5A7ED4ED212A449ACA1AF44C48FFD3C5F2
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.....Y.04...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IXY......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VXY......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VXY......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VXY............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VFW.E...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............-'.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 24 15:21:42 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	4.00315576377875
Encrypted:	false
SSDEEP:
MD5:	BCE0C3A1C473C9EB2FE9965B4573A010
SHA1:	7235A283078140D4C4C948828CB0F34763C97649
SHA-256:	C6BEE527E534188EAE0E0FA026D61AD33DF5840D7973F8ACE45FC8387DB7F3FC
SHA-512:	3B257621E4801A96AC8555EC22B645FEAAC6784A6235EC0EC35095FE0B34152727E11E233FB501E665DBDF04A22BBCFBC70021F14208872A296700B43CBC35C7
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,........0&..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IXY......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VXY......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VXY......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VXY............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VXY.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............-'.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 24 15:21:43 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.990114087512122
Encrypted:	false
SSDEEP:
MD5:	713D3AD54C57F0165E57FED66F684C1B
SHA1:	70BD6DACC3BF19FF78C3BB7B7768AD81BCEAF818
SHA-256:	D651C69EEC923DF4C3F5B028842BF1B5C0A6134C48045A0CEDBA392BF330E8F1
SHA-512:	FAA918B431A5B5F5B0708F23809FD5C6400353887DCA0B8A1C026FA290684B5D6BAF673A9811276437386C0725371E69C2FC70C748E67407CF6881A4CB761FBA
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.....P(.0&..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IXY......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VXY......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VXY......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VXY............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VXY.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............-'.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 24 15:21:42 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	4.00164821811518
Encrypted:	false
SSDEEP:
MD5:	29C4B0A90BE10FEC5CE2832ADF928863
SHA1:	ECA0C1C70A351C7FCAA6D07FE23616F64081570C
SHA-256:	0F810F8E4D6B9D12569078FDF818674F5B53465163546A2B3AE1F5AF10FCA987
SHA-512:	6650DCC7361396ECAF063B13E6CD7BD04FF6DD43EC7812257B89DAFA265732B101A2A9B55975F43ED070C5F909C2449EC890189587D2A9A535DD36BFB4051EE6
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.....`..0&..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IXY......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VXY......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VXY......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VXY............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VXY.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............-'.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Chrome Cache Entry: 102

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (64616)
Category:	downloaded
Size (bytes):	449728
Entropy (8bit):	5.448588781180164
Encrypted:	false
SSDEEP:
MD5:	40B17FF1AA4D4490F7382A25F23C2DC7
SHA1:	401F26BDF93A14779CA131C29E385C97F1FF9830
SHA-256:	9019F3CFFB86BF28F83D0E85EEBF21FD0A37C4BF159EDFCB6F18D0DF12CB5E02
SHA-512:	2A197A7165E9EB5BF3860BDD3845A8D7F6A47CAEF801DB15E1D21906329D6C79F32BF28CBAFC83C2FAA131F71C3F81FB9668116AAF999644AB6887F61508FE48
Malicious:	false
Reputation:	unknown
URL:	https://aadcdn.msftauth.net/shared/1.0/content/js/ConvergedLogin_PCore_QLF_8apNRJD3OCol8jwtxw2.js
Preview:	/!. ------------------------------------------- START OF THIRD PARTY NOTICE -----------------------------------------. * . * This file is based on or incorporates material from the projects listed below (Third Party IP). The original copyright notice and the license under which Microsoft received such Third Party IP, are set forth below. Such licenses and notices are provided for informational purposes only. Microsoft licenses the Third Party IP to you under the licensing terms for the Microsoft product. Microsoft reserves all other rights not expressly granted under this agreement, whether by implication, estoppel or otherwise.. * . * json2.js (2016-05-01). * https://github.com/douglascrockford/JSON-js. * License: Public Domain. * . * Provided for Informational Purposes Only. * . * ----------------------------------------------- END OF THIRD PARTY NOTICE ------------------------------------------. */!function(e){function n(n){for(var t,i,o=n[0],r=n[1],s=0,c=[];s<o.length;s++)

Chrome Cache Entry: 103

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (14782)
Category:	dropped
Size (bytes):	15755
Entropy (8bit):	5.366543080044668
Encrypted:	false
SSDEEP:
MD5:	630831903F4BA9060856520624E34CFC
SHA1:	36DC15B9CCC3FC8EF627354BF55EF44EBD10E203
SHA-256:	BC6804D058D5BD5B24FC04E479FC8973BEF5D3EFEAFAA9C19C60A009BF0FAC0B
SHA-512:	1B0759972BBAB0B1A11D54849051E6782600B74FADB1CAF1BD58D214F484E35154907CA7F396EDB1C81A7CDC6F264D138267FB58FD89E1BA3A4D67366EE7E8B0
Malicious:	false
Reputation:	unknown
Preview:	/!. ------------------------------------------- START OF THIRD PARTY NOTICE -----------------------------------------. * . * This file is based on or incorporates material from the projects listed below (Third Party IP). The original copyright notice and the license under which Microsoft received such Third Party IP, are set forth below. Such licenses and notices are provided for informational purposes only. Microsoft licenses the Third Party IP to you under the licensing terms for the Microsoft product. Microsoft reserves all other rights not expressly granted under this agreement, whether by implication, estoppel or otherwise.. * . * json2.js (2016-05-01). * https://github.com/douglascrockford/JSON-js. * License: Public Domain. * . * Provided for Informational Purposes Only. * . * ----------------------------------------------- END OF THIRD PARTY NOTICE ------------------------------------------. */.(window.webpackJsonp=window.webpackJsonp\|\|[]).push([[17],{519:function(e,n,s

Chrome Cache Entry: 77

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 280 x 60, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	2884
Entropy (8bit):	7.3137761943652295
Encrypted:	false
SSDEEP:
MD5:	ED9639384619BCC6A110F1E101CC2599
SHA1:	44471CBB873C6BCCBD6D4B1E369ACA92AA0C207A
SHA-256:	890CD1393BD68BD180A97E74E10B6423185637CACDADCDD34587C6DD1049C59A
SHA-512:	18494E2BAFADED42894F445D086EA562C667957B1CDBD784CEA99280D1A35DCA07E3C9C9993B095F272F0C39AFF1F8028A8E79AFF7D95F1FA12467CBB6240005
Malicious:	false
Reputation:	unknown
URL:	https://aadcdn.msftauthimages.net/c1c6b6c8-uvjnfykh4vzbvstsbtd99mgdbv2xzydewk-bgf7-kws/logintenantbranding/0/bannerlogo?ts=636540479213321993
Preview:	.PNG........IHDR.......<.......U*....sRGB.........gAMA......a.....PLTE...hachbdicejdejdfkegleglfhnginhinhjoikpikpjkqklqkmsmotmotnounpuoqvpqvprwqsxqsxrsxrtysuztu{uv{uw\|vx~xy.xz.y{...............................................................!.."..$..%..&..(..)..)..-..,../..0..2..5..6..7..8..9..<..=..=..@..B..E..I..L..N..P..R..R..T..X..Y..].._..`..b..d..e..f..h..j..j..l..n..o..p..r..s..t..u..v..y..z..\|..~..~..z{.z\|.{}.\|~.}..~..~.......................................................................................................................................................................................................................................................................................................................................................................................................................:....tRNS......................................................................................................................................................

Chrome Cache Entry: 78

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 141866
Category:	dropped
Size (bytes):	49804
Entropy (8bit):	7.994672288751266
Encrypted:	true
SSDEEP:
MD5:	6DE768A4DF1E0D0061CDB52EF06346C4
SHA1:	3829A667B97668008023DDA98F4C0772174C8EF6
SHA-256:	58732EEE2ED9091F4F5776DC8A8A14116CBE5A2BA1CCDA0256896BAB08A52128
SHA-512:	CC6966D2C2B43E762750102E734DA6B88D7BFB92DDB5D482EE25029337D95E997466E83001586F2B63DAEE890B5F3188E8EC0F1B084D5EB67CFEA55EDDFAD47D
Malicious:	false
Reputation:	unknown
Preview:	...........m[.8.0........OL....;w..nf.0.ff.X.'V......4.r~........=........,..JU.......T~.l..?..E.....X..\|t~P9...TN..G..?^.~.............Xx.0..Q..Fa4.#7.q...F.;......4...Q.W&~.@....O.T.y.37J.+Ggf...P....Pz.N...>..a.D..<.m./A,...Q.....WN.Q...8.Db$.G.H<...'....J,..8..{nG.2@HYkL../......=.pL....A?.&Ng.i,......2lo...$.<.3...?~pW..=...L..&x.QR.u3..#6q2....U.Y1..".M. .<W."7@......w..."H,@......0..P....p:...[...E].A..%..V.K\.......F.ir.}.Lc{s..O.g..(\|.........9o..A.t.K....Wv.l6..T.......t.........+..........-w {l..g...V..\=W.j.oaT}t.J`E..$W......;.k.\.t.w~}".....jf..W..."..a..0y........@.T.1.G0........Y_....../..........@.....]+....q\.cR.....t.3S-5g....'U.j.d......y.n,:).\|.?.FW...d...\|.......*.`.3....kMKf...#..,DM.TY+..g.........e+.>...{y..N/..g-#FV.V.p.......Xs.(..{..}..-.O..H=."...........8M.g..!H..0.~.Tdf.;...$D%N .)..!..V...'r\.... ...&....J\|."Nd%D:uw:.<W.+...H&.Z...L=..U.v....J.t.0%+...U..3M....y...L..G...p='.....pB"-..\|.....j .a".i=O.R Q2..."...

Chrome Cache Entry: 79

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (3450), with CRLF line terminators
Category:	downloaded
Size (bytes):	3452
Entropy (8bit):	5.117912766689607
Encrypted:	false
SSDEEP:
MD5:	CB06E9A552B197D5C0EA600B431A3407
SHA1:	04E167433F2F1038C78F387F8A166BB6542C2008
SHA-256:	1F4EDBD2416E15BD82E61BA1A8E5558D44C4E914536B1B07712181BF57934021
SHA-512:	1B4A3919E442EE4D2F30AE29B1C70DF7274E5428BCB6B3EDD84DCB92D60A0D6BDD9FA6D9DDE8EAB341FF4C12DE00A50858BF1FC5B6135B71E9E177F5A9ED34B9
Malicious:	false
Reputation:	unknown
URL:	https://login.live.com/Me.htm?v=3
Preview:	<script type="text/javascript">!function(t,e){for(var s in e)t[s]=e[s]}(this,function(t){function e(n){if(s[n])return s[n].exports;var i=s[n]={exports:{},id:n,loaded:!1};return t[n].call(i.exports,i,i.exports,e),i.loaded=!0,i.exports}var s={};return e.m=t,e.c=s,e.p="",e(0)}([function(t,e){function s(t){for(var e=f[S],s=0,n=e.length;s<n;++s)if(e[s]===t)return!0;return!1}function n(t){if(!t)return null;for(var e=t+"=",s=document.cookie.split(";"),n=0,i=s.length;n<i;n++){var a=s[n].replace(/^\s(\w+)\s=\s*/,"$1=").replace(/(\s+$)/,"");if(0===a.indexOf(e))return a.substring(e.length)}return null}function i(t,e,s){if(t)for(var n=t.split(":"),i=null,a=0,r=n.length;a<r;++a){var c=null,S=n[a].split("$");if(0===a&&(i=parseInt(S.shift()),!i))return;var l=S.length;if(l>=1){var p=o(i,S[0]);if(!p\|\|s[p])continue;c={signInName:p,idp:"msa",isSignedIn:!0}}if(l>=3&&(c.firstName=o(i,S[1]),c.lastName=o(i,S[2])),l>=4){var f=S[3],d=f.split("\|");c.otherHashedAliases=d}if(l>=5){var h=parseInt(S[4],16);h&&(c.

Chrome Cache Entry: 80

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 352 x 3
Category:	dropped
Size (bytes):	2672
Entropy (8bit):	6.640973516071413
Encrypted:	false
SSDEEP:
MD5:	166DE53471265253AB3A456DEFE6DA23
SHA1:	17C6DF4D7CCF1FA2C9EFD716FBAE0FC2C71C8D6D
SHA-256:	A46201581A7C7C667FD42787CD1E9ADF2F6BF809EFB7596E61A03E8DBA9ADA13
SHA-512:	80978C1D262BC225A8BA1758DF546E27B5BE8D84CBCF7E6044910E5E05E04AFFEFEC3C0DA0818145EB8A917E1A8D90F4BAC833B64A1F6DE97AD3D5FC80A02308
Malicious:	false
Reputation:	unknown
Preview:	GIF89a`............!..NETSCAPE2.0.....!.......,....`.....6......P.l.......H....I..:qJ......k....`BY..L..&...!.......,....0.............<....[.\K8j.tr.g..!.......,....3............^;...\UK.]\.%.V.c...!.......,....7........`....lo...[.a..*Rw~i...!.......,....;........h.....l.G-.[K.,_XA]..'g..!.......,....?........i.....g....Z.}..)..u...F..!.......,....C...............P.,nt^.i....Xq...i..!.......,....F...........{^b....n.y..i...\C.-...!.......,....H..............R...o....h.xV!.z#...!.......,"...L.............r.jY..w~aP(.......[i...!.......,(...N.............r....w.aP.j.'.)Y..S..!.......,....H.........`......hew..9`.%z.xVeS..!.......,5...A.........`...\m.Vmtzw.}.d.%...Q..!.......,9...=.........h......3S..s.-W8m...Q..!.......,A...5.........h.....N...:..!..U..!.......,H.............h....M.x...f.i.4..!.......,O...'.........i...tp......(..!.......,X.............j...@.x....!.......,].............j..L..3em..!.......,e.............`......!.......,n..............{i..!..

Chrome Cache Entry: 81

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=9, xresolution=122, yresolution=130, resolutionunit=2, software=paint.net 4.0.21], baseline, precision 8, 1920x1080, components 3
Category:	dropped
Size (bytes):	189329
Entropy (8bit):	7.914619229483533
Encrypted:	false
SSDEEP:
MD5:	B75E9E58497B4615896DA946AF3DBAB8
SHA1:	28C4BBAB57AF3BD0E4ABD7CA7A8B97D8E407483F
SHA-256:	78B440779F07B8A64DA00BCBE5A00B6573F220562FFD0368173D645FBD94B1DA
SHA-512:	1DFA8FFCB3248DC0C9E9F30946C7421950FE4E9E32484E1F990F15C99755A54F456412BF425FF6B81E494C7A7C5621DEA7A4123CEF99B6B6271760A7F212EB23
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....`.`......Exif..MM..................z.............(...........1..................................Q...........Q...........Q.................v.......v.....paint.net 4.0.21.............C....................................................................C.......................................................................8...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..../..Z.`.....;....`..QJ...._J6-:.9..0..A@y..&.E.b....F...QE.7$7b.Q.})...TQ..yn7b.Q.}).Q..y....J....RQJ..Skr.......e.C'.=..@.......nb...=.w..SG......6..s.W#.qOW.e^W..*.8.1..W.#.!.....~.si..8.G4

Chrome Cache Entry: 82

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (61177)
Category:	downloaded
Size (bytes):	113378
Entropy (8bit):	5.285066693137765
Encrypted:	false
SSDEEP:
MD5:	9C837C2B6C9C441656C3C64BE6FC6401
SHA1:	D44AA83093C4109DDD8FFAEA60755F05D1BFE7D3
SHA-256:	68C2994E21A564345EB3B4091DD2334C9CBDDB0AECDA45EE963C6DE2E1629B93
SHA-512:	AF04835BCC621FE1793C4661FDB03EDEA16219BAA77F1198AA419F771B6B3DCDAC3DA92676568C207022251483AB79C75AB6DF2CE94924748FF9CEBF64AFF5A2
Malicious:	false
Reputation:	unknown
URL:	https://aadcdn.msftauth.net/ests/2.1/content/cdnbundles/converged.v2.login.min_nin8k2ycrbzww8zl5vxkaq2.css
Preview:	/! Copyright (C) Microsoft Corporation. All rights reserved. //*!.------------------------------------------- START OF THIRD PARTY NOTICE -----------------------------------------..This file is based on or incorporates material from the projects listed below (Third Party IP). The original copyright notice and the license under which Microsoft received such Third Party IP, are set forth below. Such licenses and notices are provided for informational purposes only. Microsoft licenses the Third Party IP to you under the licensing terms for the Microsoft product. Microsoft reserves all other rights not expressly granted under this agreement, whether by implication, estoppel or otherwise...//-----------------------------------------------------------------------------.twbs-bootstrap-sass (3.3.0).//-----------------------------------------------------------------------------..The MIT License (MIT)..Copyright (c) 2013 Twitter, Inc..Permission is hereby granted, free of charge, to any person

Chrome Cache Entry: 83

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 352 x 3
Category:	downloaded
Size (bytes):	3620
Entropy (8bit):	6.867828878374734
Encrypted:	false
SSDEEP:
MD5:	B540A8E518037192E32C4FE58BF2DBAB
SHA1:	3047C1DB97B86F6981E0AD2F96AF40CDF43511AF
SHA-256:	8737D721808655F37B333F08A90185699E7E8B9BDAAA15CDB63C8448B426F95D
SHA-512:	E3612D9E6809EC192F6E2D035290B730871C269A267115E4A5515CADB7E6E14E3DD4290A35ABAA8D14CF1FA3924DC76E11926AC341E0F6F372E9FC5434B546E5
Malicious:	false
Reputation:	unknown
URL:	https://aadcdn.msftauth.net/shared/1.0/content/images/marching_ants_986f40b5a9dc7d39ef8396797f61b323.gif
Preview:	GIF89a`.........iii!.......!.&Edited with ezgif.com online GIF maker.!..NETSCAPE2.0.....,....`.....6......P.l.......H....I..:qJ......k....`BY..L..&...!.......,....`.....9..i....Q4......H..j.=.k9-5_..........j7..({.........!.......,....`.....9.......trV.......H....`.[.q6......>.. .CZ.&!.....M...!.......,....`.....8..........:......H..jJ..U..6_....../.el...q.).....!.......,....`.....9.....i..l.go.....H..".U...f......._......5......n..!.......,....`.....:..i......./.....H...5%.kE/5.........In.a..@&3.....J...!.......,....`.....9.......kr.j.....H...-.{Im5c..............@&.........!.......,....`.....9.........j..q....H...].&..\.5.........8..S..........!.......,....`.....9.......3q.g..5....H...:u..............Al..x.q.........!.......,....`.....9......\.F....z....H...zX...ov.........h3N.x4......j..!.......,....`.....9........Q.:......H....y..^...1.........n.!.F......E...!.......,....`.....8.........i,......H....*_.21.I.........%...

Chrome Cache Entry: 84

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1592
Entropy (8bit):	4.205005284721148
Encrypted:	false
SSDEEP:
MD5:	4E48046CE74F4B89D45037C90576BFAC
SHA1:	4A41B3B51ED787F7B33294202DA72220C7CD2C32
SHA-256:	8E6DB1634F1812D42516778FC890010AA57F3E39914FB4803DF2C38ABBF56D93
SHA-512:	B2BBA2A68EDAA1A08CFA31ED058AFB5E6A3150AABB9A78DB9F5CCC2364186D44A015986A57707B57E2CC855FA7DA57861AD19FC4E7006C2C239C98063FE903CF
Malicious:	false
Reputation:	unknown
URL:	https://aadcdn.msftauth.net/shared/1.0/content/images/signin-options_3e3f6b73c3f310c31d2c4d131a8ab8c6.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="48" height="48" viewBox="0 0 48 48"><defs><style>.a{fill:none;}.b{fill:#404040;}</style></defs><rect class="a" width="48" height="48"/><path class="b" d="M40,32.578V40H32V36H28V32H24V28.766A10.689,10.689,0,0,1,19,30a10.9,10.9,0,0,1-5.547-1.5,11.106,11.106,0,0,1-2.219-1.719A11.373,11.373,0,0,1,9.5,24.547a10.4,10.4,0,0,1-1.109-2.625A11.616,11.616,0,0,1,8,19a10.9,10.9,0,0,1,1.5-5.547,11.106,11.106,0,0,1,1.719-2.219A11.373,11.373,0,0,1,13.453,9.5a10.4,10.4,0,0,1,2.625-1.109A11.616,11.616,0,0,1,19,8a10.9,10.9,0,0,1,5.547,1.5,11.106,11.106,0,0,1,2.219,1.719A11.373,11.373,0,0,1,28.5,13.453a10.4,10.4,0,0,1,1.109,2.625A11.616,11.616,0,0,1,30,19a10.015,10.015,0,0,1-.125,1.578,10.879,10.879,0,0,1-.359,1.531Zm-2,.844L27.219,22.641a14.716,14.716,0,0,0,.562-1.782A7.751,7.751,0,0,0,28,19a8.786,8.786,0,0,0-.7-3.5,8.9,8.9,0,0,0-1.938-2.859A9.269,9.269,0,0,0,22.5,10.719,8.9,8.9,0,0,0,19,10a8.786,8.786,0,0,0-3.5.7,8.9,8.9,0,0,0-2.859,1.938A9.269,9.269,0,0,0,

Chrome Cache Entry: 87

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (64612)
Category:	dropped
Size (bytes):	113769
Entropy (8bit):	5.492540089333064
Encrypted:	false
SSDEEP:
MD5:	C6C029BA88D52E5312FEC69603A00340
SHA1:	079011F6F0662C11AE907C773EFE8E0C9338EAD0
SHA-256:	DDD0BB1C19B3D2D045BFCDE85D2020BBA57854C887A6691B66DBA3DA1BB3AFBE
SHA-512:	7DF09CD949A43D53D62D9013718158966508DEC2338491FFB38DC33D2EB85FF5C699792AE578975DA0E4F03CC7EA03774624208D06924EEA4C2EAC92E6E22C60
Malicious:	false
Reputation:	unknown
Preview:	/!. ------------------------------------------- START OF THIRD PARTY NOTICE -----------------------------------------. * . * This file is based on or incorporates material from the projects listed below (Third Party IP). The original copyright notice and the license under which Microsoft received such Third Party IP, are set forth below. Such licenses and notices are provided for informational purposes only. Microsoft licenses the Third Party IP to you under the licensing terms for the Microsoft product. Microsoft reserves all other rights not expressly granted under this agreement, whether by implication, estoppel or otherwise.. * . * json2.js (2016-05-01). * https://github.com/douglascrockford/JSON-js. * License: Public Domain. * . * Provided for Informational Purposes Only. * . * ----------------------------------------------- END OF THIRD PARTY NOTICE ------------------------------------------. */.(window.webpackJsonp=window.webpackJsonp\|\|[]).push([[37],{1373:function(e,t,

Chrome Cache Entry: 93

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	36
Entropy (8bit):	4.503258334775644
Encrypted:	false
SSDEEP:
MD5:	06B313E93DD76909460FBFC0CD98CB6B
SHA1:	C4F9B2BBD840A4328F85F54873C434336A193888
SHA-256:	B4532478707B495D0BB1C21C314AEF959DD1A5E0F66E52DAD5FC332C8B697CBA
SHA-512:	EFD7E8195D9C126883C71FED3EFEDE55916848B784F8434ED2677DF5004436F7EDE9F80277CB4675C4DEB8F243B2705A3806B412FAA8842E039E9DC467C11645
Malicious:	false
Reputation:	unknown
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISFwmCAmly1gHbXRIFDdFbUVISBQ1Xevf9?alt=proto
Preview:	ChgKDQ3RW1FSGgQIVhgCIAEKBw1Xevf9GgA=

Chrome Cache Entry: 94

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (45797)
Category:	downloaded
Size (bytes):	406986
Entropy (8bit):	5.31836569617146
Encrypted:	false
SSDEEP:
MD5:	E40761677762EAB0692F86B259C7D744
SHA1:	34A9B50CEC6E1163CEEFCD4D394DB6524C89A854
SHA-256:	DA4A8DF0C326292B5BEE9C732B3C962FD67AAF2F99D850F1BF65068D573C5619
SHA-512:	04FA1D6074AD24E3ABAB53D1DE116A6B39B4BE3DFABC082427F1C5A169E50527561F160CC133C2AC4AEDC4E7AC404572F60E531A4618111EA74D138B2B0DD034
Malicious:	false
Reputation:	unknown
URL:	https://aadcdn.msftauth.net/shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_117b650bccea354984d8.js
Preview:	/!. ------------------------------------------- START OF THIRD PARTY NOTICE -----------------------------------------. * . * This file is based on or incorporates material from the projects listed below (Third Party IP). The original copyright notice and the license under which Microsoft received such Third Party IP, are set forth below. Such licenses and notices are provided for informational purposes only. Microsoft licenses the Third Party IP to you under the licensing terms for the Microsoft product. Microsoft reserves all other rights not expressly granted under this agreement, whether by implication, estoppel or otherwise.. * . * json2.js (2016-05-01). * https://github.com/douglascrockford/JSON-js. * License: Public Domain. * . * Provided for Informational Purposes Only. * . * ----------------------------------------------- END OF THIRD PARTY NOTICE ------------------------------------------. */.(window.webpackJsonp=window.webpackJsonp\|\|[]).push([[8],Array(533).concat([f

Chrome Cache Entry: 96

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (32009)
Category:	dropped
Size (bytes):	57443
Entropy (8bit):	5.372940573746363
Encrypted:	false
SSDEEP:
MD5:	D580777BB3A28B94F6F1D18EE17AEDA3
SHA1:	E78833A2DB1AA97DA3F4A1994E6AF1F0D74D7CC7
SHA-256:	81188E8A76162C79DB4A5C10AC933C9E874C5B9EAE10E47956AD9DF704E01B28
SHA-512:	E3F5FFE3E7E54A7D640DF3BC06D336C9F936635D2594159B3EA5EDAEFBA6D6774060A532E0CBE0664FDC65806BD53E9BFC19C11F7946A5E157A9EC935C564378
Malicious:	false
Reputation:	unknown
Preview:	!function(e){function o(n){if(i[n])return i[n].exports;var t=i[n]={exports:{},id:n,loaded:!1};return e[n].call(t.exports,t,t.exports,o),t.loaded=!0,t.exports}var i={};return o.m=e,o.c=i,o.p="",o(0)}([function(e,o,i){i(2);var n=i(1),t=i(5),r=i(6),a=r.StringsVariantId,s=r.AllowedIdentitiesType;n.registerSource("str",function(e,o){if(e.WF_STR_SignupLink_AriaLabel_Text="Create a Microsoft account",e.WF_STR_SignupLink_AriaLabel_Generic_Text="Create a new account",e.CT_STR_CookieBanner_Link_AriaLabel="Learn more about Microsoft's Cookie Policy",e.WF_STR_HeaderDefault_Title=o.iLoginStringsVariantId===a.CombinedSigninSignupV2WelcomeTitle?"Welcome":"Sign in",e.STR_Footer_IcpLicense_Text=".ICP.13015306.-10",o.oAppCobranding&&o.oAppCobranding.friendlyAppName){var i=o.fBreakBrandingSigninString?"to continue to {0}":"Continue to {0}";e.WF_STR_App_Title=t.format(i,o.oAppCobranding.friendlyAppName)}switch(o.oAppCobranding&&o.oAppCobranding.signinDescription&&(e.WF_STR_Default_Desc=o.oAppCobrand

Chrome Cache Entry: 99

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
Category:	dropped
Size (bytes):	17174
Entropy (8bit):	2.9129715116732746
Encrypted:	false
SSDEEP:
MD5:	12E3DAC858061D088023B2BD48E2FA96
SHA1:	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5
SHA-256:	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
SHA-512:	C5030C55A855E7A9E20E22F4C70BF1E0F3C558A9B7D501CFAB6992AC2656AE5E41B050CCAC541EFA55F9603E0D349B247EB4912EE169D44044271789C719CD01
Malicious:	false
Reputation:	unknown
Preview:	..............h(..f...HH...........(..00......h....6.. ...........=...............@..........(....A..(....................(....................................."P.........................................."""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333""""""""""""""""""""""""""

Static File Info

⊘No static file info

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://eu.knowbe4.com/auth/saml/91b6f5903c38

Overview

General Information

Detection

Signatures

Classification

Process Tree

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Boot Survival

Mitre Att&ck Matrix

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

LLM Input / Output

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Chrome Cache Entry: 102

Chrome Cache Entry: 103

Chrome Cache Entry: 77

Chrome Cache Entry: 78

Chrome Cache Entry: 79

Chrome Cache Entry: 80

Chrome Cache Entry: 81

Chrome Cache Entry: 82

Chrome Cache Entry: 83

Chrome Cache Entry: 84

Chrome Cache Entry: 87

Chrome Cache Entry: 93

Chrome Cache Entry: 94

Chrome Cache Entry: 96

Chrome Cache Entry: 99

Static File Info

Windows Analysis Report
https://eu.knowbe4.com/auth/saml/91b6f5903c38