IOC Report
https://burnsmcd.alationcloud.com/compose/query/64/;1

loading gif

Files

File Path
Type
Category
Malicious
Chrome Cache Entry: 57
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 406986
dropped
Chrome Cache Entry: 58
HTML document, ASCII text, with very long lines (3450), with CRLF line terminators
downloaded
Chrome Cache Entry: 59
ASCII text, with very long lines (46591)
downloaded
Chrome Cache Entry: 60
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 406986
downloaded
Chrome Cache Entry: 61
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 449728
downloaded
Chrome Cache Entry: 62
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 57443
dropped
Chrome Cache Entry: 63
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 113769
dropped
Chrome Cache Entry: 64
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1592
downloaded
Chrome Cache Entry: 65
JPEG image data, JFIF standard 1.01, resolution (DPI), density 381x381, segment length 16, baseline, precision 8, 240x53, components 3
downloaded
Chrome Cache Entry: 66
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 113769
downloaded
Chrome Cache Entry: 67
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 15755
dropped
Chrome Cache Entry: 68
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 57443
downloaded
Chrome Cache Entry: 69
JPEG image data, JFIF standard 1.01, resolution (DPI), density 381x381, segment length 16, baseline, precision 8, 240x53, components 3
dropped
Chrome Cache Entry: 70
ASCII text, with no line terminators
downloaded
Chrome Cache Entry: 71
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 15755
downloaded
Chrome Cache Entry: 72
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1592
dropped
Chrome Cache Entry: 73
GIF image data, version 89a, 352 x 3
dropped
Chrome Cache Entry: 74
MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
downloaded
Chrome Cache Entry: 75
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 113378
downloaded
Chrome Cache Entry: 76
GIF image data, version 89a, 352 x 3
dropped
Chrome Cache Entry: 77
GIF image data, version 89a, 352 x 3
downloaded
Chrome Cache Entry: 78
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 449728
dropped
Chrome Cache Entry: 79
GIF image data, version 89a, 352 x 3
downloaded
Chrome Cache Entry: 80
MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
dropped
Chrome Cache Entry: 81
ASCII text, with very long lines (46591)
dropped
There are 16 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2312 --field-trial-handle=2196,i,8796696908694474424,14027796887653547186,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://burnsmcd.alationcloud.com/compose/query/64/;1"

URLs

Name
IP
Malicious
https://burnsmcd.alationcloud.com/compose/query/64/;1
http://knockoutjs.com/
unknown
https://login.microsoftonline.com
unknown
https://burnsmcd.alationcloud.com/compose/query/64/%3B1/
35.169.104.34
http://www.opensource.org/licenses/mit-license.php)
unknown
https://github.com/douglascrockford/JSON-js
unknown
https://burnsmcd.alationcloud.com/saml2/login/?next=/compose/query/64/%253B1/
35.169.104.34
https://login.windows-ppe.net
unknown
https://aadcdn.msauthimages.net/dbd5a2dd-ebuwtroprxsqonwy2n8z4s0iw7gb0u-ycuo77htkuf4/logintenantbranding/0/bannerlogo?ts=637805376984720579
152.199.21.175
https://burnsmcd.alationcloud.com/login/?next=/compose/query/64/%253B1/
35.169.104.34
https://aadcdn.msftauth.net/shared/1.0/content/js/BssoInterrupt_Core_zKox_QMcTIVut7mG_Z9Eew2.js
152.199.21.175
https://burnsmcd.alationcloud.com/compose/query/64/;1
35.169.104.34
There are 1 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
ingress-enterprise.use1.alationcloud.com
35.169.104.34
sni1gl.wpc.upsiloncdn.net
152.199.21.175
sni1gl.wpc.omegacdn.net
152.199.21.175
s-part-0017.t-0009.t-msedge.net
13.107.246.45
www.google.com
172.217.16.196
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com
217.20.57.18
fp2e7a.wpc.phicdn.net
192.229.221.95
autologon.microsoftazuread-sso.com
20.190.159.23
aadcdn.msauthimages.net
unknown
burnsmcd.alationcloud.com
unknown
identity.nel.measure.office.net
unknown
aadcdn.msftauth.net
unknown
login.microsoftonline.com
unknown
There are 3 hidden domains, click here to show them.

IPs

IP
Domain
Country
Malicious
13.107.246.45
s-part-0017.t-0009.t-msedge.net
United States
192.168.2.4
unknown
unknown
35.169.104.34
ingress-enterprise.use1.alationcloud.com
United States
239.255.255.250
unknown
Reserved
152.199.21.175
sni1gl.wpc.upsiloncdn.net
United States
172.217.16.196
www.google.com
United States

DOM / HTML

URL
Malicious
https://login.microsoftonline.com/bfbb9a2b-6d99-4e78-b3c7-95005d555c8b/saml2?SAMLRequest=hZLRT4MwEMb%2FFdL3AsOxjWYjmS7GmRnJQB98a0u3NcIVe8VM%2F3qBaZwv8%2FGu33f3uy%2BdI6%2Brhi1bd4CtemsVOu9YV4Csf1iQ1gIzHDUy4LVC5iTLlw8bFvkh44jKOm2AnFmay57GGmekqYi3Xi2ILukRNsn98fH1EJUZbLLPnHjPymI3dUE6Q6dDbNUa0HFwXSuMxnQU0mhWhCM2nrB48kK8VYetgbvBdXCuQRYEldlr8GstrUGzcwYqDcqXpg7EToiER4JOyiShYzWdUXElpzSJwzAu4ziWMxH0x0TEy76BrzWUGvaXrxMnEbK7osho9pgXxFv%2BpHRjANta2VzZdy3V03bzyyq6qVjL0ufVcIWsTFsOrANGwCUGJJ33BRsCsd6tsTV3l3n6TpfxbpAyBU67D5L%2Bv3QenG1KT9XfT5J%2BAQ%3D%3D&RelayState=%2Fcompose%2Fquery%2F64%2F%253B1%2F&SigAlg=http%3A%2F%2Fwww.w3.org%2F2001%2F04%2Fxmldsig-more%23rsa-sha256&Signature=eakQ1cIf1S4D8YmSsMS89T49QHwtAFbkoAtKpfe1YyWDbFAiKwR20jwWxNoCt%2BXPVtjmz5xakg0jJHAEKePwd1nnZQzHTVu2T9nKMsD5Cvsem%2B9CyE28dwz3H0b63mor%2FcrL7QwBzkIIJAD3apDXSMYR9cY27s647WwiijKLMwiZAHyT5FYEm%2FaDeWYkJ2G55YD6fCNSKlhyX0r1AJbG7tXpnCys8g%2F6mPh9yrxtKiI%2B%2BbVy4hrItUR3v%2BinkDFSEueIK87mT3L16CnfXGb609zIYgjx3jopq2Up3un%2FO4cwCQ0LOnYCv9SyekA67vVHYFv51WgNs6TPipkB
https://login.microsoftonline.com/bfbb9a2b-6d99-4e78-b3c7-95005d555c8b/saml2?SAMLRequest=hZLRT4MwEMb%2FFdL3AsOxjWYjmS7GmRnJQB98a0u3NcIVe8VM%2F3qBaZwv8%2FGu33f3uy%2BdI6%2Brhi1bd4CtemsVOu9YV4Csf1iQ1gIzHDUy4LVC5iTLlw8bFvkh44jKOm2AnFmay57GGmekqYi3Xi2ILukRNsn98fH1EJUZbLLPnHjPymI3dUE6Q6dDbNUa0HFwXSuMxnQU0mhWhCM2nrB48kK8VYetgbvBdXCuQRYEldlr8GstrUGzcwYqDcqXpg7EToiER4JOyiShYzWdUXElpzSJwzAu4ziWMxH0x0TEy76BrzWUGvaXrxMnEbK7osho9pgXxFv%2BpHRjANta2VzZdy3V03bzyyq6qVjL0ufVcIWsTFsOrANGwCUGJJ33BRsCsd6tsTV3l3n6TpfxbpAyBU67D5L%2Bv3QenG1KT9XfT5J%2BAQ%3D%3D&RelayState=%2Fcompose%2Fquery%2F64%2F%253B1%2F&SigAlg=http%3A%2F%2Fwww.w3.org%2F2001%2F04%2Fxmldsig-more%23rsa-sha256&Signature=eakQ1cIf1S4D8YmSsMS89T49QHwtAFbkoAtKpfe1YyWDbFAiKwR20jwWxNoCt%2BXPVtjmz5xakg0jJHAEKePwd1nnZQzHTVu2T9nKMsD5Cvsem%2B9CyE28dwz3H0b63mor%2FcrL7QwBzkIIJAD3apDXSMYR9cY27s647WwiijKLMwiZAHyT5FYEm%2FaDeWYkJ2G55YD6fCNSKlhyX0r1AJbG7tXpnCys8g%2F6mPh9yrxtKiI%2B%2BbVy4hrItUR3v%2BinkDFSEueIK87mT3L16CnfXGb609zIYgjx3jopq2Up3un%2FO4cwCQ0LOnYCv9SyekA67vVHYFv51WgNs6TPipkB
https://login.microsoftonline.com/bfbb9a2b-6d99-4e78-b3c7-95005d555c8b/saml2?SAMLRequest=hZLRT4MwEMb%2FFdL3AsOxjWYjmS7GmRnJQB98a0u3NcIVe8VM%2F3qBaZwv8%2FGu33f3uy%2BdI6%2Brhi1bd4CtemsVOu9YV4Csf1iQ1gIzHDUy4LVC5iTLlw8bFvkh44jKOm2AnFmay57GGmekqYi3Xi2ILukRNsn98fH1EJUZbLLPnHjPymI3dUE6Q6dDbNUa0HFwXSuMxnQU0mhWhCM2nrB48kK8VYetgbvBdXCuQRYEldlr8GstrUGzcwYqDcqXpg7EToiER4JOyiShYzWdUXElpzSJwzAu4ziWMxH0x0TEy76BrzWUGvaXrxMnEbK7osho9pgXxFv%2BpHRjANta2VzZdy3V03bzyyq6qVjL0ufVcIWsTFsOrANGwCUGJJ33BRsCsd6tsTV3l3n6TpfxbpAyBU67D5L%2Bv3QenG1KT9XfT5J%2BAQ%3D%3D&RelayState=%2Fcompose%2Fquery%2F64%2F%253B1%2F&SigAlg=http%3A%2F%2Fwww.w3.org%2F2001%2F04%2Fxmldsig-more%23rsa-sha256&Signature=eakQ1cIf1S4D8YmSsMS89T49QHwtAFbkoAtKpfe1YyWDbFAiKwR20jwWxNoCt%2BXPVtjmz5xakg0jJHAEKePwd1nnZQzHTVu2T9nKMsD5Cvsem%2B9CyE28dwz3H0b63mor%2FcrL7QwBzkIIJAD3apDXSMYR9cY27s647WwiijKLMwiZAHyT5FYEm%2FaDeWYkJ2G55YD6fCNSKlhyX0r1AJbG7tXpnCys8g%2F6mPh9yrxtKiI%2B%2BbVy4hrItUR3v%2BinkDFSEueIK87mT3L16CnfXGb609zIYgjx3jopq2Up3un%2FO4cwCQ0LOnYCv9SyekA67vVHYFv51WgNs6TPipkB
https://login.microsoftonline.com/bfbb9a2b-6d99-4e78-b3c7-95005d555c8b/saml2?SAMLRequest=hZLRT4MwEMb%2FFdL3AsOxjWYjmS7GmRnJQB98a0u3NcIVe8VM%2F3qBaZwv8%2FGu33f3uy%2BdI6%2Brhi1bd4CtemsVOu9YV4Csf1iQ1gIzHDUy4LVC5iTLlw8bFvkh44jKOm2AnFmay57GGmekqYi3Xi2ILukRNsn98fH1EJUZbLLPnHjPymI3dUE6Q6dDbNUa0HFwXSuMxnQU0mhWhCM2nrB48kK8VYetgbvBdXCuQRYEldlr8GstrUGzcwYqDcqXpg7EToiER4JOyiShYzWdUXElpzSJwzAu4ziWMxH0x0TEy76BrzWUGvaXrxMnEbK7osho9pgXxFv%2BpHRjANta2VzZdy3V03bzyyq6qVjL0ufVcIWsTFsOrANGwCUGJJ33BRsCsd6tsTV3l3n6TpfxbpAyBU67D5L%2Bv3QenG1KT9XfT5J%2BAQ%3D%3D&RelayState=%2Fcompose%2Fquery%2F64%2F%253B1%2F&SigAlg=http%3A%2F%2Fwww.w3.org%2F2001%2F04%2Fxmldsig-more%23rsa-sha256&Signature=eakQ1cIf1S4D8YmSsMS89T49QHwtAFbkoAtKpfe1YyWDbFAiKwR20jwWxNoCt%2BXPVtjmz5xakg0jJHAEKePwd1nnZQzHTVu2T9nKMsD5Cvsem%2B9CyE28dwz3H0b63mor%2FcrL7QwBzkIIJAD3apDXSMYR9cY27s647WwiijKLMwiZAHyT5FYEm%2FaDeWYkJ2G55YD6fCNSKlhyX0r1AJbG7tXpnCys8g%2F6mPh9yrxtKiI%2B%2BbVy4hrItUR3v%2BinkDFSEueIK87mT3L16CnfXGb609zIYgjx3jopq2Up3un%2FO4cwCQ0LOnYCv9SyekA67vVHYFv51WgNs6TPipkB