Windows Analysis Report
https://1drv.ms/f/s!BGFxeW-p8eX4gQbAlS3QGsRgYLO6?e=fXfFWpIjuUW7ZIzZ2-r8YQ&at=9

Overview

General Information

Sample URL: https://1drv.ms/f/s!BGFxeW-p8eX4gQbAlS3QGsRgYLO6?e=fXfFWpIjuUW7ZIzZ2-r8YQ&at=9
Analysis ID: 1543866
Infos:

Detection

Score: 0
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

No high impact signatures.

Classification

There are no high impact signatures.

Source: C:\Program Files\Google\Chrome\Application\chrome.exe Directory created: C:\Program Files\scoped_dir7848_256834423 Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Directory created: C:\Program Files\chrome_BITS_7848_650284550 Jump to behavior
Source: unknown TCP traffic detected without corresponding DNS query: 23.219.82.9
Source: unknown TCP traffic detected without corresponding DNS query: 142.250.64.67
Source: unknown TCP traffic detected without corresponding DNS query: 69.164.46.0
Source: unknown TCP traffic detected without corresponding DNS query: 69.164.46.0
Source: unknown TCP traffic detected without corresponding DNS query: 69.164.46.0
Source: unknown TCP traffic detected without corresponding DNS query: 69.164.46.0
Source: unknown TCP traffic detected without corresponding DNS query: 142.250.64.67
Source: unknown UDP traffic detected without corresponding DNS query: 239.255.255.250
Source: unknown UDP traffic detected without corresponding DNS query: 239.255.255.250
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 239.255.255.250
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 239.255.255.250
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global traffic HTTP traffic detected: GET /redir?resid=F8E5F1A96F797161!134&authkey=!AsCVLdAaxGBgs7o&ithint=folder&e=fXfFWpIjuUW7ZIzZ2-r8YQ&at=9 HTTP/1.1Host: onedrive.live.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Chromium";v="128", "Not;A=Brand";v="24", "Google Chrome";v="128"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /?id=F8E5F1A96F797161!134&resid=F8E5F1A96F797161!134&ithint=folder&authkey=!AsCVLdAaxGBgs7o&cid=f8e5f1a96f797161 HTTP/1.1Host: onedrive.live.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Chromium";v="128", "Not;A=Brand";v="24", "Google Chrome";v="128"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: E=P:9yY791v33Ig=:8C19CDfhT43H3frHdqSZhtZ4lkZVWGoaoa1/45M6OPk=:F; xid=6825030f-f760-4fea-a5c6-de9d149da2fc&&ODSP-ODWEB-ODCF&348; xidseq=1
Source: global traffic HTTP traffic detected: GET /_layouts/15/spwebworkerproxy.ashx HTTP/1.1Host: onedrive.live.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: E=P:9yY791v33Ig=:8C19CDfhT43H3frHdqSZhtZ4lkZVWGoaoa1/45M6OPk=:F; xid=6825030f-f760-4fea-a5c6-de9d149da2fc&&ODSP-ODWEB-ODCF&348; xidseq=1
Source: global traffic HTTP traffic detected: GET /_layouts/15/images/odbfavicon.ico?rev=47 HTTP/1.1Host: onedrive.live.comConnection: keep-alivesec-ch-ua: "Chromium";v="128", "Not;A=Brand";v="24", "Google Chrome";v="128"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://onedrive.live.com/?id=F8E5F1A96F797161!134&resid=F8E5F1A96F797161!134&ithint=folder&authkey=!AsCVLdAaxGBgs7o&cid=f8e5f1a96f797161Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: E=P:9yY791v33Ig=:8C19CDfhT43H3frHdqSZhtZ4lkZVWGoaoa1/45M6OPk=:F; xid=6825030f-f760-4fea-a5c6-de9d149da2fc&&ODSP-ODWEB-ODCF&348; xidseq=1
Source: global traffic HTTP traffic detected: GET /webappmanifest.json HTTP/1.1Host: onedrive.live.comConnection: keep-alivesec-ch-ua: "Chromium";v="128", "Not;A=Brand";v="24", "Google Chrome";v="128"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: manifestReferer: https://onedrive.live.com/?id=F8E5F1A96F797161!134&resid=F8E5F1A96F797161!134&ithint=folder&authkey=!AsCVLdAaxGBgs7o&cid=f8e5f1a96f797161Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: E=P:9yY791v33Ig=:8C19CDfhT43H3frHdqSZhtZ4lkZVWGoaoa1/45M6OPk=:F; xid=6825030f-f760-4fea-a5c6-de9d149da2fc&&ODSP-ODWEB-ODCF&348; xidseq=1
Source: global traffic HTTP traffic detected: GET /_layouts/15/images/odbfavicon.ico?rev=47 HTTP/1.1Host: onedrive.live.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: xid=6825030f-f760-4fea-a5c6-de9d149da2fc&&ODSP-ODWEB-ODCF&348; E=P:60HH+Fv33Ig=:9fz0OaJAmSuGDtCh0u8qz9BVpphZMWYfJ07yH6u/7VE=:F; xidseq=2; wla42=
Source: global traffic DNS traffic detected: DNS query: 1drv.ms
Source: global traffic DNS traffic detected: DNS query: onedrive.live.com
Source: global traffic DNS traffic detected: DNS query: www.google.com
Source: global traffic DNS traffic detected: DNS query: p.sfx.ms
Source: global traffic DNS traffic detected: DNS query: api.onedrive.com
Source: global traffic DNS traffic detected: DNS query: m365cdn.nel.measure.office.net
Source: global traffic DNS traffic detected: DNS query: storage.live.com
Source: global traffic TCP traffic: 192.168.11.20:59758 -> 239.255.255.250:1900
Source: global traffic TCP traffic: 192.168.11.20:59758 -> 239.255.255.250:1900
Source: global traffic TCP traffic: 192.168.11.20:59758 -> 239.255.255.250:1900
Source: global traffic TCP traffic: 192.168.11.20:59758 -> 239.255.255.250:1900
Source: chromecache_111.1.dr String found in binary or memory: https://onedrive.live.com/_forms/default.aspx
Source: chromecache_111.1.dr String found in binary or memory: https://onedrive.live.com/_forms/default.aspx?ReturnUrl=%2F%3Fid%3DF8E5F1A96F797161%21134%26resid%3D
Source: chromecache_111.1.dr String found in binary or memory: https://res-1.cdn.office.net
Source: chromecache_112.1.dr String found in binary or memory: https://res-1.cdn.office.net/files/odsp-web-prod_2024-10-11.008/
Source: chromecache_112.1.dr String found in binary or memory: https://res-1.cdn.office.net/files/odsp-web-prod_2024-10-11.008/spwebworker.js
Source: chromecache_111.1.dr String found in binary or memory: https://res-1.cdn.office.net/files/odsp-web-prod_2024-10-18.010/
Source: chromecache_111.1.dr String found in binary or memory: https://res-1.cdn.office.net/files/sp-client/odsp-media-27cf24d8
Source: chromecache_111.1.dr String found in binary or memory: https://res-2.cdn.office.net/files/odsp-web-prod_2024-10-18.010/
Source: chromecache_111.1.dr String found in binary or memory: https://skyapi.onedrive.live.com
Source: chromecache_111.1.dr String found in binary or memory: https://spoprod-a.akamaihd.net/files/odsp-common-library-prod_2019-02-15_20190219.002/require.js
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49755 -> 443
Source: classification engine Classification label: clean0.win@17/201@22/4
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Program Files\scoped_dir7848_256834423 Jump to behavior
Source: unknown Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-subproc-heap-profiling --field-trial-handle=2188,i,1239798624536174216,5055867596480514111,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20240909-180142.416000 --mojo-platform-channel-handle=2200 /prefetch:3
Source: unknown Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://1drv.ms/f/s!BGFxeW-p8eX4gQbAlS3QGsRgYLO6?e=fXfFWpIjuUW7ZIzZ2-r8YQ&at=9"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-subproc-heap-profiling --field-trial-handle=2188,i,1239798624536174216,5055867596480514111,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20240909-180142.416000 --mojo-platform-channel-handle=2200 /prefetch:3 Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Directory created: C:\Program Files\scoped_dir7848_256834423 Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Directory created: C:\Program Files\chrome_BITS_7848_650284550 Jump to behavior
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs