Edit tour

Windows Analysis Report
https://email.nationalgeographic.com/T/v600000192d461b369a965aaf4bbe5cfc0/b0a141541c854b2b0000021ef3a0bcf0/b0a14154-1c85-4b2b-a826-24f74eee951f?dU=v0G4RBKTXg2GtTHJDsy7ii3waBSrIwMXGZJ7x_OARFKFQAIe3mwx22JG_r9Sy1LWLGyMVrrFIdudbYjwKGAKz6iTAgyV5XAM3SbSN-FzJU9XXpFWtSFRxbGw4nHcgLdnvWYAVcbDlQyQtE1-NmUBs

Overview

General Information

Sample URL:	https://email.nationalgeographic.com/T/v600000192d461b369a965aaf4bbe5cfc0/b0a141541c854b2b0000021ef3a0bcf0/b0a14154-1c85-4b2b-a826-24f74eee951f?__dU__=v0G4RBKTXg2GtTHJDsy7ii3waBSrIwMXGZJ7x_OARFKFQAIe3
Analysis ID:	1545107

Detection

Score:	1
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

HTML body with high number of embedded SVGs detected

HTML page contains string obfuscation

Stores files to the Windows start menu directory

Classification

Process Tree

System is w10x64_ra

chrome.exe (PID: 4596 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6760 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 --field-trial-handle=1992,i,16613948786829333205,13691959373357222691,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6424 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://email.nationalgeographic.com/T/v600000192d461b369a965aaf4bbe5cfc0/b0a141541c854b2b0000021ef3a0bcf0/b0a14154-1c85-4b2b-a826-24f74eee951f?__dU__=v0G4RBKTXg2GtTHJDsy7ii3waBSrIwMXGZJ7x_OARFKFQAIe3mwx22JG_r9Sy1LWLGyMVrrFIdudbYjwKGAKz6iTAgyV5XAM3SbSN-FzJU9XXpFWtSFRxbGw4nHcgLdnvWYAVcbDlQyQtE1-NmUBscmA==&__F__=v0fUYvj" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: https://privacychoices.thewaltdisneycompany.com/manage?ee=mgLwiTAsmx8AAAGSWcOkSwEqxr8G9BnmRjE8tQU37C%2FR5amsImFHddte6mpL1mSYNKIEueIttnXBWW9iNxTNgRcePYfDOPA%2FnXkdVvXE4qVu&campaignid=b0a14154-1c85-4b2b-a826-24f74eee951f&langpref=en-us&source=PCM_M&rid=CDB33B20B2C4F23C75331940E996C8D7&cmpid=org=ngp::mc=crm-email::src=ngp::cmp=editorial::add=Daily_NL_Monday_History_20241028&langPref=en-US

HTTP Parser: Total embedded SVG size: 103043

Source: https://privacychoices.thewaltdisneycompany.com/resources/analytics/prod/utag.js

HTTP Parser: Found new string: script //tealium universal tag - utag.loader ut4.0.201811270012, Copyright 2018 Tealium.com Inc. All Rights Reserved..var utag_condload=false;try{(function(){function ul(src,a,b){a=document;b=a.createElement('script');b.language='javascript';b.type='text/javascript';b.src=src;a.getElementsByTagName('head')[0].appendChild(b)};if((""+document.cookie).match("utag_env_disney_dtss-permission-center=(\/\/tags\.tiqcdn\.com\/utag\/disney\/[^\S;]*)")){if(RegExp.$1.indexOf("/prod/")===-1){var s=RegExp.$1;while(s.indexOf("%")!=-1){s=decodeURIComponent(s);}s=s.replace(/\.\./g,"");ul(s);utag_condload=true;__tealium_default_path='//privacychoices.thewaltdisneycompany.com/resources/analytics/prod/';}}})();}catch(e){};if(typeof utag=="undefined"&&!utag_condload){var utag={id:"disney.dtss-permission-center",o:{},sender:{},send:{},rpt:{ts:{a:new Date()}},dbi:[],db_log:[],loader:{q:[],lc:0,f:{},p:0,ol:0,wq:[],lq:[],bq:{},bk:{},rf:0,ri:0,rp:0,rq:[],ready_q:[],sendq:{"pending":0},run_ready_q:function(){for(var i=0;i<utag.loader.ready_q....

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.16:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.16:49751 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200

Source: global traffic	DNS traffic detected: DNS query: email.nationalgeographic.com
Source: global traffic	DNS traffic detected: DNS query: privacychoices.thewaltdisneycompany.com
Source: global traffic	DNS traffic detected: DNS query: fast.fonts.net
Source: global traffic	DNS traffic detected: DNS query: cdn.registerdisney.go.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: tags.tiqcdn.com
Source: global traffic	DNS traffic detected: DNS query: sw88.go.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49700
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49699 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49699
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.16:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.16:49751 version: TLS 1.2

Source: classification engine

Classification label: clean1.win@18/24@22/190

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 --field-trial-handle=1992,i,16613948786829333205,13691959373357222691,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://email.nationalgeographic.com/T/v600000192d461b369a965aaf4bbe5cfc0/b0a141541c854b2b0000021ef3a0bcf0/b0a14154-1c85-4b2b-a826-24f74eee951f?__dU__=v0G4RBKTXg2GtTHJDsy7ii3waBSrIwMXGZJ7x_OARFKFQAIe3mwx22JG_r9Sy1LWLGyMVrrFIdudbYjwKGAKz6iTAgyV5XAM3SbSN-FzJU9XXpFWtSFRxbGw4nHcgLdnvWYAVcbDlQyQtE1-NmUBscmA==&__F__=v0fUYvj"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 --field-trial-handle=1992,i,16613948786829333205,13691959373357222691,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact

Source	Detection	Scanner	Link
www.google.com	0%	Virustotal	Browse
email.nationalgeographic.com	0%	Virustotal	Browse
fast.fonts.net	0%	Virustotal	Browse

Name	IP	Active	Malicious	Antivirus Detection	Reputation
fast.fonts.net	104.16.40.28	true	false	0%, Virustotal, Browse	unknown
email.nationalgeographic.com	159.127.198.37	true	false	0%, Virustotal, Browse	unknown
www.google.com	172.217.18.4	true	false	0%, Virustotal, Browse	unknown
epcui-appli-gbdbpiganme9-1602070907.us-west-2.elb.amazonaws.com	52.35.22.192	true	false		unknown
go.com.ssl.d1.sc.omtrdc.net	63.140.62.17	true	false		unknown
dzfq4ouujrxm8.cloudfront.net	13.33.187.116	true	false		unknown
privacychoices.thewaltdisneycompany.com	unknown	unknown	false		unknown
tags.tiqcdn.com	unknown	unknown	false		unknown
sw88.go.com	unknown	unknown	false		unknown
cdn.registerdisney.go.com	unknown	unknown	false		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://privacychoices.thewaltdisneycompany.com/manage?ee=mgLwiTAsmx8AAAGSWcOkSwEqxr8G9BnmRjE8tQU37C%2FR5amsImFHddte6mpL1mSYNKIEueIttnXBWW9iNxTNgRcePYfDOPA%2FnXkdVvXE4qVu&campaignid=b0a14154-1c85-4b2b-a826-24f74eee951f&langpref=en-us&source=PCM_M&rid=CDB33B20B2C4F23C75331940E996C8D7&cmpid=org=ngp::mc=crm-email::src=ngp::cmp=editorial::add=Daily_NL_Monday_History_20241028&langPref=en-US	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
1.1.1.1	unknown	Australia	13335	CLOUDFLARENETUS	false
172.217.18.4	www.google.com	United States	15169	GOOGLEUS	false
216.58.206.78	unknown	United States	15169	GOOGLEUS	false
74.125.71.84	unknown	United States	15169	GOOGLEUS	false
142.250.185.227	unknown	United States	15169	GOOGLEUS	false
63.140.62.17	go.com.ssl.d1.sc.omtrdc.net	United States	15224	OMNITUREUS	false
63.140.62.27	unknown	United States	15224	OMNITUREUS	false
13.33.187.116	dzfq4ouujrxm8.cloudfront.net	United States	16509	AMAZON-02US	false
159.127.198.37	email.nationalgeographic.com	United States	19137	EPSILON-INTERACTIVEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
13.33.187.32	unknown	United States	16509	AMAZON-02US	false
142.250.186.110	unknown	United States	15169	GOOGLEUS	false
52.35.22.192	epcui-appli-gbdbpiganme9-1602070907.us-west-2.elb.amazonaws.com	United States	16509	AMAZON-02US	false
104.102.48.97	unknown	United States	16625	AKAMAI-ASUS	false
142.250.186.42	unknown	United States	15169	GOOGLEUS	false
104.16.40.28	fast.fonts.net	United States	13335	CLOUDFLARENETUS	false
142.250.186.99	unknown	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.16
192.168.2.4

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1545107
Start date and time:	2024-10-30 05:52:26 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Sample URL:	https://email.nationalgeographic.com/T/v600000192d461b369a965aaf4bbe5cfc0/b0a141541c854b2b0000021ef3a0bcf0/b0a14154-1c85-4b2b-a826-24f74eee951f?__dU__=v0G4RBKTXg2GtTHJDsy7ii3waBSrIwMXGZJ7x_OARFKFQAIe3mwx22JG_r9Sy1LWLGyMVrrFIdudbYjwKGAKz6iTAgyV5XAM3SbSN-FzJU9XXpFWtSFRxbGw4nHcgLdnvWYAVcbDlQyQtE1-NmUBscmA==&__F__=v0fUYvj
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	13
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled
Analysis Mode:	stream
Analysis stop reason:	Timeout
Detection:	CLEAN
Classification:	clean1.win@18/24@22/190

Warnings

Exclude process from analysis (whitelisted): svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.185.227, 142.250.186.110, 74.125.71.84, 34.104.35.123, 104.102.48.97, 199.232.214.172
Excluded domains from analysis (whitelisted): e11276.dscg.akamaiedge.net, clients2.google.com, accounts.google.com, edgedl.me.gvt1.com, ctldl.windowsupdate.com, clientservices.googleapis.com, clients.l.google.com, cdn.registerdisney.go.com.edgekey.net
Not all processes where analyzed, report is missing behavior information
VT rate limit hit for: cdn.registerdisney.go.com
VT rate limit hit for: privacychoices.thewaltdisneycompany.com

LLM Input / Output

Input	Output
URL: Model: claude-3-5-sonnet-latest	{ "typosquatting": false, "unusual_query_string": true, "suspicious_tld": false, "ip_in_url": false, "long_subdomain": false, "malicious_keywords": false, "encoded_characters": true, "redirection": false, "contains_email_address": false, "known_domain": true, "brand_spoofing_attempt": false, "third_party_hosting": false }
URL: URL: https://email.nationalgeographic.com/T/v600000192d461b369a965aaf4bbe5cfc0/b0a141541c854b2b0000021ef3a0bcf0/b0a14154-1c85-4b2b-a826-24f74eee951f?__dU__=v0G4RBKTXg2GtTHJDsy7ii3waBSrIwMXGZJ7x_OARFKFQAIe3mwx22JG_r9Sy1LWLGyMVrrFIdudbYjwKGAKz6iTAgyV5XAM3SbSN-FzJU9XXpFWtSFRxbGw4nHcgLdnvWYAVcbDlQyQtE1-NmUBscmA==&__F__=v0fUYvj
URL: https://privacychoices.thewaltdisneycompany.com/manage?ee=mgLwiTAsmx8AAAGSWcOkSwEqxr8G9BnmRjE8tQU37C%2FR5amsImFHddte6mpL1mSYNKIEueIttnXBWW9iNxTNgRcePYfDOPA%2FnXkdVvXE4qVu&campaignid=b0a14154-1c85-4b2b-a826-24f74eee951f&langpref=en-us&source=PCM_M&rid=CDB3 Model: claude-3-haiku-20240307	```json { "contains_trigger_text": true, "trigger_text": "EMAIL PREFERENCES", "prominent_button_name": "UNSUBSCRIBE FROM ALL", "text_input_field_labels": [ "Hello mar****@dbb.catholic.edu.au", "Country/Region of Residence: Australia" ], "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false }

URL: Model: claude-3-5-sonnet-latest	{ "typosquatting": false, "unusual_query_string": true, "suspicious_tld": false, "ip_in_url": false, "long_subdomain": true, "malicious_keywords": false, "encoded_characters": true, "redirection": false, "contains_email_address": false, "known_domain": true, "brand_spoofing_attempt": false, "third_party_hosting": false }
URL: URL: https://privacychoices.thewaltdisneycompany.com/manage?ee=mgLwiTAsmx8AAAGSWcOkSwEqxr8G9BnmRjE8tQU37C%2FR5amsImFHddte6mpL1mSYNKIEueIttnXBWW9iNxTNgRcePYfDOPA%2FnXkdVvXE4qVu&campaignid=b0a14154-1c85-4b2b-a826-24f74eee951f&langpref=en-us&source=PCM_M&rid=CDB33B20B2C4F23C75331940E996C8D7&cmpid=org=ngp::mc=crm-email::src=ngp::cmp=editorial::add=Daily_NL_Monday_History_20241028&langPref=en-US
URL: https://privacychoices.thewaltdisneycompany.com/manage?ee=mgLwiTAsmx8AAAGSWcOkSwEqxr8G9BnmRjE8tQU37C%2FR5amsImFHddte6mpL1mSYNKIEueIttnXBWW9iNxTNgRcePYfDOPA%2FnXkdVvXE4qVu&campaignid=b0a14154-1c85-4b2b-a826-24f74eee951f&langpref=en-us&source=PCM_M&rid=CDB3 Model: claude-3-haiku-20240307	```json { "brands": [ "Disney", "Pixar", "Lucasfilm", "Marvel", "The Walt Disney Company", "National Geographic", "ABC", "ESPN", "FX" ] }

URL: https://privacychoices.thewaltdisneycompany.com/manage?ee=mgLwiTAsmx8AAAGSWcOkSwEqxr8G9BnmRjE8tQU37C%2FR5amsImFHddte6mpL1mSYNKIEueIttnXBWW9iNxTNgRcePYfDOPA%2FnXkdVvXE4qVu&campaignid=b0a14154-1c85-4b2b-a826-24f74eee951f&langpref=en-us&source=PCM_M&rid=CDB3 Model: gpt-4o	```json{ "legit_domain": "thewaltdisneycompany.com", "classification": "wellknown", "reasons": [ "The brand 'Disney' is well-known and associated with 'thewaltdisneycompany.com'.", "The URL 'privacychoices.thewaltdisneycompany.com' is a subdomain of the legitimate domain 'thewaltdisneycompany.com'.", "There are no suspicious elements in the URL such as misspellings or unusual domain extensions.", "The use of a subdomain 'privacychoices' is common for large organizations to handle specific services or information." ], "riskscore": 1}
URL: privacychoices.thewaltdisneycompany.com Brands: Disney Input Fields: Hello mar****@dbb.catholic.edu.au, Country/Region of Residence: Australia

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 30 03:52:54 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2673
Entropy (8bit):	3.990226870204554
Encrypted:	false
SSDEEP:
MD5:	92E923939468A5A4B5DA204979F40C00
SHA1:	B92EB8F15045F4344B71CBD35CA0A153C13950DD
SHA-256:	A6FAFF57E6B6124CB8B670DD961414A3ECD50C40680459FE6CD37E9F718B817A
SHA-512:	72B7BEAFFFEBC3EDA4532826CF334D2ABE8F3CC2CB69DBA00B85EFE85A09F2AE7F8AD74C314CB3906602196FAE846449DADA6A998D3973E3E9D9BA809D8DB636
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.........N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I^Y.&....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V^Y.&....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V^Y.&....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V^Y.&..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V^Y.&...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............k.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e..C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 30 03:52:54 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2675
Entropy (8bit):	4.004509672628715
Encrypted:	false
SSDEEP:
MD5:	BFED41EF7702E7F175C5706AB916C75D
SHA1:	B0D8BDB7BB92CA82EBEAA17D5D877DAFA88B2E7A
SHA-256:	AAFB027EBF888A6FD680B8143CB1CD065F19595005C4C7DA86ACC52931119C94
SHA-512:	5B43CB94B4D7D3998B110E0AC34BFACDB12DC62C226FD3BC9A78B8A1D62B67D2B9E8E5448749E1334B18E9A5F46C740B711E05070C6A341E44C278CDAFDD1249
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.....7.....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I^Y.&....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V^Y.&....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V^Y.&....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V^Y.&..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V^Y.&...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............k.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e..C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2689
Entropy (8bit):	4.010525190327946
Encrypted:	false
SSDEEP:
MD5:	8CC98B96D190201FA0ABF4213480CBC7
SHA1:	5171C4628B2350795A9536E3EFBDD8014EAE7BB8
SHA-256:	915ECFE58E707569A744FA88C7C558DDF6F0FD02D06EDDF025F2A5B84491D316
SHA-512:	9FF617F67EF3E9A638A76D25CB4E2CB85AFF5E4A17D69912430DCFE1E8D91A6D4564C4567D752503C04A91D246E1A66D9BC307110D5A24036D4F2FF85908A3E0
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.....Y.04...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I^Y.&....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V^Y.&....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V^Y.&....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V^Y.&..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VFW.E...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............k.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 30 03:52:53 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	4.000341113394263
Encrypted:	false
SSDEEP:
MD5:	E30F39B0E8573BF94F47A7D6397045C8
SHA1:	B8B92C9CC03790B1579FDA47DE2CD38B2B507458
SHA-256:	E6D9B06F0B674576348CB6392A087C8779356AEEB9DBC1378914EF38EF582D57
SHA-512:	9FB198F6633EC63CA2FE6E0798AE6146B0DC021866B3AD65451093C7162999CA7A0AD672097DB5A0BC5D6A0E4FCF687A0795FB830621BE7BB34A13250611D141
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,....e......N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I^Y.&....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V^Y.&....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V^Y.&....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V^Y.&..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V^Y.&...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............k.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e..C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 30 03:52:54 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.991590338573189
Encrypted:	false
SSDEEP:
MD5:	0508070690CAF71BD17A5301EA5CDD65
SHA1:	4680C1EE70F9DE877FF23185247F10BD6A54DB3D
SHA-256:	77E3349AB1E54509A998EB7E092B6B19D54181D9D5A5A36834C8E129C0843213
SHA-512:	30642DE4A982B7BF638136D6DBDBD2552DE2BB0E37CA199DB0DA4AF43B369576E51E0A6476418B7DEC858D7CCDD8117FDB7A463F97486B49B26C72778CA620D8
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,...........N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I^Y.&....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V^Y.&....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V^Y.&....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V^Y.&..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V^Y.&...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............k.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e..C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 30 03:52:53 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	4.0015024265846755
Encrypted:	false
SSDEEP:
MD5:	0AD13DE8B0DD05BD7C46E4128697380A
SHA1:	0048F37533EA51AC4EACA0E1D6E0CD5E9011BC15
SHA-256:	5BC35D6540181EC956BD2CF734AD42E13D7B0F8DB5555E9E361A65759C27F616
SHA-512:	086310D6FC00F8D7DD2FF07882A29F1984CA902A9745767CF175385F9362697178438E2EA49AAFA46F150ABE68E66D3CFCBA8910497165C803601A7EF8369B13
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,...........N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I^Y.&....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V^Y.&....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V^Y.&....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V^Y.&..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V^Y.&...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............k.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e..C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Chrome Cache Entry: 75

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (32055)
Category:	downloaded
Size (bytes):	274997
Entropy (8bit):	5.362089563932047
Encrypted:	false
SSDEEP:
MD5:	F78B0F13FAB58D1D255667EC01B13291
SHA1:	B95F46EF12E6689ECB3E93FD991F4DCB0850C395
SHA-256:	0F7A5AC612D50AE7A04FFE20F16D22791098B40A0D118822E7C681AA3459DA0D
SHA-512:	B579A951BEFF1C1C01EB80ADDD565AE19BB8641FF4F844E2620AA06E3D4C202F8FD208AA581586B54DA550BAE1386B6996FDFFDEACD8A1823392DA3ADAE19285
Malicious:	false
Reputation:	unknown
URL:	https://cdn.registerdisney.go.com/v2/outer/DisneyID.js
Preview:	!function(){function e(t,n,r){function o(s,a){if(!n[s]){if(!t[s]){var c="function"==typeof require&&require;if(!a&&c)return c(s,!0);if(i)return i(s,!0);var u=new Error("Cannot find module '"+s+"'");throw u.code="MODULE_NOT_FOUND",u}var d=n[s]={exports:{}};t[s][0].call(d.exports,function(e){var n=t[s][1][e];return o(n\|\|e)},d,d.exports,e,t,n,r)}return n[s].exports}for(var i="function"==typeof require&&require,s=0;s<r.length;s++)o(r[s]);return o}return e}()({1:[function(e,t,n){(function(e,r){(function(){!function(e){if("function"==typeof bootstrap)bootstrap("promise",e);else if("object"==typeof n&&"object"==typeof t)t.exports=e();else if("function"==typeof define&&define.amd)define(e);else if("undefined"!=typeof ses){if(!ses.ok())return;ses.makeQ=e}else Q=e()}(function(){"use strict";function t(e){return function(){return X.apply(e,arguments)}}function n(e){return e===Object(e)}function o(e){return"[object StopIteration]"===re(e)\|\|e instanceof K}function i(e,t){if(V&&t.stack&&"object"==ty

Chrome Cache Entry: 76

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1190
Entropy (8bit):	5.074825153382555
Encrypted:	false
SSDEEP:
MD5:	63A2584DE4DEAB7CF36023E4BEEBADB6
SHA1:	75B03C0A928A49418FC45E85BF24465AA0EAE858
SHA-256:	45FF02C379C723D3F69585BDA55624B8E4D548CE7E0D401010A0F1054DF98644
SHA-512:	79234BEAE4CE3CE2FA860F6CA9C80623DFC4EA7248E2255A0AA6FDBFD3556A8CCCA4EA9B685BF8856FEB0A23721D3D5B7AB17A573B1C5637750453C111551CC9
Malicious:	false
Reputation:	unknown
Preview:	{"legalCountry":"AU","consumerPermissions":[{"name":"Updates, special offers and other information that may interest you from The Walt Disney Family of Companies","code":"WDIGFamilySites","typeCode":"F","sourceCode":"ESP","permissionStateCode":"D","clientId":"DTSS-PERMISSIONCENTER.WEB-PROD","permissionStateTimestamp":1730263986334,"taxonomyNodeId":1,"businessUnitName":"TWDC","categoryName":"The Walt Disney Family of Companies","friendlyName":"Updates, special offers and other information that may interest you from The Walt Disney Family of Companies","typeName":"FOB","expired":false,"type":"CONSUMER"},{"name":"National Geographic","suppressionEntityName":"National Geographic","suppressionEntityID":100220,"suppressionEntitySourceID":21110,"code":"National_Geographic_L","typeCode":"L","sourceCode":"ESP","permissionStateCode":"E","clientId":"DTSS-PERMISSIONCENTER.WEB-PROD","permissionStateTimestamp":1730263986884,"taxonomyNodeId":6009,"businessUnitName":"National Geographic","categoryName

Chrome Cache Entry: 77

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (12528)
Category:	downloaded
Size (bytes):	45451
Entropy (8bit):	5.439734758643244
Encrypted:	false
SSDEEP:
MD5:	AB7AEEC94BB3F98585E4F0CEA6F4B2C7
SHA1:	A6FEDC822F9CE614782467F5A2C6267D1FDE8C90
SHA-256:	513468C6DD032E2E6DD79651B5453DF5D9E33E7D4CCFD835B44EAA2A1227DF4F
SHA-512:	F2880AB745D468B844E04908CE7056BAAADB2EC7DFD55EA314831A0702FEE51319F534064CB47FD34BB2331AE394C7D35EF6D6AD61C54E960527FDD8B429BF9C
Malicious:	false
Reputation:	unknown
URL:	https://privacychoices.thewaltdisneycompany.com/resources/analytics/prod/utag.2.js?utv=ut4.44.201811270012
Preview:	//tealium universal tag - utag.2 ut4.0.201811270012, Copyright 2018 Tealium.com Inc. All Rights Reserved..var omni_s=new AppMeasurement();omni_s.account="wdgpermissionscenter";omni_s.trackDownloadLinks=true;omni_s.trackExternalLinks=true;omni_s.trackInlineStats=true;omni_s.linkInternalFilters="javascript:,privacychoices.thewaltdisneycompany.com";omni_s.linkLeaveQueryString=false;omni_s.linkTrackVars="None";omni_s.linkTrackEvents="None";omni_s.usePlugins=false;omni_s.currencyCode="USD";omni_s.visitorNamespace="dtsspermissionscenter";omni_s.trackingServer="w88.go.com";omni_s.trackingServerSecure="sw88.go.com";omni_s.debugTracking=utag.cfg.utagdb;if(window.Visitor&&""){try{omni_s.visitor=Visitor.getInstance("");}catch(e){}}.function AppMeasurement(){var a=this;a.version="1.6.3";var k=window;k.s_c_in\|\|(k.s_c_il=[],k.s_c_in=0);a._il=k.s_c_il;a._in=k.s_c_in;a._il[a._in]=a;k.s_c_in++;a._c="s_c";var q=k.AppMeasurement.Jb;q\|\|(q=null);var r=k,n,t;try{for(n=r.parent,t=r.location;n&&n.location&&t&

Chrome Cache Entry: 78

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 24648, version 0.0
Category:	downloaded
Size (bytes):	24648
Entropy (8bit):	7.990894131576563
Encrypted:	true
SSDEEP:
MD5:	6582BF953A86281FEFE137C104650500
SHA1:	4C8CCC56FD6A632A2C6B478E4CBF7A480BA23DEC
SHA-256:	DDD0EF3969A8FE8E74303A68E23A42017302163556F72D9CCCFC0F1CF615B6A8
SHA-512:	E099F173C4BBD0B02622AF7C3C9DD52164EB261EECF4C561F4C9486B92248FF389B162583D0ACC64D52B20D7161D3426E8C7B735095EE055FB09D424B21848F5
Malicious:	false
Reputation:	unknown
URL:	https://fast.fonts.net/dv2/14/a1243c20-2204-4773-960f-e869e0b492b3.woff2?d44f19a684109620e484157da390e818ef7147590fb5ff11319dd647c1ed2320d42e072c64794381ba6416ab9e1d3ec0a8aaab3051bd14d3237ba259c100ea62ef90d7c29d67f160447863fa24a036d5d9379df80a6ec97981d2ee363656b205337d00c7e4f474b7f0a28fe2f44ef8faca5fd29d29b3f814cccb969b6b9452844f3c8f5cd44e569cebba99ef34916785&projectId=e4a6ad5f-dc34-455c-ab4a-3e3316e5e1ba
Preview:	wOF2......`H......S...]Q......]..................`..`..t....Y..........6.$..t.....<.. ..... .^[.=q...=+.=.HQ.a..I?........j..../~.....O...?.....U`.n.u\.7DDW.5..W...D%. W6EQ......+.s.z..5y....fv..&...+3k..9q.w...oE<.+.......;}.Wv..c...,0H.c5.s..m'm,m. .....8c.....E4E..J[Xv).......A..H.K.'.x).cIL...R.Ts..).XR...zySM..UM...u..".36...3.u......2..2>...>J..si>K.=....R...mJSz.\i,.x....x.eFk.T..&.>....dF."..H...r.A..B.!a..U..M..}~......;t...X4.i.c..<.V.X..XE..+......j.o.U.....~.+......B.%..T..M.)S.N.:n.eyg.2..3[..>.1%...23..f6.E#.....jC......s.}3-.`.E.....&..W%k..o.....bi<d.hq....Y.f.L......T.=80....D..MB.\.".....S...Y)...*@....G..1....8...6l.3..nk.)?.fi.&...@.Q..U......L.i...,.......!.sW<$Y..(.\Y.J....B........V.s....a..".'a...?..."......:.+.2.(.....ny.)H.Y.).6r.qI.#.._5[=....s.S...l.....?.>..6.......6....P.....j...+/.!..!7U.]......ES.1fE.c.72E.D....j....ILh..PY.........[V...$wO....2+.\|']3..1C..v..-...P.a..>..}.J.a....q....R...G...=.....n..V....G?..

Chrome Cache Entry: 80

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 18428, version 1.0
Category:	downloaded
Size (bytes):	18428
Entropy (8bit):	7.988037163385806
Encrypted:	false
SSDEEP:
MD5:	EECD612FA5F3095CB55C6B24AFEA0C19
SHA1:	09C6579033B509596A0280B7B9D409FA89022715
SHA-256:	446D2C488253B49A62319B809A1AFA6F942A8521E4C7B13DCDE1B72B630878A2
SHA-512:	4B1602C852673C93F6D6611297ADF5309416138376B0D10E9A5838D06E65B003A8371F4051E944132E61129046F47351D44B0C8C5C335539049F515D7724D9EB
Malicious:	false
Reputation:	unknown
URL:	https://fast.fonts.net/dv2/14/8bf38806-3423-4080-b38f-d08542f7e4ac.woff2?d44f19a684109620e484157da390e818ef7147590fb5ff11319dd647c1ed2320d42e072c64794381ba6416ab9e1d3ec0a8aaab3051bd14d3237ba259c100ea62ef90d7c29d67f160447863fa24a036d5d9379df80a6ec97981d2ee363656b205337d00c7e4f474b7f0a28fe2f44ef8faca5fd29d29b3f814cccb969b6b9452844f3c8f5cd44e569cebba99ef34916785&projectId=e4a6ad5f-dc34-455c-ab4a-3e3316e5e1ba
Preview:	wOF2......G...........G.............................`..`..N..2..4.....p..$.6.$..(..,.. .... ..j.a.5l.1.[.r 5..h..$.J.U.c..vx.J.....1.8\.V9... ..D%.i...........v...........Q.".(...?...mP.HOKS...K'.b..!..\|...bp.4.C:.E.!o..gYb..8.\............<..S.B~).!B.Q..]..."..j@u..%Km....'.....M.@..G......l.#...........1`#G...U....m....(...+....C?........~....l!S......m...'..~Bub.?...f&i...R.O~........).I.&@....l..9.]....-.....Qb.....-......t.3..?.:$...l.,.).{.Bjw.uF....J....6_....Wj.ZiyG[..].~U.+7..rw!.R.ak>.+.=..U....[.<T-..DH..H....o......T.S...2.......<#..'.9..e...>..(...W.'..4...4[....A`..&..`.Z.Rm.".%..........<.R+..C...1....!I...0..ojY...9.)..$.<..$. \|..2.........."{F.....lUA..9P.;2.:wrB.Z.V4...D. [..2.L...\|...t.2w.LL.....h.c....!......t..-.d..LN.a..>a...7'..Y#.\|}...EN9...."..5_{.?D...."2.l..g...Q...I.}Y....=.06~.AK...f.....r..TQ.X..7..K ....9...=.....G;ux.5}...H.F...\..$...........y.Mt.N.-v<.}x.....0a...D.ig.u.E....;.d...=......y{+x...... ;.

Chrome Cache Entry: 81

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	2
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	7BC0EE636B3B83484FC3B9348863BD22
SHA1:	EBBFFB7D7EA5362A22BFA1BAB0BFDEB1617CD610
SHA-256:	A2C2339691FC48FBD14FB307292DFF3E21222712D9240810742D7DF0C6D74DFB
SHA-512:	4D094B64124366530E7E327B1AD5D06C0FD1CEB96387D6A143E9F561C2F9FF7CA9D68E7C23B8B14AAB5309C202A8DCED9A38D950662A50984D2841577293CD64
Malicious:	false
Reputation:	unknown
URL:	https://tags.tiqcdn.com/utag/tiqapp/utag.v.js?a=disney/dtss-permission-center/201811270012&cb=1730263983434
Preview:	//

Chrome Cache Entry: 82

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (1466)
Category:	dropped
Size (bytes):	23907
Entropy (8bit):	5.382994596559351
Encrypted:	false
SSDEEP:
MD5:	45552B338CBE49D2100D01B64F88C40F
SHA1:	3EE15D5BD96AA6EB8D2CB82D1B67F5E8EA477828
SHA-256:	07E4C9EAD69073625286C276E029040FDEC38F9C54559D9A5C6615B1C471354D
SHA-512:	284B191F99712D170068D6752F6A34404E9FBFD5C31A0F2CE62787128D52AD6F0A107C6FABA8E8D8E6796A4BC1A93B182E8AB2E0570BF28E60D65EF638058B51
Malicious:	false
Reputation:	unknown
Preview:	//tealium universal tag - utag.loader ut4.0.201811270012, Copyright 2018 Tealium.com Inc. All Rights Reserved..var utag_condload=false;try{(function(){function ul(src,a,b){a=document;b=a.createElement('script');b.language='javascript';b.type='text/javascript';b.src=src;a.getElementsByTagName('head')[0].appendChild(b)};if((""+document.cookie).match("utag_env_disney_dtss-permission-center=(\/\/tags\.tiqcdn\.com\/utag\/disney\/[^\S;]*)")){if(RegExp.$1.indexOf("/prod/")===-1){var s=RegExp.$1;while(s.indexOf("%")!=-1){s=decodeURIComponent(s);}s=s.replace(/\.\./g,"");ul(s);utag_condload=true;__tealium_default_path='//privacychoices.thewaltdisneycompany.com/resources/analytics/prod/';}}})();}catch(e){};if(typeof utag=="undefined"&&!utag_condload){var utag={id:"disney.dtss-permission-center",o:{},sender:{},send:{},rpt:{ts:{a:new Date()}},dbi:[],db_log:[],loader:{q:[],lc:0,f:{},p:0,ol:0,wq:[],lq:[],bq:{},bk:{},rf:0,ri:0,rp:0,rq:[],ready_q:[],sendq:{"pending":0},run_ready_q:function(){for(var i=

Chrome Cache Entry: 83

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	28
Entropy (8bit):	3.950212064914748
Encrypted:	false
SSDEEP:
MD5:	DD0E41619E3E11CDCF4C7508A13916D5
SHA1:	6732131D429E1AD9F604160FB44815B702309824
SHA-256:	EA22796AB2325D2EFDA63AD84D798B1F4B3419D6337CFB24C4560E34EEFE8B54
SHA-512:	F43609451FA12D18FEF17B7CB90B37B2A24A1807FDA1ECB6E6FC8029F0AA884D3714E82E0C7F0DD1538FBAE34C4790C0BC4D150A4D5F2825C700ECC8D36693D0
Malicious:	false
Reputation:	unknown
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISFwm7wxKctl1sYxIFDaOyTP0SBQ2jskz9?alt=proto
Preview:	ChIKBw2jskz9GgAKBw2jskz9GgA=

Chrome Cache Entry: 84

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3179
Entropy (8bit):	4.855415470142864
Encrypted:	false
SSDEEP:
MD5:	0BE964EF68C798C32136CF76996E8C50
SHA1:	C1FDE1EB8BEC59459E4E32E2EE7B7D36AB868826
SHA-256:	279AB98B90CFD1A0A825519843A5A520E2B44CFA84E751C7793F177B092512E8
SHA-512:	EE6BE10A5A3B31491A9FC560805BB87F825D42238BF0BD39BAFE7AC670E7B6B7AA9F0B7A43ACEFBF12D6E2C7A1B8F7D36441FECC4CCF94293A6A701048957532
Malicious:	false
Reputation:	unknown
Preview:	/****/ (function(modules) { // webpackBootstrap./**/ .// The module cache./**/ .var installedModules = {};./**/./**/ .// The require function./**/ .function __webpack_require__(moduleId) {./**/./**/ ..// Check if module is in cache./**/ ..if(installedModules[moduleId]) {./**/ ...return installedModules[moduleId].exports;./**/ ..}./**/ ..// Create a new module (and put it into the cache)./**/ ..var module = installedModules[moduleId] = {./**/ ...i: moduleId,./**/ ...l: false,./**/ ...exports: {}./**/ ..};./**/./**/ ..// Execute the module function./**/ ..modules[moduleId].call(module.exports, module, module.exports, __webpack_require__);./**/./**/ ..// Flag the module as loaded./**/ ..module.l = true;./**/./**/ ..// Return the exports of the module./**/ ..return module.exports;./**/ .}./**/./**/./**/ .// expose the modules object (__webpack_modules__)./****/ .__webpack

Chrome Cache Entry: 85

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1642), with CRLF line terminators
Category:	downloaded
Size (bytes):	15655
Entropy (8bit):	4.692378612745094
Encrypted:	false
SSDEEP:
MD5:	C420A601E4928BCFE6377EF6B5C716F3
SHA1:	E181815F509E8F22EC528A53164AFDAD5297E5B0
SHA-256:	4E77A41AB74E23754001C74DB092A30B45D9303BCD9700A686064A76BEFC3240
SHA-512:	C1A10F87F729D90D5FE319E70DD39DA37FF38FE64FC3793D7F3A22CBDCF58B34AE3869DD037FFBB35184D8361C3C7F28AA16CBCC663590475D441EA3754090B4
Malicious:	false
Reputation:	unknown
URL:	https://fast.fonts.net/cssapi/e4a6ad5f-dc34-455c-ab4a-3e3316e5e1ba.css
Preview:	@import url(/t/1.css?apiType=css&projectid=e4a6ad5f-dc34-455c-ab4a-3e3316e5e1ba);..@font-face{..font-family:"Aramis W01_n2";..src:url("/dv2/2/eb9e54ac-2dc9-4fc9-ad00-9a124c23b2b2.eot?d44f19a684109620e484157da390e818ef7147590fb5ff11319dd647c1ed2320d42e072c64794381ba6416ab9e1d3ec0a8aaab3051bd14d3237ba259c100ea62ef90d7c29d67f160447863fa24a036d5d9379df80a6ec97981d2ee363656b205337d00c7e4f474b7f0a28fe2f44ef8faca5fd29d29b3f814cccb969b6b9452844f3c8f5cd44e569cebba99ef34916785&projectId=e4a6ad5f-dc34-455c-ab4a-3e3316e5e1ba#iefix") format("eot");..}..@font-face{..font-family:"Aramis W01";..src:url("/dv2/2/eb9e54ac-2dc9-4fc9-ad00-9a124c23b2b2.eot?d44f19a684109620e484157da390e818ef7147590fb5ff11319dd647c1ed2320d42e072c64794381ba6416ab9e1d3ec0a8aaab3051bd14d3237ba259c100ea62ef90d7c29d67f160447863fa24a036d5d9379df80a6ec97981d2ee363656b205337d00c7e4f474b7f0a28fe2f44ef8faca5fd29d29b3f814cccb969b6b9452844f3c8f5cd44e569cebba99ef34916785&projectId=e4a6ad5f-dc34-455c-ab4a-3e3316e5e1ba#iefix");..src:url("/d

Chrome Cache Entry: 87

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 26080, version 0.0
Category:	downloaded
Size (bytes):	26080
Entropy (8bit):	7.990248374383621
Encrypted:	true
SSDEEP:
MD5:	6136E05B5B1B2748C67A5E9E29A752FC
SHA1:	BAA4A61A16E46102F290BD7B63B3BA50770EAE0B
SHA-256:	4B3A5E9E68E0A41245BE2AF724B0D350AD1328F6496D1B6B73620BF22FE3E359
SHA-512:	4800AB1722017E840485AD16172999B9874138ADD6EF0DD36841AD3F43C7078EE876A8A9ED076FC50E7AC7B66BCE5EE73B05E3D7F281D4EEB22D9F03B9B16152
Malicious:	false
Reputation:	unknown
URL:	https://fast.fonts.net/dv2/14/51f9e41d-621a-45c3-80ff-092b8869ee56.woff2?d44f19a684109620e484157da390e818ef7147590fb5ff11319dd647c1ed2320d42e072c64794381ba6416ab9e1d3ec0a8aaab3051bd14d3237ba259c100ea62ef90d7c29d67f160447863fa24a036d5d9379df80a6ec97981d2ee363656b205337d00c7e4f474b7f0a28fe2f44ef8faca5fd29d29b3f814cccb969b6b9452844f3c8f5cd44e569cebba99ef34916785&projectId=e4a6ad5f-dc34-455c-ab4a-3e3316e5e1ba
Preview:	wOF2......e.......J\|..b.......cH.................`..`..t....Y..........6.$..t.....<.. ..... .[[.4qE....=i.=.HQ.a..I?........j..../~.....O...?.....E`...:.7DDW.5..W...D%. W.....GX.g..'u.O..T...'....O%pR$.@....uE..L..D...O.\.C.7S....p.5..)..]..3O~.."..`..I:@sk..6..K.m.[.[...nA...n`..`./.jP...+.eDb.>O[.Q~...+%.f.$..,tb...j... ...'.......BO0g.t."n...f\D.8..gq........]~.BU..Dr.Q:5#.Db......\..=.c\|>.U..$.....M.tSb.n1..E...Y.c.g..D._.r.....}..]j<.y.Y.S9}.A.".8.uvU..Q._ivFiF..WQ.....x....p....Jp.;........7rfg.j....F\|>.>.B...#..}..[...'.j.u.@T[...U.u.4....'.N}s.#D^I.I@......9..9....g<.Z..-.k..4.9..az.h......%.%.qyx..........!.u..I..M&.p....3.d.?/..ZUD.z..=.Z..X...j+\|..2KM.....J>V1J..a.w....?M..;...w.s;.{{..hl..$).\.Y.4.A.(.......9.V.X.R`.K.Xk..ut\|......wM..fO9.>..=.V...T.<.R..... 2........y..B{?f.. ..~.Z......=s..`M.J..L..0Z'.!.zq.~+j.By...C\$.2k)....U@_}VS0....8`..;....#..@.....'.y.,.....s...U4.Q.3.....y.....s.......L0..b*.1.L~c........%...+..'.X.Ol....b

Chrome Cache Entry: 88

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (39408)
Category:	downloaded
Size (bytes):	40053
Entropy (8bit):	5.341616202464391
Encrypted:	false
SSDEEP:
MD5:	0C457A1A1960E04962F1183470EC2D77
SHA1:	B53C00B17B3CFF98807DC460B601A93FBB1EAE37
SHA-256:	B353784B461E54F841FBB22785FAC617B4A32220F514E782521A4145878D1214
SHA-512:	5FBCEA7F7C737175246C3DBB26920D0E0FEBBA04FBFD68A91DFFB8E8A14077C8A7F2B139180C56C6B9EAFCDEF029588A2C78939AD6527C9D48BDFA2DAE8E8BBC
Malicious:	false
Reputation:	unknown
URL:	https://privacychoices.thewaltdisneycompany.com/resources/css/themes/default.css
Preview:	.html,body,div,span,applet,object,iframe,h1,h2,h3,h4,h5,h6,p,blockquote,pre,a,abbr,acronym,address,big,cite,code,del,dfn,em,img,ins,kbd,q,s,samp,small,strike,strong,sub,sup,tt,var,b,u,i,center,dl,dt,dd,ol,ul,li,fieldset,form,label,legend,table,caption,tbody,tfoot,thead,tr,th,td,article,aside,canvas,details,figcaption,figure,footer,header,hgroup,menu,nav,section,summary,time,mark,audio,video{margin:0;padding:0;border:0;font-size:100%;font:inherit;vertical-align:baseline;box-sizing:border-box;-moz-box-sizing:border-box;-webkit-box-sizing:border-box;-o-box-sizing:border-box}article,aside,details,figcaption,figure,footer,header,hgroup,menu,nav,section{display:block}body{line-height:1}ol,ul{list-style:none}blockquote,q{quotes:none}blockquote:before,blockquote:after,q:before,q:after{content:'';content:none}ins{text-decoration:none}del{text-decoration:line-through}table{border-collapse:collapse;border-spacing:0}p.description.all.bottom.p2{color:#333}.saveButton,.postalButton,.customerServic

Chrome Cache Entry: 89

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 18148, version 1.0
Category:	downloaded
Size (bytes):	18148
Entropy (8bit):	7.98817232361315
Encrypted:	false
SSDEEP:
MD5:	ACA5631983A98FDE993196E350B3274E
SHA1:	3D185A9A89D24109FFB47DDE6268B3B1FF3F66EA
SHA-256:	06F337FB04772FC10B70A824E4D9A24889C7473F9530A9ED9C599E9F6719FCFF
SHA-512:	56BCE07DBCD1177E4E2EF9DD0F2B278B1ED6C42DF6D2970B13C8303D7F8399F858D866B95F9156A00C86C90E970B2C73DF8A510CBB1682D88C7C154CC2BBED6D
Malicious:	false
Reputation:	unknown
URL:	https://fast.fonts.net/dv2/14/e17c7943-8db2-4470-9e2a-74a8d01f6776.woff2?d44f19a684109620e484157da390e818ef7147590fb5ff11319dd647c1ed2320d42e072c64794381ba6416ab9e1d3ec0a8aaab3051bd14d3237ba259c100ea62ef90d7c29d67f160447863fa24a036d5d9379df80a6ec97981d2ee363656b205337d00c7e4f474b7f0a28fe2f44ef8faca5fd29d29b3f814cccb969b6b9452844f3c8f5cd44e569cebba99ef34916785&projectId=e4a6ad5f-dc34-455c-ab4a-3e3316e5e1ba
Preview:	wOF2......F........$..F...........................\|.`..`..N.....4..... ..=.6.$..(..,.. ..". ....~...6.z..@...{.+.6.xw.nb.[.Y..VI.o....?.=d`3... ..!....`..e.v..Y..wm4.Z.7.".Rm/....lr=.}.N..&....hm..[.{bTib.G...2....+...R..@.#.\|)....#7z..f...........c}.....a.)..G>)).....h..Fm..E.[..f...%......<1....l...7.....$;.NJ... .e)..z......G..W..WD0..\|"...~..k..-... .=kHb..(.R...L;...Ys...-$.O.Fh{.....Y.,.O.!g.O\|.s.....E..%.c..(.G...\....).o."\..b.}O.]....;......r..J..g.T;....@S......WJn..K..46k..@..@O..i..1I[..z..(.....!..8v`....+.8..A[K......-!..CNM..J.\T..........%..D`... '....^...y.a.q.s..G.Y..r..._t.......\.........\`U!+\.'..S.`.D.@J..?..d.Eg0....&.3.......W.Ue....,E:I.2..3@0.hOEf...5W...$.B"....n.?..'\:QK"$I7.G..M.a.."j.P".uj...MQ.A..q..)..1&u...".2EA..-......LH.... ....y.._Ce1.....A.gQm..C..].z.AD.z........V.....".!.K(....^..\|....H ...6s...F....+..0....5"U...W..l.".z.........b[".;ST..p.w......J...}...J.....M%..`.e....E.3......... P.7.a..@'.in.0K..Fl......

Chrome Cache Entry: 92

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1706
Entropy (8bit):	7.872686994723032
Encrypted:	false
SSDEEP:
MD5:	6169315CF572A63643756B015A26ADF4
SHA1:	0AA5205BF925BCCA66A647FC954A3F38D181D34C
SHA-256:	E12CDADC9DD9980063AD0547B6E63D76075D2478076154950100F568C9774236
SHA-512:	53CAF2C50D91231F15A4D7E09474C19EC2A4531C1D9019AF425281BF833B5A03EF9336E4DD2C18030C72BC0BBAA93ECD94E94101C9BD3642710AEB2C3BEEBD5C
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR... ... .....szz....qIDATX...k....?gf..].dI..VLl.B\..c.\...4..J.....C....B..?.B!o.....M]..-X8up\.b...d.V.....fN.~?.$_d%)]..9s8.;g.\F...sV....%....G....q.vPK.n.5...c....x..hF..tV...c.............T.T.I...Z...D.....l.p....`O.&+...N....F........K0vW.O.....y.Op........&....Hv;6..o....d....1.J........).2N,.b..:q.L.-..H..L... ...nu..9]{...Q.8 .....p....$.:.<...]!j.I.;)......A.....aj..>[...5.1.@^.ES...a.t...QF.G84...N..z.:...h.$.......o..F.D.)....I....h.G.e..j.9<y.T.c..>Fm.......7...p.v.F{8t+imKLv...y.....k}.#...W...."...WCO...%..y.W.3Q=..s..y...s.6.F}.O$...^V..k...].$.C0.Q$.M...0\.B...QMhw....Q.@.t..}/S..'....T..........2...n.....?...G.u3...&.;s4...seFF^`x...h.(.."..w..GR.Rr...i..5....d.6.:....^o....<s.W.....k.=..x.x..K").bHvPK...!r.........B.....#.=.........&9../..).$.!.'&..>%.(J@.......\...ch.Q.%......8z!.......3R=.......=..Wp..U....H...9R9..L.j8.c.T..3..........9.W..j....t...[.....&^c..w....<.J...y..2g'Nsl...l....L(.]V:..."%W...

Chrome Cache Entry: 93

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (4099)
Category:	downloaded
Size (bytes):	2588198
Entropy (8bit):	5.221446353436356
Encrypted:	false
SSDEEP:
MD5:	6B222D432A9E3D8EB9BCDF807378549C
SHA1:	5E072DDA30AF70738D6376263778B6409BABA0F2
SHA-256:	BF8877F4ADC4A991BD91B6970280EC44984818882B602669124C79801DD4AD27
SHA-512:	65666580C976BB07DCA17FFD2726F5ECE600EE80E3AF436A17175777FE9D33D81C40266FADA72ABCDBFCD8C9C22EE7C6328423B3E0BC621FEF78DEF0CFD4C3D7
Malicious:	false
Reputation:	unknown
URL:	https://privacychoices.thewaltdisneycompany.com/resources/js/manage.js
Preview:	/****/ (function(modules) { // webpackBootstrap./**/ .// The module cache./**/ .var installedModules = {};./**/./**/ .// The require function./**/ .function __webpack_require__(moduleId) {./**/./**/ ..// Check if module is in cache./**/ ..if(installedModules[moduleId]) {./**/ ...return installedModules[moduleId].exports;./**/ ..}./**/ ..// Create a new module (and put it into the cache)./**/ ..var module = installedModules[moduleId] = {./**/ ...i: moduleId,./**/ ...l: false,./**/ ...exports: {}./**/ ..};./**/./**/ ..// Execute the module function./**/ ..modules[moduleId].call(module.exports, module, module.exports, __webpack_require__);./**/./**/ ..// Flag the module as loaded./**/ ..module.l = true;./**/./**/ ..// Return the exports of the module./**/ ..return module.exports;./**/ .}./**/./**/./**/ .// expose the modules object (__webpack_modules__)./****/ .__webpack

Chrome Cache Entry: 94

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	13359
Entropy (8bit):	4.989415233854822
Encrypted:	false
SSDEEP:
MD5:	BEC64EDD4B0B568E80E2A7E0DB3FB855
SHA1:	075614B43AB9379DBFFE852B54721B8769CA6D75
SHA-256:	F499CD5F56DC75346F037937FDA240AEACED5E5DE238CBBFC9231D6C84F356B5
SHA-512:	3302A0079048A7B0E12C10B7880C670B936AFA0E351C8FCF0026B01CAD0276D2E6784B1EE8E44EC7414DC813199F247EEF5778111A61ED493339651C24B6B23F
Malicious:	false
Reputation:	unknown
Preview:	{"expiredClickbackText":"This link has expired. Please return to the login page using the button below to resend the link.","homeButton":"Return To Login","lang-select":"Your language:","lobHeadline":"You are about to unsubscribe from:","subscribeOneHeadline":"Yes! I would like to receive updates, special offers, and other information from <%= permissionEntity %>","senderHeadline":"You are about to unsubscribe from all commercial email messages from:","senderHeadline2":"Here are the emails you are receiving from:","actionButton":"Yes, Unsubscribe Me","subscribeActionButton":"Sign Me Up","secondaryLink":"Manage More Email Communications","successMessage":"We have received your request to unsubscribe from <%= permissionEntity %>","confirmSuccessMessage":"Thank you for confirming your subscription to: <%= permissionEntityList %>","singleSubscribeSuccessMessage":"Success! You've been signed up.","unsubButton":"unsubscribe from all","saveButton":"Save changes","permissionStatesUnsubscribed"

Chrome Cache Entry: 95

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (399)
Category:	downloaded
Size (bytes):	4159
Entropy (8bit):	5.031585116473463
Encrypted:	false
SSDEEP:
MD5:	2822756050B8611E3BB0096BD1D5E347
SHA1:	C924C66E57EB213FE94A568B74255E0971197D44
SHA-256:	7ED828047ED5FB9CF6BA051C63EF08B663CFECDE49E47F57B746EDF04F1B3A62
SHA-512:	43FA114A374BF83B5B1165490D54294EAC7DC4CAC14C195BDF2E41CCCD486C844114A648C94AD18B860923C82B3156737EB7F50E7DD492D3EAC1A998A234750F
Malicious:	false
Reputation:	unknown
URL:	https://privacychoices.thewaltdisneycompany.com/manage?ee=mgLwiTAsmx8AAAGSWcOkSwEqxr8G9BnmRjE8tQU37C%2FR5amsImFHddte6mpL1mSYNKIEueIttnXBWW9iNxTNgRcePYfDOPA%2FnXkdVvXE4qVu&campaignid=b0a14154-1c85-4b2b-a826-24f74eee951f&langpref=en-us&source=PCM_M&rid=CDB33B20B2C4F23C75331940E996C8D7&cmpid=org=ngp::mc=crm-email::src=ngp::cmp=editorial::add=Daily_NL_Monday_History_20241028&langPref=en-US
Preview:	<!DOCTYPE html>.<html lang="en-US" dir="auto">. <head>. <meta charset="utf-8">. <meta name="viewport" content="width=device-width, initial-scale=1.0">. <meta name="google-site-verification" content="K3xCGz49FnDi44REJBL8KM5C6AXH1h9fDYkqKDWHA7w">. <meta name="description" content="The Privacy Choices site offers The Walt Disney Company subscribers a way to view or manage their marketing list subscriptions for all Walt Disney Company sites, such as those for ABC ESPN, Marvel, Star Wars, and of course individual Walt Disney Company sites too. You can cancel existing subscriptions or sign up for any previously cancelled newsletters too.">. https://developers.google.com/search/docs/crawling-indexing/robots-meta-tag#directives-->. <meta name="robots" content="none,noarchive">. <title>Manage Walt Disney Company Email Communication Preferences </title>. <link type="text/css" rel="stylesheet" href="//fast.fonts.net/cssapi/e4a6ad5f-dc34-455c-ab4a-3e3316e5e1ba.css">.

Chrome Cache Entry: 96

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 25660, version 0.0
Category:	downloaded
Size (bytes):	25660
Entropy (8bit):	7.991767978953059
Encrypted:	true
SSDEEP:
MD5:	0A3B8E4BB89545084EF612BCAF5DB19B
SHA1:	CFFF9F749FA5A21F5375F735CFDFC6C63992B653
SHA-256:	F958FD6669821599B8B4272ECFCDF02DB39CF798251DFA82FDD117EAD1AA8A24
SHA-512:	0D1F699185AA84AB6959AF095B31E6BB4FDD80A504C9F487D9EC60F93396672BBFEF54EAB27524968FFC01460C25D45FA9153FD9ABE4511B74C8CDB80CA52BC4
Malicious:	false
Reputation:	unknown
URL:	https://fast.fonts.net/dv2/14/0ff80234-f44e-463b-ab90-743ba33f4323.woff2?d44f19a684109620e484157da390e818ef7147590fb5ff11319dd647c1ed2320d42e072c64794381ba6416ab9e1d3ec0a8aaab3051bd14d3237ba259c100ea62ef90d7c29d67f160447863fa24a036d5d9379df80a6ec97981d2ee363656b205337d00c7e4f474b7f0a28fe2f44ef8faca5fd29d29b3f814cccb969b6b9452844f3c8f5cd44e569cebba99ef34916785&projectId=e4a6ad5f-dc34-455c-ab4a-3e3316e5e1ba
Preview:	wOF2......d<......8D..a?......a..................`..`..t....Y.....(..t.6.$..t.....<.. ...%. .[[."q...=i.=.HQ.a..I?....o..... ...o..._............b.....@...O\kc..t.}r... ...8.V..D.\|L...i... f..... ...&!.boi..B[z..]....9m+.8.....q..z.U..d...3.$'..E.DR;... ..v.q.d;@6.Y.......h.....$.L.......&^B....a^]q..JM..TiK..."...6SmiZ....3.3..m.8..AM..J.6}...n...t.#G.....0.Nn....%\...y...W........./..a..0._._.. ...`#...3..tQ.(]..:.E.N.q...si.e.g...hfa.L.-....EV.-..$.%....W.\Es..U4....r.W./.....>..Q2+.......Q......r..r..=.k....w...p..$.m.\.=Z].;t.q.8....y..?.l9&]).a[9....7 X..Re...@..f..9.Ci.c....j.@/.:..K..W......_.u#.,8..e.....]..x....C..\T.mj.R.O..d(..E.....S}..#.8..-.n.I/...s..sq.Z..\tJt...8.@..a...\.P.s.:7..Rz.t.~*.....\|..>N+.,mRXB.J.al........K...".>...I......[..+.V.UN-......A.........H.H..3].,..s....p)8o.D..$X.%.l..v....Bl3./..7.._6)Z..........!!..a7qZ.#..\.NQD...+.....M&:...Y.,~...-.4.4.h.B^..qGX...F..~..@.Oq.J.4.....yA...ShK......b...`....6.B[.J3.h'...4...DG:J.

Static File Info

⊘No static file info

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Overview

General Information

Detection

Signatures

Classification

Process Tree

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Boot Survival

Mitre Att&ck Matrix

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

LLM Input / Output

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Chrome Cache Entry: 75

Chrome Cache Entry: 76

Chrome Cache Entry: 77

Chrome Cache Entry: 78

Chrome Cache Entry: 80

Chrome Cache Entry: 81

Chrome Cache Entry: 82

Chrome Cache Entry: 83

Chrome Cache Entry: 84

Chrome Cache Entry: 85

Chrome Cache Entry: 87

Chrome Cache Entry: 88

Chrome Cache Entry: 89

Chrome Cache Entry: 92

Chrome Cache Entry: 93

Chrome Cache Entry: 94

Chrome Cache Entry: 95

Chrome Cache Entry: 96

Static File Info