Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
https://o55qyvqab.cc.rs6.net/tn.jsp?f=001NLI7eEoRb5Poh74ULgAKom24kvJpWAk7SrFC8PeKGB4ch0zE0ULqXgMufWeJvvvB1HYAZX_HUxR2p1kN047r3H6c_orKoOCDj7a4YlV4veWxW_rUx27ktdCMeMkvzKaJyGdGK6S1uyfa3RyHuKzja564mBkBzwv_bijWmkaJ3uk=&c=KpnKfC8Kkb6GNlpOBU33X-rsXNZ-8Usc41ZN8PfcGwzdYsAxp7SBiQ==&ch=V5dV41Z3E2LkgWlCrDBHABzJ

Overview

General Information

Sample URL:https://o55qyvqab.cc.rs6.net/tn.jsp?f=001NLI7eEoRb5Poh74ULgAKom24kvJpWAk7SrFC8PeKGB4ch0zE0ULqXgMufWeJvvvB1HYAZX_HUxR2p1kN047r3H6c_orKoOCDj7a4YlV4veWxW_rUx27ktdCMeMkvzKaJyGdGK6S1uyfa3RyHuKzja564mBkBzwv
Analysis ID:1545668

Detection

Score:1
Range:0 - 100
Whitelisted:false
Confidence:80%

Signatures

Stores files to the Windows start menu directory
URL contains potential PII (phishing indication)

Classification

  • System is w10x64_ra
  • chrome.exe (PID: 6288 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
    • chrome.exe (PID: 4684 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2056 --field-trial-handle=1972,i,6183626884481712133,336424547748364940,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
  • chrome.exe (PID: 6772 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://o55qyvqab.cc.rs6.net/tn.jsp?f=001NLI7eEoRb5Poh74ULgAKom24kvJpWAk7SrFC8PeKGB4ch0zE0ULqXgMufWeJvvvB1HYAZX_HUxR2p1kN047r3H6c_orKoOCDj7a4YlV4veWxW_rUx27ktdCMeMkvzKaJyGdGK6S1uyfa3RyHuKzja564mBkBzwv_bijWmkaJ3uk=&c=KpnKfC8Kkb6GNlpOBU33X-rsXNZ-8Usc41ZN8PfcGwzdYsAxp7SBiQ==&ch=V5dV41Z3E2LkgWlCrDBHABzJ6qosa9-mrP7je3mxxtX9W-Ut-Y9mzg==&_e=davis.moeller@dacotahbank.com" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
  • cleanup
No yara matches
No Sigma rule has matched
No Suricata rule has matched

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: https://o55qyvqab.cc.rs6.net/tn.jsp?f=001NLI7eEoRb5Poh74ULgAKom24kvJpWAk7SrFC8PeKGB4ch0zE0ULqXgMufWeJvvvB1HYAZX_HUxR2p1kN047r3H6c_orKoOCDj7a4YlV4veWxW_rUx27ktdCMeMkvzKaJyGdGK6S1uyfa3RyHuKzja564mBkBzwv_bijWmkaJ3uk=&c=KpnKfC8Kkb6GNlpOBU33X-rsXNZ-8Usc41ZN8PfcGwzdYsAxp7SBiQ==&ch=V5dV41Z3E2LkgWlCrDBHABzJ6qosa9-mrP7je3mxxtX9W-Ut-Y9mzg==&_e=davis.moeller@dacotahbank.comSample URL: PII: davis.moeller@dacotahbank.com
Source: https://o55qyvqab.cc.rs6.net/tn.jsp?f=001NLI7eEoRb5Poh74ULgAKom24kvJpWAk7SrFC8PeKGB4ch0zE0ULqXgMufWeJvvvB1HYAZX_HUxR2p1kN047r3H6c_orKoOCDj7a4YlV4veWxW_rUx27ktdCMeMkvzKaJyGdGK6S1uyfa3RyHuKzja564mBkBzwv_bijWmkaJ3uk=&c=KpnKfC8Kkb6GNlpOBU33X-rsXNZ-8Usc41ZN8PfcGwzdYsAxp7SBiQ==&ch=V5dV41Z3E2LkgWlCrDBHABzJ6qosa9-mrP7je3mxxtX9W-Ut-Y9mzg==&_e=davis.moeller@dacotahbank.comSample URL: PII: davis.moeller@dacotahbank.com
Source: https://o55qyvqab.cc.rs6.net/tn.jsp?f=001NLI7eEoRb5Poh74ULgAKom24kvJpWAk7SrFC8PeKGB4ch0zE0ULqXgMufWeJvvvB1HYAZX_HUxR2p1kN047r3H6c_orKoOCDj7a4YlV4veWxW_rUx27ktdCMeMkvzKaJyGdGK6S1uyfa3RyHuKzja564mBkBzwv_bijWmkaJ3uk=&c=KpnKfC8Kkb6GNlpOBU33X-rsXNZ-8Usc41ZN8PfcGwzdYsAxp7SBiQ==&ch=V5dV41Z3E2LkgWlCrDBHABzJ6qosa9-mrP7je3mxxtX9W-Ut-Y9mzg==&_e=davis.moeller@dacotahbank.comSample URL: PII: davis.moeller@dacotahbank.com
Source: https://o55qyvqab.cc.rs6.net/tn.jsp?f=001NLI7eEoRb5Poh74ULgAKom24kvJpWAk7SrFC8PeKGB4ch0zE0ULqXgMufWeJvvvB1HYAZX_HUxR2p1kN047r3H6c_orKoOCDj7a4YlV4veWxW_rUx27ktdCMeMkvzKaJyGdGK6S1uyfa3RyHuKzja564mBkBzwv_bijWmkaJ3uk=&c=KpnKfC8Kkb6GNlpOBU33X-rsXNZ-8Usc41ZN8PfcGwzdYsAxp7SBiQ==&ch=V5dV41Z3E2LkgWlCrDBHABzJ6qosa9-mrP7je3mxxtX9W-Ut-Y9mzg==&_e=davis.moeller@dacotahbank.comSample URL: PII: davis.moeller@dacotahbank.com
Source: https://o55qyvqab.cc.rs6.net/tn.jsp?f=001NLI7eEoRb5Poh74ULgAKom24kvJpWAk7SrFC8PeKGB4ch0zE0ULqXgMufWeJvvvB1HYAZX_HUxR2p1kN047r3H6c_orKoOCDj7a4YlV4veWxW_rUx27ktdCMeMkvzKaJyGdGK6S1uyfa3RyHuKzja564mBkBzwv_bijWmkaJ3uk=&c=KpnKfC8Kkb6GNlpOBU33X-rsXNZ-8Usc41ZN8PfcGwzdYsAxp7SBiQ==&ch=V5dV41Z3E2LkgWlCrDBHABzJ6qosa9-mrP7je3mxxtX9W-Ut-Y9mzg==&_e=davis.moeller@dacotahbank.comSample URL: PII: davis.moeller@dacotahbank.com
Source: https://o55qyvqab.cc.rs6.net/tn.jsp?f=001NLI7eEoRb5Poh74ULgAKom24kvJpWAk7SrFC8PeKGB4ch0zE0ULqXgMufWeJvvvB1HYAZX_HUxR2p1kN047r3H6c_orKoOCDj7a4YlV4veWxW_rUx27ktdCMeMkvzKaJyGdGK6S1uyfa3RyHuKzja564mBkBzwv_bijWmkaJ3uk=&c=KpnKfC8Kkb6GNlpOBU33X-rsXNZ-8Usc41ZN8PfcGwzdYsAxp7SBiQ==&ch=V5dV41Z3E2LkgWlCrDBHABzJ6qosa9-mrP7je3mxxtX9W-Ut-Y9mzg==&_e=davis.moeller@dacotahbank.comSample URL: PII: davis.moeller@dacotahbank.com
Source: https://o55qyvqab.cc.rs6.net/tn.jsp?f=001NLI7eEoRb5Poh74ULgAKom24kvJpWAk7SrFC8PeKGB4ch0zE0ULqXgMufWeJvvvB1HYAZX_HUxR2p1kN047r3H6c_orKoOCDj7a4YlV4veWxW_rUx27ktdCMeMkvzKaJyGdGK6S1uyfa3RyHuKzja564mBkBzwv_bijWmkaJ3uk=&c=KpnKfC8Kkb6GNlpOBU33X-rsXNZ-8Usc41ZN8PfcGwzdYsAxp7SBiQ==&ch=V5dV41Z3E2LkgWlCrDBHABzJ6qosa9-mrP7je3mxxtX9W-Ut-Y9mzg==&_e=davis.moeller@dacotahbank.comSample URL: PII: davis.moeller@dacotahbank.com
Source: https://o55qyvqab.cc.rs6.net/tn.jsp?f=001NLI7eEoRb5Poh74ULgAKom24kvJpWAk7SrFC8PeKGB4ch0zE0ULqXgMufWeJvvvB1HYAZX_HUxR2p1kN047r3H6c_orKoOCDj7a4YlV4veWxW_rUx27ktdCMeMkvzKaJyGdGK6S1uyfa3RyHuKzja564mBkBzwv_bijWmkaJ3uk=&c=KpnKfC8Kkb6GNlpOBU33X-rsXNZ-8Usc41ZN8PfcGwzdYsAxp7SBiQ==&ch=V5dV41Z3E2LkgWlCrDBHABzJ6qosa9-mrP7je3mxxtX9W-Ut-Y9mzg==&_e=davis.moeller@dacotahbank.comSample URL: PII: davis.moeller@dacotahbank.com
Source: https://o55qyvqab.cc.rs6.net/tn.jsp?f=001NLI7eEoRb5Poh74ULgAKom24kvJpWAk7SrFC8PeKGB4ch0zE0ULqXgMufWeJvvvB1HYAZX_HUxR2p1kN047r3H6c_orKoOCDj7a4YlV4veWxW_rUx27ktdCMeMkvzKaJyGdGK6S1uyfa3RyHuKzja564mBkBzwv_bijWmkaJ3uk=&c=KpnKfC8Kkb6GNlpOBU33X-rsXNZ-8Usc41ZN8PfcGwzdYsAxp7SBiQ==&ch=V5dV41Z3E2LkgWlCrDBHABzJ6qosa9-mrP7je3mxxtX9W-Ut-Y9mzg==&_e=davis.moeller@dacotahbank.comSample URL: PII: davis.moeller@dacotahbank.com
Source: https://o55qyvqab.cc.rs6.net/tn.jsp?f=001NLI7eEoRb5Poh74ULgAKom24kvJpWAk7SrFC8PeKGB4ch0zE0ULqXgMufWeJvvvB1HYAZX_HUxR2p1kN047r3H6c_orKoOCDj7a4YlV4veWxW_rUx27ktdCMeMkvzKaJyGdGK6S1uyfa3RyHuKzja564mBkBzwv_bijWmkaJ3uk=&c=KpnKfC8Kkb6GNlpOBU33X-rsXNZ-8Usc41ZN8PfcGwzdYsAxp7SBiQ==&ch=V5dV41Z3E2LkgWlCrDBHABzJ6qosa9-mrP7je3mxxtX9W-Ut-Y9mzg==&_e=davis.moeller@dacotahbank.comSample URL: PII: davis.moeller@dacotahbank.com
Source: https://o55qyvqab.cc.rs6.net/tn.jsp?f=001NLI7eEoRb5Poh74ULgAKom24kvJpWAk7SrFC8PeKGB4ch0zE0ULqXgMufWeJvvvB1HYAZX_HUxR2p1kN047r3H6c_orKoOCDj7a4YlV4veWxW_rUx27ktdCMeMkvzKaJyGdGK6S1uyfa3RyHuKzja564mBkBzwv_bijWmkaJ3uk=&c=KpnKfC8Kkb6GNlpOBU33X-rsXNZ-8Usc41ZN8PfcGwzdYsAxp7SBiQ==&ch=V5dV41Z3E2LkgWlCrDBHABzJ6qosa9-mrP7je3mxxtX9W-Ut-Y9mzg==&_e=davis.moeller@dacotahbank.comSample URL: PII: davis.moeller@dacotahbank.com
Source: https://o55qyvqab.cc.rs6.net/tn.jsp?f=001NLI7eEoRb5Poh74ULgAKom24kvJpWAk7SrFC8PeKGB4ch0zE0ULqXgMufWeJvvvB1HYAZX_HUxR2p1kN047r3H6c_orKoOCDj7a4YlV4veWxW_rUx27ktdCMeMkvzKaJyGdGK6S1uyfa3RyHuKzja564mBkBzwv_bijWmkaJ3uk=&c=KpnKfC8Kkb6GNlpOBU33X-rsXNZ-8Usc41ZN8PfcGwzdYsAxp7SBiQ==&ch=V5dV41Z3E2LkgWlCrDBHABzJ6qosa9-mrP7je3mxxtX9W-Ut-Y9mzg==&_e=davis.moeller@dacotahbank.comSample URL: PII: davis.moeller@dacotahbank.com
Source: https://o55qyvqab.cc.rs6.net/tn.jsp?f=001NLI7eEoRb5Poh74ULgAKom24kvJpWAk7SrFC8PeKGB4ch0zE0ULqXgMufWeJvvvB1HYAZX_HUxR2p1kN047r3H6c_orKoOCDj7a4YlV4veWxW_rUx27ktdCMeMkvzKaJyGdGK6S1uyfa3RyHuKzja564mBkBzwv_bijWmkaJ3uk=&c=KpnKfC8Kkb6GNlpOBU33X-rsXNZ-8Usc41ZN8PfcGwzdYsAxp7SBiQ==&ch=V5dV41Z3E2LkgWlCrDBHABzJ6qosa9-mrP7je3mxxtX9W-Ut-Y9mzg==&_e=davis.moeller@dacotahbank.comSample URL: PII: davis.moeller@dacotahbank.com
Source: https://o55qyvqab.cc.rs6.net/tn.jsp?f=001NLI7eEoRb5Poh74ULgAKom24kvJpWAk7SrFC8PeKGB4ch0zE0ULqXgMufWeJvvvB1HYAZX_HUxR2p1kN047r3H6c_orKoOCDj7a4YlV4veWxW_rUx27ktdCMeMkvzKaJyGdGK6S1uyfa3RyHuKzja564mBkBzwv_bijWmkaJ3uk=&c=KpnKfC8Kkb6GNlpOBU33X-rsXNZ-8Usc41ZN8PfcGwzdYsAxp7SBiQ==&ch=V5dV41Z3E2LkgWlCrDBHABzJ6qosa9-mrP7je3mxxtX9W-Ut-Y9mzg==&_e=davis.moeller@dacotahbank.comSample URL: PII: davis.moeller@dacotahbank.com
Source: https://www.surveymonkey.com/r/FMLD24?e=davis.moeller@dacotahbank.comHTTP Parser: No favicon
Source: https://www.surveymonkey.com/r/FMLD24?e=davis.moeller@dacotahbank.comHTTP Parser: No favicon
Source: https://www.surveymonkey.com/r/FMLD24?e=davis.moeller@dacotahbank.comHTTP Parser: No favicon
Source: https://www.surveymonkey.com/r/close-window/?sm=AHNLv_2FfpZK5O4CWJrS8HcdfZ9lSweveFgWcpdG8_2B_2B3A_3DHTTP Parser: No favicon
Source: C:\Program Files\Google\Chrome\Application\chrome.exeDirectory created: C:\Program Files\Google\Chrome\Application\Dictionaries
Source: unknownHTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.16:49741 version: TLS 1.2
Source: unknownHTTPS traffic detected: 2.19.244.127:443 -> 192.168.2.16:49742 version: TLS 1.2
Source: unknownHTTPS traffic detected: 2.19.244.127:443 -> 192.168.2.16:49743 version: TLS 1.2
Source: unknownHTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.16:49753 version: TLS 1.2
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknownTCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknownTCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknownTCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknownTCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknownTCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknownTCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknownTCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknownTCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknownTCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknownTCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknownTCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknownTCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknownTCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknownTCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknownTCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknownTCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknownTCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknownTCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknownTCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknownTCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknownTCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknownTCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknownTCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknownTCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknownTCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknownTCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknownTCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknownTCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknownTCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknownTCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.10
Source: global trafficDNS traffic detected: DNS query: o55qyvqab.cc.rs6.net
Source: global trafficDNS traffic detected: DNS query: www.surveymonkey.com
Source: global trafficDNS traffic detected: DNS query: prod.smassets.net
Source: global trafficDNS traffic detected: DNS query: secure.surveymonkey.com
Source: global trafficDNS traffic detected: DNS query: cdn.smassets.net
Source: global trafficDNS traffic detected: DNS query: cdn.signalfx.com
Source: global trafficDNS traffic detected: DNS query: surveymonkey-assets.s3.amazonaws.com
Source: global trafficDNS traffic detected: DNS query: www.google.com
Source: global trafficDNS traffic detected: DNS query: bam-cell.nr-data.net
Source: unknownNetwork traffic detected: HTTP traffic on port 49708 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49744
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49743
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49742
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49741
Source: unknownNetwork traffic detected: HTTP traffic on port 49766 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49743 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49746 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49717 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49735
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49734
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49733
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49699
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49732
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49731
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49730
Source: unknownNetwork traffic detected: HTTP traffic on port 49732 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49711 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49703 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49728 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49749 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49700 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49729
Source: unknownNetwork traffic detected: HTTP traffic on port 49752 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49728
Source: unknownNetwork traffic detected: HTTP traffic on port 49714 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49727
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49726
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49725
Source: unknownNetwork traffic detected: HTTP traffic on port 49735 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49724
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49723
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49722
Source: unknownNetwork traffic detected: HTTP traffic on port 49706 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49731 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49712 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49729 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49760 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49745 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49719
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49718
Source: unknownNetwork traffic detected: HTTP traffic on port 49751 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49717
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49716
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49714
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49713
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49712
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49711
Source: unknownNetwork traffic detected: HTTP traffic on port 49757 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49734 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49726 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49765 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49768 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49723 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49708
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49707
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49706
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49705
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49704
Source: unknownNetwork traffic detected: HTTP traffic on port 49754 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49703
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49701
Source: unknownNetwork traffic detected: HTTP traffic on port 49733 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49700
Source: unknownNetwork traffic detected: HTTP traffic on port 49699 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49727 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49704 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49762 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49701 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49713 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49759 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49753 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49707 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49724 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49742 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49718 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49768
Source: unknownNetwork traffic detected: HTTP traffic on port 49756 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49766
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49765
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49764
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49762
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49761
Source: unknownNetwork traffic detected: HTTP traffic on port 49678 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49760
Source: unknownNetwork traffic detected: HTTP traffic on port 49725 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49741 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49764 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49719 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49722 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49759
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49757
Source: unknownNetwork traffic detected: HTTP traffic on port 49755 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49756
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49755
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49754
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49753
Source: unknownNetwork traffic detected: HTTP traffic on port 49673 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49752
Source: unknownNetwork traffic detected: HTTP traffic on port 49705 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49730 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49751
Source: unknownNetwork traffic detected: HTTP traffic on port 49761 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49744 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49716 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49749
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49746
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49745
Source: unknownHTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.16:49741 version: TLS 1.2
Source: unknownHTTPS traffic detected: 2.19.244.127:443 -> 192.168.2.16:49742 version: TLS 1.2
Source: unknownHTTPS traffic detected: 2.19.244.127:443 -> 192.168.2.16:49743 version: TLS 1.2
Source: unknownHTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.16:49753 version: TLS 1.2
Source: classification engineClassification label: clean1.win@18/6@32/285
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Program Files\Google\Chrome\Application\Dictionaries
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: unknownProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2056 --field-trial-handle=1972,i,6183626884481712133,336424547748364940,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknownProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://o55qyvqab.cc.rs6.net/tn.jsp?f=001NLI7eEoRb5Poh74ULgAKom24kvJpWAk7SrFC8PeKGB4ch0zE0ULqXgMufWeJvvvB1HYAZX_HUxR2p1kN047r3H6c_orKoOCDj7a4YlV4veWxW_rUx27ktdCMeMkvzKaJyGdGK6S1uyfa3RyHuKzja564mBkBzwv_bijWmkaJ3uk=&c=KpnKfC8Kkb6GNlpOBU33X-rsXNZ-8Usc41ZN8PfcGwzdYsAxp7SBiQ==&ch=V5dV41Z3E2LkgWlCrDBHABzJ6qosa9-mrP7je3mxxtX9W-Ut-Y9mzg==&_e=davis.moeller@dacotahbank.com"
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2056 --field-trial-handle=1972,i,6183626884481712133,336424547748364940,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: C:\Program Files\Google\Chrome\Application\chrome.exeDirectory created: C:\Program Files\Google\Chrome\Application\Dictionaries
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk
ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management Instrumentation1
Registry Run Keys / Startup Folder
1
Process Injection
3
Masquerading
OS Credential DumpingSystem Service DiscoveryRemote ServicesData from Local System2
Encrypted Channel
Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization Scripts1
Registry Run Keys / Startup Folder
1
Process Injection
LSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable Media1
Non-Application Layer Protocol
Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared Drive2
Application Layer Protocol
Automated ExfiltrationData Encrypted for Impact

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand
No Antivirus matches
No Antivirus matches
No Antivirus matches
No Antivirus matches
No Antivirus matches
NameIPActiveMaliciousAntivirus DetectionReputation
o55qyvqab.cc.rs6.net
208.75.122.11
truefalse
    unknown
    s3-w.us-east-1.amazonaws.com
    54.231.169.185
    truefalse
      unknown
      d2yx97y2ukjhui.cloudfront.net
      18.244.18.118
      truefalse
        unknown
        cdn.signalfx.com
        108.138.7.16
        truefalse
          unknown
          www.google.com
          142.250.185.228
          truefalse
            unknown
            fastly-tls12-bam-cell.nr-data.net
            162.247.243.30
            truefalse
              unknown
              d15akbylw3vqc5.cloudfront.net
              18.238.243.34
              truefalse
                unknown
                cdn.smassets.net
                unknown
                unknownfalse
                  unknown
                  www.surveymonkey.com
                  unknown
                  unknownfalse
                    unknown
                    surveymonkey-assets.s3.amazonaws.com
                    unknown
                    unknownfalse
                      unknown
                      prod.smassets.net
                      unknown
                      unknownfalse
                        unknown
                        bam-cell.nr-data.net
                        unknown
                        unknownfalse
                          unknown
                          secure.surveymonkey.com
                          unknown
                          unknownfalse
                            unknown
                            NameMaliciousAntivirus DetectionReputation
                            https://www.surveymonkey.com/r/close-window/?sm=AHNLv_2FfpZK5O4CWJrS8HcdfZ9lSweveFgWcpdG8_2B_2B3A_3Dfalse
                              unknown
                              https://www.surveymonkey.com/r/FMLD24?e=davis.moeller@dacotahbank.comfalse
                                unknown
                                • No. of IPs < 25%
                                • 25% < No. of IPs < 50%
                                • 50% < No. of IPs < 75%
                                • 75% < No. of IPs
                                IPDomainCountryFlagASNASN NameMalicious
                                142.250.185.228
                                www.google.comUnited States
                                15169GOOGLEUSfalse
                                142.250.186.170
                                unknownUnited States
                                15169GOOGLEUSfalse
                                172.217.18.14
                                unknownUnited States
                                15169GOOGLEUSfalse
                                18.238.243.39
                                unknownUnited States
                                16509AMAZON-02USfalse
                                108.138.217.34
                                unknownUnited States
                                16509AMAZON-02USfalse
                                108.138.7.16
                                cdn.signalfx.comUnited States
                                16509AMAZON-02USfalse
                                162.247.243.30
                                fastly-tls12-bam-cell.nr-data.netUnited States
                                13335CLOUDFLARENETUSfalse
                                18.173.205.24
                                unknownUnited States
                                3MIT-GATEWAYSUSfalse
                                142.250.185.163
                                unknownUnited States
                                15169GOOGLEUSfalse
                                142.250.185.142
                                unknownUnited States
                                15169GOOGLEUSfalse
                                18.173.205.26
                                unknownUnited States
                                3MIT-GATEWAYSUSfalse
                                208.75.122.11
                                o55qyvqab.cc.rs6.netUnited States
                                40444ASN-CCUSfalse
                                142.250.186.99
                                unknownUnited States
                                15169GOOGLEUSfalse
                                18.244.18.118
                                d2yx97y2ukjhui.cloudfront.netUnited States
                                16509AMAZON-02USfalse
                                172.217.16.202
                                unknownUnited States
                                15169GOOGLEUSfalse
                                1.1.1.1
                                unknownAustralia
                                13335CLOUDFLARENETUSfalse
                                216.58.212.131
                                unknownUnited States
                                15169GOOGLEUSfalse
                                74.125.71.84
                                unknownUnited States
                                15169GOOGLEUSfalse
                                239.255.255.250
                                unknownReserved
                                unknownunknownfalse
                                18.173.205.79
                                unknownUnited States
                                3MIT-GATEWAYSUSfalse
                                142.250.185.174
                                unknownUnited States
                                15169GOOGLEUSfalse
                                18.238.243.34
                                d15akbylw3vqc5.cloudfront.netUnited States
                                16509AMAZON-02USfalse
                                54.231.169.185
                                s3-w.us-east-1.amazonaws.comUnited States
                                16509AMAZON-02USfalse
                                52.217.122.49
                                unknownUnited States
                                16509AMAZON-02USfalse
                                142.250.184.234
                                unknownUnited States
                                15169GOOGLEUSfalse
                                IP
                                192.168.2.16
                                Joe Sandbox version:41.0.0 Charoite
                                Analysis ID:1545668
                                Start date and time:2024-10-30 19:55:39 +01:00
                                Joe Sandbox product:CloudBasic
                                Overall analysis duration:
                                Hypervisor based Inspection enabled:false
                                Report type:full
                                Cookbook file name:defaultwindowsinteractivecookbook.jbs
                                Sample URL:https://o55qyvqab.cc.rs6.net/tn.jsp?f=001NLI7eEoRb5Poh74ULgAKom24kvJpWAk7SrFC8PeKGB4ch0zE0ULqXgMufWeJvvvB1HYAZX_HUxR2p1kN047r3H6c_orKoOCDj7a4YlV4veWxW_rUx27ktdCMeMkvzKaJyGdGK6S1uyfa3RyHuKzja564mBkBzwv_bijWmkaJ3uk=&c=KpnKfC8Kkb6GNlpOBU33X-rsXNZ-8Usc41ZN8PfcGwzdYsAxp7SBiQ==&ch=V5dV41Z3E2LkgWlCrDBHABzJ6qosa9-mrP7je3mxxtX9W-Ut-Y9mzg==&_e=davis.moeller@dacotahbank.com
                                Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                Number of analysed new started processes analysed:13
                                Number of new started drivers analysed:0
                                Number of existing processes analysed:0
                                Number of existing drivers analysed:0
                                Number of injected processes analysed:0
                                Technologies:
                                • EGA enabled
                                Analysis Mode:stream
                                Analysis stop reason:Timeout
                                Detection:CLEAN
                                Classification:clean1.win@18/6@32/285
                                • Exclude process from analysis (whitelisted): svchost.exe
                                • Excluded IPs from analysis (whitelisted): 142.250.185.163, 142.250.185.174, 74.125.71.84, 34.104.35.123, 142.250.186.170
                                • Excluded domains from analysis (whitelisted): fonts.googleapis.com, clients2.google.com, accounts.google.com, edgedl.me.gvt1.com, clientservices.googleapis.com, clients.l.google.com
                                • Not all processes where analyzed, report is missing behavior information
                                • VT rate limit hit for: https://o55qyvqab.cc.rs6.net/tn.jsp?f=001NLI7eEoRb5Poh74ULgAKom24kvJpWAk7SrFC8PeKGB4ch0zE0ULqXgMufWeJvvvB1HYAZX_HUxR2p1kN047r3H6c_orKoOCDj7a4YlV4veWxW_rUx27ktdCMeMkvzKaJyGdGK6S1uyfa3RyHuKzja564mBkBzwv_bijWmkaJ3uk=&c=KpnKfC8Kkb6GNlpOBU33X-rsXNZ-8Usc41ZN8PfcGwzdYsAxp7SBiQ==&ch=V5dV41Z3E2LkgWlCrDBHABzJ6qosa9-mrP7je3mxxtX9W-Ut-Y9mzg==&_e=davis.moeller@dacotahbank.com
                                InputOutput
                                URL: Model: claude-3-5-sonnet-latest
                                {
                                    "typosquatting": false,
                                    "unusual_query_string": false,
                                    "suspicious_tld": true,
                                    "ip_in_url": false,
                                    "long_subdomain": true,
                                    "malicious_keywords": false,
                                    "encoded_characters": false,
                                    "redirection": false,
                                    "contains_email_address": false,
                                    "known_domain": false,
                                    "brand_spoofing_attempt": false,
                                    "third_party_hosting": true
                                }
                                URL: URL: https://o55qyvqab.cc.rs6.net
                                URL: https://www.surveymonkey.com/r/FMLD24?e=davis.moeller@dacotahbank.com Model: claude-3-haiku-20240307
                                ```json
                                {
                                  "contains_trigger_text": false,
                                  "trigger_text": "unknown",
                                  "prominent_button_name": "unknown",
                                  "text_input_field_labels": [
                                    "First name",
                                    "Last name",
                                    "Email"
                                  ],
                                  "pdf_icon_visible": false,
                                  "has_visible_captcha": false,
                                  "has_urgent_text": false,
                                  "has_visible_qrcode": false
                                }
                                URL: Model: claude-3-5-sonnet-latest
                                {
                                    "typosquatting": false,
                                    "unusual_query_string": false,
                                    "suspicious_tld": false,
                                    "ip_in_url": false,
                                    "long_subdomain": false,
                                    "malicious_keywords": false,
                                    "encoded_characters": false,
                                    "redirection": false,
                                    "contains_email_address": false,
                                    "known_domain": true,
                                    "brand_spoofing_attempt": false,
                                    "third_party_hosting": false
                                }
                                URL: URL: https://www.surveymonkey.com
                                URL: https://www.surveymonkey.com/r/FMLD24?e=davis.moeller@dacotahbank.com Model: claude-3-haiku-20240307
                                ```json
                                {
                                  "brands": [
                                    "Farmer MAC"
                                  ]
                                }
                                URL: https://www.surveymonkey.com/r/FMLD24?e=davis.moeller@dacotahbank.com Model: gpt-4o
                                ```json{  "legit_domain": "farmermac.com",  "classification": "known",  "reasons": [    "The brand 'Farmer MAC' is known and associated with the domain 'farmermac.com'.",    "The URL 'www.surveymonkey.com' does not match the legitimate domain for Farmer MAC.",    "SurveyMonkey is a legitimate survey platform, but it is not directly associated with Farmer MAC.",    "The use of a third-party service like SurveyMonkey could be legitimate if Farmer MAC is conducting a survey, but it requires verification from official Farmer MAC channels.",    "The presence of input fields for personal information (First name, Last name, Email) on a third-party domain increases the risk of phishing if not verified."  ],  "riskscore": 6}
                                URL: www.surveymonkey.com
                                            Brands: Farmer MAC
                                            Input Fields: First name, Last name, Email
                                URL: https://www.surveymonkey.com/r/FMLD24?e=davis.moeller@dacotahbank.com Model: claude-3-haiku-20240307
                                ```json
                                {
                                  "contains_trigger_text": true,
                                  "trigger_text": "Let us know if you are coming?",
                                  "prominent_button_name": "Yes, I'll be there.",
                                  "text_input_field_labels": [
                                    "First name",
                                    "Last name",
                                    "Email"
                                  ],
                                  "pdf_icon_visible": false,
                                  "has_visible_captcha": false,
                                  "has_urgent_text": false,
                                  "has_visible_qrcode": false
                                }
                                URL: https://www.surveymonkey.com/r/FMLD24?e=davis.moeller@dacotahbank.com Model: claude-3-haiku-20240307
                                ```json
                                {
                                  "brands": [
                                    "Farmer MAC"
                                  ]
                                }
                                URL: https://www.surveymonkey.com/r/FMLD24?e=davis.moeller@dacotahbank.com Model: gpt-4o
                                ```json{  "legit_domain": "farmermac.com",  "classification": "known",  "reasons": [    "The brand 'Farmer MAC' is a known entity associated with agricultural finance.",    "The URL 'www.surveymonkey.com' does not match the legitimate domain for Farmer MAC, which is 'farmermac.com'.",    "SurveyMonkey is a legitimate survey platform, but it is not directly associated with Farmer MAC.",    "The presence of input fields like 'First name', 'Last name', and 'Email' on a survey platform is typical, but the mismatch in domain raises suspicion."  ],  "riskscore": 7}
                                Google indexed: True
                                URL: www.surveymonkey.com
                                            Brands: Farmer MAC
                                            Input Fields: First name, Last name, Email
                                URL: https://www.surveymonkey.com/r/FMLD24?e=davis.moeller@dacotahbank.com Model: claude-3-haiku-20240307
                                ```json
                                {
                                  "contains_trigger_text": false,
                                  "trigger_text": "unknown",
                                  "prominent_button_name": "SUBMIT",
                                  "text_input_field_labels": [
                                    "First name",
                                    "Last name",
                                    "Email"
                                  ],
                                  "pdf_icon_visible": false,
                                  "has_visible_captcha": false,
                                  "has_urgent_text": false,
                                  "has_visible_qrcode": false
                                }
                                URL: https://www.surveymonkey.com/r/FMLD24?e=davis.moeller@dacotahbank.com Model: claude-3-haiku-20240307
                                ```json
                                {
                                  "contains_trigger_text": true,
                                  "trigger_text": "SUBMIT",
                                  "prominent_button_name": "SUBMIT",
                                  "text_input_field_labels": "unknown",
                                  "pdf_icon_visible": false,
                                  "has_visible_captcha": false,
                                  "has_urgent_text": false,
                                  "has_visible_qrcode": false
                                }
                                URL: https://www.surveymonkey.com/r/FMLD24?e=davis.moeller@dacotahbank.com Model: claude-3-haiku-20240307
                                ```json
                                {
                                  "brands": [
                                    "Central Standard Crafthouse & Kitchen"
                                  ]
                                }
                                URL: https://www.surveymonkey.com/r/FMLD24?e=davis.moeller@dacotahbank.com Model: claude-3-haiku-20240307
                                ```json
                                {
                                  "brands": [
                                    "Farmer Mac"
                                  ]
                                }
                                URL: https://www.surveymonkey.com/r/FMLD24?e=davis.moeller@dacotahbank.com Model: gpt-4o
                                ```json{  "legit_domain": "surveymonkey.com",  "classification": "unknown",  "reasons": [    "The URL 'www.surveymonkey.com' is a legitimate domain associated with SurveyMonkey, a well-known online survey development cloud-based software.",    "The brand 'Central Standard Crafthouse & Kitchen' is not directly associated with SurveyMonkey, indicating that the webpage might be using SurveyMonkey's platform for legitimate purposes.",    "SurveyMonkey is a trusted service provider that allows users to create surveys, which may include input fields like 'First name', 'Last name', and 'Email'.",    "There are no suspicious elements in the URL such as misspellings, extra characters, or unusual domain extensions.",    "The brand 'Central Standard Crafthouse & Kitchen' is not classified as 'known' or 'wellknown' in the context of this URL, hence classified as 'unknown'."  ],  "riskscore": 2}
                                URL: www.surveymonkey.com
                                            Brands: Central Standard Crafthouse & Kitchen
                                            Input Fields: First name, Last name, Email
                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 30 17:56:06 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                                Category:dropped
                                Size (bytes):2673
                                Entropy (8bit):3.9892966061229767
                                Encrypted:false
                                SSDEEP:
                                MD5:5B3E98402F523358E9F4F51C51139B0F
                                SHA1:D52EAEEC2389A3C814FE05F87FDD568BE3145D29
                                SHA-256:152C44B288D55A2AF558939D75CB331CFE94FFB04F7B9A7709E7348A5111571B
                                SHA-512:9BDD8A99E31CBCD62D91B8D0E0ED0EA6A7960D195441E2F4C77364DD1B6EAE001ABA59E8E3F326364A21ABCA501274AC6394004F7A7F977951935A582E0230DF
                                Malicious:false
                                Reputation:unknown
                                Preview:L..................F.@.. ...$+.,.....<._.*..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I^Y......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V^Y......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V^Y......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V^Y............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V^Y.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........f.kx.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F
                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 30 17:56:06 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                                Category:dropped
                                Size (bytes):2675
                                Entropy (8bit):4.003676423663494
                                Encrypted:false
                                SSDEEP:
                                MD5:DB8F5D310CFC8E6C9DB896B5BFA03E49
                                SHA1:8CE14002B15034B89967FA183BB7CAE0D1DC9C69
                                SHA-256:F2EE79165D1447B0F86A37D598CD4E15351202CC1C4E7B5F3DA641FB5AEB2B3F
                                SHA-512:68E5B0E795148B1FB55C032309F7FBF22C2CAF9B7737EAB88D85E4F1F91A5F2C031466893C3D5D60F4F1EE5BF47E0FF09517E426295A94B953497B848CA1B7F3
                                Malicious:false
                                Reputation:unknown
                                Preview:L..................F.@.. ...$+.,.....x._.*..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I^Y......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V^Y......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V^Y......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V^Y............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V^Y.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........f.kx.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F
                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                                Category:dropped
                                Size (bytes):2689
                                Entropy (8bit):4.010905047841708
                                Encrypted:false
                                SSDEEP:
                                MD5:E071283896E856D2333446572D96CE3C
                                SHA1:0EFA36197A105C0C006B7CDD1493FC6776BA0CD1
                                SHA-256:7C7BA3E85F4722F510D58F9C1A70DBA5D08F8638B226F1C5946D8B85F8FC7EC6
                                SHA-512:74383BDDF02E188AAC3A230804266285FEC96DBAE7F364408A1AF64D2D516FBEA43D261CB617FBBF25AD7ED12FBDF61FA35E9BE0F00657B0EEB645E5905B51FD
                                Malicious:false
                                Reputation:unknown
                                Preview:L..................F.@.. ...$+.,.....Y.04...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I^Y......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V^Y......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V^Y......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V^Y............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VFW.E...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........f.kx.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F
                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 30 17:56:06 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                                Category:dropped
                                Size (bytes):2677
                                Entropy (8bit):4.0022406286403
                                Encrypted:false
                                SSDEEP:
                                MD5:49F2BC122588CC6BBA707F4046063842
                                SHA1:DC1ED368D13887BEA5997CC813B335FE6D3033EF
                                SHA-256:54DA1D3E880C8AB5EDD6DC55C5F9264DD75F2365ECEBFEAA73A148913221CF44
                                SHA-512:6237248380DC4D84D299334E5FBBAD6292844767E6FDBE216E7C430BEF506DADCBF38A961EDACD58B907B8990F2E865CF17BF2AB7E0822F5A7A6FB39AFF5EDED
                                Malicious:false
                                Reputation:unknown
                                Preview:L..................F.@.. ...$+.,....L.._.*..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I^Y......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V^Y......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V^Y......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V^Y............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V^Y.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........f.kx.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F
                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 30 17:56:06 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                                Category:dropped
                                Size (bytes):2677
                                Entropy (8bit):3.9917343033855897
                                Encrypted:false
                                SSDEEP:
                                MD5:606013DFEED8C801D970D08263ECA46C
                                SHA1:CD6F5D07DCBA4025A02CF9185ACFD3C5BE219CE9
                                SHA-256:6812D1552CCD121462BB1613E00388A8893A90D603F68A2228DF7AA200DB7827
                                SHA-512:2B4ECCD9C7D3390DADE4B9566F81A0E06501F6154A92FB21FA2ACEDC533DA6ED132FBF72CB0A3F4EACD89370F30373CB1F6416C4CEAF1D84AEF2C72090CAEEC9
                                Malicious:false
                                Reputation:unknown
                                Preview:L..................F.@.. ...$+.,......._.*..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I^Y......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V^Y......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V^Y......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V^Y............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V^Y.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........f.kx.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F
                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 30 17:56:06 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                                Category:dropped
                                Size (bytes):2679
                                Entropy (8bit):4.001327227193306
                                Encrypted:false
                                SSDEEP:
                                MD5:FE9CAB99A9CC35E1E2ADC2644C472589
                                SHA1:F425B1629AC0EAF866562B02E8ED202682044317
                                SHA-256:A5CC16623EBDEFB1FB42B4B557D000BD5C49DA9B5B58DE527EAE079D570730DF
                                SHA-512:325C300D9C930609BC560B9FB2B97CA850F6F4596172E162D9F005731282DD79859C462C1AAF43095B6F161B98552FBA34C6F076D3A09D2C748A779A2456033C
                                Malicious:false
                                Reputation:unknown
                                Preview:L..................F.@.. ...$+.,......._.*..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I^Y......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V^Y......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V^Y......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V^Y............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V^Y.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........f.kx.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F
                                No static file info