Edit tour

Windows Analysis Report
https://atpscan.global.hornetsecurity.com?d=CSvj-8b3fpwAumC6AbFMfEVmIT5ENJWTqrZHusAeFnU&f=Mzo1PUwZQd3evqHstuwR_5FCozrkJ9Jd1jGDrnrvcdluTk54zR-Gop3tgMHHrGpX90Gv7ZppU4ALGygldB7J0A&i=&k=bz9r&m=KuGpJb7F8ZjkKBdLnbtsoBlIPcr_V2YvhrjDwSG7wjDkh9t68btueC3me_khplS04Y1vkmcz2DALFAdsCPnXV9Y0e_KkoBmquE5hQxvQRCkIOVA

Overview

General Information

Sample URL:	https://atpscan.global.hornetsecurity.com?d=CSvj-8b3fpwAumC6AbFMfEVmIT5ENJWTqrZHusAeFnU&f=Mzo1PUwZQd3evqHstuwR_5FCozrkJ9Jd1jGDrnrvcdluTk54zR-Gop3tgMHHrGpX90Gv7ZppU4ALGygldB7J0A&i=&k=bz9r&m=KuGpJb7F8Zj
Analysis ID:	1592048

Detection

Score:	0
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

Stores files to the Windows start menu directory

Classification

Process Tree

System is w10x64_ra

chrome.exe (PID: 7020 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6340 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 --field-trial-handle=1948,i,7884178855131201589,16240752380149472380,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 5672 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://atpscan.global.hornetsecurity.com?d=CSvj-8b3fpwAumC6AbFMfEVmIT5ENJWTqrZHusAeFnU&f=Mzo1PUwZQd3evqHstuwR_5FCozrkJ9Jd1jGDrnrvcdluTk54zR-Gop3tgMHHrGpX90Gv7ZppU4ALGygldB7J0A&i=&k=bz9r&m=KuGpJb7F8ZjkKBdLnbtsoBlIPcr_V2YvhrjDwSG7wjDkh9t68btueC3me_khplS04Y1vkmcz2DALFAdsCPnXV9Y0e_KkoBmquE5hQxvQRCkIOVAxUSYrmBcZKNoh8NCT&n=3jw3xk5HrrJRpv5jkTsPtIA8SNg8pPkNVIChy5v4uioLwV8t1Qhw8Jl0rPecYr_z&r=Mi1JW6WUX7aRK4law3uJhl9L7Awt-TwJX20OR-eyQiCnjiN--PaFEdBZXBvOt4br&s=9e20e3b941956d702101ff1a86d29524b24c4f8158208c10cfbca279a872d30e&u=https%3A%2F%2Fwww.google.ca%2Furl%3Fn89vrc%3Dhttps%3A%2F%2Fwww.cookejackson.com%26bg%3DAJ%26SQ%3DPQ%26TA%3DR6%26SQ%3DPW%26TA%3D6O%26q%3D%252561%25256d%252570%252F%252573%252561%25256E%252564%252562%25256F%252578%25252E%252575%252573%25252E%252570%252572%25256F%252564%25252E%252561%252570%252569%25252E%252575%252570%252566%25256F%252572%252574%25252E%252563%25256F%25256D%25252F%25256C%252569%25256E%25256B%25252F%252565%252579%25254A%252573%252549%25256A%25256F%252569aHR0cHM6Ly9xM3oycDUuZGVrY2hvYnRpZXcuY29tL2Jvbm5pZS5wZXRlcnNlbkBnZWxpdGEuY29tIiwidSI6InVzZXItMGIzMzM5NWItZDE0OS00NzVkLTljMDMtZmExMGIxMjg1YTVmIiwiciI6ImFubmEudmFuY2VAbWFzb25vd2VuYW5kaGFsZS5jaCIsInYiOjF9%26opdg%3DSmo%26Uk4%3DRXM%26QTU%3DN3I%20Category%20Status%20Priority%20QuickActions" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: unknown	HTTPS traffic detected: 2.23.242.162:443 -> 192.168.2.16:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.23.242.162:443 -> 192.168.2.16:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.16:49746 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.242.162
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.242.162
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.242.162
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.242.162
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.242.162
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.242.162
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.242.162
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.242.162
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.242.162
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.242.162
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.242.162
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.242.162
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.242.162
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.242.162
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.242.162
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.242.162
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.242.162
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.242.162
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.242.162
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108

Source: global traffic	DNS traffic detected: DNS query: atpscan.global.hornetsecurity.com
Source: global traffic	DNS traffic detected: DNS query: securelinks.cloud-security.net
Source: global traffic	DNS traffic detected: DNS query: www.google.com

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746

Source: unknown	HTTPS traffic detected: 2.23.242.162:443 -> 192.168.2.16:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.23.242.162:443 -> 192.168.2.16:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.16:49746 version: TLS 1.2

Source: classification engine

Classification label: clean0.win@17/27@8/38

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 --field-trial-handle=1948,i,7884178855131201589,16240752380149472380,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://atpscan.global.hornetsecurity.com?d=CSvj-8b3fpwAumC6AbFMfEVmIT5ENJWTqrZHusAeFnU&f=Mzo1PUwZQd3evqHstuwR_5FCozrkJ9Jd1jGDrnrvcdluTk54zR-Gop3tgMHHrGpX90Gv7ZppU4ALGygldB7J0A&i=&k=bz9r&m=KuGpJb7F8ZjkKBdLnbtsoBlIPcr_V2YvhrjDwSG7wjDkh9t68btueC3me_khplS04Y1vkmcz2DALFAdsCPnXV9Y0e_KkoBmquE5hQxvQRCkIOVAxUSYrmBcZKNoh8NCT&n=3jw3xk5HrrJRpv5jkTsPtIA8SNg8pPkNVIChy5v4uioLwV8t1Qhw8Jl0rPecYr_z&r=Mi1JW6WUX7aRK4law3uJhl9L7Awt-TwJX20OR-eyQiCnjiN--PaFEdBZXBvOt4br&s=9e20e3b941956d702101ff1a86d29524b24c4f8158208c10cfbca279a872d30e&u=https%3A%2F%2Fwww.google.ca%2Furl%3Fn89vrc%3Dhttps%3A%2F%2Fwww.cookejackson.com%26bg%3DAJ%26SQ%3DPQ%26TA%3DR6%26SQ%3DPW%26TA%3D6O%26q%3D%252561%25256d%252570%252F%252573%252561%25256E%252564%252562%25256F%252578%25252E%252575%252573%25252E%252570%252572%25256F%252564%25252E%252561%252570%252569%25252E%252575%252570%252566%25256F%252572%252574%25252E%252563%25256F%25256D%25252F%25256C%252569%25256E%25256B%25252F%252565%252579%25254A%252573%252549%25256A%25256F%252569aHR0cHM6Ly9xM3oycDUuZGVrY2hvYnRpZXcuY29tL2Jvbm5pZS5wZXRlcnNlbkBnZWxpdGEuY29tIiwidSI6InVzZXItMGIzMzM5NWItZDE0OS00NzVkLTljMDMtZmExMGIxMjg1YTVmIiwiciI6ImFubmEudmFuY2VAbWFzb25vd2VuYW5kaGFsZS5jaCIsInYiOjF9%26opdg%3DSmo%26Uk4%3DRXM%26QTU%3DN3I%20Category%20Status%20Priority%20QuickActions"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 --field-trial-handle=1948,i,7884178855131201589,16240752380149472380,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
https://atpscan.global.hornetsecurity.com?d=CSvj-8b3fpwAumC6AbFMfEVmIT5ENJWTqrZHusAeFnU&f=Mzo1PUwZQd3evqHstuwR_5FCozrkJ9Jd1jGDrnrvcdluTk54zR-Gop3tgMHHrGpX90Gv7ZppU4ALGygldB7J0A&i=&k=bz9r&m=KuGpJb7F8ZjkKBdLnbtsoBlIPcr_V2YvhrjDwSG7wjDkh9t68btueC3me_khplS04Y1vkmcz2DALFAdsCPnXV9Y0e_KkoBmquE5hQxvQRCkIOVAxUSYrmBcZKNoh8NCT&n=3jw3xk5HrrJRpv5jkTsPtIA8SNg8pPkNVIChy5v4uioLwV8t1Qhw8Jl0rPecYr_z&r=Mi1JW6WUX7aRK4law3uJhl9L7Awt-TwJX20OR-eyQiCnjiN--PaFEdBZXBvOt4br&s=9e20e3b941956d702101ff1a86d29524b24c4f8158208c10cfbca279a872d30e&u=https%3A%2F%2Fwww.google.ca%2Furl%3Fn89vrc%3Dhttps%3A%2F%2Fwww.cookejackson.com%26bg%3DAJ%26SQ%3DPQ%26TA%3DR6%26SQ%3DPW%26TA%3D6O%26q%3D%252561%25256d%252570%252F%252573%252561%25256E%252564%252562%25256F%252578%25252E%252575%252573%25252E%252570%252572%25256F%252564%25252E%252561%252570%252569%25252E%252575%252570%252566%25256F%252572%252574%25252E%252563%25256F%25256D%25252F%25256C%252569%25256E%25256B%25252F%252565%252579%25254A%252573%252549%25256A%25256F%252569aHR0cHM6Ly9xM3oycDUuZGVrY2hvYnRpZXcuY29tL2Jvbm5pZS5wZXRlcnNlbkBnZWxpdGEuY29tIiwidSI6InVzZXItMGIzMzM5NWItZDE0OS00NzVkLTljMDMtZmExMGIxMjg1YTVmIiwiciI6ImFubmEudmFuY2VAbWFzb25vd2VuYW5kaGFsZS5jaCIsInYiOjF9%26opdg%3DSmo%26Uk4%3DRXM%26QTU%3DN3I%20Category%20Status%20Priority%20QuickActions	0%	Avira URL Cloud	safe

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
securelinks.cloud-security.net	94.100.133.74	true	false	high
atpscan.global.hornetsecurity.com	94.100.136.44	true	false	high
www.google.com	216.58.206.36	true	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://securelinks.cloud-security.net/404	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
94.100.136.44	atpscan.global.hornetsecurity.com	Germany	24679	SSERV-ASDE	false
142.250.185.67	unknown	United States	15169	GOOGLEUS	false
142.251.168.84	unknown	United States	15169	GOOGLEUS	false
94.100.133.74	securelinks.cloud-security.net	Germany	25394	MK-NETZDIENSTE-ASDE	false
1.1.1.1	unknown	Australia	13335	CLOUDFLARENETUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.250.186.142	unknown	United States	15169	GOOGLEUS	false
216.58.206.36	www.google.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.16

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1592048
Start date and time:	2025-01-15 17:45:59 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Sample URL:	https://atpscan.global.hornetsecurity.com?d=CSvj-8b3fpwAumC6AbFMfEVmIT5ENJWTqrZHusAeFnU&f=Mzo1PUwZQd3evqHstuwR_5FCozrkJ9Jd1jGDrnrvcdluTk54zR-Gop3tgMHHrGpX90Gv7ZppU4ALGygldB7J0A&i=&k=bz9r&m=KuGpJb7F8ZjkKBdLnbtsoBlIPcr_V2YvhrjDwSG7wjDkh9t68btueC3me_khplS04Y1vkmcz2DALFAdsCPnXV9Y0e_KkoBmquE5hQxvQRCkIOVAxUSYrmBcZKNoh8NCT&n=3jw3xk5HrrJRpv5jkTsPtIA8SNg8pPkNVIChy5v4uioLwV8t1Qhw8Jl0rPecYr_z&r=Mi1JW6WUX7aRK4law3uJhl9L7Awt-TwJX20OR-eyQiCnjiN--PaFEdBZXBvOt4br&s=9e20e3b941956d702101ff1a86d29524b24c4f8158208c10cfbca279a872d30e&u=https%3A%2F%2Fwww.google.ca%2Furl%3Fn89vrc%3Dhttps%3A%2F%2Fwww.cookejackson.com%26bg%3DAJ%26SQ%3DPQ%26TA%3DR6%26SQ%3DPW%26TA%3D6O%26q%3D%252561%25256d%252570%252F%252573%252561%25256E%252564%252562%25256F%252578%25252E%252575%252573%25252E%252570%252572%25256F%252564%25252E%252561%252570%252569%25252E%252575%252570%252566%25256F%252572%252574%25252E%252563%25256F%25256D%25252F%25256C%252569%25256E%25256B%25252F%252565%252579%25254A%252573%252549%25256A%25256F%252569aHR0cHM6Ly9xM3oycDUuZGVrY2hvYnRpZXcuY29tL2Jvbm5pZS5wZXRlcnNlbkBnZWxpdGEuY29tIiwidSI6InVzZXItMGIzMzM5NWItZDE0OS00NzVkLTljMDMtZmExMGIxMjg1YTVmIiwiciI6ImFubmEudmFuY2VAbWFzb25vd2VuYW5kaGFsZS5jaCIsInYiOjF9%26opdg%3DSmo%26Uk4%3DRXM%26QTU%3DN3I%20Category%20Status%20Priority%20QuickActions
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	11
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled
Analysis Mode:	stream
Analysis stop reason:	Timeout
Detection:	CLEAN
Classification:	clean0.win@17/27@8/38

Warnings

Exclude process from analysis (whitelisted): SgrmBroker.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.185.67, 142.250.186.142, 142.251.168.84, 216.58.212.142, 142.250.185.238, 216.58.212.174
Excluded domains from analysis (whitelisted): fs.microsoft.com, clients2.google.com, accounts.google.com, redirector.gvt1.com, clientservices.googleapis.com, clients.l.google.com
Not all processes where analyzed, report is missing behavior information
VT rate limit hit for: https://atpscan.global.hornetsecurity.com?d=CSvj-8b3fpwAumC6AbFMfEVmIT5ENJWTqrZHusAeFnU&f=Mzo1PUwZQd3evqHstuwR_5FCozrkJ9Jd1jGDrnrvcdluTk54zR-Gop3tgMHHrGpX90Gv7ZppU4ALGygldB7J0A&i=&k=bz9r&m=KuGpJb7F8ZjkKBdLnbtsoBlIPcr_V2YvhrjDwSG7wjDkh9t68btueC3me_khplS04Y1vkmcz2DALFAdsCPnXV9Y0e_KkoBmquE5hQxvQRCkIOVAxUSYrmBcZKNoh8NCT&n=3jw3xk5HrrJRpv5jkTsPtIA8SNg8pPkNVIChy5v4uioLwV8t1Qhw8Jl0rPecYr_z&r=Mi1JW6WUX7aRK4law3uJhl9L7Awt-TwJX20OR-eyQiCnjiN--PaFEdBZXBvOt4br&s=9e20e3b941956d702101ff1a86d29524b24c4f8158208c10cfbca279a872d30e&u=https%3A%2F%2Fwww.google.ca%2Furl%3Fn89vrc%3Dhttps%3A%2F%2Fwww.cookejackson.com%26bg%3DAJ%26SQ%3DPQ%26TA%3DR6%26SQ%3DPW%26TA%3D6O%26q%3D%252561%25256d%252570%252F%252573%252561%25256E%252564%252562%25256F%252578%25252E%252575%252573%25252E%252570%252572%25256F%252564%25252E%252561%252570%252569%25252E%252575%252570%252566%25256F%252572%252574%25252E%252563%25256F%25256D%25252F%25256C%252569%25256E%25256B%25252F%252565%252579%25254A%252573%252549%25256A%25256F%252569aHR0cHM6L

Input	Output
URL: https://atpscan.global.hornetsecurity.com Model: Joe Sandbox AI	{ "typosquatting": false, "unusual_query_string": false, "suspicious_tld": false, "ip_in_url": false, "long_subdomain": false, "malicious_keywords": false, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": true, "brand_spoofing_attempt": false, "third_party_hosting": false, "reasoning": "This is a legitimate domain for Hornetsecurity, a known cybersecurity company. The subdomain structure is normal, and .com is a standard TLD. The domain follows expected naming conventions for a corporate service." }
URL: https://atpscan.global.hornetsecurity.com
URL: https://securelinks.cloud-security.net/895.be1bd3f... Model: Joe Sandbox AI	{ "risk_score": 6, "reasoning": "The provided JavaScript snippet exhibits several behaviors that raise moderate security concerns. It includes external data transmission, the use of fallback domains, and aggressive DOM manipulation, which collectively warrant a medium risk score. While the script does not appear to contain any high-risk indicators like dynamic code execution or obvious data exfiltration, the overall behavior and lack of transparency around the data being transmitted warrant further investigation." }
"use strict";(self.webpackChunktoc=self.webpackChunktoc\|\|[]).push([[895],{6895:(ut,k,d)=>{d.r(k),d.d(k,{V3Module:()=>v});var w=d(177),Y=d(9417),_=d(9888),O=d(8797);const h="function"==typeof Buffer,C="function"==typeof TextDecoder?new TextDecoder:void 0,p=("function"==typeof TextEncoder&&new TextEncoder,Array.prototype.slice.call("ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=")),g=(e=>{let s={};return e.forEach((i,r)=>s[i]=r),s})(p),H=/^(?:[A-Za-z\d+\/]{4})*?(?:[A-Za-z\d+\/]{2}(?:==)?\|[A-Za-z\d+\/]{3}=?)?$/,a=String.fromCharCode.bind(String),F="function"==typeof Uint8Array.from?Uint8Array.from.bind(Uint8Array):e=>new Uint8Array(Array.prototype.slice.call(e,0)),j=e=>e.replace(/[^A-Za-z0-9\+\/]/g,""),B=e=>{let s,i,r,n,o="";const l=e.length%3;for(let b=0;b<e.length;){if((i=e.charCodeAt(b++))>255\|\|(r=e.charCodeAt(b++))>255\|\|(n=e.charCodeAt(b++))>255)throw new TypeError("invalid character found");s=i<<16\|r<<8\|n,o+=p[s>>18&63]+p[s>>12&63]+p[s>>6&63]+p[63&s]}return l?o.slice(0,l-3)+"===".substring(l):o},Z=/[\xC0-\xDF][\x80-\xBF]\|[\xE0-\xEF][\x80-\xBF]{2}\|[\xF0-\xF7][\x80-\xBF]{3}/g,K=e=>{switch(e.length){case 4:var i=((7&e.charCodeAt(0))<<18\|(63&e.charCodeAt(1))<<12\|(63&e.charCodeAt(2))<<6\|63&e.charCodeAt(3))-65536;return a(55296+(i>>>10))+a(56320+(1023&i));case 3:return a((15&e.charCodeAt(0))<<12\|(63&e.charCodeAt(1))<<6\|63&e.charCodeAt(2));default:return a((31&e.charCodeAt(0))<<6\|63&e.charCodeAt(1))}},P=e=>e.replace(Z,K),S=e=>{if(e=e.replace(/\s+/g,""),!H.test(e))throw new TypeError("malformed base64.");e+="==".slice(2-(3&e.length));let s,r,n,i="";for(let o=0;o<e.length;)s=g[e.charAt(o++)]<<18\|g[e.charAt(o++)]<<12\|(r=g[e.charAt(o++)])<<6\|(n=g[e.charAt(o++)]),i+=64===r?a(s>>16&255):64===n?a(s>>16&255,s>>8&255):a(s>>16&255,s>>8&255,255&s);return i},I="function"==typeof atob?e=>atob(j(e)):h?e=>Buffer.from(e,"base64").toString("binary"):S,U=h?e=>F(Buffer.from(e,"base64")):e=>F(I(e).split("").map(s=>s.charCodeAt(0))),tt=h?e=>Buffer.from(e,"base64").toString("utf8"):C?e=>C.decode(U(e)):e=>P(I(e)),N=e=>j(e.replace(/[-_]/g,s=>"-"==s?"+":"/")),x=e=>tt(N(e)),st_decode=x;var t=d(4438),it=d(1626);class f{constructor(s){this.http=s}redirect(s,i){return this.http.post(`${s}redirect`,i)}analyse(s,i){return this.http.post(`${s}analyse`,i)}static#t=this.\u0275fac=function(i){return new(i\|\|f)(t.KVO(it.Qq))};static#e=this.\u0275prov=t.jDH({token:f,factory:f.\u0275fac})}var J=d(5694);const X=e=>({disabled:e});function rt(e,s){if(1&e){const i=t.RV6();t.j41(0,"div",26),t.bIt("click",function(){t.eBV(i);const n=t.XpG(2);return t.Njj(n.navToLeft())})("keyup",function(){t.eBV(i);const n=t.XpG(2);return t.Njj(n.navToLeft())}),t.k0s()}if(2&e){const i=t.XpG(2);t.Y8G("ngClass",t.eq3(1,X,i.leftNavDisabled))}}function nt(e,s){if(1&e){const i=t.RV6();t.j41(0,"div",27),t.bIt("click",function(){t.eBV(i);const n=t.XpG(2);return t.Njj(n.navToRight())})("keyup",function(){t.eBV(i);const n=t.XpG(2);return t.Njj(n.navToRight())}),t.k0s()}if(2&e){const i=t.XpG(2);t.Y8G("ngClass",t.eq3(1,X,i.rightNavDisabled))}}function ot(e,s){if(1&e&&(t.j41(0,"div",28)(1,"div",17)(2,"div",18)(3,"div",19),t.nrm(4,"img",29),t.j41(5,"h2"),t.EFF(6),t.nI1(7,"translate"),t.k0s()(),t.j41(8,"strong"),t.EFF(9),t.nI1(10,"translate"),t.k0s(),t.j41(11,"p"),t.EFF(12),t.nI1(13,"translate"),t.k0s()(),t.j41(14,"div",22),t.nrm(15,"img",30),t.k0s(),t.nrm(16,"div",5),t.k0s()()),2&e){const i=t.XpG(2);t.R7$(6),t.JRh(t.bMT(7,3,"urlscan.scanning.title")),t.R7$(3),t.JRh(t.bMT(10,5,"urlscan.scanning.notify")),t.R7$(3),t.JRh(t.bMT(13,7,i.securityQuote))}}function at(e,s){if(1&e&&(t.j41(0,"div",31)(1,"div",17)(2,"div",18)(3,"div",19),t.nrm(4,"img",32),t.j41(5,"h2"),t.EFF(6),t.nI1(7,"translate"),t.k0s()(),t.j41(8,"strong"),t.EFF(9),t.nI1(10,"translate"),t.k0s(),t.j41(11,"p"),t.EFF(12),t.nI1(13,"translate"),t.k0s(),t.j41(14,"p"),t.EFF(15),t.nI1(16,"translate"),t.k0s()(),t.j41(17,"div",22),t.nrm(18,"img",33),t.k0s(),t.nrm(19,"div",5),t.k0s()()),2&e){const i=t.XpG(2);t.R7$(6),t.JRh(t.bMT(7,6,"urlscan.v
URL: https://securelinks.cloud-security.net/runtime.d60... Model: Joe Sandbox AI	{ "risk_score": 6, "reasoning": "The provided JavaScript snippet exhibits several behaviors that raise moderate security concerns. It uses dynamic code execution through the `r.l()` function, which can potentially load and execute external scripts. Additionally, it sends data to external domains, including `analytics.example.com`, which could be used for data exfiltration. While the script may have a legitimate purpose, such as analytics or telemetry, the use of legacy APIs like `XDomainRequest` and the potential for inconsistent behavior warrant further review." }
(()=>{"use strict";var e,v={},m={};function r(e){var i=m[e];if(void 0!==i)return i.exports;var t=m[e]={exports:{}};return v[e](t,t.exports,r),t.exports}r.m=v,e=[],r.O=(i,t,o,u)=>{if(!t){var a=1/0;for(n=0;n<e.length;n++){for(var[t,o,u]=e[n],c=!0,f=0;f<t.length;f++)(!1&u\|\|a>=u)&&Object.keys(r.O).every(b=>r.O[b](t[f]))?t.splice(f--,1):(c=!1,u<a&&(a=u));if(c){e.splice(n--,1);var d=o();void 0!==d&&(i=d)}}return i}u=u\|\|0;for(var n=e.length;n>0&&e[n-1][2]>u;n--)e[n]=e[n-1];e[n]=[t,o,u]},r.d=(e,i)=>{for(var t in i)r.o(i,t)&&!r.o(e,t)&&Object.defineProperty(e,t,{enumerable:!0,get:i[t]})},r.f={},r.e=e=>Promise.all(Object.keys(r.f).reduce((i,t)=>(r.f[t](e,i),i),[])),r.u=e=>e+"."+{218:"0809266569f41ece",895:"be1bd3f1e3cf97bf"}[e]+".js",r.miniCssF=e=>{},r.o=(e,i)=>Object.prototype.hasOwnProperty.call(e,i),(()=>{var e={},i="toc:";r.l=(t,o,u,n)=>{if(e[t])e[t].push(o);else{var a,c;if(void 0!==u)for(var f=document.getElementsByTagName("script"),d=0;d<f.length;d++){var l=f[d];if(l.getAttribute("src")==t\|\|l.getAttribute("data-webpack")==i+u){a=l;break}}a\|\|(c=!0,(a=document.createElement("script")).type="module",a.charset="utf-8",a.timeout=120,r.nc&&a.setAttribute("nonce",r.nc),a.setAttribute("data-webpack",i+u),a.src=r.tu(t)),e[t]=[o];var s=(g,b)=>{a.onerror=a.onload=null,clearTimeout(p);var h=e[t];if(delete e[t],a.parentNode&&a.parentNode.removeChild(a),h&&h.forEach(y=>y(b)),g)return g(b)},p=setTimeout(s.bind(null,void 0,{type:"timeout",target:a}),12e4);a.onerror=s.bind(null,a.onerror),a.onload=s.bind(null,a.onload),c&&document.head.appendChild(a)}}})(),r.r=e=>{typeof Symbol<"u"&&Symbol.toStringTag&&Object.defineProperty(e,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(e,"__esModule",{value:!0})},(()=>{var e;r.tt=()=>(void 0===e&&(e={createScriptURL:i=>i},typeof trustedTypes<"u"&&trustedTypes.createPolicy&&(e=trustedTypes.createPolicy("angular#bundler",e))),e)})(),r.tu=e=>r.tt().createScriptURL(e),r.p="",(()=>{var e={121:0};r.f.j=(o,u)=>{var n=r.o(e,o)?e[o]:void 0;if(0!==n)if(n)u.push(n[2]);else if(121!=o){var a=new Promise((l,s)=>n=e[o]=[l,s]);u.push(n[2]=a);var c=r.p+r.u(o),f=new Error;r.l(c,l=>{if(r.o(e,o)&&(0!==(n=e[o])&&(e[o]=void 0),n)){var s=l&&("load"===l.type?"missing":l.type),p=l&&l.target&&l.target.src;f.message="Loading chunk "+o+" failed.\n("+s+": "+p+")",f.name="ChunkLoadError",f.type=s,f.request=p,n[1](f)}},"chunk-"+o,o)}else e[o]=0},r.O.j=o=>0===e[o];var i=(o,u)=>{var f,d,[n,a,c]=u,l=0;if(n.some(p=>0!==e[p])){for(f in a)r.o(a,f)&&(r.m[f]=a[f]);if(c)var s=c(r)}for(o&&o(u);l<n.length;l++)d=n[l],r.o(e,d)&&e[d]&&e[d][0](),e[d]=0;return r.O(s)},t=self.webpackChunktoc=self.webpackChunktoc\|\|[];t.forEach(i.bind(null,0)),t.push=i.bind(null,t.push.bind(t))})()})();
URL: https://securelinks.cloud-security.net/404 Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "The target URL is not valid. Your request cannot be processed.", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://securelinks.cloud-security.net/404 Model: Joe Sandbox AI	{ "brands": "unknown" }

URL: https://securelinks.cloud-security.net/404 Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://securelinks.cloud-security.net/404 Model: Joe Sandbox AI	{ "brands": [ "Hornetsecurity" ] }

URL: https://cloud-security.net Model: Joe Sandbox AI	{ "typosquatting": false, "unusual_query_string": false, "suspicious_tld": false, "ip_in_url": false, "long_subdomain": false, "malicious_keywords": false, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": false, "brand_spoofing_attempt": false, "third_party_hosting": false, "reasoning": "This appears to be a legitimate-looking domain using a standard .net TLD. The domain name is descriptive of its likely purpose (cloud security) and doesn't contain any suspicious elements." }
URL: https://cloud-security.net

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Jan 15 15:47:09 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2673
Entropy (8bit):	3.993796317342278
Encrypted:	false
SSDEEP:
MD5:	508FC1386EE27172AE8CA2460E89EEEC
SHA1:	9224755E259BCA9CDB7B65DD191EE9A540B9B0B6
SHA-256:	E02CAF0FF32E477A7A8945CCEF488BE8A21D1E3716C254A22794008A8D848C76
SHA-512:	60BEF119076BA497193969B0B5713AA76272AE0520E876BB19ACA28CF480CA10FC82D43B85A64E44C1EB3392F1EF3E28D69CD810A81B01A88663AF36D89D0756
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,........mg..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I/Z.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V/Z.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V/Z.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V/Z............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V/Z............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............f......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Jan 15 15:47:09 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2675
Entropy (8bit):	4.009086773222255
Encrypted:	false
SSDEEP:
MD5:	0DF643660D65BAD2D475897462ED52D4
SHA1:	F21386A8BCD9FEF4D76E83D5B60D1EB9FA339957
SHA-256:	5FA9C279494C911DDE04291795ED001BE8DB1061B1A9771CA50D6BBA460421FC
SHA-512:	E9AB8749D835D2D91061133F79B7021EFBEAD36F7A92EB7CC69FD8B805D1B35416A3B4492C6F4F3F9DC6782FDA37A00E5BC2162BF9A35F914A8DE707579A6392
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,........mg..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I/Z.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V/Z.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V/Z.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V/Z............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V/Z............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............f......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2689
Entropy (8bit):	4.018007554754152
Encrypted:	false
SSDEEP:
MD5:	97408F3E71D4BE1C72556E4C1B5B515E
SHA1:	7C4AA4862A505F9431635C5ED91F7457C7979955
SHA-256:	D53C1BF443D31227D38010FB2EE99AF33BFB17117DE0CFD4A66E7826BEC83D89
SHA-512:	C889631882D6076B3B316D1497A276FADAD47946FCC3C7CCFCAE66C0E89628FD18D28FED2C9ABBAFC317078C6CCA690082674008028D56F2663C0ECF8C08AED9
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.....Y.04...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I/Z.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V/Z.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V/Z.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V/Z............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VFW.E...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............f......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Jan 15 15:47:09 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	4.006698131009491
Encrypted:	false
SSDEEP:
MD5:	31A11CEBC6E87E023221D0D25A1A52B2
SHA1:	418DF4B4C060CBEE479A5C4892CEC27FFAE18EAC
SHA-256:	46D469E5ED5B1F903959E087AB2B8F953F5F3712268C2391F7BAF263DF8B604C
SHA-512:	45C42682BB709EAB2271D7EF65AD1F3BFA7A9C5C3998BC7B9AF4A7FFD20F3B2C340DA9A880747DEB8E3CF63D05BE3256F03EA31B5274DF9BC731A95A956FA966
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,....I?z.mg..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I/Z.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V/Z.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V/Z.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V/Z............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V/Z............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............f......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Jan 15 15:47:09 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.995632782020756
Encrypted:	false
SSDEEP:
MD5:	9BE3D00C0F95FCD6B48190097147B2FC
SHA1:	7238AFD274AE4E97F2885E65770C29DAFFE1F416
SHA-256:	6CF3FF5F8EE4B48E7491375F892750EF710E26B805945768ABED9C3CF8D51DE3
SHA-512:	8028FD248C7F207D5A3E1A6D8C7EAFD875E9A0400EC1D2268954941CC47455BA9A5D9E0A17FE5DECD9A253F72CDB04F273064ECA025F4FD430670B86F19EA064
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.....^..mg..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I/Z.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V/Z.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V/Z.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V/Z............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V/Z............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............f......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Jan 15 15:47:09 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	4.001259982293753
Encrypted:	false
SSDEEP:
MD5:	B0A1430A084E027A95AB13BB8D679734
SHA1:	1AA917FB3C46F9177274E78555A1C337746ABE6B
SHA-256:	3FCBAB3A90431609D87FA058CFCB8905B835CC27F3CBE2265A941D03AE0A6621
SHA-512:	112EAF825918B0FA9009B0401304F9D1CAD784111137648AF49ACA0A4AF6B6883E70C14186F660A9B57349E8DE9F9F86D9BE5EFB05983F46B919C9E9157D28AB
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,....1-p.mg..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I/Z.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V/Z.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V/Z.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V/Z............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V/Z............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............f......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Chrome Cache Entry: 100

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (1626)
Category:	downloaded
Size (bytes):	2700
Entropy (8bit):	5.404498031676358
Encrypted:	false
SSDEEP:
MD5:	CA1283E0450D2543AB1896C928DDDA40
SHA1:	449A5A0382F4D7CAE5FEBC1E8737E3F42CB62278
SHA-256:	E63F99F80FA6498669406B28DACE22088A93BF6DE20680BC887C6172A381211A
SHA-512:	1EBFF3E4F45A8136A68D20B0615B2F86881795AE7659343BF22CB2F7E6C64F712B60F47A477E205D838E1289C845A228B7AEB385615288CF28C7C9FAE36BE625
Malicious:	false
Reputation:	unknown
URL:	https://securelinks.cloud-security.net/404
Preview:	<!doctype html>.<html lang="en" data-logo="images/logo-default.png" data-theme="" data-encodedurl="" data-critters-container>..<head>. <title id="text-title">Anti-phishing analysis</title>. <base href="https://securelinks.cloud-security.net/">. <meta charset="UTF-8">. <meta name="vsc-antiphishing" content="1.0">. <meta name="viewport" content="width=device-width, initial-scale=1">. <meta name="referrer" content="no-referrer">. <link rel="icon" href="./favicon.ico">.<style>@charset "UTF-8";@font-face{font-display:swap;font-family:Hornet;font-style:normal;font-weight:100 300;src:url(Hornet-Light.cd2b04feae6199b9.woff2) format("woff2"),url(Hornet-Light.31e61e203363fc06.otf) format("opentype"),url(Hornet-Light.90e024ffd42abe77.ttf) format("truetype")}@font-face{font-display:swap;font-family:Hornet;font-style:normal;font-weight:400;src:url(Hornet-Regular.021743c5464be55c.woff2) format("woff2"),url(Hornet-Regular.5980f69ef2f414bf.otf) format("opentype"),url(Hornet-Regula

Chrome Cache Entry: 103

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 40 x 41, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	648
Entropy (8bit):	6.9444680008496515
Encrypted:	false
SSDEEP:
MD5:	3DE33DFA1B245F7553171CE3833B354D
SHA1:	F4438771EB078C7A522DBC3993716216788FE613
SHA-256:	811539B2DF228C281BACF0E9D94EABD239F9EFE1F97716F27071424A5F32A149
SHA-512:	2805C3FB1EFF1919CA6DFD983EF714E1C9D5638BA63F35F087FE6681FD1710FB45B2ECC0E65BE230B3B23D002A29EFC235CC353E3DA2CD1069D82EDFB284E58D
Malicious:	false
Reputation:	unknown
URL:	https://securelinks.cloud-security.net/images/shield-check-solid.png
Preview:	.PNG........IHDR...(...).....p\|......gAMA......a.....sRGB.........pHYs.................PLTEGpL...........................................................................................................................................................h....3tRNS.. ..0... @.......`.@0`.`...pP0...@...Pp.p0... .`..i3....6IDAT.......@.E.....w.u....!F:.:.q..\..:.g\0..U&...........T..il.cr.R.R]4.8z.U.(....`..^...x......k.W`/.....sy.pF.9...g`...H..H./@....;.r.3U.........`..u$F...'.=qp...H.u@8Q.'.r..1.dM...T)..YMO\|X..s.E-/..Ub.wj...........Z,...`CC.^...z9ZF...@^...ut$F...#1:...J.Z.5=.U.u.r{U.\..:.6\..4..e..o......C........IEND.B`.

Chrome Cache Entry: 67

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	549193
Entropy (8bit):	5.440799036817487
Encrypted:	false
SSDEEP:
MD5:	6E65A57136F66F1A805A84D88C73EFB0
SHA1:	A2F504264EA295C294F2DF1CA1B906BB41E23EAA
SHA-256:	800EF65BCCBFC293578C2F91838AD7D275D23510CA7EE9550253D8386433D5A2
SHA-512:	A022717E6C7DECFA6C0ABD6A6AAB2049BF45C15815BC9C8B1028418AD8A95531018F2D1C824201B556A7046865D843F0A4DFD25FEA2BF2D2BBE2B32328368AB0
Malicious:	false
Reputation:	unknown
Preview:	"use strict";(self.webpackChunktoc=self.webpackChunktoc\|\|[]).push([[792],{8797:(lt,De,L)=>{L.d(De,{F:()=>z});var a=L(177),x=L(9417),Y=L(5694),Q=L(4438);class z{static#e=this.\u0275fac=function(Le){return new(Le\|\|z)};static#t=this.\u0275mod=Q.$C({type:z});static#n=this.\u0275inj=Q.G2t({imports:[a.MD,x.YN,x.X1,a.MD,x.YN,x.X1,Y.h]})}},950:(lt,De,L)=>{var z,I,a=L(345),x=L(4438),Y=L(1626),Q=L(177);(I=z\|\|(z={}))[I.State=0]="State",I[I.Transition=1]="Transition",I[I.Sequence=2]="Sequence",I[I.Group=3]="Group",I[I.Animate=4]="Animate",I[I.Keyframes=5]="Keyframes",I[I.Style=6]="Style",I[I.Trigger=7]="Trigger",I[I.Reference=8]="Reference",I[I.AnimateChild=9]="AnimateChild",I[I.AnimateRef=10]="AnimateRef",I[I.Query=11]="Query",I[I.Stagger=12]="Stagger";const ve="*";function ae(I,l=null){return{type:z.Sequence,steps:I,options:l}}function me(I){return{type:z.Style,styles:I,offset:null}}class Zt{static#e=this.\u0275fac=function(p){return new(p\|\|Zt)};static#t=this.\u0275prov=x.jDH({token:Zt,factory:(

Chrome Cache Entry: 68

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 550 x 312, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	8982
Entropy (8bit):	7.9057836818765335
Encrypted:	false
SSDEEP:
MD5:	AC1F68DFFF4C95D6173D3DF275C3C3C5
SHA1:	ECCD110D000BD792433131BA2085F2BE31DA98F0
SHA-256:	7D286D640E6703FC4B2B1BCF474EDE14C215669F226F4A26C0281C183BD06FC1
SHA-512:	FB08053DC1E235720C3EC651E234CB8E42C3E3E2FDC59E71F95D1EE177A1EB0D24ACD2EDC32B256FFF05791D9910AD4E92E2E9888D3C5BC6F0012F5C2784576F
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...&...8.....X$......gAMA......a.....sRGB.........pHYs.................PLTE.........Wdot..R`k_kuGpL......P`h......~.......................P`p.........Ucm....X......[gr.X.....Z..X.fpy.X..X..X..Y..Y........X..W.\hr.P..d/.\ .j<bmv.Y....._&.` .X.px..Y.TbmVdm.W..g.............o@....W..sK.X...\|.....js\|.b).xYYgp.X..h.......`'.f5P`p^is..........h3y......Y.......r}..p.......k3....~..Sal........~.................Z..a&....`lv...it..f,...._"......y......h/......er\|......Zfq..p..Rht~....X.t~.....................\.mw.......^.....^kv......\it....Y...........c)...........p.............t@....j1....}L...lw....s}....n{......f^ku......]ku....~L.`$...}....................m6fq{x.................................~Mfr{.............s.....\............g<..~....c]hbfs.....sa_.......`D]ag.j7.eT...{uw.i:.gH.g7.........gH....Y$.f5.gXfq=@.....atRNS3L`...... +.M!&..... .0....x.. Y.`...@.@<.0.....p7...f...McPArsHPf.@j^s.Y..LlU......P.?[...x..]...8IDATx....O.[......mV@\5..@.G.

Chrome Cache Entry: 71

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 40 x 41, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	608
Entropy (8bit):	6.976364509574518
Encrypted:	false
SSDEEP:
MD5:	8556D7FB1D9C540E7019A123120F2EA7
SHA1:	F87AFB09A0F888F51EF230B843525260002B45BA
SHA-256:	7B3D59CC41CEC1E0B16DFB20140E18FA45553097959C630D5AE20A12935E5125
SHA-512:	4008008B0ED7F1092C8EE2E7A06B590858A3163CD028FA71D3CFEE3D55DCEA6A56F0E47FE45408360BE46677771D4FC2B95AFCB0BB8AD4EE95843C258B7C79B5
Malicious:	false
Reputation:	unknown
URL:	https://securelinks.cloud-security.net/images/circle-blocked-solid.png
Preview:	.PNG........IHDR...(...).....p\|......gAMA......a.....sRGB.........pHYs................{PLTEGpL.h8.j3.k3.l4.k2.p8.p0.k3.k3.j2.p@.p0.l3.j0.j2.j2.k3.j3.k3.i2.j3.k3.j2.j2.h0.j2.j3.k4.j3.e0.k4.k2.h0.k2.l4.k2.k2.k2.k2.k3..~....(tRNS. ..@. ..... P0....p..`. ...0p.@p......t.N...:IDAT8...v. ....0.m.....h....N..@....O...7.....a(.....AU.....V...:^..G..u..8..m...:&r..._.U?cD..^..Xk....N%.s:...T)...M..+.r..io..y.P... I.AkFz8...R..l.N`..........t2b.P#4I9D...7.HJ.>..Y..r..d.=.cG..`...>.....M...'{oI...%].=-..cv..N..i...K.:z..)\|....b.S....W.I..-.5.].y .....'w.ii..8A....D3O...gn........u/..2....IEND.B`.

Chrome Cache Entry: 72

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	50
Entropy (8bit):	4.21287868934203
Encrypted:	false
SSDEEP:
MD5:	48CEF5284EEBCF3B1380D6710357990C
SHA1:	B381F3445730FEFD66485A85E761CF6323D59AD9
SHA-256:	CDFC8444656AA534028FB59331119A15CE73E5129435B877ED8AA11A65C91FA7
SHA-512:	419F94B95EE23EE0AD5DEB4C1580C6A0C3E39C04D81E21DD9BCB6BC68823788F6A5D80B4BBB8ECBB52349010418D1F5910791C6C091299BD6D8432782DA224DA
Malicious:	false
Reputation:	unknown
URL:	https://securelinks.cloud-security.net/app/config/config.json
Preview:	{. "serviceUrl": "http://localhost:4220".}.

Chrome Cache Entry: 73

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	5371
Entropy (8bit):	5.123544901248162
Encrypted:	false
SSDEEP:
MD5:	02EFC42E535F3957B39856795900CB0B
SHA1:	C87B16C080AEE832CA6086AE4FAD27EB98C60780
SHA-256:	C02B9B424716C0BAF1BE2CB183899C6AE0252AB2DEBA23071FBD61DB4303338C
SHA-512:	D1F6FC33A19881460AA8CCEA7F4007B5DCB8D6A2C628FAE9199B622C60D74A89815609F44F3CB581ECDF9B0AD44953FAE967F9136B024E35EC614F4323B18599
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8"?>. Generator: Adobe Illustrator 28.2.0, SVG Export Plug-In . SVG Version: 6.00 Build 0) -->.<svg version="1.1" id="Calque_1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px".. viewBox="0 0 417.6 258.9" style="enable-background:new 0 0 417.6 258.9;" xml:space="preserve">.<style type="text/css">...st0{fill:#FFFFFF;stroke:#3D505B;stroke-miterlimit:10;}...st1{opacity:0.38;fill:#C3D2D8;enable-background:new ;}...st2{fill:#C3D2D8;stroke:#3D505B;stroke-miterlimit:10;}...st3{fill:none;stroke:#3D505B;stroke-miterlimit:10;}...st4{fill:#BED600;stroke:#BED600;stroke-miterlimit:10;}...st5{fill:#D8EB47;stroke:#BED600;stroke-miterlimit:10;}...st6{fill:#BED600;stroke:#BED600;stroke-miterlimit:9.9996;}...st7{fill:#FFFFFF;}.</style>.<g id="layer_1">..<rect id="Paper" x="125.1" y="63.2" class="st0" width="165.6" height="195.2"/>..<circle class="st1" cx="137.4" cy="73.4" r="2.8"/>..<circle class="st1" cx="148.2" cy="

Chrome Cache Entry: 74

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 49 x 41, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	574
Entropy (8bit):	7.003749898821409
Encrypted:	false
SSDEEP:
MD5:	2FD4F7E868BDFC2783336BFF3023B54D
SHA1:	34B74C34C949FECFD9EF4D306461979E2B27FFE5
SHA-256:	4D1957F26FD121F764E588060F2B27C97700D0E917F9102D57FB2FC3F281E5B7
SHA-512:	60D38C7B09A42244E9576EEB98A856D5AC1C4654DB1491AF0A72BD0B7BD83AA377BE2F055C7A1309252996EBB9D95EC2D93A2EFFC110BBDFE1235C557BF5F55B
Malicious:	false
Reputation:	unknown
URL:	https://securelinks.cloud-security.net/images/shield-loop-solid.png
Preview:	.PNG........IHDR...1...).......1.....gAMA......a.....sRGB.........pHYs................HPLTEGpL...........................................................................tRNS....@`.. ...p.0.P.....C5....\IDATH.U.r. .3.0$........tY..t:.[&...l.....~.......+...i..:...l...<.)9.[..!......t....n..1....57..?.\|x!./}...v.?=.?.{.Pa........s........xM M..7.!%....H.nK;.n.l}#r.R`.~..YI.J...\..A&..\|.KT........]Sm... ...`..V@,...`u.v......G...1U.\|..[.%B.g.`.....s*.K....%.u.,......ZS}..QO.vQ ..C.BZ2......z.M....\.....0..3.............C....c.o\|.W...d-....IEND.B`.

Chrome Cache Entry: 75

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2181), with no line terminators
Category:	downloaded
Size (bytes):	2181
Entropy (8bit):	5.3095990683805665
Encrypted:	false
SSDEEP:
MD5:	A403E98E25AC68FA90C5737E59F7587F
SHA1:	FFA564511AF63DF85D75929EDA4CA027D2692130
SHA-256:	6FF0F6C2CE32B910C69C182DD3BE48757F3022CB5CBCC06F0FCDB5C92A1F8974
SHA-512:	9E279278C2F8DCFBB17F187981BF7C80555F38FD5BED88B6AA0ADC6A9E5A65770EC7905F36118F2EB32CE44DFF15B8E8A3C222BA7EC1E4F0E9D1E2957182E011
Malicious:	false
Reputation:	unknown
URL:	https://securelinks.cloud-security.net/218.0809266569f41ece.js
Preview:	"use strict";(self.webpackChunktoc=self.webpackChunktoc\|\|[]).push([[218],{6218:(f,l,a)=>{a.r(l),a.d(l,{ErrorModule:()=>r});var d=a(177),g=a(9417),h=a(9888),t=a(4438),c=a(5694);class n{constructor(s){this.translate=s,this.logo=""}ngOnInit(){const s=["de","en","es","fr"],e=document.querySelector("html"),o=e.getAttribute("data-theme"),i=e.getAttribute("lang");i&&-1!==s.indexOf(i.toLowerCase())?this.translate.setDefaultLang(i.toLowerCase()):-1!==s.indexOf(navigator.language.split("-")[0])?this.translate.setDefaultLang(navigator.language.split("-")[0]):this.translate.setDefaultLang("en");const m=o\|\|"dark";this.logo="dark"!==m?"./images/logo-default.png":"./images/logo.png"}static#t=this.\u0275fac=function(e){return new(e\|\|n)(t.rXU(c.c$))};static#e=this.\u0275cmp=t.VBU({type:n,selectors:[["app-404"]],decls:25,vars:10,consts:[[1,"content-holder","holder-parent"],["id","page-header"],[1,"header-image"],["alt","logo",3,"src"],[1,"header-title"],[2,"clear","both"],[1,"content-product-holder"],[1

Chrome Cache Entry: 77

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	7568
Entropy (8bit):	4.28627422479574
Encrypted:	false
SSDEEP:
MD5:	E70A7FEA65196A80D6893563C6320B17
SHA1:	391FBF6210CE6C3B0D4B47AADAB1B0D72F498CC0
SHA-256:	D3FED4BCC05BF65575D05CD3E7E90BA6200B13BD1B4FE0EDC3A20971BA08684B
SHA-512:	02C173F6AA606C525EE7280200004CAB99D8E9D014274717DDF5CED86286FC04E45033237EC3EBD7116626986AC80D601F43EF8369882125E2FA7DBEF99A49C5
Malicious:	false
Reputation:	unknown
URL:	https://securelinks.cloud-security.net/translations/en.json
Preview:	{. "urlscan": {. "atp": "Advanced Threat Protection",. "land_page": "URL Scanning",. "reason": {. "url_integrity_error": "The integrity of the requested URL could not be verified.",. "bad_status_code": "The requested URL returned a negative status code.",. "blocked_by": "The requested URL matched a malicious pattern.",. "multiple_download_fails": "URLs that are referenced on the requested web page or on one of its linked web pages returned a negative status code.",. "all_scanners_failed": "The requested web page could not be scanned because the scan function was temporarily unavailable. Please try again later.",. "blocked_url_in_whitelist": "The requested URL matched a malicious pattern but is on the allow list.",. "unimplemented_rewrite_version": "The requested URL could not be identified.",. "unpack_error": "The requested URL could not be restored before the scan.",.

Chrome Cache Entry: 78

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 381 x 189, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	5861
Entropy (8bit):	7.683707650541321
Encrypted:	false
SSDEEP:
MD5:	E34F3DA43B467D6929B0BD59759517DE
SHA1:	374DFD60029B884AE5ACAA2A1B20E4D774D9FA83
SHA-256:	A97CC7904F4522EB52B27E13DB3E33A49F23B1C6AAB3CBD75C9B42B94D3EC84A
SHA-512:	23D6025F8025A7E098867D678BA0387718640949F3BEB74D0215577AB62452AE27E58918B1C95715729AD4F79B23CB99FA387C89936766A2125B92826B31D0F8
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...}.........h8]c....gAMA......a.....sRGB.........pHYs.................PLTEGpL............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................<....tRNS.0p@.8.P P.8...........`........(............ ......ITA....."../...............q...,.M..W......?s.v.T...d...E..4&.._]..*..<U....J$

Chrome Cache Entry: 80

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 495 x 309, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	5808
Entropy (8bit):	7.899339536396948
Encrypted:	false
SSDEEP:
MD5:	D53A85BF4EC9FCCB0D4D211B8D76DBAD
SHA1:	ADEC794DB162E17B34C90BCEB69A2E5847496AD0
SHA-256:	3747D2D6D30FD7EB538C98C936ED43912A4636B3F4D2C6FAB5F2FB144133D79C
SHA-512:	501BD8553402D69E33E37DD5FF31753B02CDCB49CD797BE8A67AF0B43531AD4FC95FA5A054A0BD7B5116F7FE7E4DF779DEB5647788496684830C40D782A450DA
Malicious:	false
Reputation:	unknown
URL:	https://securelinks.cloud-security.net/images/completed.png
Preview:	.PNG........IHDR.......5...........gAMA......a.....sRGB.........pHYs................UPLTEGpLP`h...fpxUcm...Tcm......q}.......Rak.............................................................................`..%..........................2..,...y..........P..$..C...htz.....:.....-bmv...u..r.......~.........it~......~..................fs}......iu...............er\|...............~..t~...4.......................................J...gt~..........%...]ku..................................%.........hu~...............x.._lv...Sal.................,.............n{......h.....Zfq.................o{.........lw....dqz..w.................[..Y.....;............D......u.R..\|...u......DtRNS. l..L.3..`..,..0&.).....#......`@. .M. p...@.....=0.Y.fP,.s0O.f....w.....IDATx....wS...pz.0.T.l.1......4[.O#.m.UVd..-. a.f16..BcC.......%.6p.$4.....d.'.=.Iz..y.~.......{g.{k.p..Z.7..^[.a.X.....o$.k..a......8......C;....mBq.hg.0..H{Y.......xK+..M..8;$.o.A..vV\J.Q...(n7.e.....[5jg..cq.

Chrome Cache Entry: 81

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 49920, version 1.0
Category:	downloaded
Size (bytes):	49920
Entropy (8bit):	7.996426918774006
Encrypted:	true
SSDEEP:
MD5:	26506E803D3D8B51270718F8A93DA7FD
SHA1:	6D15EA085D9835E27535892C4212EE8F56E48384
SHA-256:	ECFE794CBBA27DA3987A32504E6A35AB5A5A67BD70D69B89444FAC4882DC5895
SHA-512:	BFEC060B60DAA1D2CA4B473F06C384B943C6F75B8F3428676783FF815A414CF0E9F0D5FC65789C556FB2AC14A6900026C0C55B8DCDBDB364400E2B9301F4FF97
Malicious:	false
Reputation:	unknown
URL:	https://securelinks.cloud-security.net/Hornet-SemiBold.bf9154546071add8.woff2
Preview:	wOF2...............$............................"...t..F.`..$.V........0..[..<..6.$..8. .....=..2[.r...v.q...v.jb.Kf.O{..9%.s..U.U5.k....[..1.3......5.B.jv...&)Z...{..?Ar.D.0}A.o.vW.~.r.u..9.Y#.\|....S..p..g[..d...d.qTg....{._.....7.....:J/.J..]...8.d".D%m.A.f..HmB6.z..>.\.H.lz.g...L.$.Ddz6'..g.X@x......h...T.Jt......(9uM..h...i.2...M.......i...HVYf./....HV.......6.#d...I(n.....6.7.>e..N..w..>..\l..lde.aEF..)...].kB....H.....#..B^.<6<f.%......+...n..4.0.w......x.........0.h..lr.......9..............."Q.....,.Fc....;.J..m."Z{x.gw.}".(,...[D.}@..Gh4.(...[...%.:....hj..............P....xE..O....9B........[JE,._.^....Ei....P(.J!\|.FQX....y.$oO>e.r.......tn6.6`.-w....p4.;..}v.....3...N8@...0.....%.Z.."...a.]....D...b.]..y._..."""!.]A......H....t...VN&//....^.C.....>.4..d.......D.p.......f...H.H..&EQ.n..........Ks[.O.[4P..eY.}.....p!t..7.m.z.....l%..Tl..(EAJ."j...z....\|{~...&.t:...J2.K..H....3'.:{..S.%...A....`..A0...%.H.q...S.G[..<...je.;.

Chrome Cache Entry: 82

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2713), with no line terminators
Category:	downloaded
Size (bytes):	2713
Entropy (8bit):	5.308299534055227
Encrypted:	false
SSDEEP:
MD5:	DB5CA089D76E4480D203D98FC45E13F6
SHA1:	42A62C0C7742A97C1361BBA1BF33BCDB4C54B011
SHA-256:	092242A628AF1705B1734CEC65C3A12364D3BDDAD337A20D5A900358A7577847
SHA-512:	FE88A4CAAB386A04544C3A25813854897C4282CED6723FC956A7A38783DE389506575FD0E1921DA2014DF21692A281B35EE3CB21210712536FCF1894433EF8CA
Malicious:	false
Reputation:	unknown
URL:	https://securelinks.cloud-security.net/runtime.d608c7ed1d9c3996.js
Preview:	(()=>{"use strict";var e,v={},m={};function r(e){var i=m[e];if(void 0!==i)return i.exports;var t=m[e]={exports:{}};return v[e](t,t.exports,r),t.exports}r.m=v,e=[],r.O=(i,t,o,u)=>{if(!t){var a=1/0;for(n=0;n<e.length;n++){for(var[t,o,u]=e[n],c=!0,f=0;f<t.length;f++)(!1&u\|\|a>=u)&&Object.keys(r.O).every(b=>r.O[b](t[f]))?t.splice(f--,1):(c=!1,u<a&&(a=u));if(c){e.splice(n--,1);var d=o();void 0!==d&&(i=d)}}return i}u=u\|\|0;for(var n=e.length;n>0&&e[n-1][2]>u;n--)e[n]=e[n-1];e[n]=[t,o,u]},r.d=(e,i)=>{for(var t in i)r.o(i,t)&&!r.o(e,t)&&Object.defineProperty(e,t,{enumerable:!0,get:i[t]})},r.f={},r.e=e=>Promise.all(Object.keys(r.f).reduce((i,t)=>(r.f[t](e,i),i),[])),r.u=e=>e+"."+{218:"0809266569f41ece",895:"be1bd3f1e3cf97bf"}[e]+".js",r.miniCssF=e=>{},r.o=(e,i)=>Object.prototype.hasOwnProperty.call(e,i),(()=>{var e={},i="toc:";r.l=(t,o,u,n)=>{if(e[t])e[t].push(o);else{var a,c;if(void 0!==u)for(var f=document.getElementsByTagName("script"),d=0;d<f.length;d++){var l=f[d];if(l.getAttribute("src")==t

Chrome Cache Entry: 83

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (34317), with no line terminators
Category:	downloaded
Size (bytes):	34317
Entropy (8bit):	5.395050154373031
Encrypted:	false
SSDEEP:
MD5:	AD0E75BA8A3ECE9A1C9B77505FEE0CED
SHA1:	4592F816CCF9333A7300ED0792F2F0407C00297C
SHA-256:	5456382D2FBCD1FB337FCB90034B05A1A1A141F5D8E38165D416BF41B76F479D
SHA-512:	CF28A7C734EEE86633BB81F634277AA6181F7C6B63253D4D7FF583784787BE8766D710D2B62E69051C6548773CA4355F64496E88A5A4CFD6CF38B71C974AF465
Malicious:	false
Reputation:	unknown
URL:	https://securelinks.cloud-security.net/polyfills.607595976de3afd5.js
Preview:	"use strict";(self.webpackChunktoc=self.webpackChunktoc\|\|[]).push([[461],{6935:()=>{!function(e){const t=e.performance;function c(H){t&&t.mark&&t.mark(H)}function s(H,r){t&&t.measure&&t.measure(H,r)}c("Zone");const a=e.__Zone_symbol_prefix\|\|"__zone_symbol__";function l(H){return a+H}const y=!0===e[l("forceDuplicateZoneCheck")];if(e.Zone){if(y\|\|"function"!=typeof e.Zone.__symbol__)throw new Error("Zone already loaded.");return e.Zone}class _{static#e=this.__symbol__=l;static assertZonePatched(){if(e.Promise!==se.ZoneAwarePromise)throw new Error("Zone.js has detected that ZoneAwarePromise `(window\|global).Promise` has been overwritten.\nMost likely cause is that a Promise polyfill has been loaded after Zone.js (Polyfilling Promise api is not necessary when zone.js is loaded. If you must load one, do so before loading zone.js.)")}static get root(){let r=_.current;for(;r.parent;)r=r.parent;return r}static get current(){return U.zone}static get currentTask(){return oe}static __load_patch(r,

Chrome Cache Entry: 84

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (8206)
Category:	downloaded
Size (bytes):	8207
Entropy (8bit):	5.175649761615389
Encrypted:	false
SSDEEP:
MD5:	36CE11FA3B14B9F4C950F1DB634D3E63
SHA1:	D844C00B783BA7E250563C19775E884AD2A32BE7
SHA-256:	90EF5F750A447710E60902B4E4CD51BA95B38E2C6925DB2742ED5369F87017CF
SHA-512:	A932B64849EF0CA20918C2B68868DBFFB5B7DCB587DC1342534F149473ECA3A8B4F6B5779C08A00C60F4B23D6916BF43CC2E3D9633C730D347EB92E6CF25D2EA
Malicious:	false
Reputation:	unknown
URL:	https://securelinks.cloud-security.net/styles.291c02806014e652.css
Preview:	@charset "UTF-8";@font-face{font-display:swap;font-family:Hornet;font-style:normal;font-weight:100 300;src:url(Hornet-Light.cd2b04feae6199b9.woff2) format("woff2"),url(Hornet-Light.31e61e203363fc06.otf) format("opentype"),url(Hornet-Light.90e024ffd42abe77.ttf) format("truetype")}@font-face{font-display:swap;font-family:Hornet;font-style:normal;font-weight:400;src:url(Hornet-Regular.021743c5464be55c.woff2) format("woff2"),url(Hornet-Regular.5980f69ef2f414bf.otf) format("opentype"),url(Hornet-Regular.6bc6bd36aa9f0fa4.ttf) format("truetype")}@font-face{font-display:swap;font-family:Hornet;font-style:normal;font-weight:500;src:url(Hornet-Medium.03c89235257bc8cf.woff2) format("woff2"),url(Hornet-Medium.8a6de98516a752a1.otf) format("opentype"),url(Hornet-Medium.3dea1f3c7deff814.ttf) format("truetype")}@font-face{font-display:swap;font-family:Hornet;font-style:normal;font-weight:600 900;src:url(Hornet-SemiBold.bf9154546071add8.woff2) format("woff2"),url(Hornet-SemiBold.eef7328456406f52.otf) f

Chrome Cache Entry: 88

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 48108, version 1.0
Category:	downloaded
Size (bytes):	48108
Entropy (8bit):	7.995882110476692
Encrypted:	true
SSDEEP:
MD5:	5619FCCB91BD4D8B2847CD88A22BB8D7
SHA1:	47C1A0C78B4FD45746FF3FCB1041BF96F5F45C27
SHA-256:	FB275F3A183E4552E77ED48A1BF545066596CE929F40CB72979C559D173F3795
SHA-512:	C61FDBBD1243C1C1B37A9737949A485DE4765A45EC3DE1CFED6992B90126E3B28B66FC22224B85232D084172AE9382F83FC5226E0B43D15CCF5EBD33A1CCEFAE
Malicious:	false
Reputation:	unknown
URL:	https://securelinks.cloud-security.net/Hornet-Regular.021743c5464be55c.woff2
Preview:	wOF2...............p.............................".....&.`..".V........0..]..<..6.$..8. ..U..=..2[-Xr.u..pS.u.B.5..7=.......8....E..o...e.'...MX.k.....??i.\.u.]..l..?.....9..Q...V..Z.D.r^q..R.....q...bJ....l.2....{ ..........eKo.lW3...L.."O..P....Q......j.2]...3.p.<9R_CVz..(.@O~tm....mFU...........B..C$..[.....>..= ..+Z.....2.....a....U...p.L....'.2..b....=...?...R...\.X5.6'M...Y...D.F....)..e .[..Dd0.-...I..........,K..Q.]J.....>.>.c.@..'..Ak....&F.[.....Q..q.&f`p...V........el..........d..KFEI..D...(..+(`5F......b\|..)..=.=g.....K.H@.......1D.....7....x".*.........v..MH=.OZ.....++5.E..!.uX....e'....<.{.^gb...V<,......2g!..B.B.Km........CU..l4..\|".x....{.O....vS$..N.)..../.bk....v.."....~..@s...S.X..u..$K2.....0.Lf........w....S..Yq.X....v.{.....d.,......r.!.@.^.H......6.....N]6&...v.....a/........p.I."vM....K...V:.....D4".."....4F.&.d...D..e:8.%...S'..^.t.K..g..n=Yz$[...#..i64.'._.-....~i=...YZ...9..= h......_U;.......K....Sj...4.B......?5.B..6.

Chrome Cache Entry: 91

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (1626)
Category:	downloaded
Size (bytes):	2697
Entropy (8bit):	5.4054827459209704
Encrypted:	false
SSDEEP:
MD5:	08738FBCE04A054614C61300403756C2
SHA1:	CF3A91B63BC1ED779A028CA64F32FB31F2782C64
SHA-256:	E203879546D1341B467FA935956F07FB9588F1CA2C48867D19109CE4CC01266F
SHA-512:	46E94CE918B5B8BFAD0B222960B6C72139C9F6F904F15B09B7693EDDDA153500A30807AD9A782C30AB97E378C9C20598462FEDD0BB5BC5B3E32EB1F75B2851CE
Malicious:	false
Reputation:	unknown
URL:	https://securelinks.cloud-security.net/v4?d=CSvj-8b3fpwAumC6AbFMfEVmIT5ENJWTqrZHusAeFnU&f=Mzo1PUwZQd3evqHstuwR_5FCozrkJ9Jd1jGDrnrvcdluTk54zR-Gop3tgMHHrGpX90Gv7ZppU4ALGygldB7J0A&i=&k=bz9r&m=KuGpJb7F8ZjkKBdLnbtsoBlIPcr_V2YvhrjDwSG7wjDkh9t68btueC3me_khplS04Y1vkmcz2DALFAdsCPnXV9Y0e_KkoBmquE5hQxvQRCkIOVAxUSYrmBcZKNoh8NCT&n=3jw3xk5HrrJRpv5jkTsPtIA8SNg8pPkNVIChy5v4uioLwV8t1Qhw8Jl0rPecYr_z&r=Mi1JW6WUX7aRK4law3uJhl9L7Awt-TwJX20OR-eyQiCnjiN--PaFEdBZXBvOt4br&s=9e20e3b941956d702101ff1a86d29524b24c4f8158208c10cfbca279a872d30e&u=https%3A%2F%2Fwww.google.ca%2Furl%3Fn89vrc%3Dhttps%3A%2F%2Fwww.cookejackson.com%26bg%3DAJ%26SQ%3DPQ%26TA%3DR6%26SQ%3DPW%26TA%3D6O%26q%3D%252561%25256d%252570%252F%252573%252561%25256E%252564%252562%25256F%252578%25252E%252575%252573%25252E%252570%252572%25256F%252564%25252E%252561%252570%252569%25252E%252575%252570%252566%25256F%252572%252574%25252E%252563%25256F%25256D%25252F%25256C%252569%25256E%25256B%25252F%252565%252579%25254A%252573%252549%25256A%25256F%252569aHR0cHM6Ly9xM3oycDUuZGVrY2hvYnRpZXcuY29tL2Jvbm5pZS5wZXRlcnNlbkBnZWxpdGEuY29tIiwidSI6InVzZXItMGIzMzM5NWItZDE0OS00NzVkLTljMDMtZmExMGIxMjg1YTVmIiwiciI6ImFubmEudmFuY2VAbWFzb25vd2VuYW5kaGFsZS5jaCIsInYiOjF9%26opdg%3DSmo%26Uk4%3DRXM%26QTU%3DN3I%20Category%20Status%20Priority%20QuickActions
Preview:	<!doctype html>.<html lang="" data-logo="images/logo-default.png" data-theme="" data-encodedurl="" data-critters-container>..<head>. <title id="text-title">Anti-phishing analysis</title>. <base href="https://securelinks.cloud-security.net/">. <meta charset="UTF-8">. <meta name="vsc-antiphishing" content="1.0">. <meta name="viewport" content="width=device-width, initial-scale=1">. <meta name="referrer" content="no-referrer">. <link rel="icon" href="./favicon.ico">.<style>@charset "UTF-8";@font-face{font-display:swap;font-family:Hornet;font-style:normal;font-weight:100 300;src:url(Hornet-Light.cd2b04feae6199b9.woff2) format("woff2"),url(Hornet-Light.31e61e203363fc06.otf) format("opentype"),url(Hornet-Light.90e024ffd42abe77.ttf) format("truetype")}@font-face{font-display:swap;font-family:Hornet;font-style:normal;font-weight:400;src:url(Hornet-Regular.021743c5464be55c.woff2) format("woff2"),url(Hornet-Regular.5980f69ef2f414bf.otf) format("opentype"),url(Hornet-Regular.

Chrome Cache Entry: 92

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 381 x 189, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	5885
Entropy (8bit):	7.633626076350842
Encrypted:	false
SSDEEP:
MD5:	49FFE68D82D0C1A1A75C081422CB67A7
SHA1:	BA7A91D0AEFAF9A1B9341DDF9C6DA7487B636389
SHA-256:	44068129BD4515CD320B5BAFAE65BE2763C0FFC9080BFE8147D613146546DA67
SHA-512:	598C6978F6D188FCCE61B4B3B506996362AEABA86835300226AD47BCE8F577614CE5F8B61A06EFB7B5786BDF727221B6D3A9F8F3537DCF28747CDFB688D8C7A4
Malicious:	false
Reputation:	unknown
URL:	https://securelinks.cloud-security.net/images/logo.png
Preview:	.PNG........IHDR...}.........h8]c....gAMA......a.....sRGB.........pHYs.................PLTEGpL....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................tRNS.p0@8..P P....8........`.................)......0.T..,.... ....v.3..I..A.......q)..?..sM4'.%...d....".......`...D...U.W.J.

Chrome Cache Entry: 93

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 1 icon, -128x-128, 32 bits/pixel
Category:	downloaded
Size (bytes):	67646
Entropy (8bit):	2.212959767992868
Encrypted:	false
SSDEEP:
MD5:	0B2B04040BC6EE5E6F123D5316A8407A
SHA1:	17AED11945C5EF8021A97F13162F06D5F7E65CEC
SHA-256:	3862DB4922F99149C6E1CA3EAC9743A9980CB60546E7E76269717C4CDC5236FE
SHA-512:	E069431349CCB8403603BAE40B641DBB21DCB5461295B6E9AD8F08A03894F9DBD3E49B270D980926C7009BF45118C4CC0A990534D10F572DB4BCEC7C872A1919
Malicious:	false
Reputation:	unknown
URL:	https://securelinks.cloud-security.net/favicon.ico
Preview:	............ .(.......(............. .........#...#.........................{...{...{/..{P..{...{...{...{...{...{...{...{...{...{...{...{...{...{...{...{...{...{Q..{H..{...{...................................................................................................................................................................................................................................................................................................................................................................................................................{...{...{}..{...{...{...{...{...{...{...{...{...{...{...{...{...{...{...{...{...{...{...{...{...{...{...{...{...{...{6..{...............................................................................................................................................................................................................................................................................................................

Chrome Cache Entry: 94

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (18047), with no line terminators
Category:	dropped
Size (bytes):	18047
Entropy (8bit):	5.424910363050938
Encrypted:	false
SSDEEP:
MD5:	74A115C2AB3173B22F7D3D392B047946
SHA1:	44B6B66DDA2B934EA8F8C0996CC860F17A639C25
SHA-256:	CC3E0F33193785EA654E0C48C5AB249D6016BBA7E7F750A13A451867DFC87F62
SHA-512:	B561E297985F9573E3E1762048C1F888F5E46E0F73FA7CDE7E334B0DE361A698D43AC07A194183C400F53EE5CCBA42A903E87244639E27DE52AEFD2D8916EBD3
Malicious:	false
Reputation:	unknown
Preview:	"use strict";(self.webpackChunktoc=self.webpackChunktoc\|\|[]).push([[895],{6895:(ut,k,d)=>{d.r(k),d.d(k,{V3Module:()=>v});var w=d(177),Y=d(9417),_=d(9888),O=d(8797);const h="function"==typeof Buffer,C="function"==typeof TextDecoder?new TextDecoder:void 0,p=("function"==typeof TextEncoder&&new TextEncoder,Array.prototype.slice.call("ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=")),g=(e=>{let s={};return e.forEach((i,r)=>s[i]=r),s})(p),H=/^(?:[A-Za-z\d+\/]{4})*?(?:[A-Za-z\d+\/]{2}(?:==)?\|[A-Za-z\d+\/]{3}=?)?$/,a=String.fromCharCode.bind(String),F="function"==typeof Uint8Array.from?Uint8Array.from.bind(Uint8Array):e=>new Uint8Array(Array.prototype.slice.call(e,0)),j=e=>e.replace(/[^A-Za-z0-9\+\/]/g,""),B=e=>{let s,i,r,n,o="";const l=e.length%3;for(let b=0;b<e.length;){if((i=e.charCodeAt(b++))>255\|\|(r=e.charCodeAt(b++))>255\|\|(n=e.charCodeAt(b++))>255)throw new TypeError("invalid character found");s=i<<16\|r<<8\|n,o+=p[s>>18&63]+p[s>>12&63]+p[s>>6&63]+p[63&s]}return l?o.sli

Static File Info

⊘No static file info

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Overview

General Information

Detection

Signatures

Classification

Process Tree

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Compliance

Networking

System Summary

Boot Survival

Mitre Att&ck Matrix

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

LLM Input / Output

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Chrome Cache Entry: 100

Chrome Cache Entry: 103

Chrome Cache Entry: 67

Chrome Cache Entry: 68

Chrome Cache Entry: 71

Chrome Cache Entry: 72

Chrome Cache Entry: 73

Chrome Cache Entry: 74

Chrome Cache Entry: 75

Chrome Cache Entry: 77

Chrome Cache Entry: 78

Chrome Cache Entry: 80

Chrome Cache Entry: 81

Chrome Cache Entry: 82

Chrome Cache Entry: 83

Chrome Cache Entry: 84

Chrome Cache Entry: 88

Chrome Cache Entry: 91

Chrome Cache Entry: 92

Chrome Cache Entry: 93

Chrome Cache Entry: 94

Static File Info