Windows Analysis Report
https://ascmiami.sharepoint.com/:f:/s/ASCMiami/EnZkVOJg1ZlAgu5SBwQGHckBxo1H_z4nHojmvCDnQJFG4A?e=5%3am8TN7j&at=9

Overview

General Information

Sample URL: https://ascmiami.sharepoint.com/:f:/s/ASCMiami/EnZkVOJg1ZlAgu5SBwQGHckBxo1H_z4nHojmvCDnQJFG4A?e=5%3am8TN7j&at=9
Analysis ID: 1592102
Infos:

Detection

Score: 2
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

HTML body contains low number of good links
HTML title does not match URL
Stores files to the Windows start menu directory
Submit button contains javascript call

Classification

HTML body contains low number of good links
Source: https://ascmiami.sharepoint.com/:f:/s/ASCMiami/EnZkVOJg1ZlAgu5SBwQGHckBxo1H_z4nHojmvCDnQJFG4A?e=5%3am8TN7j&at=9 HTTP Parser: Number of links: 0
Source: https://ascmiami.sharepoint.com/sites/ASCMiami/_layouts/15/guestaccess.aspx?e=5%3am8TN7j&at=9&share=EnZkVOJg1ZlAgu5SBwQGHckBxo1H_z4nHojmvCDnQJFG4A HTTP Parser: Number of links: 0
HTML title does not match URL
Source: https://ascmiami.sharepoint.com/:f:/s/ASCMiami/EnZkVOJg1ZlAgu5SBwQGHckBxo1H_z4nHojmvCDnQJFG4A?e=5%3am8TN7j&at=9 HTTP Parser: Title: Sharing Link Validation does not match URL
Source: https://ascmiami.sharepoint.com/sites/ASCMiami/_layouts/15/guestaccess.aspx?e=5%3am8TN7j&at=9&share=EnZkVOJg1ZlAgu5SBwQGHckBxo1H_z4nHojmvCDnQJFG4A HTTP Parser: Title: Sharing Link Validation does not match URL
Submit button contains javascript call
Source: https://ascmiami.sharepoint.com/:f:/s/ASCMiami/EnZkVOJg1ZlAgu5SBwQGHckBxo1H_z4nHojmvCDnQJFG4A?e=5%3am8TN7j&at=9 HTTP Parser: On click: javascript:WebForm_DoPostBackWithOptions(new WebForm_PostBackOptions("btnSubmitEmail", "", true, "", "", false, true))
Source: https://ascmiami.sharepoint.com/sites/ASCMiami/_layouts/15/guestaccess.aspx?e=5%3am8TN7j&at=9&share=EnZkVOJg1ZlAgu5SBwQGHckBxo1H_z4nHojmvCDnQJFG4A HTTP Parser: On click: javascript:WebForm_DoPostBackWithOptions(new WebForm_PostBackOptions("btnSubmitEmail", "", true, "", "", false, true))
Source: https://ascmiami.sharepoint.com/sites/ASCMiami/_layouts/15/guestaccess.aspx?e=5%3am8TN7j&at=9&share=EnZkVOJg1ZlAgu5SBwQGHckBxo1H_z4nHojmvCDnQJFG4A HTTP Parser: On click: javascript:WebForm_DoPostBackWithOptions(new WebForm_PostBackOptions("btnSubmitEmail", "", true, "", "", false, true))
Source: https://ascmiami.sharepoint.com/sites/ASCMiami/_layouts/15/guestaccess.aspx?e=5%3am8TN7j&at=9&share=EnZkVOJg1ZlAgu5SBwQGHckBxo1H_z4nHojmvCDnQJFG4A HTTP Parser: On click: javascript:WebForm_DoPostBackWithOptions(new WebForm_PostBackOptions("btnSubmitEmail", "", true, "", "", false, true))
Source: https://ascmiami.sharepoint.com/sites/ASCMiami/_layouts/15/guestaccess.aspx?e=5%3am8TN7j&at=9&share=EnZkVOJg1ZlAgu5SBwQGHckBxo1H_z4nHojmvCDnQJFG4A HTTP Parser: On click: javascript:WebForm_DoPostBackWithOptions(new WebForm_PostBackOptions("btnSubmitEmail", "", true, "", "", false, true))
Source: https://ascmiami.sharepoint.com/:f:/s/ASCMiami/EnZkVOJg1ZlAgu5SBwQGHckBxo1H_z4nHojmvCDnQJFG4A?e=5%3am8TN7j&at=9 HTTP Parser: No <meta name="author".. found
Source: https://ascmiami.sharepoint.com/sites/ASCMiami/_layouts/15/guestaccess.aspx?e=5%3am8TN7j&at=9&share=EnZkVOJg1ZlAgu5SBwQGHckBxo1H_z4nHojmvCDnQJFG4A HTTP Parser: No <meta name="author".. found
Source: https://ascmiami.sharepoint.com/sites/ASCMiami/_layouts/15/guestaccess.aspx?e=5%3am8TN7j&at=9&share=EnZkVOJg1ZlAgu5SBwQGHckBxo1H_z4nHojmvCDnQJFG4A HTTP Parser: No <meta name="author".. found
Source: https://ascmiami.sharepoint.com/sites/ASCMiami/_layouts/15/guestaccess.aspx?e=5%3am8TN7j&at=9&share=EnZkVOJg1ZlAgu5SBwQGHckBxo1H_z4nHojmvCDnQJFG4A HTTP Parser: No <meta name="author".. found
Source: https://ascmiami.sharepoint.com/sites/ASCMiami/_layouts/15/guestaccess.aspx?e=5%3am8TN7j&at=9&share=EnZkVOJg1ZlAgu5SBwQGHckBxo1H_z4nHojmvCDnQJFG4A HTTP Parser: No <meta name="author".. found
Source: https://ascmiami.sharepoint.com/:f:/s/ASCMiami/EnZkVOJg1ZlAgu5SBwQGHckBxo1H_z4nHojmvCDnQJFG4A?e=5%3am8TN7j&at=9 HTTP Parser: No <meta name="copyright".. found
Source: https://ascmiami.sharepoint.com/sites/ASCMiami/_layouts/15/guestaccess.aspx?e=5%3am8TN7j&at=9&share=EnZkVOJg1ZlAgu5SBwQGHckBxo1H_z4nHojmvCDnQJFG4A HTTP Parser: No <meta name="copyright".. found
Source: https://ascmiami.sharepoint.com/sites/ASCMiami/_layouts/15/guestaccess.aspx?e=5%3am8TN7j&at=9&share=EnZkVOJg1ZlAgu5SBwQGHckBxo1H_z4nHojmvCDnQJFG4A HTTP Parser: No <meta name="copyright".. found
Source: https://ascmiami.sharepoint.com/sites/ASCMiami/_layouts/15/guestaccess.aspx?e=5%3am8TN7j&at=9&share=EnZkVOJg1ZlAgu5SBwQGHckBxo1H_z4nHojmvCDnQJFG4A HTTP Parser: No <meta name="copyright".. found
Source: https://ascmiami.sharepoint.com/sites/ASCMiami/_layouts/15/guestaccess.aspx?e=5%3am8TN7j&at=9&share=EnZkVOJg1ZlAgu5SBwQGHckBxo1H_z4nHojmvCDnQJFG4A HTTP Parser: No <meta name="copyright".. found
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries Jump to behavior
Source: chrome.exe Memory has grown: Private usage: 0MB later: 33MB
Source: unknown TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global traffic HTTP traffic detected: GET /:f:/s/ASCMiami/EnZkVOJg1ZlAgu5SBwQGHckBxo1H_z4nHojmvCDnQJFG4A?e=5%3am8TN7j&at=9 HTTP/1.1Host: ascmiami.sharepoint.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /WebResource.axd?d=ygT7WCEJLlXS2jOwrxKF84Ec5Y1_hEjtzNO1fgSALYr0v9nh79ausiQA3ulooOJNOpVoHBcXcN0GZkY2R00Zkoi73rZz5_cLQDd7b9jM9qU1&t=638661570537377670 HTTP/1.1Host: ascmiami.sharepoint.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://ascmiami.sharepoint.com/:f:/s/ASCMiami/EnZkVOJg1ZlAgu5SBwQGHckBxo1H_z4nHojmvCDnQJFG4A?e=5%3am8TN7j&at=9Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /ScriptResource.axd?d=d1JlPwJpN1OS1dEUHYAfcp2Nwvc6kd-pEx9V7_Mx3wQWdjOXn-Wy2arwgs4gpuFBhTPFC6d1tAOWicajngzIzzj7SyBT62B29JNp6jHEpnOm5TPjfIAPaHe9nOWqUgzJF4P82kXD5BtayRMXCEUOE4TFzmqGTm4TEWSOerb4AkY1&t=64bd211b HTTP/1.1Host: ascmiami.sharepoint.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://ascmiami.sharepoint.com/:f:/s/ASCMiami/EnZkVOJg1ZlAgu5SBwQGHckBxo1H_z4nHojmvCDnQJFG4A?e=5%3am8TN7j&at=9Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /ScriptResource.axd?d=ZFIKyO4SxR55gIh3-Oo4RYUd2n5OUqrRGMiyzzH64Y-bgTSZkYaVXdOUzpV1KJ04gwldttBxpEIZFH1RrvtcUllrCT6w9NPzTPc0ohQAfyw-sCcO57UWAjEIRtxh7rCBIS-MgcxSjXZw3JfpcSMLoJv2SPAZA55KuPcB6yOaK--S5rDV2DsOivTMdN8-vk510&t=ffffffffb201fd3f HTTP/1.1Host: ascmiami.sharepoint.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://ascmiami.sharepoint.com/:f:/s/ASCMiami/EnZkVOJg1ZlAgu5SBwQGHckBxo1H_z4nHojmvCDnQJFG4A?e=5%3am8TN7j&at=9Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /ScriptResource.axd?d=qDbDDKE8Yly1QKthG9B6uKc-lDvrpw27M5EBmHQH90OgEba57kDr_Q2pnzUx89g_FZQiodEvb5nAtX44qcA0sUoZTmrPa4C8TAqVdsB6v-gaQC-4ZdOKOWfnI96ZsV8AwWSV5uH-PCquhsH4RfjLIIKkKhEAkFKB7fzHGImkuuBOGR0Fb-uBaCWk_4YBw0c00&t=ffffffffb201fd3f HTTP/1.1Host: ascmiami.sharepoint.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://ascmiami.sharepoint.com/:f:/s/ASCMiami/EnZkVOJg1ZlAgu5SBwQGHckBxo1H_z4nHojmvCDnQJFG4A?e=5%3am8TN7j&at=9Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /_layouts/15/images/microsoft-logo.png HTTP/1.1Host: ascmiami.sharepoint.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ascmiami.sharepoint.com/:f:/s/ASCMiami/EnZkVOJg1ZlAgu5SBwQGHckBxo1H_z4nHojmvCDnQJFG4A?e=5%3am8TN7j&at=9Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /WebResource.axd?d=ygT7WCEJLlXS2jOwrxKF84Ec5Y1_hEjtzNO1fgSALYr0v9nh79ausiQA3ulooOJNOpVoHBcXcN0GZkY2R00Zkoi73rZz5_cLQDd7b9jM9qU1&t=638661570537377670 HTTP/1.1Host: ascmiami.sharepoint.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /_layouts/15/images/microsoft-logo.png HTTP/1.1Host: ascmiami.sharepoint.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /ScriptResource.axd?d=qDbDDKE8Yly1QKthG9B6uKc-lDvrpw27M5EBmHQH90OgEba57kDr_Q2pnzUx89g_FZQiodEvb5nAtX44qcA0sUoZTmrPa4C8TAqVdsB6v-gaQC-4ZdOKOWfnI96ZsV8AwWSV5uH-PCquhsH4RfjLIIKkKhEAkFKB7fzHGImkuuBOGR0Fb-uBaCWk_4YBw0c00&t=ffffffffb201fd3f HTTP/1.1Host: ascmiami.sharepoint.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /ScriptResource.axd?d=d1JlPwJpN1OS1dEUHYAfcp2Nwvc6kd-pEx9V7_Mx3wQWdjOXn-Wy2arwgs4gpuFBhTPFC6d1tAOWicajngzIzzj7SyBT62B29JNp6jHEpnOm5TPjfIAPaHe9nOWqUgzJF4P82kXD5BtayRMXCEUOE4TFzmqGTm4TEWSOerb4AkY1&t=64bd211b HTTP/1.1Host: ascmiami.sharepoint.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /ScriptResource.axd?d=ZFIKyO4SxR55gIh3-Oo4RYUd2n5OUqrRGMiyzzH64Y-bgTSZkYaVXdOUzpV1KJ04gwldttBxpEIZFH1RrvtcUllrCT6w9NPzTPc0ohQAfyw-sCcO57UWAjEIRtxh7rCBIS-MgcxSjXZw3JfpcSMLoJv2SPAZA55KuPcB6yOaK--S5rDV2DsOivTMdN8-vk510&t=ffffffffb201fd3f HTTP/1.1Host: ascmiami.sharepoint.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /_layouts/15/images/favicon.ico?rev=47 HTTP/1.1Host: ascmiami.sharepoint.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ascmiami.sharepoint.com/:f:/s/ASCMiami/EnZkVOJg1ZlAgu5SBwQGHckBxo1H_z4nHojmvCDnQJFG4A?e=5%3am8TN7j&at=9Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /_layouts/15/images/favicon.ico?rev=47 HTTP/1.1Host: ascmiami.sharepoint.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /WebResource.axd?d=ygT7WCEJLlXS2jOwrxKF84Ec5Y1_hEjtzNO1fgSALYr0v9nh79ausiQA3ulooOJNOpVoHBcXcN0GZkY2R00Zkoi73rZz5_cLQDd7b9jM9qU1&t=638689305853757238 HTTP/1.1Host: ascmiami.sharepoint.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://ascmiami.sharepoint.com/sites/ASCMiami/_layouts/15/guestaccess.aspx?e=5%3am8TN7j&at=9&share=EnZkVOJg1ZlAgu5SBwQGHckBxo1H_z4nHojmvCDnQJFG4AAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /WebResource.axd?d=ygT7WCEJLlXS2jOwrxKF84Ec5Y1_hEjtzNO1fgSALYr0v9nh79ausiQA3ulooOJNOpVoHBcXcN0GZkY2R00Zkoi73rZz5_cLQDd7b9jM9qU1&t=638689305853757238 HTTP/1.1Host: ascmiami.sharepoint.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic DNS traffic detected: DNS query: www.google.com
Source: global traffic DNS traffic detected: DNS query: ascmiami.sharepoint.com
Source: global traffic DNS traffic detected: DNS query: m365cdn.nel.measure.office.net
Source: unknown HTTP traffic detected: POST /sites/ASCMiami/_layouts/15/guestaccess.aspx?e=5%3am8TN7j&at=9&share=EnZkVOJg1ZlAgu5SBwQGHckBxo1H_z4nHojmvCDnQJFG4A HTTP/1.1Host: ascmiami.sharepoint.comConnection: keep-aliveContent-Length: 1650Cache-Control: max-age=0sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1Origin: https://ascmiami.sharepoint.comContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentReferer: https://ascmiami.sharepoint.com/:f:/s/ASCMiami/EnZkVOJg1ZlAgu5SBwQGHckBxo1H_z4nHojmvCDnQJFG4A?e=5%3am8TN7j&at=9Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: chromecache_95.2.dr, chromecache_101.2.dr String found in binary or memory: http://github.com/jrburke/requirejs
Source: chromecache_99.2.dr String found in binary or memory: https://ascmiami.sharepoint.com/sites/ASCMiami/_layouts/15/images/folder.png
Source: chromecache_91.2.dr, chromecache_88.2.dr String found in binary or memory: https://reactjs.org/docs/error-decoder.html?invariant=
Source: chromecache_109.2.dr, chromecache_94.2.dr, chromecache_87.2.dr, chromecache_92.2.dr, chromecache_99.2.dr String found in binary or memory: https://res-1.cdn.office.net
Source: chromecache_109.2.dr, chromecache_94.2.dr, chromecache_87.2.dr, chromecache_92.2.dr, chromecache_99.2.dr String found in binary or memory: https://res-1.cdn.office.net/bld/_layouts/15/16.0.25611.12006/require.js
Source: chromecache_109.2.dr, chromecache_94.2.dr, chromecache_87.2.dr, chromecache_92.2.dr, chromecache_99.2.dr String found in binary or memory: https://res-1.cdn.office.net/files/odsp-web-prod_2025-01-03.006/
Source: chromecache_109.2.dr, chromecache_94.2.dr, chromecache_87.2.dr, chromecache_92.2.dr, chromecache_99.2.dr String found in binary or memory: https://res-1.cdn.office.net/files/odsp-web-prod_2025-01-03.006/spoguestaccesswebpack/spoguestaccess
Source: chromecache_109.2.dr, chromecache_94.2.dr, chromecache_87.2.dr, chromecache_92.2.dr, chromecache_99.2.dr String found in binary or memory: https://res-2.cdn.office.net/files/odsp-web-prod_2025-01-03.006/
Source: chromecache_109.2.dr, chromecache_94.2.dr, chromecache_87.2.dr, chromecache_92.2.dr, chromecache_99.2.dr String found in binary or memory: https://spoprod-a.akamaihd.net/files/odsp-common-library-prod_2019-02-15_20190219.002/require.js
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50026 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50022 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50022
Source: unknown Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50026
Source: unknown Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49854 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49914 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49915
Source: unknown Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49914
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown Network traffic detected: HTTP traffic on port 49737 -> 443
Source: classification engine Classification label: clean2.win@16/45@12/4
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Program Files\Google\Chrome\Application\Dictionaries Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps Jump to behavior
Source: unknown Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2304 --field-trial-handle=2020,i,10739807963695843706,9773108110104851494,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://ascmiami.sharepoint.com/:f:/s/ASCMiami/EnZkVOJg1ZlAgu5SBwQGHckBxo1H_z4nHojmvCDnQJFG4A?e=5%3am8TN7j&at=9"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2304 --field-trial-handle=2020,i,10739807963695843706,9773108110104851494,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: Google Drive.lnk.0.dr LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries Jump to behavior
Stores files to the Windows start menu directory
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk Jump to behavior
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 process2 2 Behavior Graph ID: 1592102 URL: https://ascmiami.sharepoint... Startdate: 15/01/2025 Architecture: WINDOWS Score: 2 5 chrome.exe 10 2->5         started        8 chrome.exe 2->8         started        dnsIp3 13 192.168.2.5, 443, 49574, 49703 unknown unknown 5->13 15 239.255.255.250 unknown Reserved 5->15 10 chrome.exe 5->10         started        process4 dnsIp5 17 dual-spo-0005.spo-msedge.net 13.107.136.10, 443, 49714, 49715 MICROSOFT-CORP-MSN-AS-BLOCKUS United States 10->17 19 www.google.com 216.58.206.36, 443, 49712, 50022 GOOGLEUS United States 10->19 21 6 other IPs or domains 10->21
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
13.107.136.10
 dual-spo-0005.spo-msedge.net United States
8068 MICROSOFT-CORP-MSN-AS-BLOCKUS false
216.58.206.36
 www.google.com United States
15169 GOOGLEUS false
239.255.255.250
 unknown Reserved
unknown unknown false

Private

IP
192.168.2.5

Contacted Domains

Name IP Active
dual-spo-0005.spo-msedge.net 13.107.136.10 true
www.google.com 216.58.206.36 true
ascmiami.sharepoint.com unknown unknown
m365cdn.nel.measure.office.net unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
https://ascmiami.sharepoint.com/_layouts/15/images/microsoft-logo.png false
  • Avira URL Cloud: safe
 unknown
https://ascmiami.sharepoint.com/:f:/s/ASCMiami/EnZkVOJg1ZlAgu5SBwQGHckBxo1H_z4nHojmvCDnQJFG4A?e=5%3am8TN7j&at=9 false
    		unknown
    https://ascmiami.sharepoint.com/sites/ASCMiami/_layouts/15/guestaccess.aspx?e=5%3am8TN7j&at=9&share=EnZkVOJg1ZlAgu5SBwQGHckBxo1H_z4nHojmvCDnQJFG4A false
      		unknown
      https://ascmiami.sharepoint.com/ScriptResource.axd?d=qDbDDKE8Yly1QKthG9B6uKc-lDvrpw27M5EBmHQH90OgEba57kDr_Q2pnzUx89g_FZQiodEvb5nAtX44qcA0sUoZTmrPa4C8TAqVdsB6v-gaQC-4ZdOKOWfnI96ZsV8AwWSV5uH-PCquhsH4RfjLIIKkKhEAkFKB7fzHGImkuuBOGR0Fb-uBaCWk_4YBw0c00&t=ffffffffb201fd3f false
      • Avira URL Cloud: safe
      		 unknown
      https://ascmiami.sharepoint.com/WebResource.axd?d=ygT7WCEJLlXS2jOwrxKF84Ec5Y1_hEjtzNO1fgSALYr0v9nh79ausiQA3ulooOJNOpVoHBcXcN0GZkY2R00Zkoi73rZz5_cLQDd7b9jM9qU1&t=638661570537377670 false
      • Avira URL Cloud: safe
      		 unknown
      https://ascmiami.sharepoint.com/WebResource.axd?d=ygT7WCEJLlXS2jOwrxKF84Ec5Y1_hEjtzNO1fgSALYr0v9nh79ausiQA3ulooOJNOpVoHBcXcN0GZkY2R00Zkoi73rZz5_cLQDd7b9jM9qU1&t=638689305853757238 false
      • Avira URL Cloud: safe
      		 unknown
      https://ascmiami.sharepoint.com/_layouts/15/images/favicon.ico?rev=47 false
      • Avira URL Cloud: safe
      		 unknown
      https://ascmiami.sharepoint.com/ScriptResource.axd?d=d1JlPwJpN1OS1dEUHYAfcp2Nwvc6kd-pEx9V7_Mx3wQWdjOXn-Wy2arwgs4gpuFBhTPFC6d1tAOWicajngzIzzj7SyBT62B29JNp6jHEpnOm5TPjfIAPaHe9nOWqUgzJF4P82kXD5BtayRMXCEUOE4TFzmqGTm4TEWSOerb4AkY1&t=64bd211b false
      • Avira URL Cloud: safe
      		 unknown