Windows Analysis Report
https://valleyglassinc-my.sharepoint.com/:x:/g/personal/kylief_valleyglass_com/EQQGPxTO__9Poobn5TukyJkB_VG03JzurVQP2laCRuMuHA

Overview

General Information

Sample URL:	https://valleyglassinc-my.sharepoint.com/:x:/g/personal/kylief_valleyglass_com/EQQGPxTO__9Poobn5TukyJkB_VG03JzurVQP2laCRuMuHA
Analysis ID:	1428876
Infos:

Detection

Score:	1
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Stores files to the Windows start menu directory

Uses insecure TLS / SSL version for HTTPS connection

Classification

Signatures

Uses insecure TLS / SSL version for HTTPS connection

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49703 version: SSL 3.0

Source: unknown	HTTPS traffic detected: 184.24.36.112:443 -> 192.168.2.5:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.24.36.112:443 -> 192.168.2.5:49725 version: TLS 1.2

Uses insecure TLS / SSL version for HTTPS connection

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49703 version: SSL 3.0

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 184.24.36.112
Source: unknown	TCP traffic detected without corresponding DNS query: 184.24.36.112
Source: unknown	TCP traffic detected without corresponding DNS query: 184.24.36.112
Source: unknown	TCP traffic detected without corresponding DNS query: 184.24.36.112
Source: unknown	TCP traffic detected without corresponding DNS query: 184.24.36.112
Source: unknown	TCP traffic detected without corresponding DNS query: 184.24.36.112
Source: unknown	TCP traffic detected without corresponding DNS query: 184.24.36.112
Source: unknown	TCP traffic detected without corresponding DNS query: 184.24.36.112
Source: unknown	TCP traffic detected without corresponding DNS query: 184.24.36.112
Source: unknown	TCP traffic detected without corresponding DNS query: 184.24.36.112
Source: unknown	TCP traffic detected without corresponding DNS query: 184.24.36.112
Source: unknown	TCP traffic detected without corresponding DNS query: 184.24.36.112
Source: unknown	TCP traffic detected without corresponding DNS query: 184.24.36.112
Source: unknown	TCP traffic detected without corresponding DNS query: 184.24.36.112
Source: unknown	TCP traffic detected without corresponding DNS query: 184.24.36.112
Source: unknown	TCP traffic detected without corresponding DNS query: 184.24.36.112
Source: unknown	TCP traffic detected without corresponding DNS query: 184.24.36.112
Source: unknown	TCP traffic detected without corresponding DNS query: 184.24.36.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /:x:/g/personal/kylief_valleyglass_com/EQQGPxTO__9Poobn5TukyJkB_VG03JzurVQP2laCRuMuHA HTTP/1.1Host: valleyglassinc-my.sharepoint.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_layouts/15/1033/styles/corev15.css?rev=d9H3to%2BPaydkiWscqN0mJQ%3D%3DTAG441 HTTP/1.1Host: valleyglassinc-my.sharepoint.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://valleyglassinc-my.sharepoint.com/:x:/g/personal/kylief_valleyglass_com/EQQGPxTO__9Poobn5TukyJkB_VG03JzurVQP2laCRuMuHAAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_layouts/15/1033/styles/error.css?rev=tF7fyfzbaQzNoASoSDlV4A%3D%3DTAG441 HTTP/1.1Host: valleyglassinc-my.sharepoint.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://valleyglassinc-my.sharepoint.com/:x:/g/personal/kylief_valleyglass_com/EQQGPxTO__9Poobn5TukyJkB_VG03JzurVQP2laCRuMuHAAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ScriptResource.axd?d=NgeraXf62xoNme3s-nva94cKIdNgzW3_IQMt1G5-iuqRLvOiMZ_qJHGv7SK8DzRi6BtVJqmjbuvlqpqhPKsDZFQ7SCnLlcWHEgW-LiBxr8R88qT2SddjTOq9Omqx01n6x_u-e6gfi_JrUTEAFxPrKAdV727PReh5dFQI8hy1hY6TW-6K6oYNL977PhSpNjyI0&t=722fe453 HTTP/1.1Host: valleyglassinc-my.sharepoint.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://valleyglassinc-my.sharepoint.com/:x:/g/personal/kylief_valleyglass_com/EQQGPxTO__9Poobn5TukyJkB_VG03JzurVQP2laCRuMuHAAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ScriptResource.axd?d=oss1GNe_QxAv3TikIgRy_-NOHkB42h8-smNripDChgkcYKb03Lw475ncbnT6MIsaP5H7ERi82zXToNdidd-beeJ2HyxTKrQnnrBEE7czb1hQI6Kx50OXtXk01hoTBIAzjWGC_Brom9IoS2rqlVEJgXXyfAWmVvWFT6JjdhN1CizGHy9Hn34BJT4yQ6uOgjfH0&t=722fe453 HTTP/1.1Host: valleyglassinc-my.sharepoint.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://valleyglassinc-my.sharepoint.com/:x:/g/personal/kylief_valleyglass_com/EQQGPxTO__9Poobn5TukyJkB_VG03JzurVQP2laCRuMuHAAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /WebResource.axd?d=02gr6bN-yBhmkjUgZhXZbcx-I5GFUW4rFBxPpE7F0dAz0HZ8Jip111DYNxTtB6UuIOMHp9EW_aT0BWuF3uk-XqpAUjcVHZ3hEJMEFoN7Xo01&t=638428559797478602 HTTP/1.1Host: valleyglassinc-my.sharepoint.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://valleyglassinc-my.sharepoint.com/:x:/g/personal/kylief_valleyglass_com/EQQGPxTO__9Poobn5TukyJkB_VG03JzurVQP2laCRuMuHAAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_layouts/15/images/favicon.ico?rev=47 HTTP/1.1Host: valleyglassinc-my.sharepoint.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://valleyglassinc-my.sharepoint.com/:x:/g/personal/kylief_valleyglass_com/EQQGPxTO__9Poobn5TukyJkB_VG03JzurVQP2laCRuMuHAAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /_layouts/15/images/favicon.ico?rev=47 HTTP/1.1Host: valleyglassinc-my.sharepoint.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: unknown

DNS traffic detected: queries for: valleyglassinc-my.sharepoint.com

Source: chromecache_80.2.dr	String found in binary or memory: https://res-1.cdn.office.net/bld/_layouts/15/16.0.24727.12007/1033/initstrings.js
Source: chromecache_80.2.dr	String found in binary or memory: https://res-1.cdn.office.net/bld/_layouts/15/16.0.24727.12007/blank.js
Source: chromecache_80.2.dr	String found in binary or memory: https://res-1.cdn.office.net/bld/_layouts/15/16.0.24727.12007/init.js
Source: chromecache_80.2.dr	String found in binary or memory: https://res-1.cdn.office.net/bld/_layouts/15/16.0.24727.12007/theming.js

Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724

Source: unknown	HTTPS traffic detected: 184.24.36.112:443 -> 192.168.2.5:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.24.36.112:443 -> 192.168.2.5:49725 version: TLS 1.2

Source: classification engine

Classification label: clean1.win@16/33@6/4

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2008 --field-trial-handle=1892,i,3793261570733558033,11566504711601303332,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://valleyglassinc-my.sharepoint.com/:x:/g/personal/kylief_valleyglass_com/EQQGPxTO__9Poobn5TukyJkB_VG03JzurVQP2laCRuMuHA"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2008 --field-trial-handle=1892,i,3793261570733558033,11566504711601303332,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Stores files to the Windows start menu directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
13.107.136.10	dual-spo-0005.spo-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.250.105.105	www.google.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.5

Contacted Domains

Name	IP	Active
dual-spo-0005.spo-msedge.net	13.107.136.10	true
www.google.com	142.250.105.105	true
fp2e7a.wpc.phicdn.net	192.229.211.108	true
valleyglassinc-my.sharepoint.com	unknown	unknown

Contacted URLs

Name	Malicious	Reputation
https://valleyglassinc-my.sharepoint.com/_layouts/15/1033/styles/error.css?rev=tF7fyfzbaQzNoASoSDlV4A%3D%3DTAG441	false	unknown
https://valleyglassinc-my.sharepoint.com/ScriptResource.axd?d=oss1GNe_QxAv3TikIgRy_-NOHkB42h8-smNripDChgkcYKb03Lw475ncbnT6MIsaP5H7ERi82zXToNdidd-beeJ2HyxTKrQnnrBEE7czb1hQI6Kx50OXtXk01hoTBIAzjWGC_Brom9IoS2rqlVEJgXXyfAWmVvWFT6JjdhN1CizGHy9Hn34BJT4yQ6uOgjfH0&t=722fe453	false	unknown
https://valleyglassinc-my.sharepoint.com/:x:/g/personal/kylief_valleyglass_com/EQQGPxTO__9Poobn5TukyJkB_VG03JzurVQP2laCRuMuHA	false	unknown
https://valleyglassinc-my.sharepoint.com/_layouts/15/1033/styles/corev15.css?rev=d9H3to%2BPaydkiWscqN0mJQ%3D%3DTAG441	false	unknown
https://valleyglassinc-my.sharepoint.com/_layouts/15/images/favicon.ico?rev=47	false	unknown

ID:	1428876
Product:	CloudBasic
Start time:	19:01:55
Start date:	19.04.2024
Cookbook:	browseurl.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Apr 19 16:02:46 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	3038D9A0731B0DEA079F91EDEBBD5208	B21D19C9495CB9DCAFF9798D79837E6D92710E26	AF1389CFCB1C67FC23ACBEE232BBB341E2C18D485030FE2D19E26AB94429ACC4
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Apr 19 16:02:46 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	A66EA24F2A71A2C6FC4B7577D2B99BA0	76E74B39EDCD16A4004DDFA8CE56219C68302477	53633343D2F388515E2C8E12179A62633280C7D2EE009209FBB048DF862EC7F8
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 4 12:54:07 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	A6AE8E2CFD5BD986D71A9E99EA6CC723	A6B53877BECFBD8DB34AC4DD3C843295EC40CDF4	61F09586B4FD1E2156542830A5FBFCCACE1B2806272BF82DFAD3E489F98AEC8F
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Apr 19 16:02:46 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	1C143AE8A7A9EC3B7143CD1E1DCB059A	52E3CE338F9B847DA3B9558C0A88D71D9EE65741	AD13780238F3B4417A8ACA8DE7B0AA8E0C319643DB225B81D79608182E36DB82
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Apr 19 16:02:46 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	E37C66B1DE8ACF22CD6DC7B279E345F5	2B42D161AA65097DB6F5DAA25B8B67B259288991	98D905CC6BA3BAE38F6EFA95C67B8F26BEC714F2392F483DB8EFF10B844EF5CD
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Apr 19 16:02:46 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	961382620028083A6D3868FCD54F3AD5	5A3B7576ACC14556135AB28EBB3C12D2645C2B1D	1D25A3E4D4973713BD41BB9679ABB3B18482B016EF29D90B372B943640B83302
Chrome Cache Entry: 72	ASCII text, with very long lines (65536), with no line terminators	29C0CB5C5CC2B8CAC109153976E27534	48C3258B2FE4F414795059A91F7744C4C431D808	747EA30208562F390A008403E6388D3998EEE48D015E5CA32C057DE7D02ABE58
Chrome Cache Entry: 73	MS Windows icon resource - 3 icons, 32x32, 32 bits/pixel, 24x24, 32 bits/pixel	0B60F3C9E4DA6E807E808DA7360F24F2	9AFC7ABB910DE855EFB426206E547574A1E074B7	ADDEEDEEEF393B6B1BE5BBB099B656DCD797334FF972C495CCB09CFCB1A78341
Chrome Cache Entry: 74	ASCII text, with very long lines (23437), with CRLF line terminators	964FCB2BAF87049DC68975291AE89431	D0CD8C989D44BC531472B632868D3FB2DE4B3184	B8F7BD568E379502CF0C00027581D2761C7DC14B166F5D25FC048A0B56B7BFBB
Chrome Cache Entry: 75	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 40329	027A7D52E1CEED8AEF7DC13505B81D36	33CF0BCE6A4C8B44B4A80B3116C978C12EE93FD0	29061464FB6FCE2326B952EACAA95C3C6183BFEA74C3851390E9838720D372A6
Chrome Cache Entry: 76	ASCII text, with very long lines (65536), with no line terminators	2DE2482829622DE740DB42E04CBCD047	2A88D65A01BDA232B97B24163F66BA7F90A63386	947D9E7117E8528021EC98FBBD6FE75A4D393A699DFFFFB3A2803EAE42845CEB
Chrome Cache Entry: 77	ASCII text, with CRLF line terminators	77D1F7B68F8F6B2764896B1CA8DD2625	029DB673E5079D061FAF65C929E62381A2997112	6A8AA4FE96A0E0846655C2977C533F9AFABC9F8B02E6F4643244CD417D28263C
Chrome Cache Entry: 78	ASCII text, with very long lines (456), with no line terminators	F797B9FE66DEB63DB9AE1DDB7319DF4D	B6C676E335CEE429E861EF3E1B2ADAC685566C1E	81AAA642B9117EDACAA45CE9EEB02542AC0F96E0C0B3305D88B86D82DA9EEC0E
Chrome Cache Entry: 79	MS Windows icon resource - 3 icons, 32x32, 32 bits/pixel, 24x24, 32 bits/pixel	0B60F3C9E4DA6E807E808DA7360F24F2	9AFC7ABB910DE855EFB426206E547574A1E074B7	ADDEEDEEEF393B6B1BE5BBB099B656DCD797334FF972C495CCB09CFCB1A78341
Chrome Cache Entry: 80	HTML document, ASCII text, with very long lines (64255), with CRLF, LF line terminators	03A491F6BA2494601D2C2D597092161E	3448F72EDBFCC3BFABB6451D8BB05D59F5070797	5FF58D811AB3EBE2A850F61DA757FDA09DD76B16E55AEA85CD9993D62C9139E7
Chrome Cache Entry: 81	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 102804	B62553925BD98826C60457D2EB6B9A46	84DBBB6D9B36A587C21B5A56B1D9E587E33BA943	C58166FE4DF4BA8F25A960C21451EAF841D97F6F552F104E43431C9DB1C2E2CC
Chrome Cache Entry: 82	ASCII text, with CRLF line terminators	90EA7274F19755002360945D54C2A0D7	647B5D8BF7D119A2C97895363A07A0C6EB8CD284	40732E9DCFA704CF615E4691BB07AECFD1CC5E063220A46E4A7FF6560C77F5DB
Chrome Cache Entry: 83	ASCII text, with very long lines (35238), with no line terminators	C637DE6889D81964119BA1FD124E2454	5DB2B1681BE6FF9A7B26E269CD80D817D41A01BE	18E8366C8C5590C3D056BA6CA9691B7471D6970EE00D0E22A4B68E517B54F087
Chrome Cache Entry: 84	ASCII text, with very long lines (65536), with no line terminators	79A07306C2CF97F9EDDA0B0387F9C6E3	D4D9B058C35C2F361CAEA062F59E1CD7DF796D88	ABB5A1C1F7C2B0ADFBF5A9BCA0CEC06762FCB7D5724539E818EE30F7C20F7412
Chrome Cache Entry: 85	ASCII text, with CRLF line terminators	B45EDFC9FCDB690CCDA004A8483955E0	BAEDF73329EABB32504CAC640538EE3B6B31819F	E817BF53005172205995AA07E0021BD8254A0204A1177E925F365E838C32D069

Windows Analysis Report
https://valleyglassinc-my.sharepoint.com/:x:/g/personal/kylief_valleyglass_com/EQQGPxTO__9Poobn5TukyJkB_VG03JzurVQP2laCRuMuHA

Overview

General Information

Detection

Signatures

Classification

Signatures

Compliance

Networking

System Summary

Boot Survival

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs

Windows Analysis Report https://valleyglassinc-my.sharepoint.com/:x:/g/personal/kylief_valleyglass_com/EQQGPxTO__9Poobn5TukyJkB_VG03JzurVQP2laCRuMuHA

Overview

General Information

Detection

Signatures

Classification

Signatures

Compliance

Networking

System Summary

Boot Survival

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs

Windows Analysis Report
https://valleyglassinc-my.sharepoint.com/:x:/g/personal/kylief_valleyglass_com/EQQGPxTO__9Poobn5TukyJkB_VG03JzurVQP2laCRuMuHA