Edit tour

Windows Analysis Report
https://www.ne16.com/t/4177044/70602841/2927387/1/124665/?f8785874=aHR0cHM6Ly93b29kLWRlY2sub3JnL3BkZi85SWRac1p5aTJEeWh3ZUcvYTFmM2IxODIyN2RiNTc4NjIzOGE2ZTc0NTE3YWQ4MDEvWEM4YXAvYTFmM2IxODIyN2RiNTc4NjIzOGE2ZTc0NTE3YWQ4MDEvWTJOc1lYSmxRR0psYkd4d1lYSjBibVZ5YzJsdVl5NWpiMjA9

Overview

General Information

Sample URL:	https://www.ne16.com/t/4177044/70602841/2927387/1/124665/?f8785874=aHR0cHM6Ly93b29kLWRlY2sub3JnL3BkZi85SWRac1p5aTJEeWh3ZUcvYTFmM2IxODIyN2RiNTc4NjIzOGE2ZTc0NTE3YWQ4MDEvWEM4YXAvYTFmM2IxODIyN2RiNTc4NjIzO
Analysis ID:	1430327

Detection

HTMLPhisher

Score:	68
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Phishing site detected (based on favicon image match)

Yara detected HtmlPhish10

Yara detected HtmlPhish45

Phishing site detected (based on image similarity)

HTML body contains low number of good links

HTML body contains password input but no form action

HTML page contains hidden URLs or javascript code

HTML title does not match URL

Stores files to the Windows start menu directory

Classification

Process Tree

System is w10x64_ra

chrome.exe (PID: 7068 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www.ne16.com/t/4177044/70602841/2927387/1/124665/?f8785874=aHR0cHM6Ly93b29kLWRlY2sub3JnL3BkZi85SWRac1p5aTJEeWh3ZUcvYTFmM2IxODIyN2RiNTc4NjIzOGE2ZTc0NTE3YWQ4MDEvWEM4YXAvYTFmM2IxODIyN2RiNTc4NjIzOGE2ZTc0NTE3YWQ4MDEvWTJOc1lYSmxRR0psYkd4d1lYSjBibVZ5YzJsdVl5NWpiMjA9 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6088 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 --field-trial-handle=1996,i,4342779536777233872,16681339852322972338,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Yara Signatures

HTML

Source	Rule	Description	Author
3.4.pages.csv	JoeSecurity_HtmlPhish_45	Yara detected HtmlPhish_45	Joe Security
3.6.pages.csv	JoeSecurity_HtmlPhish_10	Yara detected HtmlPhish_10	Joe Security
3.4.pages.csv	JoeSecurity_HtmlPhish_45	Yara detected HtmlPhish_45	Joe Security
3.5.pages.csv	JoeSecurity_HtmlPhish_10	Yara detected HtmlPhish_10	Joe Security

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Phishing

Phishing site detected (based on favicon image match)

Source: https://xs523936.xsrv.jp/EjYpCSPnF4RcmNH/XPS57-RTO/main/main.php#wM8rPSFgrELdel79aiDOOEPQSUXzJvjiA4EWcM41y1DTRSoHLRBc9zQw9qBJBwpqDAyBstJy2gwA4FAqMsoncZUPe5jTd1wDpywd8uohgIgaBPYUmFz3mBfevbGEmxuAwksi755lmVKRUHOMCJxLu2sRe1B5li5EBMY0fMAslErj9zKAdbUQdtYyRLYX5HRQa86EEyRhvDe0aZ0NsP7X4zL19XEdQVyMjF9GeAhAALtP96scw9c17e0rcOE04Ry1LwdmrNDThwLu4B4z5rpPIgyZmgLwL4K3Cyy0GNwGQKws9wyKlljAhvSedj1pCLRTxuJcLEsZm6NlvpDaLTKjGBfQZcbnsi0XuxSYIcpzfQ1sbjrEjJDRIGVg1hy9UUeyi9gK3BCoz41NYnp7vIXuR2EuENi0qEdySkciLcGujJ46smVXvkaMWcSxnHlQn6PCK0DQ3XZVOanhzmv5egHeu8warAzbhOM4Law7weUCfpTaEIHuEBnprUSzW5jYWz4NlnYqgnUyD557VrNC5udIVp6RKwxJsq9HB8cblPgNslfN8GiYCm7XedPbFD4mPFUu18zXohvctz8deOT52BwaGXRfmzjVZOiWuuYn8Sk2Mric5i0v6FTEEp4459VSFAUpLQOpk9wmcSnu5Z6o7amflUonMQezgQ1SQ4caB7MgkanWOZlnzqynaaQTe8HyZe8OZFPzXY2IgzVY3a81J3jVPUaELN5mRSIK1YeV4hoJT67knC5P4amVlXIOqKGGWmk2HJWgwTmajCtM8bMnu9EwiAGAnbINKCsv5kerckAcXlgXFhh0pgXrzvpsMCRIDPRQ6wtDV0warnZd3XHousdMElnFpjvBnBN6mzV132rz5YKLAss2oCOoAt0Om4AB1iSCJiGSxFguV3jEVGN2TgLBh5Z5j0LKOplC8Jn9FaZyusm10jTYViPh7nkdfvBmJWglsjI7tbU1YUkDJLdJZPWPqcHAfuRKW2pcJyJQe3Uph27OXCflcpgkIVEBIWx2h8sqWd6I9JUyOtI71RC5IS1UlJ2SkfGGXGWUa3kLnZ5xxLYJSbCYGeS5cuCRx4n7gsp9S4dm9FsMrGUcwFXWPY7YECc6RSpDtSPO5DrncK2V97HUpv7NqzYnocnnjbE5MpYxIoMeAxGeKu8XNt7dEoQE9zJqbeUaxQhy0Fj43sLPuni4T3NsEAJDsfDK0nkuqemMpQqdItKSpsiEGQFncxLlO8sEgOPFGgwlWbhVz8a0ZIC2DC8TTvxGdiJfnNX1v2rcgCiwA9yICW5hV0JPal0NgZ9FfJKixpyqZhmnha44SPipU9Yu93z9HYoVaGO2oOlVXemEMgiZsHMezEhfjVWtx9Wvqd7jthADQz3naFCl0qcGtkqY1CMjNYVI6t4SHHQnrsqkty40cG1OTjzLy7E03QEHrICEYE14lms1D2CC0VJPhVOKv6mnSfH5tvfcuC4kB6xBgwQuN8vNSn2qqSRh6gbABAebveIYDKrBRzll0Cjq6QwFZFxoXAFBR78nvAf74U6CszbBsB1UfygHRY3pNKi939NXOc6XV7wHfnNs96BZHgI4vtBFxhljs6Nu93CiWIDEjRf7Thl4q7EKh2jwYmybZV7BS7kRfJe0TkDDWhehfyrapQFbHeZPdLBSlNUwc4oekEBMDWJj9v4OepiCdTbN35KHbJvzl5Q4Iu0LakCOODxkD6fqkqn2yWRtZR8LyiBRDB9HKz7Xqn1QCWWl7EiTXL29lZ0mZP9TC3MervCxcp4VTdCP3LZOwSeh2jVWlLgPyT8gNLvtoXb1TAFOqV9GvredgzuEIGh0q0nCBX3CrgitqnuVAS5JxXoEi4TdeozhzbL4tSOCqSvY5Q03mZfB00jBqIDrttUOHStRDcLPyNgatWR92VCSyKIRdE94ZlflqFQgBMZ0bnMaGkDHKDQmV0VJ19G7NChQUObLUCMM7J3ANUEGXGzMOAzd6fzIePUrJbMCZe4g4VgIR9JuEZRsiIbzhB7IDCOEpMY3fDamtg9hQklbhvzORM7v3WeWF2yFAwxPxD7karzNrT08m6wQgNufGRHXPFpYN9akhaFo4SQO1mKOMgEwC67NWljZ7cpae9keTzr9OVHhoG2S6guTYbVN6GjH1Apf8kGXnl4cU4fyZWiTb8f7otMxY6Iz81jCCa7tjSUvuxZESLsgPIjg30tIaDN4cUGENZ8irTpePSC8aEQWqKPPWeM0AUu4Sk51rPMZZ991fVLWemYyWqDLlFXy8Z5O3YVgW8LGkS2iREEBcH3GzAgkqJgxL5NLsusnJxIId5AhNjPU8vOpFlK70ALNFpusEO2iwTfFznzDFTI7n7kqlpc4dwSzSAjHsNEupqQhYEyem9a2fUPhhP487GA3xu9Fv5AZLDb6ut6OT1Y0FlYOrbT1hZPELxO1saHKdelsUHhj9fBIQzaXK1sHFVw4BEvTmgb1e0eA5RvHr65yJE4HQ5lVuwltNMbm70rXajXbO45P28hmckbvPsL0mmVEwiceTPiZA7W2DFcjXcUgnMeLr7NyvzVC9TMcQ49BkUpLCZIwdbXuUVe8iYCQfEO7KA397JcSh5C7ihSTqHLWGD1eQ19dV55iVwHR7PGeW9Zg7NDROaxCn1d0EnWVQFvBjYmuseAuhIgsmSjE4KjaRpyLb48rFraoxMEwVGV82AGcpSZ5b4BNacHLXWyN8uunrQGrc9oRa8vT8qqZBUzxh6qXrKxT83oEMefQTXMbJ7b3oyraNlzveqPRC3ILGrVZj6KEVSxdDoKcSmNnJKv2EGSoCrgzL08LP54WXKlGehaQaQvMqxTsjKemh3ZhD4wQOrdUdtD7wxjFWkXFTHGU2MyxJiO65oo9zqRsniIZrax7VRL9D96ZNiuZB3vzbhhXPKlld2i5i8MU3ztFfZn6DZZ2ntc3vYVnZ31lDavUwVLuPnYMS8Dkn5Kde2x3pIOsgYs6eFFBbf7tLyOsFpENNeA349AN?cfg=cclare@bellpartnersinc.com

Matcher: Template: outlook matched with high similarity

Yara detected HtmlPhish10

Source: Yara match	File source: 3.6.pages.csv, type: HTML
Source: Yara match	File source: 3.5.pages.csv, type: HTML

Yara detected HtmlPhish45

Source: Yara match	File source: 3.4.pages.csv, type: HTML
Source: Yara match	File source: 3.4.pages.csv, type: HTML

Phishing site detected (based on image similarity)

Matcher: Found strong image similarity, brand: MICROSOFT

Source: https://xs523936.xsrv.jp/EjYpCSPnF4RcmNH/XPS57-RTO/main/main.php#wM8rPSFgrELdel79aiDOOEPQSUXzJvjiA4EWcM41y1DTRSoHLRBc9zQw9qBJBwpqDAyBstJy2gwA4FAqMsoncZUPe5jTd1wDpywd8uohgIgaBPYUmFz3mBfevbGEmxuAwksi755lmVKRUHOMCJxLu2sRe1B5li5EBMY0fMAslErj9zKAdbUQdtYyRLYX5HRQa86EEyRhvDe0aZ0NsP7X4zL19XEdQVyMjF9GeAhAALtP96scw9c17e0rcOE04Ry1LwdmrNDThwLu4B4z5rpPIgyZmgLwL4K3Cyy0GNwGQKws9wyKlljAhvSedj1pCLRTxuJcLEsZm6NlvpDaLTKjGBfQZcbnsi0XuxSYIcpzfQ1sbjrEjJDRIGVg1hy9UUeyi9gK3BCoz41NYnp7vIXuR2EuENi0qEdySkciLcGujJ46smVXvkaMWcSxnHlQn6PCK0DQ3XZVOanhzmv5egHeu8warAzbhOM4Law7weUCfpTaEIHuEBnprUSzW5jYWz4NlnYqgnUyD557VrNC5udIVp6RKwxJsq9HB8cblPgNslfN8GiYCm7XedPbFD4mPFUu18zXohvctz8deOT52BwaGXRfmzjVZOiWuuYn8Sk2Mric5i0v6FTEEp4459VSFAUpLQOpk9wmcSnu5Z6o7amflUonMQezgQ1SQ4caB7MgkanWOZlnzqynaaQTe8HyZe8OZFPzXY2IgzVY3a81J3jVPUaELN5mRSIK1YeV4hoJT67knC5P4amVlXIOqKGGWmk2HJWgwTmajCtM8bMnu9EwiAGAnbINKCsv5kerckAcXlgXFhh0pgXrzvpsMCRIDPRQ6wtDV0warnZd3XHousdMElnFpjvBnBN6mzV132rz5YKLAss2oCOoAt0Om4AB1iSCJiGSxFguV3jEVGN2TgLBh5Z5j0LKOplC8Jn9FaZyusm10jTYViPh7nkdfvBmJWg...	HTTP Parser: Number of links: 0
Source: https://passwordreset.microsoftonline.com/?ru=https%3a%2f%2flogin.microsoftonline.com%2fcommon%2freprocess%3fctx%3drQQIARAAhZLNa9MAAMWbdq1b0dlNET0IEzzIJG2-0xR2SJt-pFuStU0amoOlaZM0bZqkbdK0uYseB8LAgRcPojt6Ei8Kehi7uPP8DwRFPMiObnoeXh7v8d7t_ZLLRBom0lAa2owhaSh3HyMJHMNwFUSRLgFilAqBWVQjQLhHoecVQhLdzmQ9mXr8xL-3_yNTePN8bbO59fnFIbDR9zx3mstkgiBIO7pudrV01xllrI7dM21jhrwDgBMAOIjGNRuUGofRKYFmYZTCYQInYRQlYRhJt0QabslsqAw4TyizGG9CkCJagx25OuTCoseLUtgKhwuuXMQUWYK4cAgrMhcI4tDjRmzIFy72tcWO2B8JIudxTG3BDaSAZySEZ2r4afS6QPteH7kQZ2KG2q_oiu5MRm3XmXoHsf0oa2_LVLkyq3f8Rcjy42q1gpCmQMlwFxs7xZaUX_TC1rRdsn18Z9uFFFrtg9VCXfLl4XAATjhyx9iFbFKCkOliYbCo2K-apqzkLV0k59uUU1B5vcD2XAItBc1i1RBMexdCbdjrBzZfLpXzou808Www5STOmtfAkS_DeAlSF0h7e9jlVa_RbWBzmOk4vR4KVXlZ1gJK1gdsVt015tREwAl80pg3CmatrxqjsSVW8CZV4uyybMrZPO-5TYyzS2irgyjCjDXyltFG9VCv0_zApcJsvUkTSjB383gFZECD7jShRnAYu3PJvTPkbSxxbkaOfRwjHVezzd6GO3F009IuQ2KGZIS_qeKMtDRtWSdLwLelW8uJVOp2ZCPy4CYUyy0vJ1ORi3S2BLyMnxMXxlcTj-4q9OuVr59-j6nIcTzTLNgMjVMGKs_6XmgV8g8JXrJ0oYQTZTxDDOcNX-34vfmYcbbgHLyXAPYSiePEGsu0-aLYEGmeo...	HTTP Parser: Number of links: 0

HTTP Parser: <input type="password" .../> found but no <form action="...

Source: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/6g1kf/0x4AAAAAAAX1G-BH6O7iEZAj/auto/normal

HTTP Parser: Base64 decoded: http://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/6g1kf/0x4AAAAAAAX1G-BH6O7iEZAj/auto/normal

HTTP Parser: Title: Sign in to your account does not match URL

HTTP Parser: <input type="password" .../> found

Source: https://xs523936.xsrv.jp/EjYpCSPnF4RcmNH/XPS57-RTO/main/	HTTP Parser: No favicon
Source: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/6g1kf/0x4AAAAAAAX1G-BH6O7iEZAj/auto/normal	HTTP Parser: No favicon
Source: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/6g1kf/0x4AAAAAAAX1G-BH6O7iEZAj/auto/normal	HTTP Parser: No favicon

Source: https://xs523936.xsrv.jp/EjYpCSPnF4RcmNH/XPS57-RTO/main/main.php#wM8rPSFgrELdel79aiDOOEPQSUXzJvjiA4EWcM41y1DTRSoHLRBc9zQw9qBJBwpqDAyBstJy2gwA4FAqMsoncZUPe5jTd1wDpywd8uohgIgaBPYUmFz3mBfevbGEmxuAwksi755lmVKRUHOMCJxLu2sRe1B5li5EBMY0fMAslErj9zKAdbUQdtYyRLYX5HRQa86EEyRhvDe0aZ0NsP7X4zL19XEdQVyMjF9GeAhAALtP96scw9c17e0rcOE04Ry1LwdmrNDThwLu4B4z5rpPIgyZmgLwL4K3Cyy0GNwGQKws9wyKlljAhvSedj1pCLRTxuJcLEsZm6NlvpDaLTKjGBfQZcbnsi0XuxSYIcpzfQ1sbjrEjJDRIGVg1hy9UUeyi9gK3BCoz41NYnp7vIXuR2EuENi0qEdySkciLcGujJ46smVXvkaMWcSxnHlQn6PCK0DQ3XZVOanhzmv5egHeu8warAzbhOM4Law7weUCfpTaEIHuEBnprUSzW5jYWz4NlnYqgnUyD557VrNC5udIVp6RKwxJsq9HB8cblPgNslfN8GiYCm7XedPbFD4mPFUu18zXohvctz8deOT52BwaGXRfmzjVZOiWuuYn8Sk2Mric5i0v6FTEEp4459VSFAUpLQOpk9wmcSnu5Z6o7amflUonMQezgQ1SQ4caB7MgkanWOZlnzqynaaQTe8HyZe8OZFPzXY2IgzVY3a81J3jVPUaELN5mRSIK1YeV4hoJT67knC5P4amVlXIOqKGGWmk2HJWgwTmajCtM8bMnu9EwiAGAnbINKCsv5kerckAcXlgXFhh0pgXrzvpsMCRIDPRQ6wtDV0warnZd3XHousdMElnFpjvBnBN6mzV132rz5YKLAss2oCOoAt0Om4AB1iSCJiGSxFguV3jEVGN2TgLBh5Z5j0LKOplC8Jn9FaZyusm10jTYViPh7nkdfvBmJWg	HTTP Parser: No <meta name="author".. found
Source: https://xs523936.xsrv.jp/EjYpCSPnF4RcmNH/XPS57-RTO/main/main.php#wM8rPSFgrELdel79aiDOOEPQSUXzJvjiA4EWcM41y1DTRSoHLRBc9zQw9qBJBwpqDAyBstJy2gwA4FAqMsoncZUPe5jTd1wDpywd8uohgIgaBPYUmFz3mBfevbGEmxuAwksi755lmVKRUHOMCJxLu2sRe1B5li5EBMY0fMAslErj9zKAdbUQdtYyRLYX5HRQa86EEyRhvDe0aZ0NsP7X4zL19XEdQVyMjF9GeAhAALtP96scw9c17e0rcOE04Ry1LwdmrNDThwLu4B4z5rpPIgyZmgLwL4K3Cyy0GNwGQKws9wyKlljAhvSedj1pCLRTxuJcLEsZm6NlvpDaLTKjGBfQZcbnsi0XuxSYIcpzfQ1sbjrEjJDRIGVg1hy9UUeyi9gK3BCoz41NYnp7vIXuR2EuENi0qEdySkciLcGujJ46smVXvkaMWcSxnHlQn6PCK0DQ3XZVOanhzmv5egHeu8warAzbhOM4Law7weUCfpTaEIHuEBnprUSzW5jYWz4NlnYqgnUyD557VrNC5udIVp6RKwxJsq9HB8cblPgNslfN8GiYCm7XedPbFD4mPFUu18zXohvctz8deOT52BwaGXRfmzjVZOiWuuYn8Sk2Mric5i0v6FTEEp4459VSFAUpLQOpk9wmcSnu5Z6o7amflUonMQezgQ1SQ4caB7MgkanWOZlnzqynaaQTe8HyZe8OZFPzXY2IgzVY3a81J3jVPUaELN5mRSIK1YeV4hoJT67knC5P4amVlXIOqKGGWmk2HJWgwTmajCtM8bMnu9EwiAGAnbINKCsv5kerckAcXlgXFhh0pgXrzvpsMCRIDPRQ6wtDV0warnZd3XHousdMElnFpjvBnBN6mzV132rz5YKLAss2oCOoAt0Om4AB1iSCJiGSxFguV3jEVGN2TgLBh5Z5j0LKOplC8Jn9FaZyusm10jTYViPh7nkdfvBmJWg	HTTP Parser: No <meta name="author".. found
Source: https://passwordreset.microsoftonline.com/?ru=https%3a%2f%2flogin.microsoftonline.com%2fcommon%2freprocess%3fctx%3drQQIARAAhZLNa9MAAMWbdq1b0dlNET0IEzzIJG2-0xR2SJt-pFuStU0amoOlaZM0bZqkbdK0uYseB8LAgRcPojt6Ei8Kehi7uPP8DwRFPMiObnoeXh7v8d7t_ZLLRBom0lAa2owhaSh3HyMJHMNwFUSRLgFilAqBWVQjQLhHoecVQhLdzmQ9mXr8xL-3_yNTePN8bbO59fnFIbDR9zx3mstkgiBIO7pudrV01xllrI7dM21jhrwDgBMAOIjGNRuUGofRKYFmYZTCYQInYRQlYRhJt0QabslsqAw4TyizGG9CkCJagx25OuTCoseLUtgKhwuuXMQUWYK4cAgrMhcI4tDjRmzIFy72tcWO2B8JIudxTG3BDaSAZySEZ2r4afS6QPteH7kQZ2KG2q_oiu5MRm3XmXoHsf0oa2_LVLkyq3f8Rcjy42q1gpCmQMlwFxs7xZaUX_TC1rRdsn18Z9uFFFrtg9VCXfLl4XAATjhyx9iFbFKCkOliYbCo2K-apqzkLV0k59uUU1B5vcD2XAItBc1i1RBMexdCbdjrBzZfLpXzou808Www5STOmtfAkS_DeAlSF0h7e9jlVa_RbWBzmOk4vR4KVXlZ1gJK1gdsVt015tREwAl80pg3CmatrxqjsSVW8CZV4uyybMrZPO-5TYyzS2irgyjCjDXyltFG9VCv0_zApcJsvUkTSjB383gFZECD7jShRnAYu3PJvTPkbSxxbkaOfRwjHVezzd6GO3F009IuQ2KGZIS_qeKMtDRtWSdLwLelW8uJVOp2ZCPy4CYUyy0vJ1ORi3S2BLyMnxMXxlcTj-4q9OuVr59-j6nIcTzTLNgMjVMGKs_6XmgV8g8JXrJ0oYQTZTxDDOcNX-34vfmYcbbgHLyXAPYSiePEGsu0-aLYEGmeo	HTTP Parser: No <meta name="author".. found

Source: https://xs523936.xsrv.jp/EjYpCSPnF4RcmNH/XPS57-RTO/main/main.php#wM8rPSFgrELdel79aiDOOEPQSUXzJvjiA4EWcM41y1DTRSoHLRBc9zQw9qBJBwpqDAyBstJy2gwA4FAqMsoncZUPe5jTd1wDpywd8uohgIgaBPYUmFz3mBfevbGEmxuAwksi755lmVKRUHOMCJxLu2sRe1B5li5EBMY0fMAslErj9zKAdbUQdtYyRLYX5HRQa86EEyRhvDe0aZ0NsP7X4zL19XEdQVyMjF9GeAhAALtP96scw9c17e0rcOE04Ry1LwdmrNDThwLu4B4z5rpPIgyZmgLwL4K3Cyy0GNwGQKws9wyKlljAhvSedj1pCLRTxuJcLEsZm6NlvpDaLTKjGBfQZcbnsi0XuxSYIcpzfQ1sbjrEjJDRIGVg1hy9UUeyi9gK3BCoz41NYnp7vIXuR2EuENi0qEdySkciLcGujJ46smVXvkaMWcSxnHlQn6PCK0DQ3XZVOanhzmv5egHeu8warAzbhOM4Law7weUCfpTaEIHuEBnprUSzW5jYWz4NlnYqgnUyD557VrNC5udIVp6RKwxJsq9HB8cblPgNslfN8GiYCm7XedPbFD4mPFUu18zXohvctz8deOT52BwaGXRfmzjVZOiWuuYn8Sk2Mric5i0v6FTEEp4459VSFAUpLQOpk9wmcSnu5Z6o7amflUonMQezgQ1SQ4caB7MgkanWOZlnzqynaaQTe8HyZe8OZFPzXY2IgzVY3a81J3jVPUaELN5mRSIK1YeV4hoJT67knC5P4amVlXIOqKGGWmk2HJWgwTmajCtM8bMnu9EwiAGAnbINKCsv5kerckAcXlgXFhh0pgXrzvpsMCRIDPRQ6wtDV0warnZd3XHousdMElnFpjvBnBN6mzV132rz5YKLAss2oCOoAt0Om4AB1iSCJiGSxFguV3jEVGN2TgLBh5Z5j0LKOplC8Jn9FaZyusm10jTYViPh7nkdfvBmJWg...	HTTP Parser: No <meta name="copyright".. found
Source: https://xs523936.xsrv.jp/EjYpCSPnF4RcmNH/XPS57-RTO/main/main.php#wM8rPSFgrELdel79aiDOOEPQSUXzJvjiA4EWcM41y1DTRSoHLRBc9zQw9qBJBwpqDAyBstJy2gwA4FAqMsoncZUPe5jTd1wDpywd8uohgIgaBPYUmFz3mBfevbGEmxuAwksi755lmVKRUHOMCJxLu2sRe1B5li5EBMY0fMAslErj9zKAdbUQdtYyRLYX5HRQa86EEyRhvDe0aZ0NsP7X4zL19XEdQVyMjF9GeAhAALtP96scw9c17e0rcOE04Ry1LwdmrNDThwLu4B4z5rpPIgyZmgLwL4K3Cyy0GNwGQKws9wyKlljAhvSedj1pCLRTxuJcLEsZm6NlvpDaLTKjGBfQZcbnsi0XuxSYIcpzfQ1sbjrEjJDRIGVg1hy9UUeyi9gK3BCoz41NYnp7vIXuR2EuENi0qEdySkciLcGujJ46smVXvkaMWcSxnHlQn6PCK0DQ3XZVOanhzmv5egHeu8warAzbhOM4Law7weUCfpTaEIHuEBnprUSzW5jYWz4NlnYqgnUyD557VrNC5udIVp6RKwxJsq9HB8cblPgNslfN8GiYCm7XedPbFD4mPFUu18zXohvctz8deOT52BwaGXRfmzjVZOiWuuYn8Sk2Mric5i0v6FTEEp4459VSFAUpLQOpk9wmcSnu5Z6o7amflUonMQezgQ1SQ4caB7MgkanWOZlnzqynaaQTe8HyZe8OZFPzXY2IgzVY3a81J3jVPUaELN5mRSIK1YeV4hoJT67knC5P4amVlXIOqKGGWmk2HJWgwTmajCtM8bMnu9EwiAGAnbINKCsv5kerckAcXlgXFhh0pgXrzvpsMCRIDPRQ6wtDV0warnZd3XHousdMElnFpjvBnBN6mzV132rz5YKLAss2oCOoAt0Om4AB1iSCJiGSxFguV3jEVGN2TgLBh5Z5j0LKOplC8Jn9FaZyusm10jTYViPh7nkdfvBmJWg...	HTTP Parser: No <meta name="copyright".. found
Source: https://passwordreset.microsoftonline.com/?ru=https%3a%2f%2flogin.microsoftonline.com%2fcommon%2freprocess%3fctx%3drQQIARAAhZLNa9MAAMWbdq1b0dlNET0IEzzIJG2-0xR2SJt-pFuStU0amoOlaZM0bZqkbdK0uYseB8LAgRcPojt6Ei8Kehi7uPP8DwRFPMiObnoeXh7v8d7t_ZLLRBom0lAa2owhaSh3HyMJHMNwFUSRLgFilAqBWVQjQLhHoecVQhLdzmQ9mXr8xL-3_yNTePN8bbO59fnFIbDR9zx3mstkgiBIO7pudrV01xllrI7dM21jhrwDgBMAOIjGNRuUGofRKYFmYZTCYQInYRQlYRhJt0QabslsqAw4TyizGG9CkCJagx25OuTCoseLUtgKhwuuXMQUWYK4cAgrMhcI4tDjRmzIFy72tcWO2B8JIudxTG3BDaSAZySEZ2r4afS6QPteH7kQZ2KG2q_oiu5MRm3XmXoHsf0oa2_LVLkyq3f8Rcjy42q1gpCmQMlwFxs7xZaUX_TC1rRdsn18Z9uFFFrtg9VCXfLl4XAATjhyx9iFbFKCkOliYbCo2K-apqzkLV0k59uUU1B5vcD2XAItBc1i1RBMexdCbdjrBzZfLpXzou808Www5STOmtfAkS_DeAlSF0h7e9jlVa_RbWBzmOk4vR4KVXlZ1gJK1gdsVt015tREwAl80pg3CmatrxqjsSVW8CZV4uyybMrZPO-5TYyzS2irgyjCjDXyltFG9VCv0_zApcJsvUkTSjB383gFZECD7jShRnAYu3PJvTPkbSxxbkaOfRwjHVezzd6GO3F009IuQ2KGZIS_qeKMtDRtWSdLwLelW8uJVOp2ZCPy4CYUyy0vJ1ORi3S2BLyMnxMXxlcTj-4q9OuVr59-j6nIcTzTLNgMjVMGKs_6XmgV8g8JXrJ0oYQTZTxDDOcNX-34vfmYcbbgHLyXAPYSiePEGsu0-aLYEGmeo...	HTTP Parser: No <meta name="copyright".. found

Source: unknown	HTTPS traffic detected: 23.46.214.6:443 -> 192.168.2.16:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.46.214.6:443 -> 192.168.2.16:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.16:49753 version: TLS 1.2

Source: chrome.exe

Memory has grown: Private usage: 1MB later: 29MB

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 23.46.214.6
Source: unknown	TCP traffic detected without corresponding DNS query: 23.46.214.6
Source: unknown	TCP traffic detected without corresponding DNS query: 23.46.214.6
Source: unknown	TCP traffic detected without corresponding DNS query: 23.46.214.6
Source: unknown	TCP traffic detected without corresponding DNS query: 23.46.214.6
Source: unknown	TCP traffic detected without corresponding DNS query: 23.46.214.6
Source: unknown	TCP traffic detected without corresponding DNS query: 23.46.214.6
Source: unknown	TCP traffic detected without corresponding DNS query: 23.46.214.6
Source: unknown	TCP traffic detected without corresponding DNS query: 23.46.214.6
Source: unknown	TCP traffic detected without corresponding DNS query: 23.46.214.6
Source: unknown	TCP traffic detected without corresponding DNS query: 23.46.214.6
Source: unknown	TCP traffic detected without corresponding DNS query: 23.46.214.6
Source: unknown	TCP traffic detected without corresponding DNS query: 23.46.214.6
Source: unknown	TCP traffic detected without corresponding DNS query: 23.46.214.6
Source: unknown	TCP traffic detected without corresponding DNS query: 23.46.214.6
Source: unknown	TCP traffic detected without corresponding DNS query: 23.46.214.6
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 23.46.214.6
Source: unknown	TCP traffic detected without corresponding DNS query: 23.46.214.6
Source: unknown	TCP traffic detected without corresponding DNS query: 23.46.214.6
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: unknown

DNS traffic detected: queries for: www.ne16.com

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49688 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 23.46.214.6:443 -> 192.168.2.16:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.46.214.6:443 -> 192.168.2.16:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.16:49753 version: TLS 1.2

Source: classification engine

Classification label: mal68.phis.win@18/41@38/209

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www.ne16.com/t/4177044/70602841/2927387/1/124665/?f8785874=aHR0cHM6Ly93b29kLWRlY2sub3JnL3BkZi85SWRac1p5aTJEeWh3ZUcvYTFmM2IxODIyN2RiNTc4NjIzOGE2ZTc0NTE3YWQ4MDEvWEM4YXAvYTFmM2IxODIyN2RiNTc4NjIzOGE2ZTc0NTE3YWQ4MDEvWTJOc1lYSmxRR0psYkd4d1lYSjBibVZ5YzJsdVl5NWpiMjA9
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 --field-trial-handle=1996,i,4342779536777233872,16681339852322972338,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 --field-trial-handle=1996,i,4342779536777233872,16681339852322972338,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Extra Window Memory Injection	1 Extra Window Memory Injection	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact

Source	Detection	Scanner	Label	Link
https://www.ne16.com/t/4177044/70602841/2927387/1/124665/?f8785874=aHR0cHM6Ly93b29kLWRlY2sub3JnL3BkZi85SWRac1p5aTJEeWh3ZUcvYTFmM2IxODIyN2RiNTc4NjIzOGE2ZTc0NTE3YWQ4MDEvWEM4YXAvYTFmM2IxODIyN2RiNTc4NjIzOGE2ZTc0NTE3YWQ4MDEvWTJOc1lYSmxRR0psYkd4d1lYSjBibVZ5YzJsdVl5NWpiMjA9	0%	Avira URL Cloud	safe

Name	IP	Active	Malicious	Reputation
part-0013.t-0009.t-msedge.net	13.107.246.41	true	false	unknown
cs1100.wpc.omegacdn.net	152.199.4.44	true	false	unknown
cdnjs.cloudflare.com	104.17.25.14	true	false	high
xs523936.xsrv.jp	103.141.97.7	true	false	high
challenges.cloudflare.com	104.17.2.184	true	false	high
www.wood-deck.org	183.90.245.33	true	false	unknown
www.google.com	64.233.185.105	true	false	high
wood-deck.org	183.90.245.33	true	false	unknown
ne16.com	54.215.244.243	true	false	high
LYH-efz.ms-acdc.office.com	40.97.230.178	true	false	high
bc1qrzt5dxvhyyl76esq6lj86ty2.com	185.216.70.3	true	false	unknown
outlook.office.com	unknown	unknown	false	high
aadcdn.msftauth.net	unknown	unknown	false	unknown
ajax.aspnetcdn.com	unknown	unknown	false	high
aadcdn.msftauthimages.net	unknown	unknown	false	unknown
passwordreset.microsoftonline.com	unknown	unknown	false	high
www.ne16.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
https://wood-deck.org/pdf/9IdZsZyi2DyhweG/a1f3b18227db5786238a6e74517ad801/XC8ap/a1f3b18227db5786238a6e74517ad801/Y2NsYXJlQGJlbGxwYXJ0bmVyc2luYy5jb20=?dlv-emuid=[members_.memberidguid_]&dlv-mlid=4177044	false	unknown
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/6g1kf/0x4AAAAAAAX1G-BH6O7iEZAj/auto/normal	false	high
https://passwordreset.microsoftonline.com/?ru=https%3a%2f%2flogin.microsoftonline.com%2fcommon%2freprocess%3fctx%3drQQIARAAhZLNa9MAAMWbdq1b0dlNET0IEzzIJG2-0xR2SJt-pFuStU0amoOlaZM0bZqkbdK0uYseB8LAgRcPojt6Ei8Kehi7uPP8DwRFPMiObnoeXh7v8d7t_ZLLRBom0lAa2owhaSh3HyMJHMNwFUSRLgFilAqBWVQjQLhHoecVQhLdzmQ9mXr8xL-3_yNTePN8bbO59fnFIbDR9zx3mstkgiBIO7pudrV01xllrI7dM21jhrwDgBMAOIjGNRuUGofRKYFmYZTCYQInYRQlYRhJt0QabslsqAw4TyizGG9CkCJagx25OuTCoseLUtgKhwuuXMQUWYK4cAgrMhcI4tDjRmzIFy72tcWO2B8JIudxTG3BDaSAZySEZ2r4afS6QPteH7kQZ2KG2q_oiu5MRm3XmXoHsf0oa2_LVLkyq3f8Rcjy42q1gpCmQMlwFxs7xZaUX_TC1rRdsn18Z9uFFFrtg9VCXfLl4XAATjhyx9iFbFKCkOliYbCo2K-apqzkLV0k59uUU1B5vcD2XAItBc1i1RBMexdCbdjrBzZfLpXzou808Www5STOmtfAkS_DeAlSF0h7e9jlVa_RbWBzmOk4vR4KVXlZ1gJK1gdsVt015tREwAl80pg3CmatrxqjsSVW8CZV4uyybMrZPO-5TYyzS2irgyjCjDXyltFG9VCv0_zApcJsvUkTSjB383gFZECD7jShRnAYu3PJvTPkbSxxbkaOfRwjHVezzd6GO3F009IuQ2KGZIS_qeKMtDRtWSdLwLelW8uJVOp2ZCPy4CYUyy0vJ1ORi3S2BLyMnxMXxlcTj-4q9OuVr59-j6nIcTzTLNgMjVMGKs_6XmgV8g8JXrJ0oYQTZTxDDOcNX-34vfmYcbbgHLyXAPYSiePEGsu0-aLYEGmeoesM0oZ-JoCnVyLvV_7L8OnVG8mkb7Ytp9uxtOn6P5Y_XoucrR59-fDs1d7R98of0&mkt=en-US&hosted=0&device_platform=Windows+10	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
13.107.246.41	part-0013.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
74.125.136.84	unknown	United States	15169	GOOGLEUS	false
152.199.4.33	unknown	United States	15133	EDGECASTUS	false
103.141.97.7	xs523936.xsrv.jp	Japan	2519	VECTANTARTERIANetworksCorporationJP	false
185.216.70.3	bc1qrzt5dxvhyyl76esq6lj86ty2.com	Germany	43659	CLOUDCOMPUTINGDE	false
104.17.3.184	unknown	United States	13335	CLOUDFLARENETUS	false
40.97.230.178	LYH-efz.ms-acdc.office.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
13.107.213.41	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.250.9.94	unknown	United States	15169	GOOGLEUS	false
74.125.138.94	unknown	United States	15169	GOOGLEUS	false
1.1.1.1	unknown	Australia	13335	CLOUDFLARENETUS	false
74.125.136.95	unknown	United States	15169	GOOGLEUS	false
142.250.105.95	unknown	United States	15169	GOOGLEUS	false
152.199.4.44	cs1100.wpc.omegacdn.net	United States	15133	EDGECASTUS	false
142.250.105.101	unknown	United States	15169	GOOGLEUS	false
40.126.29.21	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
52.96.165.146	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
20.190.157.16	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
40.126.29.23	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.250.9.100	unknown	United States	15169	GOOGLEUS	false
54.215.244.243	ne16.com	United States	16509	AMAZON-02US	false
104.17.2.184	challenges.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
64.233.185.105	www.google.com	United States	15169	GOOGLEUS	false
183.90.245.33	www.wood-deck.org	Japan	9371	SAKURA-CSAKURAInternetIncJP	false
104.17.25.14	cdnjs.cloudflare.com	United States	13335	CLOUDFLARENETUS	false

Private

IP
192.168.2.16

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1430327
Start date and time:	2024-04-23 14:31:43 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Sample URL:	https://www.ne16.com/t/4177044/70602841/2927387/1/124665/?f8785874=aHR0cHM6Ly93b29kLWRlY2sub3JnL3BkZi85SWRac1p5aTJEeWh3ZUcvYTFmM2IxODIyN2RiNTc4NjIzOGE2ZTc0NTE3YWQ4MDEvWEM4YXAvYTFmM2IxODIyN2RiNTc4NjIzOGE2ZTc0NTE3YWQ4MDEvWTJOc1lYSmxRR0psYkd4d1lYSjBibVZ5YzJsdVl5NWpiMjA9
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	14
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled
Analysis Mode:	stream
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal68.phis.win@18/41@38/209

Warnings

Exclude process from analysis (whitelisted): SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 74.125.138.94, 142.250.105.101, 142.250.105.102, 142.250.105.138, 142.250.105.100, 142.250.105.139, 142.250.105.113, 74.125.136.84, 34.104.35.123, 13.85.23.86
Excluded domains from analysis (whitelisted): fs.microsoft.com, clients2.google.com, accounts.google.com, edgedl.me.gvt1.com, slscr.update.microsoft.com, sls.update.microsoft.com, clientservices.googleapis.com, clients.l.google.com, glb.sls.prod.dcat.dsp.trafficmanager.net
Not all processes where analyzed, report is missing behavior information
VT rate limit hit for: https://www.ne16.com/t/4177044/70602841/2927387/1/124665/?f8785874=aHR0cHM6Ly93b29kLWRlY2sub3JnL3BkZi85SWRac1p5aTJEeWh3ZUcvYTFmM2IxODIyN2RiNTc4NjIzOGE2ZTc0NTE3YWQ4MDEvWEM4YXAvYTFmM2IxODIyN2RiNTc4NjIzOGE2ZTc0NTE3YWQ4MDEvWTJOc1lYSmxRR0psYkd4d1lYSjBibVZ5YzJsdVl5NWpiMjA9

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Apr 23 11:32:24 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2673
Entropy (8bit):	3.9844222323565974
Encrypted:	false
SSDEEP:
MD5:	6A58AF108BE1261196F4F66304796BBD
SHA1:	5E2842F9EBDB2078D8EE824C4D174C12A4FB68C2
SHA-256:	3AFD19C0DA3D48017E70BB3B7C7A1699021FDA1DD4013BD3BA9F2DFD0D2E494F
SHA-512:	90AD9DF37899B662DDD6FA7B1C66C61721570D991226B383D3AE7723E00678C33F53D251FC7554FBB243507D93631268674DB6F10C4736C6B2C7335F2FBD4AC7
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,......dKz...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.X.c....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X.d....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X.d....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X.d..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X.d...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........obu......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Apr 23 11:32:24 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2675
Entropy (8bit):	4.000275276719543
Encrypted:	false
SSDEEP:
MD5:	CB153BC2F49BDC51E02706A9193652C0
SHA1:	4CD1C22CA6FA283D715D5B37DD9977C7A2A59182
SHA-256:	803B6A6158E43A86B2F3FE87FFCDDBCD80559C7C0C201D37995A0DE51DB13F99
SHA-512:	AF239008BCC221C3325306148A0CC674BEDA6DC1CB067F55D7882A574F72226F328FD08A26E5D6D1D8B9EC89E6894C78CCB56529FBFD6CE1D8ACBC7750C20E57
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,......WKz...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.X.c....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X.d....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X.d....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X.d..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X.d...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........obu......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2689
Entropy (8bit):	4.0066815289410505
Encrypted:	false
SSDEEP:
MD5:	127B94F118EA00DA6B0F99EF9C7C67E2
SHA1:	27779571C244F5AB513A634B325114347114A682
SHA-256:	D69E0192A12B6EBDE84812427015BD40E2510A4E1B71E674E6A17C3FC755EC63
SHA-512:	527FEB564A5A09991F9E957E5A8F878C195296AFDB163A37650893B536C2C9008A4A3FB15483F201A725373A94378F595A9C205D521B0C74B9735DDF9408C054
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.....Y.04...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.X.c....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X.d....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X.d....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X.d..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VFW.E...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........obu......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Apr 23 11:32:24 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	4.001125240524627
Encrypted:	false
SSDEEP:
MD5:	A06DC7999193D9C4BF995031BA38D7B2
SHA1:	00A96DBE5A01EBC93C94F9A380F5060536838820
SHA-256:	17B18DEAD48D7F96EB05462C678FA9A64389B7980FBC6B0C30F9B7BC366C223D
SHA-512:	7794B62DBD5C077B8D825A1011F05F87C35CA8B32ED42BE9C8D50DA7658C23A3E8B42E8CCFEE74ACBD8FC1E06CD86006A4EA7040649FF32D6576FE2F98CFDB35
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,......PKz...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.X.c....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X.d....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X.d....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X.d..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X.d...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........obu......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Apr 23 11:32:24 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.989905427336772
Encrypted:	false
SSDEEP:
MD5:	358C65F3CF80A46E044E4C8641EF2BE2
SHA1:	B76170F4EB433136074446A3FF87CC11F80CD458
SHA-256:	CE435010E487AA5B62B9B8C832214A16E3DA297C84B15AB6DEC89ACCC8AC7444
SHA-512:	1BCD078333D69C5535A4EE2E045233B2F15B342FD50E691A99A495D952E0E67668C08B76CE7C6E9969EB782063526EC94A15860300A1E856744CAF97A5834D91
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,......^Kz...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.X.c....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X.d....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X.d....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X.d..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X.d...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........obu......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Apr 23 11:32:24 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.996921524186026
Encrypted:	false
SSDEEP:
MD5:	753A1E4509346F1A52F9FDC0A378042A
SHA1:	6BF6336735C8FB313262AA3C28424536898192B9
SHA-256:	2EE1BE1B31259C994C551C9168679926B172EAC5136C4A091828B41DFF3D851B
SHA-512:	9841337132F6A5732976BAB24E84064E9D6F20736B5250FF52AEC7A503A9DC4809D434413AFC108CB6D35E945552CA48FE5B4C605F5998B93F816BCDE0E34A31
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.....&FKz...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.X.c....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X.d....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X.d....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X.d..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X.d...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........obu......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Chrome Cache Entry: 100

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 247 x 60, 8-bit/color RGBA, interlaced
Category:	downloaded
Size (bytes):	6688
Entropy (8bit):	7.954231157447757
Encrypted:	false
SSDEEP:
MD5:	A4025535F61947AC1CC576D4FBFFB97A
SHA1:	CDAD6CE389BB7E06705C398D4A48C805F1DA1E2B
SHA-256:	2674A237B7DAFE8F3F637D9ABED32E7D22AC2F9A4FFD58315147AB676ABB0A89
SHA-512:	1215D1EE392CA10A070B1358E5F8A8CFB6C9613F6AC828A2419D85B7FE0375B0D18025671D864016666CEADE146C21020120858B9DA5150DEDACEA8E560261C1
Malicious:	false
Reputation:	unknown
URL:	https://aadcdn.msftauthimages.net/dbd5a2dd-1auvjophypvrmkqw2wfkazajglu7bxgemgsyiwdo-qs/logintenantbranding/0/bannerlogo?ts=637871785723670839
Preview:	.PNG........IHDR.......<............sRGB.........gAMA......a.....pHYs...........~.....IDATx^...\E.....,@.......EqD....a..].atD....$...8..... .+....2.0..&!AP@.$y..\|_u............}k;Uu.T....J.;.R.F....Z4sX....3E..9.."..Q"<\|...n.\...,;=.}P.uN..hX+.#....A.B..e.....1.yl......w.......1.:.)..[.. ...-p....M.k.>.g%.$..p...f.L>.p..^.....}E..........'........./.:......k/..I..s.zq.W.:...._... .f..\|.....].....v.7R..j...8..`..<.Z.......!+.....b.`A..........N..S4.@.@4.{.....hm........o_]........v>...[..B..I`y..D....[....[..-........o....wFk[..m..-.?{.......U..R9......+.&M.G}8T.....h.H.b..<"p...@.F..!.`.>..5'T..yi....G0(lG.2..i.4...I......d..a.g^...^.....<gk.=...R.k.Y..D......#.....\|.t.t7.....^...\|....Q...w.a....W.g.......L..hM..0l..A..vn..W.........wP.;D......5...X...?.ep.hM1..x:.m5{.pf>S...z.h-..bX....I@.WFk.....}4zw.q_........5E............:Z.p;AL.;...@..x.^...`.....t.....X.O........1..1}:.`.1....J....n.P..a..4.....8.C."......ya....K.....p..q..c

Chrome Cache Entry: 102

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with CRLF line terminators
Category:	downloaded
Size (bytes):	12429
Entropy (8bit):	4.880328887313854
Encrypted:	false
SSDEEP:
MD5:	A17520454D4A65A399B863B5CC46D3FC
SHA1:	0A02C72D7AFCD5198C590108E7F2302A1F75544D
SHA-256:	62E5E7DC19D018BEDB24E2C89ED41271B9D94A6DDE3359CC9CABBC315385C0E5
SHA-512:	0757698DC40D0AC165F159270375514A543448FB2A3E7B3B70EB500180EA00FDA3A4FC7F77C48EA013C3BAC082C092BB852CF86F7D4C0094596DE6917DCA1449
Malicious:	false
Reputation:	unknown
URL:	https://passwordreset.microsoftonline.com/css/Style.css?v=1342177280
Preview:	* {.. line-break: strict..}....body,..input,..select,..textarea,..button,..legend {.. font-weight: normal;.. font-family: "Segoe UI-Regular-final", "Segoe UI", Segoe, Tahoma, Helvetica, Arial, Sans-Serif;.. font-size: 12px;.. line-height: 19px;.. letter-spacing: .01em;.. color: #666666..}....span.requiredstar {.. font-weight: normal;.. font-family: "Segoe UI-Regular-final", "Segoe UI", Segoe, Tahoma, Helvetica, Arial, Sans-Serif;.. font-size: 12px;.. color: #a80f22..}....h1,..h2,..h3,..h4,..h5,..h6 {.. font-weight: normal;.. font-family: "SegoeUI-Light-final", "Segoe UI Light", "Segoe UI", Segoe, Tahoma, Helvetica, Arial, Sans-Serif;.. color: #333333;.. margin: 0 0 0 0;.. cursor: default..}....h1 {.. font-size: 32px;.. line-height: normal;.. letter-spacing: -.01em;.. padding-left: 0px;.. padding-right: 0px..}....h2 {.. font-size: 22px;.. line-height: normal;.. letter-spacing: -.01em..}....h3 {.. font-size: 13px;

Chrome Cache Entry: 103

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (33188), with no line terminators
Category:	downloaded
Size (bytes):	33188
Entropy (8bit):	5.1450255437534755
Encrypted:	false
SSDEEP:
MD5:	9AFFFE529685D2F4A4D54678239EE661
SHA1:	5FFA91354D50FFD6E0C485BA81C60DAD5F95466D
SHA-256:	1F99C053B6BF55B2159447D5525F84BAEB2E3174CEBBE89D3CEC629DE555D9C2
SHA-512:	6E7A023B179FD6F5790B3A5E25C3915C89EB9DA60DE1F4867DEA8A707D753412E3029865D95BC7CD39BECBBECD5BE635DB392D3E19C5F7BAF8B9D6D204F037B0
Malicious:	false
Reputation:	unknown
URL:	https://xs523936.xsrv.jp/EjYpCSPnF4RcmNH/XPS57-RTO/main/src.js
Preview:	document.write("<html lang=\"en-US\" class=\"lang-en-us\"><head><title>Just a moment...<\/title><meta http-equiv=\"Content-Type\" content=\"text\/html; charset=UTF-8\"><meta http-equiv=\"X-UA-Compatible\" content=\"IE=Edge\"><meta name=\"robots\" content=\"noindex,nofollow\">\r\n<script src=\"https:\/\/challenges.cloudflare.com\/turnstile\/v0\/api.js?onload=onloadTurnstileCallback\" defer><\/script>\r\n<meta name=\"viewport\" content=\"width=device-width,initial-scale=1\"><style>*{box-sizing:border-box;margin:0;padding:0}html{line-height:1.15;-webkit-text-size-adjust:100%;color:#313131}button,html{font-family:system-ui,-apple-system,BlinkMacSystemFont,Segoe UI,Roboto,Helvetica Neue,Arial,Noto Sans,sans-serif,Apple Color Emoji,Segoe UI Emoji,Segoe UI Symbol,Noto Color Emoji}@media (prefers-color-scheme:dark){body{background-color:#FFF;color:#d9d9d9}body a{color:#fff}body a:hover{color:#ee730a;text-decoration:underline}body .lds-ring div{border-color:#999 transparent transparent}body .fo

Chrome Cache Entry: 104

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=4, xresolution=62, yresolution=70, resolutionunit=2, software=paint.net 4.3.10], baseline, precision 8, 1920x1080, components 3
Category:	downloaded
Size (bytes):	297537
Entropy (8bit):	7.879269348751945
Encrypted:	false
SSDEEP:
MD5:	2FFAD3036EDC43526C1B6979D0891DB0
SHA1:	115643C718DB7F8DC2429CB7353A3F8AAF9B725D
SHA-256:	7F1777B65908BB564EA89A8B33CC087E9CBBE567D5695B8B6100B7A5970581A3
SHA-512:	2F000E62BB6E8D60A141DF2390BAA9F85ACD841BCE7DCD2ABA268ABF326E86CEA6168BCC7D4F1DEEB1B3C64E4EF7BE3644B0DBC2B0AD57F9049C2B8E8E0268F1
Malicious:	false
Reputation:	unknown
URL:	https://aadcdn.msftauthimages.net/dbd5a2dd-1auvjophypvrmkqw2wfkazajglu7bxgemgsyiwdo-qs/logintenantbranding/0/illustration?ts=637868564189809565
Preview:	......JFIF.....H.H.....hExif..MM.*.................>...........F.(...........1.........N.......I.......I....paint.net 4.3.10.....XICC_PROFILE......HLino....mntrRGB XYZ .........1..acspMSFT....IEC sRGB.......................-HP ................................................cprt...P...3desc.......lwtpt........bkpt........rXYZ........gXYZ...,....bXYZ...@....dmnd...T...pdmdd........vued...L....view.......$lumi........meas.......$tech...0....rTRC...<....gTRC...<....bTRC...<....text....Copyright (c) 1998 Hewlett-Packard Company..desc........sRGB IEC61966-2.1............sRGB IEC61966-2.1..................................................XYZ .......Q........XYZ ................XYZ ......o...8.....XYZ ......b.........XYZ ......$.........desc........IEC http://www.iec.ch............IEC http://www.iec.ch..............................................desc........IEC 61966-2.1 Default RGB colour space - sRGB............IEC 61966-2.1 Default RGB colour space - sRGB......................desc.......,

Chrome Cache Entry: 106

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 513
Category:	dropped
Size (bytes):	276
Entropy (8bit):	7.316609873335077
Encrypted:	false
SSDEEP:
MD5:	4E3510919D29D18EEB6E3E8B2687D2F5
SHA1:	31522A9EC576A462C3F1FFA65C010D4EB77E9A85
SHA-256:	1707BE1284617ACC0A66A14448207214D55C3DA4AAF25854E137E138E089257E
SHA-512:	DFAD29E3CF9E51D1749961B47382A5151B1F3C98DEABF2B63742EB6B7F7743EE9B605D646A730CF3E087D4F07E43107C8A01FF5F68020C7BF933EBA370175682
Malicious:	false
Reputation:	unknown
Preview:	...........Q=o. ..+.......=t....E.k["...../g;n.,....{.......2....e.......J).8..).5.....>,.ih...^s...&M.Ta..m........C.N5.G.!.-...}.9.~........u.3..@i..qK.U.......E.........S.......A.....6...G..g...,f3g.5F..I...G@<..L.:`.N&.?R....d..(.7._....z.L.......s....

Chrome Cache Entry: 107

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 338 x 72, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	4020
Entropy (8bit):	7.929907559552797
Encrypted:	false
SSDEEP:
MD5:	36AFB641BECFAD75FED5F4E6E8C39268
SHA1:	2495652F017B7A06D796AFE9C4A06ECD54F9CCFE
SHA-256:	5C2192A3932CB78B431A1AC0F3F3D73414A31C63D5CB279F2687E58C72694200
SHA-512:	08C27020CF80A181B941EE144090FFBDD12ED34BA8CBEC037ACECE63F850FF8A69BE6DDB0EC24F7141C46F27779ED59AF84A55FB367C1B6F8893B444F44C5AF5
Malicious:	false
Reputation:	unknown
URL:	https://passwordreset.microsoftonline.com/images/footer_logo_grey_bg.png
Preview:	.PNG........IHDR...R...H.......}.....pHYs..!8..!8.E.1`....sRGB.........gAMA......a....IIDATx...r....[ZZ..V.'0......].......z....M..U.%........C.....}...s...mIV.O5...... ...U.Hq@b......Y..../)..hy.._S......KzK...O\5EQ...(....B.(......(J ...(.......B.(......(J ...(.......B.(..H..EQ.C...V...7.//...~...?.....h4:.@TH.E....}........k.v....L./.@TH...pGN.;.....'.(s...k.......4GTH...'O.~...g[..o.."....l..>.G...;..~...&.....d..u.^F.........M.h.....>.}>..........[......E.b..?.u..{.B........M._.iAh.>~.<S...=.@`e..e....R....._ViA.E....R.@...@..vm.'Ei.v..\>QD..e..R......;o.p{......./^d..TH;.,F>..6...1?..E.p.}..J.p...XD.........7.^b..../.w...........n0.+R.V).J.a..^.X.S..B(..W+++..W. ..e%"Z.[.{,....JQ.iG`....(5..e..`u.*.=.)J...........C.!.@..;$.i.F...W.[....#............k.(J.z....`.dB..)..-H...R.H..O.#V..%......W.4>.'..aJ9.2Q..+.R..id`.x..1.. .../.(J%..>2d.QJ..7.\|.S`..10>..}.M#.....4......<f}..OWO..m.;C[;u.\|P!......L...S.Egr.....3.k.......i.........O...

Chrome Cache Entry: 108

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 58 x 49, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	61
Entropy (8bit):	4.035372245524404
Encrypted:	false
SSDEEP:
MD5:	EA736FCE395B9495675BDC79B0ADFC2D
SHA1:	BB32AC09EFCCA908C8E9D8C510EECAF2BAB12D80
SHA-256:	1DBA4BAA649D673CB82B65230979E908D7A253D64DCF83817A046544FFFC0285
SHA-512:	46FA5641C34F0FA0105E25E0EC03FE050E04BEAF2A46E19BB0A87520A6E8432FDF8963DDC4D3886373BAD78C5F608AF82D8246E538CB2CD142D44F004CF556A9
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...:...1.......-.....IDAT.....$.....IEND.B`.

Chrome Cache Entry: 109

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 17 x 25, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	471
Entropy (8bit):	7.197252382638843
Encrypted:	false
SSDEEP:
MD5:	C651D60A08FF0F579E2EB9BE6043A3C6
SHA1:	E7BCBB896EEA20A4DC68EDD2EF5B336E92690A55
SHA-256:	7B4B6ADAA1DDA648143A18A52B51DFAAB54775BDB6284DFF5C869235CD385230
SHA-512:	017C29423F096A45AD5D1002B2F14E27A8298F144A962B78F46A96626A1027D5E4EC57468CD8F8C5B9E97461FA651452A1786CD9F5F76264652D03F55D516138
Malicious:	false
Reputation:	unknown
URL:	https://passwordreset.microsoftonline.com/images/hip_reload.png
Preview:	.PNG........IHDR..............>.....sRGB.........gAMA......a.....pHYs..........+......tEXtSoftware.Adobe ImageReadyq.e<...GIDAT8O...@...;Wa.`.X....b....... A.F....K...a..t*{3.e...K.....C..0.....)~;.eYvP....L}.KAEQP.4..WYd....mV]..m....$M...`...C.$R.......`..dM.T....,RU..TU..`.'0.!...D[`p..W)D8,dv]Wt....\^v.$.s..`.i...!...D..e$......$.8../..8....;..\6,...f\|....n.....e..M...g.O.9....q..&........0.w...k...z....\.iZ..c.;.F...Uq7.'Y....X ....IEND.B`.

Chrome Cache Entry: 110

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with CRLF line terminators
Category:	downloaded
Size (bytes):	3005
Entropy (8bit):	4.3348196756520005
Encrypted:	false
SSDEEP:
MD5:	A870B45AC5D6B0D4E18C4829C7B660B4
SHA1:	2D3CA0E1F19EFDEB9B2DD3DCFFB17F8ABA118AA0
SHA-256:	144524233F795D6A425B76F7AE5C0BB622B5F67E2E6AE73532AD526528CA07CF
SHA-512:	295A21307D452F4BF51C62770C6A6B43CDB8B5A6BFA3617E068C8550285252B88F8BBF93A81C39E4BD7F73645EE094EDE0E2733DAFA5094E3EBAE20033363270
Malicious:	false
Reputation:	unknown
URL:	https://passwordreset.microsoftonline.com/WebResource.axd?d=yfXejayQP4znoQO4Q-WuWPSNpyoJDwiwsvGNyHLDkV-PCUGEhfUGU0GUo6RpydbAZm4pVM6jMkiJTAk2fJp7MSpXra16O_3dfe89Y44574UNGtregrtcpIFs09dlI78n-7VGOm1MYkgpXZ10U0Gm3Q2&t=638478749639812753
Preview:	function WebForm_FindFirstFocusableChild(control) {.. if (!control \|\| !(control.tagName)) {.. return null;.. }.. var tagName = control.tagName.toLowerCase();.. if (tagName == "undefined") {.. return null;.. }.. var children = control.childNodes;.. if (children) {.. for (var i = 0; i < children.length; i++) {.. try {.. if (WebForm_CanFocus(children[i])) {.. return children[i];.. }.. else {.. var focused = WebForm_FindFirstFocusableChild(children[i]);.. if (WebForm_CanFocus(focused)) {.. return focused;.. }.. }.. } catch (e) {.. }.. }.. }.. return null;..}..function WebForm_AutoFocus(focusId) {.. var targetControl;.. if (__nonMSDOMBrowser) {.. targetControl = document.getElementById(focusId);.. }.. else {.. targetContro

Chrome Cache Entry: 111

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	31
Entropy (8bit):	3.86469832616696
Encrypted:	false
SSDEEP:
MD5:	2D7D30EA1C6F925302D2C3ABED382951
SHA1:	5BA6BBC5670C4AF1125CF9AC0AA1CA2811E744D1
SHA-256:	83C09BA9A8DAEDB136F90B17A294CAA90AD471A016E430DF6E229ACB5A81E100
SHA-512:	BCC7AAA8A6A27ADCBD1B3E0FCA73FC1BD727FECEAB34734E99863503D1D50936A8830C0A12D75D187614F318F46B1E67F046E89F5EB6CE727D8433A722E2C525
Malicious:	false
Reputation:	unknown
Preview:	{"detail":"Method Not Allowed"}

Chrome Cache Entry: 112

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 16 x 25, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	405
Entropy (8bit):	6.927238031773719
Encrypted:	false
SSDEEP:
MD5:	D4FFE61373F6AA32EEB8CA7CD41AB980
SHA1:	4925FAC4BC73EFB7C7BBC32B11C435ECF1D61674
SHA-256:	D5C54FFC6B8BD44D932BE8F37B1CD5B666205C7574F9D56EF68E56F83E08FFAD
SHA-512:	0F7EDE96F20BB3C053C246FFE1EF8CE739CEF7757FAAED031A365299B88664A046557C2C7FDB3BADED070BA4EBA1A14950D7E3A066B4976BF07142CEFA48BEEB
Malicious:	false
Reputation:	unknown
URL:	https://passwordreset.microsoftonline.com/images/hip_speaker.png
Preview:	.PNG........IHDR.............8.......sRGB.........gAMA......a.....pHYs..........+......tEXtSoftware.Adobe ImageReadyq.e<....IDAT8O...0...nf..y.,X4.g.I.h4..H.`.b.bA..f.n....%.=.iS.?N....^....A.(...~.i..m[.Qyz..iB..(...8...<G.........y..$.8....EQ.u]..I..(R.l...a...=..?t...CUU.......-..7.!..@.u0\..y.@..[a...p@.J.......e..>.Y..i..>A...+.,[. X9..z....B.4..+)..`n/..Q..>...y....e<....IEND.B`.

Chrome Cache Entry: 113

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 4 icons, 64x64, 32 bits/pixel, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	24038
Entropy (8bit):	5.992474931914016
Encrypted:	false
SSDEEP:
MD5:	877784A5F5808CEFA2B61E73BFCF8EAE
SHA1:	6A0E7EDA2734D7BBBA3CE38D37B347DF001B1DBF
SHA-256:	BE7F0632337BC381D4962125545A5CC3C1E84E2D03DBDB97AB3D79AD78B91B6D
SHA-512:	DABFFC928F7ED2A2D05003DAEF643806BD1CEC6B98E705F7415A82AFE7034F4E1E8A70C5AE69B094A948EEDAB4E8B76DCF72DF881DA092FE4AB76DA0EEFB8C3C
Malicious:	false
Reputation:	unknown
Preview:	......@@.... .(@..F... .... .(...n@........ .(....P........ .(....Y..(...@......... ............................................................W.X..~S...W...X...X...X..X..V..p...}.............................................................kQ.W*..S$..wK..k..k..k..m..m..p..q..q..r..~......".........................................................................t..s'..^...\...^..._..._...`...a...b...e....M.................................................................fF.^...sB...m...v...w...x...x...y...{...{............%...#..."..."... ......................................................................v.._..xL...V...X...X...Y...Z...Z...\...`..}N...k#....................................................................rO4.Y+...T...k...q...q...p...q...q...u...}...."...$... .................................................................................j...S...T...X...Z...Y...Z...[...Z...]..._..{O...o?...........................................

Chrome Cache Entry: 114

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with CRLF line terminators
Category:	downloaded
Size (bytes):	26951
Entropy (8bit):	4.514992390210281
Encrypted:	false
SSDEEP:
MD5:	B3D7A123BE5203A1A3F0F10233ED373F
SHA1:	F4C61F321D8F79A805B356C6EC94090C0D96215C
SHA-256:	EF9453F74B2617D43DCEF4242CF5845101FCFB57289C81BCEB20042B0023A192
SHA-512:	A01BFE8546E59C8AF83280A795B3F56DFA23D556B992813A4EB70089E80621686C7B51EE87B3109502667CAF1F95CBCA074BF607E543A0390BF6F8BB3ECD992B
Malicious:	false
Reputation:	unknown
URL:	https://passwordreset.microsoftonline.com/ScriptResource.axd?d=toY-xGLgNRMp8DvmwA1TquKcoJ63M_cuZ5JgxzWt9ClMkvhUKZCgrarPNsEuFNEcadvXW2fG2R9jPyWkIjURV0R3rstR8-gYWGtAa2gNs5GtZP42MZEwWOvqRS6DElp2Lx85avv2yXlUVL89z6fLsiNPiNVErN11dM-pHGijQpW8Abi7Z2Jf67nkX0GRoy7Ti38BLDX3qqBnOrnBOpAUUQ2&t=ffffffffa8ad04d3
Preview:	var Page_ValidationVer = "125";..var Page_IsValid = true;..var Page_BlockSubmit = false;..var Page_InvalidControlToBeFocused = null;..var Page_TextTypes = /^(text\|password\|file\|search\|tel\|url\|email\|number\|range\|color\|datetime\|date\|month\|week\|time\|datetime-local)$/i;..function ValidatorUpdateDisplay(val) {.. if (typeof(val.display) == "string") {.. if (val.display == "None") {.. return;.. }.. if (val.display == "Dynamic") {.. val.style.display = val.isvalid ? "none" : "inline";.. return;.. }.. }.. if ((navigator.userAgent.indexOf("Mac") > -1) &&.. (navigator.userAgent.indexOf("MSIE") > -1)) {.. val.style.display = "inline";.. }.. val.style.visibility = val.isvalid ? "hidden" : "visible";..}..function ValidatorUpdateIsValid() {.. Page_IsValid = AllValidatorsValid(Page_Validators);..}..function AllValidatorsValid(validators) {.. if ((typeof(validators) != "undefined") && (validators != null)) {

Chrome Cache Entry: 115

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with CRLF line terminators
Category:	downloaded
Size (bytes):	1498
Entropy (8bit):	4.81759827491068
Encrypted:	false
SSDEEP:
MD5:	11FE4E6509513DB245F1F97E37C5D3AB
SHA1:	05322C35B6BFAE84CE8C626BD7B1F8C4A6F15A6D
SHA-256:	78D437B40A85299F96ED9D02E35F23FD3D3EF63D844D8D2523A15516F7E1D09C
SHA-512:	E8A7C3B06C54B671FF6772D6A360DD0B4A65888B4DBD32AE04D14E4971343A71E1B4EC1E58BD45898744A1B0DF4EDE24141FF47E2C0393E18AACFC97E6F10D76
Malicious:	false
Reputation:	unknown
URL:	https://passwordreset.microsoftonline.com/css/ltrStyle.css?v=1342177280
Preview:	.paddingright { padding-right: 20px; }...paddingleft { padding-left: 20px; }...paddingright7 { padding-right: 7px; }...paddingleft7 { padding-left: 7px; }...paddingleft10 {padding-left: 10px; }...alignright { text-align: right; }...alignleft { text-align: left; }...leftalign {text-align: left; margin-left:0px;}.....borderRight {border-right: 1px solid black; padding: 0px;}.....userTypeRadioButtonMargin{margin-left: 10px; margin-top:50px;}...userVerificationInputLabel {text-align:left;padding-right: 10px;}...radioButtonMoreInformation { padding-left: 20px }.....header .logo{float:left; padding-left:30px;}.....HelpCallout td.PosRight{padding: 8px 0px 0px 0px; margin: 0px; vertical-align: top; font-size: 1px; border: none !important; background-color: transparent !important;}...HelpCallout td.PosRight > div{font-size: 1px; position: relative; left: 1px; border-bottom: none !important; border-right: none !important; border-left: none !important; width: 15px; background-color: transparent !

Chrome Cache Entry: 116

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (39257), with CRLF line terminators
Category:	downloaded
Size (bytes):	40326
Entropy (8bit):	5.245555585297941
Encrypted:	false
SSDEEP:
MD5:	DA9DC1C32E89C02FC1E9EEB7E5AAB91E
SHA1:	3EFB110EFA6068CE6B586A67F87DA5125310BC30
SHA-256:	398CDF1B27EF247E5BC77805F266BB441E60355463FC3D1776F41AAE58B08CF1
SHA-512:	D4730EBC4CA62624B8300E292F27FD79D42A9277E409545DF7DC916189ED9DF13E46FAA37E3924B85A7C7EA8C76BF65A05ECA69B4029B550430536EC6DF8552A
Malicious:	false
Reputation:	unknown
URL:	https://passwordreset.microsoftonline.com/ScriptResource.axd?d=aZLH4mSlwVT2bfQsqN_cSwyYyu3ks1oNtEUpMeosxjDyVX_6TB3IW5CEdatXFuv2I4zJTROm0VtmRKop2xS7bo0w-Iix-BcMl2_cNtK35bqyAoFbyXyvBqrmEkdN4A7rfIluoWj_uDzkv387yziPFleU1xPL4uvNI8i9rGQ3gLT9Eo-Z4-W34GRU8l-e4ISM3aOfMGbZKuDklekpBXyFblmjFoJXOxTzBgqF-kp9hX41&t=74258c30
Preview:	//----------------------------------------------------------..// Copyright (C) Microsoft Corporation. All rights reserved...//----------------------------------------------------------..// MicrosoftAjaxWebForms.js..Type._registerScript("MicrosoftAjaxWebForms.js",["MicrosoftAjaxCore.js","MicrosoftAjaxSerialization.js","MicrosoftAjaxNetwork.js","MicrosoftAjaxComponentModel.js"]);Type.registerNamespace("Sys.WebForms");Sys.WebForms.BeginRequestEventArgs=function(c,b,a){Sys.WebForms.BeginRequestEventArgs.initializeBase(this);this._request=c;this._postBackElement=b;this._updatePanelsToUpdate=a};Sys.WebForms.BeginRequestEventArgs.prototype={get_postBackElement:function(){return this._postBackElement},get_request:function(){return this._request},get_updatePanelsToUpdate:function(){return this._updatePanelsToUpdate?Array.clone(this._updatePanelsToUpdate):[]}};Sys.WebForms.BeginRequestEventArgs.registerClass("Sys.WebForms.BeginRequestEventArgs",Sys.EventArgs);Sys.WebForms.EndRequestEventArgs=fun

Chrome Cache Entry: 120

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 89 x 18, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1805
Entropy (8bit):	7.265265285391204
Encrypted:	false
SSDEEP:
MD5:	BC89C1FBFBC227DC5A7ED9B2797E240D
SHA1:	8A9390297FDD0963C466CF2FD35D5B1F88A46B6A
SHA-256:	744A8CD0A4D15DFCF4A5D2E832FF556D950F8AF24D7B66104AB2EF4FE2605D9A
SHA-512:	C18F6B22F4AC5040E3FEBE8034AD3A3A3EF32CF3384BE6C3144B2EB04080F03111743D5B30AF3A1343AFD68A20AAE5972422C724107243D00CD9CF263DDC10C7
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...Y.........0.r.....sRGB.........gAMA......a.....tEXtSoftware.Adobe ImageReadyq.e<... iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Windows" xmpMM:InstanceID="xmp.iid:BABFACAF901511E2BD4FDE5C526470CF" xmpMM:DocumentID="xmp.did:BABFACB0901511E2BD4FDE5C526470CF"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:BABFACAD901511E2BD4FDE5C526470CF" stRef:documentID="xmp.did:BABFACAE901511E2BD4FDE5C526470CF"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>..R....fIDATXG.mq[1.E.!...3&...P.................3..~L..q.O..t..{...v?..n.....b#.-.i..

Chrome Cache Entry: 121

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 2 x 2, 8-bit/color RGB, non-interlaced
Category:	downloaded
Size (bytes):	61
Entropy (8bit):	3.990210155325004
Encrypted:	false
SSDEEP:
MD5:	9246CCA8FC3C00F50035F28E9F6B7F7D
SHA1:	3AA538440F70873B574F40CD793060F53EC17A5D
SHA-256:	C07D7D29E3C20FA6CA4C5D20663688D52BAD13E129AD82CE06B80EB187D9DC84
SHA-512:	A2098304D541DF4C71CDE98E4C4A8FB1746D7EB9677CEBA4B19FF522EFDD981E484224479FD882809196B854DBC5B129962DBA76198D34AAECF7318BD3736C6B
Malicious:	false
Reputation:	unknown
URL:	https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/cmg/1/wh0E0SXYnx6pTBdJW%2Fl926I%2BPRUplRdtQz3K9lHXs%2Fs%3D
Preview:	.PNG........IHDR...............s....IDAT.....$.....IEND.B`.

Chrome Cache Entry: 122

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 3 icons, 32x32, 32 bits/pixel, 24x24, 32 bits/pixel
Category:	dropped
Size (bytes):	7886
Entropy (8bit):	4.14434000076088
Encrypted:	false
SSDEEP:
MD5:	AC16FA7FC862073B02ACD1187FC6DEF4
SHA1:	F2B9A6255F6293000F30EEE272ABDD372A14E9D3
SHA-256:	E35D94B76894D6ECA96FF5B1A12D94DFE73485EF3C52CB5B4395BE8FFAC1CB45
SHA-512:	FF0884F9F3DED38191C7D1F214545509E80DE614BC824395F3C9412AED8D81DB95BA7E761939AC1F1798C1D39A7969A3DBF373D03A88404345714EDD8165F19D
Malicious:	false
Reputation:	unknown
Preview:	...... .... .....6......... ............... .h...f...(... ...@..... ..........................................................................................................................................................................................................................................................................................................................(..(..(..(..(..(..(..(..(..(..(..(..(..(..(..(..(..(..(..(..(..(..'.....................................(..(..(..(..(..(..(..(..(..(..(..(..(..(..(..(..(..(..(..(..(.....~......................................(..(..(..(..(..(..(..(..(..(..(..(..(..(..(..(..(..(..(.."................................................ ... ... ... ... ... ... ... .."..(..(..(..(..(..(..(..(..$.....}...............................................y...y...y...y...y...y...y...y...y...%..(..(..(..(..(..'.....\|..............................

Chrome Cache Entry: 124

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	downloaded
Size (bytes):	1525
Entropy (8bit):	4.80220321270831
Encrypted:	false
SSDEEP:
MD5:	ACA0F1B02DC406E76DDC5F2BDEBEC6CE
SHA1:	594C930BE86B8843377565E349D2A10F1755A13A
SHA-256:	0446C6FD9AEB7DCD7CC089FA25323B1AE9AFA77B4CF8D4449F7D2D1B2467393A
SHA-512:	06887860F73D38799FFF8BF5B2972160B68C303EC904813861190E9A8A6477E4D300882994D661FDFC118C408625C537D8B28287DC9941D50302BD91C88ED98F
Malicious:	false
Reputation:	unknown
URL:	https://passwordreset.microsoftonline.com/js/Common.js
Preview:	.....function GetCookieValue(cookieName)..{.. if (document.cookie == undefined \|\| document.cookie == "").. return "";.... var name = cookieName + "=";.. var cookieArray = document.cookie.split(';');.. for (var i = 0; i < cookieArray.length; i++).. {.. var clientCookie = cookieArray[i].trim();.. if (clientCookie.indexOf(name) == 0).. {.. return clientCookie.substring(name.length, clientCookie.length);.. }.. }.. return "";..}....function DeleteCookie(name)..{.. if (GetCookieValue(name).length > 0).. {.. document.cookie = name + "=" + ";expires=Thu, 01 Jan 2000 00:00:01 GMT";.. }..}....function GetUserSessionData(key) {.. var sessionStorage = window.sessionStorage;.. if (sessionStorage[key] == null) {.. return "";.. }.. return sessionStorage.getItem(key);..}....function SetUserSessionData(key, value) {.. var sessionStorage = window.sessionStorage;.. sessionStorage.setItem(key, val

Chrome Cache Entry: 125

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	68
Entropy (8bit):	4.625316929997096
Encrypted:	false
SSDEEP:
MD5:	D1690731F22021E1466FBCD0DB6326EF
SHA1:	78F95BA0B7F82BBB7067000242DE860594ABD9C3
SHA-256:	490216DF4F089BB5C249BCF4034D0671254CA4236EC3ECA935AAC4B17E0FC7F3
SHA-512:	10B3CE812684D28DC72B74BA220E9A0DEE38550D49D25BB40B9EEB8764EE386E5F530D28A5E7C8E159B5C672D85D8649B102F3F04BD96092F9787ACACA4DBDF1
Malicious:	false
Reputation:	unknown
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISLAnYh4U85ulXExIFDURbFPwSBQ2L4FIoEgUNxK_d4xIFDW1rCkoSBQ2VKJT-?alt=proto
Preview:	CjEKCw1EWxT8GgQIZBgCCgcNi+BSKBoACgcNxK/d4xoACgcNbWsKShoACgcNlSiU/hoA

Chrome Cache Entry: 126

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with CRLF line terminators
Category:	downloaded
Size (bytes):	46376
Entropy (8bit):	4.760560792293901
Encrypted:	false
SSDEEP:
MD5:	DBFAC7887A157C9B73DC42927FC15B74
SHA1:	435FD188BF66F0207EEB298DD13228D17D36E4D1
SHA-256:	FC66E3943BC6EDC7B1F79D952D31DABCBA3BD576190DEEB9A7518CEE6B75C5A1
SHA-512:	C1918B35A03BD2110C2CB4EAD140BA342C54EE7BEE2C1E4B6582B56B86DA93AECDDA92DA626C7B15BDEBC067893ACD354919495551E71EE0C9D5993B43433958
Malicious:	false
Reputation:	unknown
URL:	https://passwordreset.microsoftonline.com/js/Webtrends.js
Preview:	// WebTrends SmartSource Data Collector Tag..// Version: 8.6.2..// MS Version: 3.2.5..// Tag Builder Version: 3.0..// Created: 04/01/2011..function WebTrends() {.. var that = this;.. if (typeof (gDcsId) != "undefined" && gDcsId) this.dcsid = gDcsId;.. else this.dcsid = "not_a_valid_dcsid";.. if (typeof (gDomain) != "undefined" && gDomain) this.domain = gDomain;.. else this.domain = "m.webtrends.com";.. if (typeof (gTimeZone) != "undefined" && gTimeZone) this.timezone = gTimeZone;.. else this.timezone = -8;.. if (typeof (gFpcDom) != "undefined" && gFpcDom) this.fpcdom = gFpcDom;.. else {.. if (/microsoft.com$/.test(window.location.hostname)) {.. this.fpcdom = ".microsoft.com";.. } else {.. this.fpcdom = window.location.hostname;.. }.. }.. if (typeof (gOffsite) != "undefined" && gOffsite).. if (gOffsite == true \|\| gOffsite == "true") this.fpcdom = "";.. this.navigationtag = "div,table";.. if (typeof

Chrome Cache Entry: 127

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 22 x 22
Category:	downloaded
Size (bytes):	478
Entropy (8bit):	7.072122642964318
Encrypted:	false
SSDEEP:
MD5:	309B41EE7A44BD51E5D1B52CCC620E5B
SHA1:	B162CE55DE01BF7C005F8CE4D4D7C32E7AEACA08
SHA-256:	F213507641FD02EC43981535823474ECFDE973D1B33A6CD385F1F0827FD4B528
SHA-512:	9279138126F8FEDD3AEF32BA4BCD78D3D26BBD4E7DE6F3B21014B96C34D7E69BC4C6471CC94772346CB6C7F9020EB5FE1A3A96686A5B250F5CCDEE54A0936F4D
Malicious:	false
Reputation:	unknown
URL:	https://passwordreset.microsoftonline.com/images/hip_text.gif
Preview:	GIF89a.....;....333..........ZZY.........fff.........ssr...........................................................................................MML.........@@@....................................!.....;.,.............p.+.....9.P'..D.`..........t..pB\C.k..n...[..x7hRt..x7-}.92....}%p5.+..8..9552...n2...#.3//...3../33..."..3+.../9..22....3....+./.9.2......9.........3.....}(.).....5..........7......`...........,"J....D>Dlh...F4D(..I..I..@...!..0]B..d%..w...;

Chrome Cache Entry: 129

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	16
Entropy (8bit):	3.875
Encrypted:	false
SSDEEP:
MD5:	D6B82198AF25D0139723AF9E44D3D23A
SHA1:	D60DEEF1847EEEF1889803E9D3ADC7EDA220F544
SHA-256:	A5C8CC49FA6649BE393EF22C2B31F1C46B671F8D763F783ED6D7B4E33669BDA3
SHA-512:	B21BEE2EEC588308A9DC3C3C2405377704B39B08AA20CBA40BA6E6834E67CF6F2C086E0701F5B05AEE27E2677E9C5C24FF137318275ACA00DD063DF3DCC07D4D
Malicious:	false
Reputation:	unknown
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISEAlyDZ6ZO9EL6RIFDVd69_0=?alt=proto
Preview:	CgkKBw1Xevf9GgA=

Chrome Cache Entry: 131

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (42414)
Category:	downloaded
Size (bytes):	42415
Entropy (8bit):	5.374174676958316
Encrypted:	false
SSDEEP:
MD5:	F94A2211CE789A95A7C67E8C660D63E8
SHA1:	F1FC19B6BCB96D0A905BF3192AAFF0885FF9F36F
SHA-256:	926DC3302F99EC05E4206E965DDEB7250F5910A8C38E82C7BEAFB724BBAAF37B
SHA-512:	EAC0FC89C2D6CCEB9F4C18DFC610DFF8BC194D3994F0C74B3D991F8423C6DADE11D805E76124596521C58AFA9939B45D2D3157F0A48626E12548020FC38364D3
Malicious:	false
Reputation:	unknown
URL:	https://challenges.cloudflare.com/turnstile/v0/b/471dc2adc340/api.js?onload=onloadTurnstileCallback
Preview:	"use strict";(function(){function bt(e,r,t,o,u,s,m){try{var b=e[s](m),h=b.value}catch(d){t(d);return}b.done?r(h):Promise.resolve(h).then(o,u)}function Et(e){return function(){var r=this,t=arguments;return new Promise(function(o,u){var s=e.apply(r,t);function m(h){bt(s,o,u,m,b,"next",h)}function b(h){bt(s,o,u,m,b,"throw",h)}m(void 0)})}}function M(e,r){return r!=null&&typeof Symbol!="undefined"&&r[Symbol.hasInstance]?!!r[Symbol.hasInstance](e):M(e,r)}function Ie(e,r,t){return r in e?Object.defineProperty(e,r,{value:t,enumerable:!0,configurable:!0,writable:!0}):e[r]=t,e}function Ve(e){for(var r=1;r<arguments.length;r++){var t=arguments[r]!=null?arguments[r]:{},o=Object.keys(t);typeof Object.getOwnPropertySymbols=="function"&&(o=o.concat(Object.getOwnPropertySymbols(t).filter(function(u){return Object.getOwnPropertyDescriptor(t,u).enumerable}))),o.forEach(function(u){Ie(e,u,t[u])})}return e}function fr(e,r){var t=Object.keys(e);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertyS

Chrome Cache Entry: 132

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 24 x 24
Category:	downloaded
Size (bytes):	2463
Entropy (8bit):	6.994052150121201
Encrypted:	false
SSDEEP:
MD5:	93DE6FB07C1382459E473381DA5D0E7E
SHA1:	4E1208D482A7ABA8C86FDCF8E0E92C90BB8C8C8A
SHA-256:	E97FA0CFE4B0A7BB22E9713A67D4667DA064E674A944D607E78F0D3BF48E57A5
SHA-512:	B415DE10B55639DD5DFDD038FD490B675059122373659DD86AA00EBC7F6735FD22360264226F8675741FB76F3B3A16E9AB7FA907F489B377EF16E9222AA26E3B
Malicious:	false
Reputation:	unknown
URL:	https://passwordreset.microsoftonline.com/images/wait_animation.gif
Preview:	GIF89a.............!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:BCB95722648AE111A86BB806ED51E581" xmpMM:DocumentID="xmp.did:185F1A028B0511E19AA1A07B5BDC793D" xmpMM:InstanceID="xmp.iid:185F1A018B0511E19AA1A07B5BDC793D" xmp:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:D7EC7F987A8AE111A86BB806ED51E581" stRef:documentID="xmp.did:BCB95722648AE111A86BB806ED51E581"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>......................................................................................................

Chrome Cache Entry: 134

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with CRLF line terminators
Category:	downloaded
Size (bytes):	23063
Entropy (8bit):	4.7535440881548165
Encrypted:	false
SSDEEP:
MD5:	90EA7274F19755002360945D54C2A0D7
SHA1:	647B5D8BF7D119A2C97895363A07A0C6EB8CD284
SHA-256:	40732E9DCFA704CF615E4691BB07AECFD1CC5E063220A46E4A7FF6560C77F5DB
SHA-512:	7474667800FF52A0031029CC338F81E1586F237EB07A49183008C8EC44A8F67B37E5E896573F089A50283DF96A1C8F185E53D667741331B647894532669E2C07
Malicious:	false
Reputation:	unknown
URL:	https://passwordreset.microsoftonline.com/WebResource.axd?d=2_9P-7FWCwUTw0t6PZgNgil7QYOdZv7mV3mTzPl_abY06iJhav3EeS0t3M_odI-eZMnD5CNzdW6tfsv0h7u9R5JWbOmxe47Usx_LRUKjpGi5F2_U3VOPZAXsUn8Iz933LGYQB0e77hidpcjWqh1nCg2&t=638478749639812753
Preview:	function WebForm_PostBackOptions(eventTarget, eventArgument, validation, validationGroup, actionUrl, trackFocus, clientSubmit) {.. this.eventTarget = eventTarget;.. this.eventArgument = eventArgument;.. this.validation = validation;.. this.validationGroup = validationGroup;.. this.actionUrl = actionUrl;.. this.trackFocus = trackFocus;.. this.clientSubmit = clientSubmit;..}..function WebForm_DoPostBackWithOptions(options) {.. var validationResult = true;.. if (options.validation) {.. if (typeof(Page_ClientValidate) == 'function') {.. validationResult = Page_ClientValidate(options.validationGroup);.. }.. }.. if (validationResult) {.. if ((typeof(options.actionUrl) != "undefined") && (options.actionUrl != null) && (options.actionUrl.length > 0)) {.. theForm.action = options.actionUrl;.. }.. if (options.trackFocus) {.. var lastFocus = theForm.elements["__LASTFOCUS"];.. if ((typeo

Chrome Cache Entry: 86

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (61177)
Category:	downloaded
Size (bytes):	110586
Entropy (8bit):	5.287109161477717
Encrypted:	false
SSDEEP:
MD5:	F0E5964F8BBEDF73D2D3001623BB663B
SHA1:	AADF3504D5E5A93E678487EEB4A63398F2699341
SHA-256:	9537F00CA371747A97A2ACCA388F7B2379A7FA7C59BDE18C3D2621C0DE8DE492
SHA-512:	3E5D4EDDFB57E3178811D3DADD3AEB47908D70C92F442485E8EB8137A0BAB60927B800F436F3AE740496CABD16E29EC324841721D8FA3E39E00AC2FAFE3EAEC1
Malicious:	false
Reputation:	unknown
URL:	https://aadcdn.msftauth.net/ests/2.1/content/cdnbundles/converged.v2.login.min_8owwt4u-33ps0wawi7tmow2.css
Preview:	/! Copyright (C) Microsoft Corporation. All rights reserved. //*!.------------------------------------------- START OF THIRD PARTY NOTICE -----------------------------------------..This file is based on or incorporates material from the projects listed below (Third Party IP). The original copyright notice and the license under which Microsoft received such Third Party IP, are set forth below. Such licenses and notices are provided for informational purposes only. Microsoft licenses the Third Party IP to you under the licensing terms for the Microsoft product. Microsoft reserves all other rights not expressly granted under this agreement, whether by implication, estoppel or otherwise...//-----------------------------------------------------------------------------.twbs-bootstrap-sass (3.3.0).//-----------------------------------------------------------------------------..The MIT License (MIT)..Copyright (c) 2013 Twitter, Inc..Permission is hereby granted, free of charge, to any person

Chrome Cache Entry: 87

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65329), with CRLF line terminators
Category:	downloaded
Size (bytes):	102801
Entropy (8bit):	5.336080509196147
Encrypted:	false
SSDEEP:
MD5:	C89EAA5B28DF1E17376BE71D71649173
SHA1:	2B34DF4C66BB57DE5A24A2EF0896271DFCA4F4CD
SHA-256:	66B804E7A96A87C11E1DD74EA04AC2285DF5AD9043F48046C3E5000114D39B1C
SHA-512:	B73D56304986CD587DA17BEBF21341B450D41861824102CC53885D863B118F6FDF2456B20791B9A7AE56DF91403F342550AF9E46F7401429FBA1D4A15A6BD3C0
Malicious:	false
Reputation:	unknown
URL:	https://passwordreset.microsoftonline.com/ScriptResource.axd?d=rKi1V3VGNYf9Wo4eEjkaEPP-kuASnqlHGD20Welj7KIV3NdO7hWPWT2YNjz_Q67962GGuvSh9a2PBU49MfN31fzXjV7ZIVY8eQeKVfB1MXjxEwjK0MQUJ5A91IX5rub-JCkN4CeWiYuq_NMtX7gL4aLMC2zrA36YBRqcyp19QBnvqBNTHSWUbFlRe3ATp36Z2fLUjTpPRNCswW2M9TrU0Mn0MXArQ5Sm_nIYwJwUU_w1&t=74258c30
Preview:	//----------------------------------------------------------..// Copyright (C) Microsoft Corporation. All rights reserved...//----------------------------------------------------------..// MicrosoftAjax.js..Function.__typeName="Function";Function.__class=true;Function.createCallback=function(b,a){return function(){var e=arguments.length;if(e>0){var d=[];for(var c=0;c<e;c++)d[c]=arguments[c];d[e]=a;return b.apply(this,d)}return b.call(this,a)}};Function.createDelegate=function(a,b){return function(){return b.apply(a,arguments)}};Function.emptyFunction=Function.emptyMethod=function(){};Function.validateParameters=function(c,b,a){return Function._validateParams(c,b,a)};Function._validateParams=function(g,e,c){var a,d=e.length;c=c\|\|typeof c==="undefined";a=Function._validateParameterCount(g,e,c);if(a){a.popStackFrame();return a}for(var b=0,i=g.length;b<i;b++){var f=e[Math.min(b,d-1)],h=f.name;if(f.parameterArray)h+="["+(b-d+1)+"]";else if(!c&&b>=d)break;a=Function._validateParameter(g[b],f

Chrome Cache Entry: 88

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (941), with CRLF line terminators
Category:	dropped
Size (bytes):	51589
Entropy (8bit):	4.6450536878884785
Encrypted:	false
SSDEEP:
MD5:	A98A989A754C601A510DA5B6E8364CDE
SHA1:	4F50AA58491277A6BA6314A33B2C7B2CE017825F
SHA-256:	3CF3D921E81FCB54B35BC6633E10F7EAF380AE24C1B785B10313437EF4F63E53
SHA-512:	230DC859600754BB9C40C86248FD6F6BE1659FCFF69C784A02BE0C9D34969566CB8B6D69DDF94084F8EE62E95690E1941EFC4A60824417CBDBFE0FA8C84059F7
Malicious:	false
Reputation:	unknown
Preview:	..<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">..<html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" lang="en-US">..<head><title>...Microsoft Online Password Reset..</title><meta http-equiv="x-ua-compatible" content="IE=9" /><meta http-equiv="Expires" content="0" /><meta http-equiv="Pragma" content="no-cache" /><meta http-equiv="Cache-Control" content="no-store, no-cache" /><meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /><meta name="robots" content="noindex, nofollow, NOODP, NOYDIR" /><meta name="viewport" content="width=device-width, initial-scale=1" /><link id="FavoriteIcon" rel="Shortcut Icon" type="image/x-icon" href="../favicon.ico?v=1342177280" />.... <script src="//ajax.aspnetcdn.com/ajax/jQuery/jquery-3.6.0.min.js" type="text/javascript"></script>.. <script type="text/javascript">window.jQuery \|\| document.write('<script type="text/javascript" src="../js/jquery-3.6.0.min.js">\

Chrome Cache Entry: 89

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	downloaded
Size (bytes):	12980
Entropy (8bit):	4.656952280411437
Encrypted:	false
SSDEEP:
MD5:	8EDFCD3F7A179CFF6B123DFF50F29770
SHA1:	7A2D9BB4B9F6072AB3049E6421021A5BA0A3DADF
SHA-256:	D0B747C7F7414A08B0D5107832B2F4BB44A9BB4A3AAD28390F58EDE8BBEA6AE1
SHA-512:	169D1C71078DCB1C65B3CBAFBA3379B94718D6C1E472990666430A6B2C0483CC9B27E13820A29D2DCA2364D3CD3F7D2ECDED48B9ACF406BF74CB505489FB9503
Malicious:	false
Reputation:	unknown
URL:	https://passwordreset.microsoftonline.com/js/Button.js?v=1342177280
Preview:	.//------------------------------------------------------------..// Copyright (c) Microsoft Corporation. All rights reserved...//------------------------------------------------------------....var Button = new Object();....Button.ActiveButton = null;..Button.FocusButton = null;..Button.DefaultButton = null;..Button.CancelButton = null;..Button.ActivatedButtonID = null;..Button.Groups = {};....Button.SetText = function(id, text) {.. var button = document.getElementById(id);.. if (button != null) {.. for (var i = 0; i < button.children.length; i++) {.. var ch = button.children[i];.. if (ch.tagName.toLowerCase() == 'span') {.. ch.innerHTML = text; //// TODO: this causes the text wrapped with an <a> tag to get inserted in Firefox, which needs to get fixed... break;.. }.. }.. }.. var span = document.getElementById(id + '_disabled');.. if (span != null) {.. for (var i = 0; i < span.childr

Chrome Cache Entry: 90

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 110554
Category:	downloaded
Size (bytes):	19953
Entropy (8bit):	7.979493872046846
Encrypted:	false
SSDEEP:
MD5:	C60D83111FACE767A068BE9B5178B887
SHA1:	BDBE2ED3247BB647CB318A9D0A4182E65B66473D
SHA-256:	62F6067588E8E74833692A1511AC8AF5B66F380E8BFC842B7EC7B2785494AEC3
SHA-512:	C5C424AA2AA7AB782C294512CB3666E2AB67FC152F46576531733DAD7EE4FB4CB19BCB763C126C42DD131BF7642A103ABDF0C784BA1A0D62175F400A6D9922D7
Malicious:	false
Reputation:	unknown
URL:	https://aadcdn.msauth.net/ests/2.1/content/cdnbundles/converged.v2.login.min_ziytf8dzt9eg1s6-ohhleg2.css
Preview:	...........}k..6..w...\..J.H=GSq..x.9...}T.....)Q..f<.3..... ..d..V..[D7.@w.....w..!x^.n..j].O.....EYT.&..(.:+.a.,...T.eZ..u...o....?<.w._.........>..x.c..\|.#x......Ag..}\gU...4 .^&U...mP.A.].Z.U.!..Y.......:.ve.?.!..d.L..&xB...]R....0.Hp...lKr/...E.-. .....\|l.4.o.i.......L.iF..T{.n....2....VEY.y=.....T+V./.b.....\....7L8...=i4.Sl...TB...5...Ep[.E.u{..U@...X94].#UX..uh4.i.."....ROH... T.mpU&[.rY..\rU..&..=..e.....T.....U].viNe..dU.>z..wGh]...o...eQ.U]&.~.TU.d.......j...+.?O...G...N.x....7YMd.....G....dUE.C.0#.T\|..%O....:)....o...viY.qY'..6a...`2!P!.P...F.],...iY,.T6L.....Pm8. r...B.i.?.LS$( .^.{..u.-.0I...KZ...M&J...<"D..i..g/...lE.MY.v.K.y.`.Q...$V4.1.G......G.BF{..]...../XT......%Y.h./....Y..e.DjIh.E_.9...i.b..h..9.trY\.>#B...R..jM..e*.F...h.lNI..j"xj..c...$............g._....w.......?.'.>..^../...1 ..!...go......{....{......G....xA...<....o~.~ ....^]..&D?..h..........$..~.xu....G...........36.\<........{...).GB.....'..x.

Chrome Cache Entry: 91

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 60 x 60, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1561
Entropy (8bit):	7.762338770217686
Encrypted:	false
SSDEEP:
MD5:	8DC34013E911C5F68FC2BCA0400CB06F
SHA1:	16BAFA91AF100D65C4945F04E0C6E1643B98CF00
SHA-256:	795029D360C3D16233FCE96F1BFF13C261535C0885FAE806CFF766F32D96BCEE
SHA-512:	83ACA42A30BFD629BC1E88D3ED154475E7949C1B154D19E6C9EF1DE825BA7967C0B6DA9EE79E7B420668242CCE5931DF344C97278A254F0A72C3D09EABED6051
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...<...<.....:..r....sBIT....\|.d.....pHYs...........S.....tEXtCreation Time.05/06/16...o....tEXtSoftware.Adobe Fireworks CS6.....qIDATh..=l.E.....H..H*.\|... ...&.D..).@....&...N....)_.E ...(.p...p(H...Ht... ..0............i.}s.....{`ss....;.......:...u..."....Az.r.%.9.\|....wU.j...o....N4...~....g.u.=`.;..9.7.%....Ad#......9....~7.....&.a........`]x^D....&,"..kv.l..K.S+!....#{.xm.;..%.+F<.\..#...bN...2...\.".I..U]..#.dWy$."r.2;Z...w)oD..H..u..M.'.k70.<4aG..`'~......k31W.2!Ue.A"..j....X..C...dNUd.... .j.\|c."..../..P.MXD......C`>7Y.K...n.....U..#..^4....Uu...Q.);.`9q.53..n.@.......A6.E,6.-d; ........nl.>..."..N7..9\6.....p^a..4aG...3...gUu#..j...2............f.....^.)...Udo'&..G.C.Z...L).....".t...pCD..n..a.....E....F...o.k.Y+b...[...gT..... ...]....V..m.!\..SCwh8w..J^.3N........\.W.....3.....lP.Da........-..........@_...i......r..%..)E.Q...3..M..o.$...`...".......-/EHIDZ.q.MC.......D.Q..".. ..#...................1...p.x?dKP.=...{u\.

Chrome Cache Entry: 95

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ISO-8859 text
Category:	downloaded
Size (bytes):	2814
Entropy (8bit):	5.574084648493998
Encrypted:	false
SSDEEP:
MD5:	571CF1F480FCEDC40FE58CC26647BFDD
SHA1:	42A8841EBE5BE2FDADC953B070C9D2E4C0161D1E
SHA-256:	47737D49F136CA1DAF9DB6C48D4591576DD05B1F467946ED6633D9347A3F5014
SHA-512:	D253016AF85D3A91C6658A412CB300BA28FFB8E5768AD2B3B7FB2DE70F58B944689E444D97EC67E9DF2CBD3C1DBF595F9D39CA592135A11727B01AF95CD85B2D
Malicious:	false
Reputation:	unknown
URL:	https://xs523936.xsrv.jp/favicon.ico
Preview:	<!DOCTYPE html>.<html lang="ja">.<head>.<meta charset="EUC-JP" />.<title>404 File Not Found</title>.<meta name="copyright" content="Copyright XSERVER Inc.">.<meta name="robots" content="INDEX,FOLLOW" />.<meta name="viewport" content="width=device-width,initial-scale=1.0,minimum-scale=1.0">.<style type="text/css">.* {. margin: 0;. padding: 0;.}.img {. border: 0;.}.ul {. padding-left: 2em;.}.html {. overflow-y: scroll;. background: #3b79b7;.}.body {. font-family: "....", Meiryo, "... ........", "MS PGothic", "....... Pro W3", "Hiragino Kaku Gothic Pro", sans-serif;. margin: 0;. line-height: 1.4;. font-size: 75%;. text-align: center;. color: white;.}.h1 {. font-size: 24px;. font-weight: bold;.}.h1 {. font-weight: bold;. line-height: 1;. padding-bottom: 20px;. font-family: Helvetica, sans-serif;.}.h2 {. text-align: center;. font-weight: bold;. font-size: 27px;.}.p {. text-align: center;. font-size: 14px;. m

Chrome Cache Entry: 96

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65447)
Category:	downloaded
Size (bytes):	89501
Entropy (8bit):	5.289893677458563
Encrypted:	false
SSDEEP:
MD5:	8FB8FEE4FCC3CC86FF6C724154C49C42
SHA1:	B82D238D4E31FDF618BAE8AC11A6C812C03DD0D4
SHA-256:	FF1523FB7389539C84C65ABA19260648793BB4F5E29329D2EE8804BC37A3FE6E
SHA-512:	F3DE1813A4160F9239F4781938645E1589B876759CD50B7936DBD849A35C38FFAED53F6A61DBDD8A1CF43CF4A28AA9FFFBFDDEEC9A3811A1BB4EE6DF58652B31
Malicious:	false
Reputation:	unknown
URL:	https://cdnjs.cloudflare.com/ajax/libs/jquery/3.6.0/jquery.min.js
Preview:	/! jQuery v3.6.0 \| (c) OpenJS Foundation and other contributors \| jquery.org/license /.!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery requires a window with a document");return t(e)}:t(e)}("undefined"!=typeof window?window:this,function(C,e){"use strict";var t=[],r=Object.getPrototypeOf,s=t.slice,g=t.flat?function(e){return t.flat.call(e)}:function(e){return t.concat.apply([],e)},u=t.push,i=t.indexOf,n={},o=n.toString,v=n.hasOwnProperty,a=v.toString,l=a.call(Object),y={},m=function(e){return"function"==typeof e&&"number"!=typeof e.nodeType&&"function"!=typeof e.item},x=function(e){return null!=e&&e===e.window},E=C.document,c={type:!0,src:!0,nonce:!0,noModule:!0};function b(e,t,n){var r,i,o=(n=n\|\|E).createElement("script");if(o.text=e,t)for(r in c)(i=t[r]\|\|t.getAttribute&&t.getAttribute(r))&&o.setAttribute(r,i);n.head.appendChild(o).parentNode.removeChild(o)}funct

Chrome Cache Entry: 99

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1237), with CRLF line terminators
Category:	downloaded
Size (bytes):	52436
Entropy (8bit):	4.701645034844232
Encrypted:	false
SSDEEP:
MD5:	778C22B526F18E6BE8EFF56C9370CE88
SHA1:	DD5D4704F264CDED2E1E2234D3946EF6CEC2D6E8
SHA-256:	76435CCB1A3A74C248F3204A2CF9A1BCC64F7314FF18E6C9D5A09CC25E3C19A4
SHA-512:	086C7E1AA1E101326DFFDA14C0E9518110EDAAFD02D4C2B66A9B42CB20CA533D776F353B6E35FDC069C2A267587EB2BE108C892C3A8BBA02BADA8903F33F69B2
Malicious:	false
Reputation:	unknown
URL:	https://passwordreset.microsoftonline.com/?ru=https%3a%2f%2flogin.microsoftonline.com%2fcommon%2freprocess%3fctx%3drQQIARAAhZLNa9MAAMWbdq1b0dlNET0IEzzIJG2-0xR2SJt-pFuStU0amoOlaZM0bZqkbdK0uYseB8LAgRcPojt6Ei8Kehi7uPP8DwRFPMiObnoeXh7v8d7t_ZLLRBom0lAa2owhaSh3HyMJHMNwFUSRLgFilAqBWVQjQLhHoecVQhLdzmQ9mXr8xL-3_yNTePN8bbO59fnFIbDR9zx3mstkgiBIO7pudrV01xllrI7dM21jhrwDgBMAOIjGNRuUGofRKYFmYZTCYQInYRQlYRhJt0QabslsqAw4TyizGG9CkCJagx25OuTCoseLUtgKhwuuXMQUWYK4cAgrMhcI4tDjRmzIFy72tcWO2B8JIudxTG3BDaSAZySEZ2r4afS6QPteH7kQZ2KG2q_oiu5MRm3XmXoHsf0oa2_LVLkyq3f8Rcjy42q1gpCmQMlwFxs7xZaUX_TC1rRdsn18Z9uFFFrtg9VCXfLl4XAATjhyx9iFbFKCkOliYbCo2K-apqzkLV0k59uUU1B5vcD2XAItBc1i1RBMexdCbdjrBzZfLpXzou808Www5STOmtfAkS_DeAlSF0h7e9jlVa_RbWBzmOk4vR4KVXlZ1gJK1gdsVt015tREwAl80pg3CmatrxqjsSVW8CZV4uyybMrZPO-5TYyzS2irgyjCjDXyltFG9VCv0_zApcJsvUkTSjB383gFZECD7jShRnAYu3PJvTPkbSxxbkaOfRwjHVezzd6GO3F009IuQ2KGZIS_qeKMtDRtWSdLwLelW8uJVOp2ZCPy4CYUyy0vJ1ORi3S2BLyMnxMXxlcTj-4q9OuVr59-j6nIcTzTLNgMjVMGKs_6XmgV8g8JXrJ0oYQTZTxDDOcNX-34vfmYcbbgHLyXAPYSiePEGsu0-aLYEGmeoesM0oZ-JoCnVyLvV_7L8OnVG8mkb7Ytp9uxtOn6P5Y_XoucrR59-fDs1d7R98of0&mkt=en-US&hosted=0&device_platform=Windows+10
Preview:	..<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">..<html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" lang="en-US">..<head><title>...Microsoft Online Password Reset..</title><meta http-equiv="x-ua-compatible" content="IE=9" /><meta http-equiv="Expires" content="0" /><meta http-equiv="Pragma" content="no-cache" /><meta http-equiv="Cache-Control" content="no-store, no-cache" /><meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /><meta name="robots" content="noindex, nofollow, NOODP, NOYDIR" /><meta name="viewport" content="width=device-width, initial-scale=1" /><link id="FavoriteIcon" rel="Shortcut Icon" type="image/x-icon" href="favicon.ico?v=1342177280" />.... <script src="//ajax.aspnetcdn.com/ajax/jQuery/jquery-3.6.0.min.js" type="text/javascript"></script>.. <script type="text/javascript">window.jQuery \|\| document.write('<script type="text/javascript" src="js/jquery-3.6.0.min.js">\x3C/sc

Static File Info

⊘No static file info

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://www.ne16.com/t/4177044/70602841/2927387/1/124665/?f8785874=aHR0cHM6Ly93b29kLWRlY2sub3JnL3BkZi85SWRac1p5aTJEeWh3ZUcvYTFmM2IxODIyN2RiNTc4NjIzOGE2ZTc0NTE3YWQ4MDEvWEM4YXAvYTFmM2IxODIyN2RiNTc4NjIzOGE2ZTc0NTE3YWQ4MDEvWTJOc1lYSmxRR0psYkd4d1lYSjBibVZ5YzJsdVl5NWpiMjA9

Overview

General Information

Detection

Signatures

Classification

Process Tree

Yara Signatures

HTML

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

Phishing

Compliance

Software Vulnerabilities

Networking

System Summary

Boot Survival

Mitre Att&ck Matrix

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Chrome Cache Entry: 100

Chrome Cache Entry: 102

Chrome Cache Entry: 103

Chrome Cache Entry: 104

Chrome Cache Entry: 106

Chrome Cache Entry: 107

Chrome Cache Entry: 108

Chrome Cache Entry: 109

Chrome Cache Entry: 110

Chrome Cache Entry: 111

Chrome Cache Entry: 112

Chrome Cache Entry: 113

Chrome Cache Entry: 114

Chrome Cache Entry: 115

Chrome Cache Entry: 116

Chrome Cache Entry: 120

Chrome Cache Entry: 121

Chrome Cache Entry: 122

Chrome Cache Entry: 124

Chrome Cache Entry: 125

Chrome Cache Entry: 126

Chrome Cache Entry: 127

Chrome Cache Entry: 129

Chrome Cache Entry: 131

Chrome Cache Entry: 132

Chrome Cache Entry: 134

Chrome Cache Entry: 86

Chrome Cache Entry: 87

Chrome Cache Entry: 88

Chrome Cache Entry: 89

Chrome Cache Entry: 90

Windows Analysis Report
https://www.ne16.com/t/4177044/70602841/2927387/1/124665/?f8785874=aHR0cHM6Ly93b29kLWRlY2sub3JnL3BkZi85SWRac1p5aTJEeWh3ZUcvYTFmM2IxODIyN2RiNTc4NjIzOGE2ZTc0NTE3YWQ4MDEvWEM4YXAvYTFmM2IxODIyN2RiNTc4NjIzOGE2ZTc0NTE3YWQ4MDEvWTJOc1lYSmxRR0psYkd4d1lYSjBibVZ5YzJsdVl5NWpiMjA9