Windows Analysis Report
https://workdrive.zohoexternal.com/external/e6b6caa7935dc26506daa69f1bbc974bb9ff94fe4fb64dfb0de1a223c630f65a/download

Overview

General Information

Sample URL: https://workdrive.zohoexternal.com/external/e6b6caa7935dc26506daa69f1bbc974bb9ff94fe4fb64dfb0de1a223c630f65a/download
Analysis ID: 1430560
Infos:

Detection

Score: 22
Range: 0 - 100
Whitelisted: false
Confidence: 80%

Signatures

Downloads suspicious files via Chrome
Abnormal high CPU Usage
HTTP GET or POST without a user agent
Searches for user specific document files
Stores files to the Windows start menu directory

Classification

Source: https://workdrive.zohoexternal.com/external/e6b6caa7935dc26506daa69f1bbc974bb9ff94fe4fb64dfb0de1a223c630f65a/download HTTP Parser: No favicon
Source: https://workdrive.zohoexternal.com/external/e6b6caa7935dc26506daa69f1bbc974bb9ff94fe4fb64dfb0de1a223c630f65a/download HTTP Parser: No favicon
Source: unknown HTTPS traffic detected: 13.85.23.86:443 -> 192.168.2.17:49742 version: TLS 1.2
Source: unknown HTTPS traffic detected: 23.221.242.90:443 -> 192.168.2.17:49750 version: TLS 1.2
Source: unknown HTTPS traffic detected: 23.221.242.90:443 -> 192.168.2.17:49751 version: TLS 1.2
Source: unknown HTTPS traffic detected: 40.126.7.32:443 -> 192.168.2.17:49752 version: TLS 1.2
Source: unknown HTTPS traffic detected: 13.107.5.88:443 -> 192.168.2.17:49753 version: TLS 1.2
Source: unknown HTTPS traffic detected: 13.107.21.200:443 -> 192.168.2.17:49754 version: TLS 1.2
Source: unknown HTTPS traffic detected: 13.85.23.86:443 -> 192.168.2.17:49755 version: TLS 1.2
Source: Binary string: C:\p4builds\Products\GoToMeeting\release-723\output\G2M_Dll.pdb source: Tax Forms.exe, 00000010.00000002.1717839819.0000000011534000.00000002.00000001.01000000.00000009.sdmp
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /ab HTTP/1.1Host: evoke-windowsservices-tas.msedge.netCache-Control: no-store, no-cacheX-PHOTOS-CALLERID: 9NMPJ99VJBWVX-EVOKE-RING: X-WINNEXT-RING: PublicX-WINNEXT-TELEMETRYLEVEL: BasicX-WINNEXT-OSVERSION: 10.0.19045.0X-WINNEXT-APPVERSION: 1.23082.131.0X-WINNEXT-PLATFORM: DesktopX-WINNEXT-CANTAILOR: FalseX-MSEDGE-CLIENTID: {c1afbad7-f7da-40f2-92f9-8846a91d69bd}X-WINNEXT-PUBDEVICEID: dbfen2nYS7HW6ON4OdOknKxxv2CCI5LJBTojzDztjwI=If-None-Match: 2056388360_-1434155563Accept-Encoding: gzip, deflate, br
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown TCP traffic detected without corresponding DNS query: 40.126.7.32
Source: global traffic HTTP traffic detected: GET /external/e6b6caa7935dc26506daa69f1bbc974bb9ff94fe4fb64dfb0de1a223c630f65a/download HTTP/1.1Host: workdrive.zohoexternal.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /personal/stable/jsapps/ui-lab/dist/assets/assetMap.json HTTP/1.1Host: static.zohocdn.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Origin: https://workdrive.zohoexternal.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://workdrive.zohoexternal.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /personal/stable/jsapps/ui-lab/dist/assets/dev/default_theme-d91bac1ca5e39da5e0d9d244ef35ccaa.css HTTP/1.1Host: static.zohocdn.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,*/*;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://workdrive.zohoexternal.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /personal/stable/jsapps/ui-lab/dist/assets/dev/intl/js/team/team-e945b0e38524b2e11a70a256d4418a2f.js HTTP/1.1Host: static.zohocdn.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://workdrive.zohoexternal.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /personal/stable/jsapps/ui-lab/dist/assets/dev/jquery/jquery.min-dc5e7f18c8d36ac1d3d4753a87c98d0a.js HTTP/1.1Host: static.zohocdn.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://workdrive.zohoexternal.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /personal/stable/jsapps/ui-lab/dist/assets/dev/svg-icons/icon-list-8d90da9709bd1da0c5e81d54042dd26f.js HTTP/1.1Host: static.zohocdn.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://workdrive.zohoexternal.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /personal/stable/jsapps/ui-lab/dist/assets/assetMap.json HTTP/1.1Host: static.zohocdn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /personal/stable/jsapps/files/dist/assets/assetMap.json HTTP/1.1Host: static.zohocdn.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Origin: https://workdrive.zohoexternal.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://workdrive.zohoexternal.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /personal/stable/jsapps/files/dist/assets/vendor-c443ff360647f7450d97230139bcc018.js HTTP/1.1Host: static.zohocdn.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://workdrive.zohoexternal.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /personal/stable/jsapps/files/dist/assets/files-7b7c1ab31ede3c1dba4fe27ac610609d.js HTTP/1.1Host: static.zohocdn.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://workdrive.zohoexternal.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /personal/stable/jsapps/files/dist/assets/assetMap.json HTTP/1.1Host: static.zohocdn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 5d325bd66e=c86ab89292e031494381fd9e7d67001c
Source: global traffic HTTP traffic detected: GET /personal/stable/jsapps/files/dist/engines-dist/wd-docs-menu/assets/engine-b5e083f490a369d30240b6020dc7105f.js HTTP/1.1Host: static.zohocdn.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://workdrive.zohoexternal.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /zohofonts/zohopuvi/4.0/Zoho_Puvi_Medium.woff2 HTTP/1.1Host: static.zohocdn.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://workdrive.zohoexternal.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://static.zohocdn.com/personal/stable/jsapps/ui-lab/dist/assets/dev/default_theme-d91bac1ca5e39da5e0d9d244ef35ccaa.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /zohofonts/zohopuvi/4.0/Zoho_Puvi_Bold.woff2 HTTP/1.1Host: static.zohocdn.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://workdrive.zohoexternal.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://static.zohocdn.com/personal/stable/jsapps/ui-lab/dist/assets/dev/default_theme-d91bac1ca5e39da5e0d9d244ef35ccaa.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /personal/stable/jsapps/files/dist/engines-dist/wd-chooser-components/assets/engine-ea5829e90f6248fb04814ea6c5ba0f67.js HTTP/1.1Host: static.zohocdn.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://workdrive.zohoexternal.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /personal/stable/jsapps/ui-lab/dist/assets/dev/wd_images/favicons/defaults/network-connection.ico?_=1713901636177 HTTP/1.1Host: static.zohocdn.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://workdrive.zohoexternal.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /zohofonts/zohopuvi/4.0/Zoho_Puvi_Regular.woff2 HTTP/1.1Host: static.zohocdn.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://workdrive.zohoexternal.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://static.zohocdn.com/personal/stable/jsapps/ui-lab/dist/assets/dev/default_theme-d91bac1ca5e39da5e0d9d244ef35ccaa.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /personal/stable/jsapps/ui-lab/dist/assets/dev/murphy/murphyInitializer.min-80a2ee059eb0699247fe0ca7a0b7a380.js HTTP/1.1Host: static.zohocdn.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://workdrive.zohoexternal.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /quartz/feedback/v2/zquartz-tracker.js HTTP/1.1Host: static.zohocdn.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://workdrive.zohoexternal.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://workdrive.zohoexternal.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /personal/stable/jsapps/ui-lab/dist/assets/dev/wd_images/favicons/defaults/network-connection.ico?_=1713901636177 HTTP/1.1Host: static.zohocdn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 5d325bd66e=c86ab89292e031494381fd9e7d67001c
Source: global traffic HTTP traffic detected: GET /murphysdk/2.2.2/murphy.min.js HTTP/1.1Host: static.zohocdn.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://workdrive.zohoexternal.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /personal/stable/jsapps/ui-lab/dist/assets/dev/wd_images/favicons/defaults/favicon.ico HTTP/1.1Host: static.zohocdn.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://workdrive.zohoexternal.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /zwd_sw.js HTTP/1.1Host: workdrive.zohoexternal.comConnection: keep-aliveCache-Control: max-age=0Accept: */*Service-Worker: scriptSec-Fetch-Site: same-originSec-Fetch-Mode: same-originSec-Fetch-Dest: serviceworkerReferer: https://workdrive.zohoexternal.com/external/e6b6caa7935dc26506daa69f1bbc974bb9ff94fe4fb64dfb0de1a223c630f65a/downloadUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: bf956ea90a=873849da85872a89dadb6dd4f709f4b7; zpcc=3f3b2cef-fe64-4d9e-b61b-42cd8a8ee7c7; _zcsr_tmp=3f3b2cef-fe64-4d9e-b61b-42cd8a8ee7c7; 487UVgNglIf-VCSHr_user_uuid=$3416683837468328862; inx6y681f89af8e8540ce9baba2db2bf7801f=487UVgNglIf-VCSHr; JSESSIONID=4BDAC997A97D5960FF34D0B2EBCE763B
Source: global traffic HTTP traffic detected: GET /personal/stable/jsapps/ui-lab/dist/assets/dev/wd_images/favicons/defaults/favicon.ico HTTP/1.1Host: static.zohocdn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 5d325bd66e=c86ab89292e031494381fd9e7d67001c
Source: global traffic HTTP traffic detected: GET /webfonts/robotobold/font.woff2 HTTP/1.1Host: static.zohocdn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Origin: https://workdrive.zohoexternal.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://workdrive.zohoexternal.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /webfonts/robotomedium/font.woff2 HTTP/1.1Host: static.zohocdn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Origin: https://workdrive.zohoexternal.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://workdrive.zohoexternal.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /webfonts/robotoregular/font.woff2 HTTP/1.1Host: static.zohocdn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Origin: https://workdrive.zohoexternal.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://workdrive.zohoexternal.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /personal/stable/jsapps/ui-lab/dist/assets/dev/worker/xhr_worker.min.js HTTP/1.1Host: static.zohocdn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Origin: https://workdrive.zohoexternal.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://workdrive.zohoexternal.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /personal/stable/jsapps/enterprise/dist/assets/assetMap.json HTTP/1.1Host: static.zohocdn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Origin: https://workdrive.zohoexternal.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://workdrive.zohoexternal.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /personal/stable/jsapps/ui-lab/dist/assets/assetMap.json HTTP/1.1Host: static.zohocdn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Origin: https://workdrive.zohoexternal.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://workdrive.zohoexternal.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9If-None-Match: "b47f3516dd702133ff00bcf500ab3ffa"If-Modified-Since: Tue, 23 Apr 2024 08:34:54 GMT
Source: global traffic HTTP traffic detected: GET /public/api/v1/downloadauth/inx6y681f89af8e8540ce9baba2db2bf7801f?linkId=487UVgNglIf-VCSHr HTTP/1.1Host: workdrive.zohoexternal.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: application/json; charset=utf-8Accept: application/json, text/javascript, */*; q=0.01X-ZCSRF-TOKEN: zpcr=3f3b2cef-fe64-4d9e-b61b-42cd8a8ee7c7X-Requested-With: XMLHttpRequestsec-ch-ua-platform: "Windows"Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://workdrive.zohoexternal.com/external/e6b6caa7935dc26506daa69f1bbc974bb9ff94fe4fb64dfb0de1a223c630f65a/downloadAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: bf956ea90a=873849da85872a89dadb6dd4f709f4b7; zpcc=3f3b2cef-fe64-4d9e-b61b-42cd8a8ee7c7; _zcsr_tmp=3f3b2cef-fe64-4d9e-b61b-42cd8a8ee7c7; 487UVgNglIf-VCSHr_user_uuid=$3416683837468328862; inx6y681f89af8e8540ce9baba2db2bf7801f=487UVgNglIf-VCSHr; JSESSIONID=4BDAC997A97D5960FF34D0B2EBCE763B
Source: global traffic HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=AxlFWCbwFPwmpUS&MD=C2E3BXTs HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic HTTP traffic detected: GET /public/api/v1/downloadauth/inx6y681f89af8e8540ce9baba2db2bf7801f?linkId=487UVgNglIf-VCSHr HTTP/1.1Host: workdrive.zohoexternal.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: bf956ea90a=873849da85872a89dadb6dd4f709f4b7; zpcc=3f3b2cef-fe64-4d9e-b61b-42cd8a8ee7c7; _zcsr_tmp=3f3b2cef-fe64-4d9e-b61b-42cd8a8ee7c7; 487UVgNglIf-VCSHr_user_uuid=$3416683837468328862; inx6y681f89af8e8540ce9baba2db2bf7801f=487UVgNglIf-VCSHr; JSESSIONID=4BDAC997A97D5960FF34D0B2EBCE763B
Source: global traffic HTTP traffic detected: GET /public/workdrive-external/download/inx6y681f89af8e8540ce9baba2db2bf7801f?x-cli-msg=%7B%22linkId%22%3A%22487UVgNglIf-VCSHr%22%2C%22isFileOwner%22%3Afalse%2C%22version%22%3A%221.0%22%7D HTTP/1.1Host: files-accl.zohoexternal.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-siteSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: iframeReferer: https://workdrive.zohoexternal.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 487UVgNglIf-VCSHr_user_uuid=$3416683837468328862; inx6y681f89af8e8540ce9baba2db2bf7801f=487UVgNglIf-VCSHr
Source: global traffic HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: */*Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic HTTP traffic detected: GET /ab HTTP/1.1Host: evoke-windowsservices-tas.msedge.netCache-Control: no-store, no-cacheX-PHOTOS-CALLERID: 9NMPJ99VJBWVX-EVOKE-RING: X-WINNEXT-RING: PublicX-WINNEXT-TELEMETRYLEVEL: BasicX-WINNEXT-OSVERSION: 10.0.19045.0X-WINNEXT-APPVERSION: 1.23082.131.0X-WINNEXT-PLATFORM: DesktopX-WINNEXT-CANTAILOR: FalseX-MSEDGE-CLIENTID: {c1afbad7-f7da-40f2-92f9-8846a91d69bd}X-WINNEXT-PUBDEVICEID: dbfen2nYS7HW6ON4OdOknKxxv2CCI5LJBTojzDztjwI=If-None-Match: 2056388360_-1434155563Accept-Encoding: gzip, deflate, br
Source: global traffic HTTP traffic detected: GET /client/config?cc=CH&setlang=en-CH HTTP/1.1X-Search-CortanaAvailableCapabilities: NoneX-Search-SafeSearch: ModerateAccept-Encoding: gzip, deflateX-Device-MachineId: {92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A}X-UserAgeClass: UnknownX-BM-Market: CHX-BM-DateFormat: dd/MM/yyyyX-Device-OSSKU: 48X-BM-DTZ: 120X-DeviceID: 01000A41090080B6X-BM-WindowsFlights: FX:117B9872,FX:119E26AD,FX:11C0E96C,FX:11C6E5C2,FX:11C7EB6A,FX:11C9408A,FX:11C940DB,FX:11CB9A9F,FX:11CB9AC1,FX:11CC111C,FX:11D5BFCD,FX:11DF5B12,FX:11DF5B75,FX:1240931B,FX:124B38D0,FX:127FC878,FX:1283FFE8,FX:12840617,FX:128979F9,FX:128EBD7E,FX:129135BB,FX:129E053F,FX:12A74DB5,FX:12AB734D,FX:12B8450E,FX:12BD6E73,FX:12C3331B,FX:12C7D66EX-Search-TimeZone: Bias=-60; DaylightBias=-60; TimeZoneKeyName=W. Europe Standard TimeX-BM-Theme: 000000;0078d7X-Search-RPSToken: t%3DEwDYAkR8BAAUcvamItSE/vUHpyZRp3BeyOJPQDsAAUuzSBT3Xzb3XyEiuucPwb%2B9I6ctxeJlrYkTUv9MiV9SezU51h8JMxbTXuEad%2B/eoJgwkUR3rH1Ux7DbbsPfYaFlxvtYvq3rX5YnBvki%2Brn5T01IM5XwCRhvufrhc1tNYM06NpUy1f2nS2mv4j3AJEZk9QLmuaYDuOw9dEMfRij9OoNHJRNFZaAT9LNrV5Qb38ldQsCALOBtOT%2BHRB3HP8dRlKn03/skkLCRxuC25jF9qhSNfHan0Dadpt7t4IO14iBR5xT8AZAOGGlu82Tb1fVbbE7fbidrljp3FkcMGA/SlawHcmU6zTrNgJzGfHC2eUNhpUz/hCyNSQ%2B3xOYX5xYDZgAACOgiFsz9J%2BDWqAGTphyeWxKvv8y4lisjeJPBVzKgE/cXA0ab/3/q3PxUoR5QgnI8tbQnyqK1vx8O1/dTe1Hws8Z9HImejagUSf8fpu9j62TDq4BsahGmegI7V/3pp7J5Xnq6Jrl%2Brx12bolxwyhRfSnY0hjJA/CUf9UGJpHTV0ZjjRDbutulv5Uj31Fewh%2Bf9LwYPB7JdgNoPr3jq7YXkxCatTd/dAyUQgDURDATkDr1cR7coVzm2fee99P355lR%2B2YXKHD2oxKEg9t58EA/kIAPLEyws1pHg0BfHbdzs09aqo69uNKAYYjD5jBtZhbPdpqA771aT3sr0u31x3YENttrJQNg11HxV0LMa5N%2Bx4dVy16r52FxGRgAxhN%2BrX7newSjdA/zh4qJ5wqoEwqGQ1YglpXSWWmCvLrobgQg51veWaREHlF4KcmUoAlz1fgCGjoZntqriuMnBoeCqZKSWD5ZU7FvhsDtSjHQxN4VkGXJzFHSv8bd6NfqNqQF1O7sE7VrDg7ArzB9Vo%2BUexikarLub01x65f6XCQ9rMLnPjz7UpMbGtUeRM3VhwvhdajXssbn2gE%3D%26p%3DX-Agent-DeviceId: 01000A41090080B6X-BM-CBT: 1713901650User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045X-Device-isOptin: falseAccept-language: en-GB, en, en-USX-Device-Touch: falseX-Device-ClientSession: AC1F1C6D2589483FB1C7EDC751A0BADDX-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUIHost: www.bing.comConnection: Keep-AliveCookie: SRCHUID=V=2&GUID=C4EAB6C130004333A34B5668AE4E4D10&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20240207; SRCHHPGUSR=SRCHLANG=en; MUID=4590362BB5CF472B95BBEDB3112D4B7B; MUIDB=4590362BB5CF472B95BBEDB3112D4B7B
Source: global traffic HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=AxlFWCbwFPwmpUS&MD=C2E3BXTs HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: Tax Forms.exe, 00000010.00000002.1717839819.0000000011534000.00000002.00000001.01000000.00000009.sdmp String found in binary or memory: eCMD_URL_Set_manageMaterialsURL www.yahoo.com equals www.yahoo.com (Yahoo)
Source: unknown DNS traffic detected: queries for: workdrive.zohoexternal.com
Source: unknown HTTP traffic detected: POST /RST2.srf HTTP/1.0Connection: Keep-AliveContent-Type: application/soap+xmlAccept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})Content-Length: 4788Host: login.live.com
Source: chromecache_136.1.dr String found in binary or memory: http://accounts.zoho.com
Source: Tax Forms.exe, 00000010.00000002.1717839819.0000000011534000.00000002.00000001.01000000.00000009.sdmp String found in binary or memory: http://s.gotomeeting.com/forgotpwd?email=
Source: Tax Forms.exe, 00000010.00000002.1717839819.0000000011534000.00000002.00000001.01000000.00000009.sdmp String found in binary or memory: http://s.gotomeeting.com/install-outlook-pluginhttp://support.citrixonline.com/s/G2M/Help/MPEGLAC:
Source: Tax Forms.exe, 00000010.00000002.1717839819.0000000011534000.00000002.00000001.01000000.00000009.sdmp String found in binary or memory: http://support.citrixonline.com/en_US/Meeting/help_files/G2M040012?Title=Use
Source: Tax Forms.exe, 00000010.00000002.1717839819.0000000011534000.00000002.00000001.01000000.00000009.sdmp String found in binary or memory: http://support.citrixonline.com/s/G2M/Help/VoIPInitializationErrorhttp://s.gotomeeting.com/g2mscreen
Source: Tax Forms.exe, 00000010.00000002.1717839819.0000000011534000.00000002.00000001.01000000.00000009.sdmp String found in binary or memory: http://support.citrixonline.com/s/G2M/Help/WhatsNewu~
Source: Tax Forms.exe, 00000010.00000002.1717839819.0000000011534000.00000002.00000001.01000000.00000009.sdmp String found in binary or memory: http://support.citrixonline.com/s/G2TG2W/Help/findDefaultURL()%s-Failed
Source: Tax Forms.exe, 00000010.00000002.1717839819.0000000011534000.00000002.00000001.01000000.00000009.sdmp String found in binary or memory: http://support.gotomeeting.com/ics/support/default.asp?deptID=5641&task=knowledge&questionID=3725Des
Source: Tax Forms.exe, 00000010.00000002.1717839819.0000000011534000.00000002.00000001.01000000.00000009.sdmp String found in binary or memory: http://www.citrix.com/about/legal/citrix-online-privacy-policy-
Source: Tax Forms.exe, 00000010.00000002.1717839819.0000000011534000.00000002.00000001.01000000.00000009.sdmp String found in binary or memory: http://www.gotomeeting.comSoftware/Expertcity..
Source: Tax Forms.exe, 00000010.00000002.1717839819.0000000011534000.00000002.00000001.01000000.00000009.sdmp String found in binary or memory: http://www.openssl.org/support/faq.html
Source: Tax Forms.exe, 00000010.00000002.1717839819.0000000011534000.00000002.00000001.01000000.00000009.sdmp String found in binary or memory: https://audio-usability.cdn.citrixonline.com/https://i22.gotomeeting.com/island/ash/ash.tmpl/approve
Source: Tax Forms.exe, 00000010.00000002.1717839819.0000000011534000.00000002.00000001.01000000.00000009.sdmp String found in binary or memory: https://cdn.gotomeet.at/images/whatsnew/
Source: Tax Forms.exe, 00000010.00000002.1717839819.0000000011534000.00000002.00000001.01000000.00000009.sdmp String found in binary or memory: https://cdn.gotomeet.at/images/whatsnew/..
Source: Tax Forms.exe, 00000010.00000002.1717839819.0000000011534000.00000002.00000001.01000000.00000009.sdmp String found in binary or memory: https://citrix.co1.qualtrics.com/SE/?SID=SV_3pHgu7AoUzFSGJD&sid=getBaseFeedbackURL()%s-Audio
Source: Tax Forms.exe, 00000010.00000002.1717839819.0000000011534000.00000002.00000001.01000000.00000009.sdmp String found in binary or memory: https://confluence.ops.expertcity.com/display/Proj/Endpoint
Source: chromecache_136.1.dr String found in binary or memory: https://css.zohostatic.com/personal/stable
Source: chromecache_136.1.dr String found in binary or memory: https://files-accl.zohoexternal.com
Source: chromecache_136.1.dr String found in binary or memory: https://files-accl.zohoexternal.com/WD-Chunk-Public/v2/stream/publicupload
Source: chromecache_136.1.dr String found in binary or memory: https://files-accl.zohoexternal.com/public/workdrive-external/download/inx6y681f89af8e8540ce9baba2db
Source: chromecache_136.1.dr String found in binary or memory: https://files-accl.zohoexternal.com/publicupload
Source: chromecache_136.1.dr String found in binary or memory: https://files.zohoexternal.com/WD-Chunk-Public/v2/stream/publicupload
Source: chromecache_136.1.dr String found in binary or memory: https://files.zohoexternal.com/publicupload
Source: chromecache_136.1.dr String found in binary or memory: https://js.zohostatic.com/personal/stable
Source: Tax Forms.exe, 00000010.00000002.1717839819.0000000011534000.00000002.00000001.01000000.00000009.sdmp String found in binary or memory: https://logging.citrixonline.com/report..
Source: Tax Forms.exe, 00000010.00000002.1717839819.0000000011534000.00000002.00000001.01000000.00000009.sdmp String found in binary or memory: https://logging.citrixonline.comlogginged1.citrixonline.com/loghttps://%s%sBIConsumerX-TopicmachineI
Source: Tax Forms.exe, 00000010.00000002.1717839819.0000000011534000.00000002.00000001.01000000.00000009.sdmp String found in binary or memory: https://logined1.citrixonline.com/rest/autoLoginUrlMatchMakingCycleFinishedG2MLauncherThread::~G2MLa
Source: Tax Forms.exe, 00000010.00000002.1717839819.0000000011534000.00000002.00000001.01000000.00000009.sdmp String found in binary or memory: https://p5.osdimg.com/g2m/live/services.jsonhttps://s5.osdstageimg.com/g2m/stage/services.jsonhttps:
Source: Tax Forms.exe, 00000010.00000002.1717839819.0000000011534000.00000002.00000001.01000000.00000009.sdmp String found in binary or memory: https://p5.osdimg.com/g2mupdater/live/config.jsonDownloading
Source: Tax Forms.exe, 00000010.00000002.1717839819.0000000011534000.00000002.00000001.01000000.00000009.sdmp String found in binary or memory: https://secure.citrixonline.com/buy?execution=e1s1https://secure.citrixonline.com/commerce/forgotPas
Source: chromecache_136.1.dr String found in binary or memory: https://static.zohocdn.com/personal/stable
Source: chromecache_147.1.dr String found in binary or memory: https://static.zohocdn.com/personal/stable/jsapps/enterprise/dist/assets/assetMap.json
Source: chromecache_136.1.dr String found in binary or memory: https://static.zohocdn.com/personal/stable/jsapps/files/dist/
Source: chromecache_136.1.dr String found in binary or memory: https://static.zohocdn.com/personal/stable/jsapps/ui-lab/dist/
Source: chromecache_147.1.dr String found in binary or memory: https://static.zohocdn.com/personal/stable/jsapps/ui-lab/dist/assets/assetMap.json
Source: chromecache_136.1.dr String found in binary or memory: https://static.zohocdn.com/personal/stable/jsapps/ui-lab/dist/assets/dev/wd_images/favicons/defaults
Source: chromecache_147.1.dr String found in binary or memory: https://static.zohocdn.com/personal/stable/jsapps/ui-lab/dist/assets/dev/worker/xhr_worker.min.js
Source: chromecache_136.1.dr String found in binary or memory: https://static.zohocdn.com/quartz/feedback/v2/zquartz-tracker.js
Source: chromecache_147.1.dr String found in binary or memory: https://static.zohocdn.com/webfonts/robotobold/font.woff2
Source: chromecache_147.1.dr String found in binary or memory: https://static.zohocdn.com/webfonts/robotomedium/font.woff2
Source: chromecache_147.1.dr String found in binary or memory: https://static.zohocdn.com/webfonts/robotoregular/font.woff2
Source: Tax Forms.exe, 00000010.00000002.1717839819.0000000011534000.00000002.00000001.01000000.00000009.sdmp String found in binary or memory: https://storage.citrixonline.com/storage/files/product/g2m/path/AIR//Upload/AIR/UploadFolder
Source: chromecache_136.1.dr String found in binary or memory: https://workdrive.zohoexternal.com
Source: chromecache_136.1.dr String found in binary or memory: https://workdrive.zohoexternal.com/public/api/v1/license/4431844000081981116
Source: chromecache_136.1.dr String found in binary or memory: https://workdrive.zohoexternal.com/services/oembed?type=json&url=https%3A%2F%2Fworkdrive.zohoexterna
Source: chromecache_136.1.dr String found in binary or memory: https://workdrive.zohoexternal.com/sheet
Source: chromecache_136.1.dr String found in binary or memory: https://workdrive.zohoexternal.com/show
Source: chromecache_136.1.dr String found in binary or memory: https://workdrive.zohoexternal.com/writer
Source: Tax Forms.exe, 00000010.00000002.1717839819.0000000011534000.00000002.00000001.01000000.00000009.sdmp String found in binary or memory: https://www.gotomeeting.comAudioHelpUrlG2MPreferences::setWebUrl()%s-theWebUrl
Source: Tax Forms.exe, 00000010.00000002.1717839819.0000000011534000.00000002.00000001.01000000.00000009.sdmp String found in binary or memory: https://www.gotowebinar.comG2MPreferences::setWebUrlWebinar()WebsiteUrlTraininghttps://www.gototrain
Source: Tax Forms.exe, 00000010.00000000.1505749513.00000000011F6000.00000002.00000001.01000000.00000006.sdmp String found in binary or memory: https://www.handyviewer.com
Source: Tax Forms.exe, 00000010.00000000.1504084933.0000000000AD1000.00000020.00000001.01000000.00000006.sdmp String found in binary or memory: https://www.handyviewer.com/check-version.php?version=openS
Source: Tax Forms.exe, 00000010.00000000.1504084933.0000000000AD1000.00000020.00000001.01000000.00000006.sdmp String found in binary or memory: https://www.handyviewer.com/contact.htmlopenSV
Source: Tax Forms.exe, 00000010.00000000.1504084933.0000000000AD1000.00000020.00000001.01000000.00000006.sdmp String found in binary or memory: https://www.handyviewer.com/donate.htmlopen
Source: Tax Forms.exe, 00000010.00000000.1504084933.0000000000AD1000.00000020.00000001.01000000.00000006.sdmp String found in binary or memory: https://www.handyviewer.com/donate.htmlopenS
Source: Tax Forms.exe, 00000010.00000000.1504084933.0000000000AD1000.00000020.00000001.01000000.00000006.sdmp String found in binary or memory: https://www.handyviewer.com/manual/openU
Source: Tax Forms.exe, 00000010.00000000.1504084933.0000000000AD1000.00000020.00000001.01000000.00000006.sdmp String found in binary or memory: https://www.handyviewer.com/open
Source: Tax Forms.exe, 00000010.00000000.1504084933.0000000000AD1000.00000020.00000001.01000000.00000006.sdmp String found in binary or memory: https://www.handyviewer.com/openS
Source: Tax Forms.exe, 00000010.00000000.1504084933.0000000000AD1000.00000020.00000001.01000000.00000006.sdmp String found in binary or memory: https://www.handyviewer.com/openSV
Source: chromecache_136.1.dr String found in binary or memory: https://www.zoho.com/workdrive
Source: chromecache_136.1.dr String found in binary or memory: https://www.zoho.com/workdrive/signup.html
Source: unknown Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown Network traffic detected: HTTP traffic on port 49676 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49691 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49691
Source: unknown Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown Network traffic detected: HTTP traffic on port 49680 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown Network traffic detected: HTTP traffic on port 49677 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown HTTPS traffic detected: 13.85.23.86:443 -> 192.168.2.17:49742 version: TLS 1.2
Source: unknown HTTPS traffic detected: 23.221.242.90:443 -> 192.168.2.17:49750 version: TLS 1.2
Source: unknown HTTPS traffic detected: 23.221.242.90:443 -> 192.168.2.17:49751 version: TLS 1.2
Source: unknown HTTPS traffic detected: 40.126.7.32:443 -> 192.168.2.17:49752 version: TLS 1.2
Source: unknown HTTPS traffic detected: 13.107.5.88:443 -> 192.168.2.17:49753 version: TLS 1.2
Source: unknown HTTPS traffic detected: 13.107.21.200:443 -> 192.168.2.17:49754 version: TLS 1.2
Source: unknown HTTPS traffic detected: 13.85.23.86:443 -> 192.168.2.17:49755 version: TLS 1.2

System Summary
barindex
Downloads suspicious files via Chrome
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File dump: C:\Users\user\Downloads\Tax Forms.zip (copy) Jump to dropped file
Abnormal high CPU Usage
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Process Stats: CPU usage > 24%
Source: classification engine Classification label: sus22.win@17/85@12/6
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe File created: C:\Users\user\AppData\Local\Temp\ILIST-3F8582D8.tmp Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Windows\System32\rundll32.exe Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: unknown Process created: C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
Source: unknown Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://workdrive.zohoexternal.com/external/e6b6caa7935dc26506daa69f1bbc974bb9ff94fe4fb64dfb0de1a223c630f65a/download
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 --field-trial-handle=1936,i,2894464684335535053,7787294115027878273,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown Process created: C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
Source: unknown Process created: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe "C:\Users\user\Downloads\Tax Forms\Tax Forms.exe"
Source: unknown Process created: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe "C:\Users\user\Downloads\Tax Forms\Tax Forms.exe"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 --field-trial-handle=1936,i,2894464684335535053,7787294115027878273,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Section loaded: oledlg.dll Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Section loaded: avifil32.dll Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Section loaded: msvfw32.dll Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Section loaded: shfolder.dll Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Section loaded: msacm32.dll Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Section loaded: winmmbase.dll Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Section loaded: winmmbase.dll Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Section loaded: wtsapi32.dll Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Section loaded: winsta.dll Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Section loaded: windowscodecs.dll Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Section loaded: textshaping.dll Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Section loaded: mscms.dll Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Section loaded: coloradapterclient.dll Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Section loaded: drprov.dll Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Section loaded: ntlanman.dll Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Section loaded: davclnt.dll Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Section loaded: davhlpr.dll Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Section loaded: cscapi.dll Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Section loaded: dlnashext.dll Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Section loaded: playtodevice.dll Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Section loaded: devdispitemprovider.dll Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Section loaded: mmdevapi.dll Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Section loaded: devobj.dll Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Section loaded: wpdshext.dll Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Section loaded: portabledeviceapi.dll Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Section loaded: audiodev.dll Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Section loaded: wmvcore.dll Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Section loaded: wmasf.dll Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Section loaded: mfperfhelper.dll Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Section loaded: ntshrui.dll Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Section loaded: thumbcache.dll Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Section loaded: wsock32.dll Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Section loaded: powrprof.dll Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Section loaded: avicap32.dll Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Section loaded: d3d9.dll Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Section loaded: samcli.dll Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Section loaded: dwmapi.dll Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Section loaded: logoncli.dll Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Section loaded: umpdc.dll Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Section loaded: k7rn7l32.dll Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Section loaded: ntd3ll.dll Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Section loaded: d3d10warp.dll Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Section loaded: oledlg.dll Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Section loaded: avifil32.dll Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Section loaded: msvfw32.dll Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Section loaded: shfolder.dll Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Section loaded: msacm32.dll Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Section loaded: winmmbase.dll Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Section loaded: winmmbase.dll Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Section loaded: wtsapi32.dll Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Section loaded: winsta.dll Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Section loaded: windowscodecs.dll Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Section loaded: textshaping.dll Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Section loaded: mscms.dll Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Section loaded: coloradapterclient.dll Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Section loaded: drprov.dll Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Section loaded: ntlanman.dll Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Section loaded: davclnt.dll Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Section loaded: davhlpr.dll Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Section loaded: cscapi.dll Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Section loaded: dlnashext.dll Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Section loaded: playtodevice.dll Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Section loaded: devdispitemprovider.dll Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Section loaded: mmdevapi.dll Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Section loaded: devobj.dll Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Section loaded: wpdshext.dll Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Section loaded: portabledeviceapi.dll Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Section loaded: audiodev.dll Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Section loaded: wmvcore.dll Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Section loaded: wmasf.dll Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Section loaded: mfperfhelper.dll Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Section loaded: ntshrui.dll Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Section loaded: thumbcache.dll Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Section loaded: wsock32.dll Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Section loaded: powrprof.dll Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Section loaded: avicap32.dll Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Section loaded: d3d9.dll Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Section loaded: samcli.dll Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Section loaded: dwmapi.dll Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Section loaded: logoncli.dll Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Section loaded: umpdc.dll Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Section loaded: k7rn7l32.dll Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Section loaded: ntd3ll.dll Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Section loaded: d3d10warp.dll Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CACAF262-9370-4615-A13B-9F5539DA4C0A}\InProcServer32 Jump to behavior
Source: Google Drive.lnk.0.dr LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Window found: window name: TMainForm Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: Binary string: C:\p4builds\Products\GoToMeeting\release-723\output\G2M_Dll.pdb source: Tax Forms.exe, 00000010.00000002.1717839819.0000000011534000.00000002.00000001.01000000.00000009.sdmp
Stores files to the Windows start menu directory
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk Jump to behavior
Source: C:\Windows\System32\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: Tax Forms.exe, 00000010.00000002.1721900252.000000001189F000.00000008.00000001.01000000.00000009.sdmp Binary or memory string: WorkerWProgman
Source: Tax Forms.exe, 00000010.00000002.1717839819.0000000011534000.00000002.00000001.01000000.00000009.sdmp Binary or memory string: Shell_TrayWndBaseBarexcel.exeCSharingModeApp::prepareChosenAppWindowsToBeShown attempt to share empty rectangle.CSharingModeApp::prepareChosenAppWindowsToBeShown BringWindowToTop failed.h
Source: Tax Forms.exe, 00000010.00000002.1717839819.0000000011534000.00000002.00000001.01000000.00000009.sdmp Binary or memory string: ..\..\..\Shared\Code\Common\ECBase64.cpp==..\..\Code\Win32\ECWindowsSecurity.cppAllocateAndInitializeSid()OpenProcessTokenOpenThreadTokenUnable to aquire user token for impersonationImpersonateLoggedOnUser()RevertToSelf()::OpenProcess(%d) failed, last error = %d::OpenProcessToken() failed, process id = %d, last error = %d::GetTokenInformation() failed, process id = %d, last error = %d::LookupAccountSid() failed, process id = %d, last error = %d account name = %s, domain name = %sLogged on user process found: process id = %d, process name = %s::OpenDesktop(%s) failed, last error = %dProgmanexplorer.exeWinSta0Failed to open WinSta0, last error = %dECWindowsSecurity::getLoggedOnUserToken_ThisWTSSession()Failed to open process token for process id %uFailed to open process id %uDuplicateTokenExUnexpected result from GetTokenInformation(). Last error = %dGetTokenInformationConvertSidToStringSidLookupAccountSidN/A----------------------------------------------------------------SeTcbPrivilegeWTSQueryUserTokenProcessIdToSessionIdProcessIdToSessionId() not found in kernel32.dllProcessIdToSessionIdFailed to find WTSGetActiveConsoleSessionId() in kernel32.dllFailed to load and initialize the WTSApi32 library.GetTokenInformation()Failed to allocate buffer for the token information structure::IsTokenRestricted()AllocateAndInitializeSidEqualSidECImpersonator::~ECImpersonator()%s - The start method was never invoked for this ECImpersonator object.ECImpersonator::start()%s - already impersonating\\..\..\..\Shared\File\Common\ECFileSpec.cppGetModuleFileName()lpFilename != 0nSize > 0GetModuleHandleEx()GetShortPathName()..
Searches for user specific document files
Source: C:\Users\user\Downloads\Tax Forms\Tax Forms.exe Directory queried: C:\Users\user\Documents Jump to behavior
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1430560 URL: https://workdrive.zohoexter... Startdate: 23/04/2024 Architecture: WINDOWS Score: 22 31 Downloads suspicious files via Chrome 2->31 6 chrome.exe 20 2->6         started        10 Tax Forms.exe 15 2->10         started        12 Tax Forms.exe 1 15 2->12         started        14 rundll32.exe 2->14         started        process3 dnsIp4 27 192.168.2.17, 137, 138, 443 unknown unknown 6->27 29 239.255.255.250 unknown Reserved 6->29 19 C:\Users\user\...\Tax Forms.zip (copy), Zip 6->19 dropped 16 chrome.exe 6->16         started        file5 process6 dnsIp7 21 zpublic-h2.zohopublic.com 136.143.191.16, 443, 49708, 49732 ZOHO-ASUS United States 16->21 23 h2-stratus.zohocdn.com 204.141.33.48, 443, 49709, 49710 ZOHO-ASUS United States 16->23 25 6 other IPs or domains 16->25
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
204.141.33.48
 h2-stratus.zohocdn.com United States
2639 ZOHO-ASUS false
239.255.255.250
 unknown Reserved
unknown unknown false
136.143.191.16
 zpublic-h2.zohopublic.com United States
2639 ZOHO-ASUS false
172.253.124.104
 www.google.com United States
15169 GOOGLEUS false
169.148.154.31
 useast.zohoaccl.com United States
158 ERI-ASUS false

Private

IP
192.168.2.17

Contacted Domains

Name IP Active
zpublic-h2.zohopublic.com 136.143.191.16 true
h2-stratus.zohocdn.com 204.141.33.48 true
www.google.com 172.253.124.104 true
useast.zohoaccl.com 169.148.154.31 true
workdrive.zohoexternal.com unknown unknown
static.zohocdn.com unknown unknown
files-accl.zohoexternal.com unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
https://static.zohocdn.com/zohofonts/zohopuvi/4.0/Zoho_Puvi_Regular.woff2 false
  • Avira URL Cloud: safe
 unknown
https://static.zohocdn.com/webfonts/robotomedium/font.woff2 false
  • Avira URL Cloud: safe
 unknown
https://static.zohocdn.com/personal/stable/jsapps/files/dist/engines-dist/wd-chooser-components/assets/engine-ea5829e90f6248fb04814ea6c5ba0f67.js false
  • Avira URL Cloud: safe
 unknown
https://workdrive.zohoexternal.com/zwd_sw.js false
  • Avira URL Cloud: safe
 unknown
https://static.zohocdn.com/personal/stable/jsapps/files/dist/engines-dist/wd-docs-menu/assets/engine-b5e083f490a369d30240b6020dc7105f.js false
  • Avira URL Cloud: safe
 unknown
https://static.zohocdn.com/zohofonts/zohopuvi/4.0/Zoho_Puvi_Bold.woff2 false
  • Avira URL Cloud: safe
 unknown
https://workdrive.zohoexternal.com/external/e6b6caa7935dc26506daa69f1bbc974bb9ff94fe4fb64dfb0de1a223c630f65a/download false
    		unknown
    https://static.zohocdn.com/personal/stable/jsapps/files/dist/assets/vendor-c443ff360647f7450d97230139bcc018.js false
    • Avira URL Cloud: safe
    		 unknown
    https://static.zohocdn.com/personal/stable/jsapps/files/dist/assets/files-7b7c1ab31ede3c1dba4fe27ac610609d.js false
    • Avira URL Cloud: safe
    		 unknown
    https://static.zohocdn.com/personal/stable/jsapps/files/dist/assets/assetMap.json false
    • Avira URL Cloud: safe
    		 unknown
    https://static.zohocdn.com/webfonts/robotobold/font.woff2 false
    • Avira URL Cloud: safe
    		 unknown
    https://static.zohocdn.com/personal/stable/jsapps/ui-lab/dist/assets/dev/svg-icons/icon-list-8d90da9709bd1da0c5e81d54042dd26f.js false
    • Avira URL Cloud: safe
    		 unknown
    https://static.zohocdn.com/personal/stable/jsapps/ui-lab/dist/assets/assetMap.json false
    • Avira URL Cloud: safe
    		 unknown
    https://static.zohocdn.com/personal/stable/jsapps/ui-lab/dist/assets/dev/default_theme-d91bac1ca5e39da5e0d9d244ef35ccaa.css false
    • Avira URL Cloud: safe
    		 unknown
    https://static.zohocdn.com/murphysdk/2.2.2/murphy.min.js false
    • Avira URL Cloud: safe
    		 unknown
    https://workdrive.zohoexternal.com/public/api/v1/downloadauth/inx6y681f89af8e8540ce9baba2db2bf7801f?linkId=487UVgNglIf-VCSHr false
    • Avira URL Cloud: safe
    		 unknown
    https://static.zohocdn.com/webfonts/robotoregular/font.woff2 false
    • Avira URL Cloud: safe
    		 unknown
    https://static.zohocdn.com/personal/stable/jsapps/ui-lab/dist/assets/dev/worker/xhr_worker.min.js false
    • Avira URL Cloud: safe
    		 unknown
    https://static.zohocdn.com/personal/stable/jsapps/enterprise/dist/assets/assetMap.json false
    • Avira URL Cloud: safe
    		 unknown
    https://static.zohocdn.com/zohofonts/zohopuvi/4.0/Zoho_Puvi_Medium.woff2 false
    • Avira URL Cloud: safe
    		 unknown
    https://static.zohocdn.com/personal/stable/jsapps/ui-lab/dist/assets/dev/wd_images/favicons/defaults/favicon.ico false
    • Avira URL Cloud: safe
    		 unknown
    https://static.zohocdn.com/personal/stable/jsapps/ui-lab/dist/assets/dev/jquery/jquery.min-dc5e7f18c8d36ac1d3d4753a87c98d0a.js false
    • Avira URL Cloud: safe
    		 unknown
    https://static.zohocdn.com/personal/stable/jsapps/ui-lab/dist/assets/dev/wd_images/favicons/defaults/network-connection.ico?_=1713901636177 false
    • Avira URL Cloud: safe
    		 unknown
    https://static.zohocdn.com/personal/stable/jsapps/ui-lab/dist/assets/dev/intl/js/team/team-e945b0e38524b2e11a70a256d4418a2f.js false
    • Avira URL Cloud: safe
    		 unknown
    https://static.zohocdn.com/quartz/feedback/v2/zquartz-tracker.js false
    • Avira URL Cloud: safe
    		 unknown
    https://files-accl.zohoexternal.com/public/workdrive-external/download/inx6y681f89af8e8540ce9baba2db2bf7801f?x-cli-msg=%7B%22linkId%22%3A%22487UVgNglIf-VCSHr%22%2C%22isFileOwner%22%3Afalse%2C%22version%22%3A%221.0%22%7D false
    • Avira URL Cloud: safe
    		 unknown
    https://static.zohocdn.com/personal/stable/jsapps/ui-lab/dist/assets/dev/murphy/murphyInitializer.min-80a2ee059eb0699247fe0ca7a0b7a380.js false
    • Avira URL Cloud: safe
    		 unknown