Edit tour

Windows Analysis Report
https://uploaddeimagens.com.br/images/001/894/856/original/Logo_Email_Advisia.png?1550069603

Overview

General Information

Sample URL:	https://uploaddeimagens.com.br/images/001/894/856/original/Logo_Email_Advisia.png?1550069603
Analysis ID:	1431665

Detection

Score:	48
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for domain / URL

Stores files to the Windows start menu directory

Classification

Process Tree

System is w10x64_ra

chrome.exe (PID: 1308 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://uploaddeimagens.com.br/images/001/894/856/original/Logo_Email_Advisia.png?1550069603 MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

chrome.exe (PID: 5676 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 --field-trial-handle=2004,i,776650505121540931,13570064570206997227,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

cleanup

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for domain / URL

Source: uploaddeimagens.com.br

Virustotal: Detection: 6%

Perma Link

Source: https://uploaddeimagens.com.br/images/001/894/856/original/Logo_Email_Advisia.png?1550069603	HTTP Parser: No favicon
Source: https://uploaddeimagens.com.br/images/001/894/856/original/Logo_Email_Advisia.png	HTTP Parser: No favicon
Source: https://uploaddeimagens.com.br/	HTTP Parser: No favicon

Source: unknown	HTTPS traffic detected: 40.68.123.157:443 -> 192.168.2.17:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.201.212.130:443 -> 192.168.2.17:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.201.212.130:443 -> 192.168.2.17:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.29.11:443 -> 192.168.2.17:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.5.88:443 -> 192.168.2.17:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 204.79.197.200:443 -> 192.168.2.17:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.68.123.157:443 -> 192.168.2.17:49723 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 23.201.212.130
Source: unknown	TCP traffic detected without corresponding DNS query: 23.201.212.130
Source: unknown	TCP traffic detected without corresponding DNS query: 23.201.212.130
Source: unknown	TCP traffic detected without corresponding DNS query: 23.201.212.130
Source: unknown	TCP traffic detected without corresponding DNS query: 23.201.212.130
Source: unknown	TCP traffic detected without corresponding DNS query: 23.201.212.130
Source: unknown	TCP traffic detected without corresponding DNS query: 23.201.212.130
Source: unknown	TCP traffic detected without corresponding DNS query: 23.201.212.130
Source: unknown	TCP traffic detected without corresponding DNS query: 23.201.212.130
Source: unknown	TCP traffic detected without corresponding DNS query: 23.201.212.130
Source: unknown	TCP traffic detected without corresponding DNS query: 23.201.212.130
Source: unknown	TCP traffic detected without corresponding DNS query: 23.201.212.130
Source: unknown	TCP traffic detected without corresponding DNS query: 23.201.212.130
Source: unknown	TCP traffic detected without corresponding DNS query: 23.201.212.130

Source: global traffic	DNS traffic detected: DNS query: uploaddeimagens.com.br
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: uploadedimagens.com.br
Source: global traffic	DNS traffic detected: DNS query: google.com
Source: global traffic	DNS traffic detected: DNS query: static.cloudflareinsights.com
Source: global traffic	DNS traffic detected: DNS query: a.nel.cloudflare.com

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49676 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49691 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49691
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49680 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49677 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703

Source: unknown	HTTPS traffic detected: 40.68.123.157:443 -> 192.168.2.17:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.201.212.130:443 -> 192.168.2.17:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.201.212.130:443 -> 192.168.2.17:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.29.11:443 -> 192.168.2.17:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.5.88:443 -> 192.168.2.17:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 204.79.197.200:443 -> 192.168.2.17:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.68.123.157:443 -> 192.168.2.17:49723 version: TLS 1.2

Source: classification engine

Classification label: mal48.win@18/15@20/102

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://uploaddeimagens.com.br/images/001/894/856/original/Logo_Email_Advisia.png?1550069603
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 --field-trial-handle=2004,i,776650505121540931,13570064570206997227,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 --field-trial-handle=2004,i,776650505121540931,13570064570206997227,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
https://uploaddeimagens.com.br/images/001/894/856/original/Logo_Email_Advisia.png?1550069603	0%	Avira URL Cloud	safe

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Link
uploaddeimagens.com.br	7%	Virustotal	Browse
uploadedimagens.com.br	0%	Virustotal	Browse
static.cloudflareinsights.com	0%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label	Link
about:blank	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
google.com	64.233.185.139	true	false		high
a.nel.cloudflare.com	35.190.80.1	true	false		high
static.cloudflareinsights.com	104.16.80.73	true	false	0%, Virustotal, Browse	unknown
www.google.com	108.177.122.103	true	false		high
uploaddeimagens.com.br	172.67.215.45	true	true	7%, Virustotal, Browse	unknown
uploadedimagens.com.br	unknown	unknown	false	0%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://uploaddeimagens.com.br/images/001/894/856/original/Logo_Email_Advisia.png	false		unknown
about:blank	false	Avira URL Cloud: safe	low
https://uploaddeimagens.com.br/	false		unknown
https://uploaddeimagens.com.br/images/001/894/856/original/Logo_Email_Advisia.png?1550069603	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
74.125.136.97	unknown	United States	15169	GOOGLEUS	false
1.1.1.1	unknown	Australia	13335	CLOUDFLARENETUS	false
142.250.105.94	unknown	United States	15169	GOOGLEUS	false
74.125.136.138	unknown	United States	15169	GOOGLEUS	false
172.67.215.45	uploaddeimagens.com.br	United States	13335	CLOUDFLARENETUS	true
104.16.80.73	static.cloudflareinsights.com	United States	13335	CLOUDFLARENETUS	false
8.8.8.8	unknown	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.251.15.97	unknown	United States	15169	GOOGLEUS	false
64.233.176.101	unknown	United States	15169	GOOGLEUS	false
35.190.80.1	a.nel.cloudflare.com	United States	15169	GOOGLEUS	false
74.125.138.94	unknown	United States	15169	GOOGLEUS	false
108.177.122.103	www.google.com	United States	15169	GOOGLEUS	false
172.217.215.84	unknown	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.17
192.168.2.18

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1431665
Start date and time:	2024-04-25 15:46:41 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Sample URL:	https://uploaddeimagens.com.br/images/001/894/856/original/Logo_Email_Advisia.png?1550069603
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled
Analysis Mode:	stream
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal48.win@18/15@20/102

Warnings

Exclude process from analysis (whitelisted): SIHClient.exe
Excluded IPs from analysis (whitelisted): 74.125.138.94, 74.125.136.138, 74.125.136.102, 74.125.136.139, 74.125.136.100, 74.125.136.101, 74.125.136.113, 172.217.215.84, 34.104.35.123
Excluded domains from analysis (whitelisted): clients2.google.com, accounts.google.com, edgedl.me.gvt1.com, clientservices.googleapis.com, clients.l.google.com
Not all processes where analyzed, report is missing behavior information

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Apr 25 12:47:09 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9926454763885832
Encrypted:	false
SSDEEP:
MD5:	7A21580AB2FF5B4B583B033A13149126
SHA1:	10372BF4DC354E79688FE7C8881541A4A7726BDB
SHA-256:	9982D4338886F78E1CD71DCCF836C277133F62B8BBD575D40DDF354FFDCB5B52
SHA-512:	53BF7D6BA5AFEAC761333C2BD9AA87A9C2604D32059E115999C150354F4FFC078CD1F505E8A81A1EC40D0C43399A96A961D9B977B4D1D09BE0A542C735232D52
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,......S.........y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.I.X.m....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X.m....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.V.X.m....M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.V.X.m...........................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V.X.m...........................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............!.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Apr 25 12:47:09 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	4.007732281594899
Encrypted:	false
SSDEEP:
MD5:	436E4BAA4954DA7B2215E2E8815F16C0
SHA1:	25546175FFE32A19A6E4662402345BE45A8525A4
SHA-256:	6B4A701B336D30305DE00784767CC1952E8BAF4D1EF1ABD4C3FA4F74A5C6018F
SHA-512:	340FA309E984B4C88940B4619A4B6FE75D3722377E77F9F0DB1E46CD7ED529A4B1EF76320AF7489D961B5EAFCEDC9C38CD28B4AE2F2F6008738291B3A4AD8E8E
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,......G.........y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.I.X.m....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X.m....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.V.X.m....M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.V.X.m...........................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V.X.m...........................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............!.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:54:41 2023, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2693
Entropy (8bit):	4.018216201602636
Encrypted:	false
SSDEEP:
MD5:	A2421D2319994A38FD261009240F10F8
SHA1:	DE380AA9E6E1EF36B48F4D2DDBA7D1E1C8E3D608
SHA-256:	1326FB83EA82438083501B4CEC2315DA8A1E2889D7A3C147AB9829E7DBD8F0D0
SHA-512:	5EC1F2478B7A3375FAEF6C1CC146440BA4B00F3193743D16821A785F331A37267DFEF3BC15B8D91B528420178B16EC268E2E8AA92DC7AFA0F20A552F97A66259
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.....v. ;.......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.I.X.m....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X.m....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.V.X.m....M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.V.X.m...........................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.VFW.N...........................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............!.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Apr 25 12:47:09 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	4.006128795244271
Encrypted:	false
SSDEEP:
MD5:	343EE26149199414D024C4EE3B376BBE
SHA1:	7D94A98FCFB8FE4D668A7846358855C57621B89C
SHA-256:	7C7268DC906C032DFB50D2790E5B69BC534B2088CC3D76757984725E58F31564
SHA-512:	B80E39E3B1DB2067CBF7E550140DC38300142912E2E551E8F6AE994C2C9F8400E55DF23587C1486CF220D3536A0E83B1808F0F6FEA0A8CEDBF3732B46C462A33
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.....7A.........y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.I.X.m....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X.m....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.V.X.m....M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.V.X.m...........................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V.X.m...........................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............!.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Apr 25 12:47:09 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.9985276906386713
Encrypted:	false
SSDEEP:
MD5:	9AAD279F8C36E962223CF7E783FE7C2A
SHA1:	EF203B094F4E13E7EA41D0658C016C10E20B8CE9
SHA-256:	93FCAEC420215AEBA5B29679A4BA5A9160503B0C200FC21057FD4EE075168346
SHA-512:	8ACF74DD3665F69EE12518C10F12AB89FE8D18D6B2FA5C299283DE1FA5BFB062A609304AD2DB9E939587CA09F3C02E7DEF6BC34960689727D2144413E464F65D
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,....#.M.........y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.I.X.m....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X.m....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.V.X.m....M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.V.X.m...........................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V.X.m...........................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............!.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Apr 25 12:47:08 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2683
Entropy (8bit):	4.008121964616197
Encrypted:	false
SSDEEP:
MD5:	56FFA65C70E4FCF2B57279DB752A3B00
SHA1:	5584D982ABF3E2A0FDCD6DD4EE5525D45A6DA39B
SHA-256:	5220557F9082E472B3AC550CB4723DF08E4ACC8CDA6597FE81694CCE2FD46319
SHA-512:	72E79E85CC825DE25F3B50B946DAE983B8BCF4DF4BDDA5A21CFAA5E6C1572FBA35D9CC25C1DB98637B72D1867297A99D90CA02D925D5C314C4E8EEDA1C91BF6B
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,....6.7.........y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.I.X.m....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X.m....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.V.X.m....M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.V.X.m...........................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V.X.m...........................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............!.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Chrome Cache Entry: 71

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 200 x 50, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	8819
Entropy (8bit):	7.97572224855975
Encrypted:	false
SSDEEP:
MD5:	812F541CAB0DA2FA6407CB6E7B9F4C3A
SHA1:	9973D2D7996FE55AA5C8511B27F6C9931EEB51E7
SHA-256:	CBFE328B413A76D067601EB1180FF32A1D43B38BCDC3AC3F16DC5C737C724F49
SHA-512:	6764644CF7FD3FDC85C26762F803491B3D96857D7C2687C6F828827F3EFA1551FAE94865C006A9070135A112C8B7039659B03E233430152D37BE815D8A04EC5E
Malicious:	false
Reputation:	unknown
URL:	https://uploaddeimagens.com.br/images/001/894/856/original/Logo_Email_Advisia.png
Preview:	.PNG........IHDR.......2......Q......sRGB.........gAMA......a.....pHYs..........+......tEXtSoftware.Adobe ImageReadyq.e<..!.IDATx^.].X.G.>T.A@.....w.........5Qc.1&...bMbb....!6.7TD@...).?...{./...>.....2s..Y.2u.i(....@...t..XuOj.Zw.FM.NN.l.=..Q4nDC...[.c....S......D.....f...Q."..D.E.yKo..^p~tL..bz..'.</.%.m...F\|8$.X....s.....M.[.., .......M......M_p...s.&......~.K.B_....Q...@..~.7.^G.s..T.T...$..f..Z..n..:...H.-#g'[.....$"..5..>{I......P.-.N.[VP.2.&.\|..3%f.%.5.dc....!o/..^...F.v9.#....\..'...U...Y...o.T.......w..G~?z.A.~.K......m..;!..(..k..'.l..../.M.4i.^z.E..+2e....H./c.P.<.......j..M....u7.JzN%.7GJHH...(.......x.x6.C...)'&h..u`.@r-....I.l.......Z..{....N.m..:.%.."]../.......\....X[1......U..S./.P.O...);.F..Q.&.....8X....j..X..../.....r.4..O". ......aee...L.I.....F.y4s.Q.p.K....".ydPz.q.r..S.ng..}T..\|az.`ffJ...p=....j.aX....t..gQ..m..a.v%.z.~..AL...;.....Pn.K..R..r1..x.1....e....\...`a..h...C...b.Zw..V.D...T.K.7C?f.9^.........C..

Chrome Cache Entry: 72

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	150665
Entropy (8bit):	5.246706614621158
Encrypted:	false
SSDEEP:
MD5:	FBB1E61A9BB4F9B2C8A33BFD7C5BEA83
SHA1:	71844171AFBECCA30B1B3F3BADD62756DFB83B50
SHA-256:	E04C67327CBE281402D3332A5A7A06847481D44365237B0A963EE1095943E46E
SHA-512:	AF8A25611B9B0AA0361D7681D72A85C1415D514A0DB649A74BD473F8DE28FD175FBF9599ECB8B59DE2D5915C710816AF4132B4267B79FC6C06BA4544B145A089
Malicious:	false
Reputation:	unknown
URL:	https://uploaddeimagens.com.br/assets/application-f7da5205e704db00f9724a4dc0d263bada072b7841ba2a130d9d3368db239d08.js
Preview:	if(function(e,t){"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery requires a window with a document");return t(e)}:t(e)}("undefined"!=typeof window?window:this,function(e,t){function n(e){var t=!!e&&"length"in e&&e.length,n=he.type(e);return"function"!==n&&!he.isWindow(e)&&("array"===n\|\|0===t\|\|"number"==typeof t&&t>0&&t-1 in e)}function i(e,t,n){if(he.isFunction(t))return he.grep(e,function(e,i){return!!t.call(e,i,e)!==n});if(t.nodeType)return he.grep(e,function(e){return e===t!==n});if("string"==typeof t){if(ke.test(t))return he.filter(t,e,n);t=he.filter(t,e)}return he.grep(e,function(e){return he.inArray(e,t)>-1!==n})}function o(e,t){do{e=e[t]}while(e&&1!==e.nodeType);return e}function r(e){var t={};return he.each(e.match($e)\|\|[],function(e,n){t[n]=!0}),t}function a(){ie.addEventListener?(ie.removeEventListener("DOMContentLoaded",s),e.removeEventListener("load",s)):(ie.detachEvent("onreadysta

Chrome Cache Entry: 73

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 440 x 200, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	7391
Entropy (8bit):	7.931538574105751
Encrypted:	false
SSDEEP:
MD5:	A0819667F9620B7D6093DC714F5B88A4
SHA1:	E677F4C8CDA14D63456387185BF1894E123F0191
SHA-256:	80AA3E3E5CFFA5EB2253FD32373C357439D2B3427EDBE2BB6E6B6BDFF3731979
SHA-512:	6B4B8DAFCE60AB4A5351E2F25525AEFA1E89FBB7DB5D6193EAB68CA847679F98719B30B81FF9FAF78860A4E47AD95E7677DE06914DD0A1305146E2A0F43857F2
Malicious:	false
Reputation:	unknown
URL:	https://uploaddeimagens.com.br/assets/logo-80aa3e3e5cffa5eb2253fd32373c357439d2b3427edbe2bb6e6b6bdff3731979.png
Preview:	.PNG........IHDR..............A......tEXtSoftware.Adobe ImageReadyq.e<....PLTE..3..B.......,..-...........8........z.....I.....5.....3..6.....0..m..E..c..6..(.......-.....Z..t..3.......7..6..-.......K....6..:..1..(..i..8..\|........l..(..]....&.....5....Z.........b.......3........)..?.....s..+........5..1..R..6.....,...........C..f.....r..'..8....m......}....)..5..6..........6...........5.....2..V.....c..0..I..>...........2..b..Q..)..2..V..,..<..-......./../..0..M..N..Y..3....5..4..9..0../..+..(...333..=..0..-.......'...fff..'..'..'...iii....'..'AAA..&NNN..'\\\......www.....0........'zzz.....&.......&...ppp..1..(....(.....(..2.....)..)..)........0.....0..1..'..).....(..)..(..>...........9..1..4..6..<../..(..'....R.....,..Q.....K..'..6..?..:..e..`..O..6../..z..t..o..8..)..3..1..8...1.....W..-........Q.......T...,.U/...uIDATx...\|.....I.8.A...w.a.1...F!.....B...=#j.U#J\|.....@..z.=...N....r...EHB......>.}.mmim.c.=;;{.a(....S..o....\|3..I.T...P.PpT(8*...G...B.QpT(

Chrome Cache Entry: 74

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1305)
Category:	downloaded
Size (bytes):	46274
Entropy (8bit):	5.48786904450865
Encrypted:	false
SSDEEP:
MD5:	E9372F0EBBCF71F851E3D321EF2A8E5A
SHA1:	2C7D19D1AF7D97085C977D1B69DCB8B84483D87C
SHA-256:	1259EA99BD76596239BFD3102C679EB0A5052578DC526B0452F4D42F8BCDD45F
SHA-512:	C3A1C74AC968FC2FA366D9C25442162773DB9AF1289ADFB165FC71E7750A7E62BD22F424F241730F3C2427AFFF8A540C214B3B97219A360A231D4875E6DDEE6F
Malicious:	false
Reputation:	unknown
URL:	https://ssl.google-analytics.com/ga.js
Preview:	(function(){var E;var g=window,n=document,p=function(a){var b=g._gaUserPrefs;if(b&&b.ioo&&b.ioo()\|\|a&&!0===g["ga-disable-"+a])return!0;try{var c=g.external;if(c&&c._gaUserPrefs&&"oo"==c._gaUserPrefs)return!0}catch(f){}a=[];b=n.cookie.split(";");c=/^\sAMP_TOKEN=\s(.?)\s$/;for(var d=0;d<b.length;d++){var e=b[d].match(c);e&&a.push(e[1])}for(b=0;b<a.length;b++)if("$OPT_OUT"==decodeURIComponent(a[b]))return!0;return!1};var q=function(a){return encodeURIComponent?encodeURIComponent(a).replace(/$/g,"%28").replace(/$/g,"%29"):a},r=/^(www\.)?google(\.com?)?(\.[a-z]{2})?$/,u=/(^\|\.)doubleclick\.net$/i;function Aa(a,b){switch(b){case 0:return""+a;case 1:return 1a;case 2:return!!a;case 3:return 1E3a}return a}function Ba(a){return"function"==typeof a}function Ca(a){return void 0!=a&&-1<(a.constructor+"").indexOf("String")}function F(a,b){return void 0==a\|\|"-"==a&&!b\|\|""==a}function Da(a){if(!a\|\|""==a)return"";for(;a&&-1<" \n\r\t".indexOf(a.charAt(0));)a=a.substring(1);for(;a&&-1<" \n\r\t".i

Chrome Cache Entry: 75

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (781)
Category:	downloaded
Size (bytes):	786
Entropy (8bit):	5.132590563173744
Encrypted:	false
SSDEEP:
MD5:	6C0CB7497AEC60D65D8706D74D2C3F92
SHA1:	C020861C8CA196B5A60AC019EE13F311F4B48BA8
SHA-256:	89B35C9DEF1D4E34EEBAC7EE4E6C8B0DE178FAA732D6B7F7EAAB31B9C8B5D136
SHA-512:	AFE4F694E6838EF9A87447C90695FE3DDEBD855EC848628B7FE146FAB682BBFA526DA6CAA62F8A9C7A2F917C4BD143040DA7DC89187447DB3E0A63420B7CCFC5
Malicious:	false
Reputation:	unknown
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["",["escape from tarkov unheard edition","2025 social security cola","missing camp pendleton marine found","team penske indycar","voyager 1 spacecraft","ahs delicate finale recap","chase banking outage","stellar blade game review"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002}],"google:suggestrelevance":[1257,1256,1255,1254,1253,1252,1251,1250],"google:suggestsubtypes":[[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362]],"google:suggesttype":["QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY"]}]

Chrome Cache Entry: 78

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (32485)
Category:	downloaded
Size (bytes):	185090
Entropy (8bit):	5.241277976052604
Encrypted:	false
SSDEEP:
MD5:	980760B810AA7C4AF776945714719620
SHA1:	A8B9D3F90A1BC613E81D867AB5F4CA421D72002E
SHA-256:	300626905E054593BD1ABCCBB170C897FCD028AC7E7500AF696AD124E9D6E77B
SHA-512:	9E7EFC89F16A123C9187D7A1618C06BF240A3B80997B512D9E6240B1FA3060987F7A5AE366DD21AF099BFFB2FFF76637EA9B48D5BF737128E7D2F9ACA6A880A6
Malicious:	false
Reputation:	unknown
URL:	https://uploaddeimagens.com.br/assets/application-37ec5f1cc4034f8c01fc41a8f11be0570a85840fc3f186a504b0ff92219d4b90.css
Preview:	#fancybox-loading{position:fixed;top:50%;left:50%;width:40px;height:40px;margin-top:-20px;margin-left:-20px;cursor:pointer;overflow:hidden;z-index:1104;display:none}#fancybox-loading div{position:absolute;top:0;left:0;width:40px;height:480px;background-image:url(/assets/fancybox-324b9d944e39c915922db7058a276bd708e68ea5d86762741f14864af2324607.png)}#fancybox-overlay{position:absolute;top:0;left:0;width:100%;z-index:1100;display:none}#fancybox-tmp{padding:0;margin:0;border:0;overflow:auto;display:none}#fancybox-wrap{position:absolute;top:0;left:0;padding:20px;z-index:1101;outline:none;display:none}#fancybox-outer{position:relative;width:100%;height:100%;background:#fff}#fancybox-content{width:0;height:0;padding:0;outline:none;position:relative;overflow:hidden;z-index:1102;border:0 solid #fff}#fancybox-hide-sel-frame{position:absolute;top:0;left:0;width:100%;height:100%;background:0 0;z-index:1101}#fancybox-close{position:absolute;top:-15px;right:-15px;width:30px;height:30px;background:tr

Chrome Cache Entry: 79

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (19261), with no line terminators
Category:	downloaded
Size (bytes):	19261
Entropy (8bit):	5.258945303143264
Encrypted:	false
SSDEEP:
MD5:	3BE93FD15D2F7DEE2FC0C8981C6FA5C6
SHA1:	8CD88C36FAD3E96641DBC4D781F5DDBE5123312F
SHA-256:	17106BF803D42BCF2F2BDF778ECE084D3F91C68E7EA41DAE7BFF61FEFA573DEE
SHA-512:	148291151C600F6D26A00A3DEA1919432FF94288D90C06F2C74990D7B8C418708973FBE2D06D875CBB687F00FB4373668AFBCFF5AB7911581B46A39A3906FE46
Malicious:	false
Reputation:	unknown
URL:	https://static.cloudflareinsights.com/beacon.min.js/v55bfa2fee65d44688e90c00735ed189a1713218998793
Preview:	!function(){var e={343:function(e){"use strict";for(var t=[],n=0;n<256;++n)t[n]=(n+256).toString(16).substr(1);e.exports=function(e,n){var i=n\|\|0,r=t;return[r[e[i++]],r[e[i++]],r[e[i++]],r[e[i++]],"-",r[e[i++]],r[e[i++]],"-",r[e[i++]],r[e[i++]],"-",r[e[i++]],r[e[i++]],"-",r[e[i++]],r[e[i++]],r[e[i++]],r[e[i++]],r[e[i++]],r[e[i++]]].join("")}},944:function(e){"use strict";var t="undefined"!=typeof crypto&&crypto.getRandomValues&&crypto.getRandomValues.bind(crypto)\|\|"undefined"!=typeof msCrypto&&"function"==typeof window.msCrypto.getRandomValues&&msCrypto.getRandomValues.bind(msCrypto);if(t){var n=new Uint8Array(16);e.exports=function(){return t(n),n}}else{var i=new Array(16);e.exports=function(){for(var e,t=0;t<16;t++)0==(3&t)&&(e=4294967296*Math.random()),i[t]=e>>>((3&t)<<3)&255;return i}}},508:function(e,t,n){"use strict";var i=n(944),r=n(343);e.exports=function(e,t,n){var o=t&&n\|\|0;"string"==typeof e&&(t="binary"===e?new Array(16):null,e=null);var a=(e=e\|\|{}).random\|\|(e.rng\|\|i)();if(

Chrome Cache Entry: 80

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (7823), with no line terminators
Category:	downloaded
Size (bytes):	7823
Entropy (8bit):	5.7776366365414376
Encrypted:	false
SSDEEP:
MD5:	A206EDCC655935C699FCEA27E2FD7C00
SHA1:	473358DDFC2E636655F8CCE59920E31B80A8B24D
SHA-256:	1BDCE3E347CE5222B7200A6EB73C1D2B3F1C0D2B036911557E892EFE9CB18B7D
SHA-512:	6C79AB02E979295131F96B9869A4DFA85312501F1E6632086888D08E2A84CF3C538DDEECC347D47D28E15D0CA42B4D2ED4EAD9A25DE323BC574A77D4C6FD6C1C
Malicious:	false
Reputation:	unknown
URL:	https://uploaddeimagens.com.br/cdn-cgi/challenge-platform/h/b/scripts/jsd/471dc2adc340/main.js
Preview:	window._cf_chl_opt={cFPWv:'b'};~function(V,g,h,m,n,o,y,z){V=b,function(c,e,U,f,C){for(U=b,f=c();!![];)try{if(C=-parseInt(U(457))/1(parseInt(U(527))/2)+parseInt(U(531))/3(parseInt(U(523))/4)+parseInt(U(473))/5+-parseInt(U(469))/6*(-parseInt(U(459))/7)+-parseInt(U(472))/8+-parseInt(U(438))/9+parseInt(U(444))/10,e===C)break;else f.push(f.shift())}catch(D){f.push(f.shift())}}(a,144312),g=this\|\|self,h=g[V(521)],m=function(a0,e,f,C){return a0=V,e=String[a0(443)],f={'h':function(D){return D==null?'':f.g(D,6,function(E,a1){return a1=b,a1(524)[a1(526)](E)})},'g':function(D,E,F,a2,G,H,I,J,K,L,M,N,O,P,Q,R,S,T){if(a2=a0,null==D)return'';for(H={},I={},J='',K=2,L=3,M=2,N=[],O=0,P=0,Q=0;Q<D[a2(461)];Q+=1)if(R=D[a2(526)](Q),Object[a2(530)][a2(516)][a2(464)](H,R)\|\|(H[R]=L++,I[R]=!0),S=J+R,Object[a2(530)][a2(516)][a2(464)](H,S))J=S;else{if(Object[a2(530)][a2(516)][a2(464)](I,J)){if(256>J[a2(453)](0)){for(G=0;G<M;O<<=1,E-1==P?(P=0,N[a2(528)](F(O)),O=0):P++,G++);for(T=J[a2(453)](0),G=0;8>G;O=O<<1\|1.11&T

Chrome Cache Entry: 81

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1500)
Category:	downloaded
Size (bytes):	3851
Entropy (8bit):	5.570821281000164
Encrypted:	false
SSDEEP:
MD5:	59FC9B269E6191E4364FE9D4C24FACE5
SHA1:	9A888E9C7719E7D1EDFC08D656C1C414F3C0813F
SHA-256:	0FB4DF261A0037B689CD7F1B165A5C63F5782810BEDA2A510FF5763A1652A4D5
SHA-512:	C8F52964C0DB1ADB2498FE27B5DFA71C10A0C28E39B4B0E5CB6F1E0A01289DCA5F0327AD0889B7B48FB6BBE0EA46610C7E109EB323B6A1B48006BE5F066F7EAB
Malicious:	false
Reputation:	unknown
URL:	https://uploaddeimagens.com.br/
Preview:	<!DOCTYPE html>.<html>.<head>.<title>UploadDeImagens.com.br</title>.<link rel="stylesheet" media="all" href="/assets/application-37ec5f1cc4034f8c01fc41a8f11be0570a85840fc3f186a504b0ff92219d4b90.css" />.<meta name="csrf-param" content="authenticity_token" />.<meta name="csrf-token" content="o1nPFkFF+np86rONIubOC9v7rz4ehVmH45tmvXGMVfR0VHMZmeI+04pskIhHeh8oxpMxY7RuxbLANtIEw4AgjQ==" />.<script type="text/javascript">... var _gaq = _gaq \|\| [];.. _gaq.push(['_setAccount', 'UA-7361869-1']);.. _gaq.push(['_trackPageview']);... (function() {.. var ga = document.createElement('script'); ga.type = 'text/javascript'; ga.async = true;.. ga.src = ('https:' == document.location.protocol ? 'https://ssl' : 'http://www') + '.google-analytics.com/ga.js';.. var s = document.getElementsByTagName('script')[0]; s.parentNode.insertBefore(ga, s);.. })();...</script>.</head>.<body>.<div class="page">.<div class="row-fluid">.<div class="span6">.<a class="logo" href="/"></a>.</div>.<div class="span6

Static File Info

⊘No static file info

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://uploaddeimagens.com.br/images/001/894/856/original/Logo_Email_Advisia.png?1550069603

Overview

General Information

Detection

Signatures

Classification

Process Tree

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Networking

System Summary

Boot Survival

Mitre Att&ck Matrix

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Chrome Cache Entry: 71

Chrome Cache Entry: 72

Chrome Cache Entry: 73

Chrome Cache Entry: 74

Chrome Cache Entry: 75

Chrome Cache Entry: 78

Chrome Cache Entry: 79

Chrome Cache Entry: 80

Chrome Cache Entry: 81

Static File Info

Windows Analysis Report
https://uploaddeimagens.com.br/images/001/894/856/original/Logo_Email_Advisia.png?1550069603