Edit tour

Windows Analysis Report
https://urlshortener.teams.cloud.microsoft/8DC65F1626550D3-1-1

Overview

General Information

Sample URL:	https://urlshortener.teams.cloud.microsoft/8DC65F1626550D3-1-1
Analysis ID:	1432273
Infos:

Detection

Score:	0
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

No high impact signatures.

Classification

Process Tree

System is w10x64

chrome.exe (PID: 5580 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 4340 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2492 --field-trial-handle=2488,i,5596698943673808519,4703168147859055955,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6464 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://urlshortener.teams.cloud.microsoft/8DC65F1626550D3-1-1" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: https://teams.live.com/dl/launcher/attribution.txt

HTTP Parser: No favicon

Source: unknown	HTTPS traffic detected: 23.204.76.112:443 -> 192.168.2.4:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.204.76.112:443 -> 192.168.2.4:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.4:49746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.4:49768 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 23.55.103.106
Source: unknown	TCP traffic detected without corresponding DNS query: 23.55.103.106
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50

Source: global traffic	HTTP traffic detected: GET /8DC65F1626550D3-1-1 HTTP/1.1Host: urlshortener.teams.cloud.microsoftConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=9lZxm4dKhGl2+5y&MD=6exllT7+ HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=9lZxm4dKhGl2+5y&MD=6exllT7+ HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com

Source: global traffic	DNS traffic detected: DNS query: urlshortener.teams.cloud.microsoft
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: teams.live.com
Source: global traffic	DNS traffic detected: DNS query: statics.teams.cdn.live.net

Source: chromecache_64.2.dr	String found in binary or memory: http://creativecommons.org/publicdomain/zero/1.0/
Source: chromecache_64.2.dr	String found in binary or memory: http://underscorejs.org/
Source: chromecache_64.2.dr	String found in binary or memory: https://github.com/lodash/lodash
Source: chromecache_64.2.dr	String found in binary or memory: https://js.foundation/
Source: chromecache_58.2.dr	String found in binary or memory: https://statics.teams.cdn.live.net
Source: chromecache_58.2.dr	String found in binary or memory: https://statics.teams.cdn.live.net/hashedcss-launcher/launcher.d6cd10b8b26b2130799c.css
Source: chromecache_58.2.dr	String found in binary or memory: https://statics.teams.cdn.live.net/hashedjs-launcher/launcher.3c5b23498b3a051ad013.js
Source: chromecache_58.2.dr	String found in binary or memory: https://statics.teams.cdn.live.net/hashedjs-launcher/polyfills.1f5a03d113c6ac7b91f5.js

Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49672
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443

Source: unknown	HTTPS traffic detected: 23.204.76.112:443 -> 192.168.2.4:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.204.76.112:443 -> 192.168.2.4:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.4:49746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.4:49768 version: TLS 1.2

Source: classification engine

Classification label: clean0.win@19/23@12/5

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2492 --field-trial-handle=2488,i,5596698943673808519,4703168147859055955,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://urlshortener.teams.cloud.microsoft/8DC65F1626550D3-1-1"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2492 --field-trial-handle=2488,i,5596698943673808519,4703168147859055955,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	1 Process Injection	1 Process Injection	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
https://urlshortener.teams.cloud.microsoft/8DC65F1626550D3-1-1	0%	Avira URL Cloud	safe

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
https://js.foundation/	0%	URL Reputation	safe
https://statics.teams.cdn.live.net/hashedjs-launcher/launcher.3c5b23498b3a051ad013.js	0%	Avira URL Cloud	safe
https://statics.teams.cdn.live.net/hashedjs-launcher/polyfills.1f5a03d113c6ac7b91f5.js	0%	Avira URL Cloud	safe
https://statics.teams.cdn.live.net	0%	Avira URL Cloud	safe
https://statics.teams.cdn.live.net/hashedcss-launcher/launcher.d6cd10b8b26b2130799c.css	0%	Avira URL Cloud	safe
https://statics.teams.cdn.live.net/hashedcss-launcher/launcher.d6cd10b8b26b2130799c.css	0%	Virustotal		Browse
https://statics.teams.cdn.live.net/hashedjs-launcher/polyfills.1f5a03d113c6ac7b91f5.js	0%	Virustotal		Browse
https://statics.teams.cdn.live.net	0%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
www.google.com	142.250.189.132	true	false	high
s-0005.dual-s-msedge.net	52.123.129.14	true	false	unknown
fp2e7a.wpc.phicdn.net	192.229.211.108	true	false	unknown
urlshortener.teams.cloud.microsoft	unknown	unknown	false	unknown
statics.teams.cdn.live.net	unknown	unknown	false	unknown
teams.live.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
https://urlshortener.teams.cloud.microsoft/8DC65F1626550D3-1-1	false	unknown
https://teams.live.com/dl/launcher/launcher.html?url=%2F_%23%2Fl%2Fchat%2F19%3Auni01_hwqyajis52lhbwhhort3bchwjsah7ugopu6ankkekjxscrbwtaka%40thread.v2%2Fconversations%3FtenantId%3D9188040d-6c67-4c5b-b112-36a304b66dad%26launchAgent%3DES%26laEntry%3DMAE%26v%3DMAE5%26lm%3Ddeeplink%26lmsrc%3Demail%26emltid%3D6d58df1f-2a83-46df-9008-d8bdd89ec852%26linkpos%3D1%26emltype%3DNew_Activities_TFL%26linktype%3DNew_ChatActivity_TFL&type=chat&deeplinkId=2b273fac-8de0-4932-839e-a2f6bc23be94&directDl=true&msLaunch=true&enableMobilePage=true&suppressPrompt=true	false	high
https://teams.live.com/dl/launcher/attribution.txt	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://statics.teams.cdn.live.net	chromecache_58.2.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://statics.teams.cdn.live.net/hashedjs-launcher/polyfills.1f5a03d113c6ac7b91f5.js	chromecache_58.2.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://creativecommons.org/publicdomain/zero/1.0/	chromecache_64.2.dr	false		high
https://statics.teams.cdn.live.net/hashedjs-launcher/launcher.3c5b23498b3a051ad013.js	chromecache_58.2.dr	false	Avira URL Cloud: safe	unknown
http://underscorejs.org/	chromecache_64.2.dr	false		high
https://js.foundation/	chromecache_64.2.dr	false	URL Reputation: safe	unknown
https://github.com/lodash/lodash	chromecache_64.2.dr	false		high
https://statics.teams.cdn.live.net/hashedcss-launcher/launcher.d6cd10b8b26b2130799c.css	chromecache_58.2.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.189.132	www.google.com	United States	15169	GOOGLEUS	false
52.123.129.14	s-0005.dual-s-msedge.net	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false

Private

IP
192.168.2.4
192.168.2.14

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1432273
Start date and time:	2024-04-26 18:55:11 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 58s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://urlshortener.teams.cloud.microsoft/8DC65F1626550D3-1-1
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	CLEAN
Classification:	clean0.win@19/23@12/5
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Browse: https://teams.live.com/dl/launcher/attribution.txt

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.64.227, 172.217.2.206, 142.251.107.84, 34.104.35.123, 52.113.194.132, 23.221.212.219, 23.221.212.200, 199.232.214.172, 23.221.212.210, 52.168.112.67, 192.229.211.108, 52.182.143.208, 13.85.23.206, 20.242.39.171, 142.250.189.131, 142.250.64.206
Excluded domains from analysis (whitelisted): clients1.google.com, fs.microsoft.com, accounts.google.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, clientservices.googleapis.com, browser.events.data.trafficmanager.net, a1996.dscd.akamai.net, fe3cr.delivery.mp.microsoft.com, fe3.delivery.mp.microsoft.com, clients2.google.com, edgedl.me.gvt1.com, ocsp.digicert.com, s-0005.s-msedge.net, ocsp.edge.digicert.com, glb.cws.prod.dcat.dsp.trafficmanager.net, statics.teams.cdn.live.net.edgesuite.net, onedscolprdeus04.eastus.cloudapp.azure.com, update.googleapis.com, tfl-staticscdn.trafficmanager.net, clients.l.google.com, onedscolprdcus04.centralus.cloudapp.azure.com, browser.pipe.aria.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtSetInformationFile calls found.

Simulations

Behavior and APIs

⊘No simulations

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

Chrome Cache Entry: 56

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	5621
Entropy (8bit):	4.2543291215767
Encrypted:	false
SSDEEP:	96:Rf6psAY2NMgC2s2K2U72u+qz3L3K2AtLP5y2YTDzGKOMSH0H2u+qz3LZ:96pNNlC7yu+qYVP42YTDz9S1u+qx
MD5:	EE0F7622A71A597595C5A8FB2F89A097
SHA1:	0D9768FDBA8B1D89A6DBA27D5CECC27737BF5CDD
SHA-256:	433388EFC4567EF14D3FED6F2DA976D457D43D09F6753E289C7FE544E0175281
SHA-512:	55E1161AC6A533B67FA3D073691E936090019B10283BC40F248F47DA38788A7A00FAF307BD5001B6327DAF38F874DC578A0CD212ECCF94520801C37DF668D9FF
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="utf-8"?>.<svg class="msft-teams-logo" version="1.1" id="Layer_1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px".. viewBox="0 0 141.5 16.2" style="enable-background:new 0 0 141.5 16.2;" xml:space="preserve">.<style type="text/css">...msft-teams-logo .st0{fill:#5b5fc7;}.</style>.<g>..<path class="st0" d="M15.2,16h-1.7V6c0-0.8,0-1.8,0.1-2.9h0c-0.1,0.5-0.3,1-0.4,1.4L8,16H7.2L2.1,4.6c-0.2-0.5-0.3-1-0.4-1.5h0...C1.7,3.7,1.7,4.6,1.7,6v10H0V1.1h2.3l4.6,10.4c0.3,0.6,0.5,1.2,0.7,1.8h0.1c0.3-0.8,0.5-1.4,0.7-1.8L13,1.1h2.2V16z"/>..<path class="st0" d="M19.1,2.6c-0.3,0-0.6-0.1-0.8-0.3C18.1,2.1,18,1.8,18,1.5c0-0.6,0.5-1.1,1.1-1.1c0,0,0,0,0,0...c0.3,0,0.6,0.1,0.8,0.3c0.4,0.4,0.4,1.1,0,1.6c0,0,0,0,0,0C19.7,2.5,19.4,2.6,19.1,2.6z M19.9,16h-1.7V5.3h1.7V16z"/>..<path class="st0" d="M29.9,15.5c-0.9,0.5-1.9,0.8-2.9,0.7c-1.4,0.1-2.7-0.5-3.7-1.5c-1-1-1.5-2.4-1.4-3.8c-0.1-1.5,0.5-3.1,1.5-4.2...c1-1.1,2.5-1.7,4-1.6c0.9,0,1.7,0.2,2.5,0

Chrome Cache Entry: 57

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 8 icons, 256x256 with PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced, 32 bits/pixel, 256x256 with PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced, 32 bits/pixel
Category:	downloaded
Size (bytes):	91302
Entropy (8bit):	5.083847889045784
Encrypted:	false
SSDEEP:	1536:59iJX9Lgm9iJX9Lgm9iJX9Lg/jHXZwuumF:54p4p4qXZwuumF
MD5:	2B4509D8A869917BBC5CE10982956619
SHA1:	DC21BD40ED9B873779F855026F253BDD3322723D
SHA-256:	397EDDF44E1BF7E557B0B4F5173DA95D8FD832B6F2F10D6E41C17DC539D5A822
SHA-512:	2D0A54E85C7BBDD653B1557A3741D44B621876503D6E8B8CFD5FC6BD3047E28B9702DFB132474DD3981174D96F994B46083008A327646C8D16467E80DA164BAB
Malicious:	false
Reputation:	low
URL:	https://statics.teams.cdn.live.net/hashed/favicon/prod/favicon-f1722d9.ico
Preview:	............ ............... ............... ......7..``.... ......S..@@.... .(B......00.... ..%...).. .... ......O........ .h...>`...PNG........IHDR.............\r.f....pHYs..........o.d...:IDATx...{........Uu...f.......#ry.='^....1...A].q!...$^.2...`.h...&...0Q@7.=.{6.%z..-.]#....0.L.tW}.....KOOW.......Q...w..@)..RJ)..RJ)..RJ)..RJ)..R.....H...L[..7.j.....#.0..L.....y.U..@D%.i...g..3....x..Cd...R....-.^...nY...{..\..@.4..~.zz/..\|.....g..@6S......~....W.N...%.J....r.9G ./.2......_.`..L.b.7Z.%......["...1VB.;H.].o....~+....J....E..+>..h..............y...JH..mR..,..4.Y.Bp.k.+..#^..E...P.."&.{>.$D..y.Dz$ou..5'I.v....(r..GtKj...c;.P.\[.K...>..%....M..{...'.2.v.\...s..Fn..%....*77-.{.../....2..x..h....D..@..y......".....H.x._.p....D........=C../.(..%...._Z0...D..@....{O.3..%./d.q.3..@.h......#..........M.$=;P.z...$EL........80.-..I...,....@f..b;.?."rNf.F.9.@w.B...6)-.....o...;U...K..BLD..3.#.......3.%_.,P}...V...W....l.h.s.....3w..v.R...Rw.%

Chrome Cache Entry: 58

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (16913), with no line terminators
Category:	downloaded
Size (bytes):	16929
Entropy (8bit):	4.9608809651835735
Encrypted:	false
SSDEEP:	384:P7L7e7e7e7n7vkZZkybCgKX6v169F7sV4Jz3ECGR7sjFtUQkwcuj3egT1gF7OU6/:P7L7e7e7e7n7vkY+CgKqv16LsV4JzUCp
MD5:	46E93971B624BC4B0C713273ED9BB517
SHA1:	3603950B7153E6315C7E99FDA0C9782A3DC63227
SHA-256:	03E08B21D8B0C08CAB1F4BE55EF67AA02392AA44D159CBED2580BAED4DCB3033
SHA-512:	568CFD2D383647144FA4F1732FD19055987761914CFD3BCF4153B0DFB5B9DEBC605D7793B2B33CA615017AB54C525805BF720880A22CF9B345630DBAD5976A0A
Malicious:	false
Reputation:	low
URL:	https://teams.live.com/dl/launcher/launcher.html?url=%2F_%23%2Fl%2Fchat%2F19%3Auni01_hwqyajis52lhbwhhort3bchwjsah7ugopu6ankkekjxscrbwtaka%40thread.v2%2Fconversations%3FtenantId%3D9188040d-6c67-4c5b-b112-36a304b66dad%26launchAgent%3DES%26laEntry%3DMAE%26v%3DMAE5%26lm%3Ddeeplink%26lmsrc%3Demail%26emltid%3D6d58df1f-2a83-46df-9008-d8bdd89ec852%26linkpos%3D1%26emltype%3DNew_Activities_TFL%26linktype%3DNew_ChatActivity_TFL&type=chat&deeplinkId=2b273fac-8de0-4932-839e-a2f6bc23be94&directDl=true&msLaunch=true&enableMobilePage=true
Preview:	<!doctype html><html lang="en-US" dir="ltr" class="ltr"><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><meta name="googlebot" content="noindex, nofollow"><meta name="robots" content="noindex, nofollow"><meta name="viewport" content="width=device-width,initial-scale=1"><link rel="shortcut icon" href="https://statics.teams.cdn.live.net/hashedassets-launcher/favicon/favicon.ico" type="image/x-icon"><link rel="apple-touch-icon" href="https://statics.teams.cdn.live.net/hashedassets-launcher/favicon/favicon-96x96.png"><link rel="apple-touch-icon" sizes="16x16" href="https://statics.teams.cdn.live.net/hashedassets-launcher/favicon/favicon-16x16.png"><link rel="apple-touch-icon" sizes="32x32" href="https://statics.teams.cdn.live.net/hashedassets-launcher/favicon/favicon-32x32.png"><link rel="apple-touch-icon" sizes="96x96" href="https://statics.teams.cdn.live.net/hashedassets-launcher/favicon/favicon-96x96.png"><met

Chrome Cache Entry: 59

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	46672
Entropy (8bit):	4.699890563164541
Encrypted:	false
SSDEEP:	768:fnUjUVjWqCODE7ZDP38TsXYfAMoM6wgjnlsuOK8TTI:fnUjkrE7ZDP38T8JZigbGKP
MD5:	570F11D9E530B70ED3FCC44B355C1D64
SHA1:	824EF8F872B2E7F86CF5AD2F6FFC6D2EE4018FDE
SHA-256:	DCDA18533910157B38C266C465CE4E099C77DAC8F2DB94C21BEDE074A5A7583C
SHA-512:	E0F36108A7D18109BB9A98D3D69D817F18F6AB13144669881179DFDB42BC46BD6DFF6F062F904AF3DD3FE06D4985398AE44E9CBC41E2FE0983C77BF60F3BB427
Malicious:	false
Reputation:	low
URL:	https://statics.teams.cdn.live.net/hashedassets-launcher/download_teams_desktop.56ea711b4689afe2bd227c93e4ab38ed.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" fill="none" viewBox="0 0 588 263">. <g clip-path="url(#a)">. <path fill="#56A84F" d="M480.181 94.4848c.244-7.9042 8.288-9.7641 8.497-16.5133.208-6.749-6.389-8.3956-5.95-16.2692.688-12.3156 13.271-11.9275 13.271-11.9275s12.583.3881 12.509 12.7227c-.047 7.8858-6.732 9.1226-6.941 15.8716-.208 6.7492 7.707 9.1015 7.463 17.0057-.244 7.9042-6.478 10.8312-6.696 17.9082-.219 7.077 4.918 9.855 4.611 19.803-.307 9.947-12.708 23.562-12.708 23.562l-3.069-.095s-11.537-14.353-11.23-24.301c.307-9.947 5.605-12.403 5.823-19.48.218-7.077-5.824-10.383-5.58-18.2872Z"/>. <path fill="#77D672" d="M510.893 147.675c2.762-8.968-.522-13.684-1.243-16.159-.72-2.475-1.271-3.241-.841-5.206.382-1.737.855-2.644 3.174-3.976 2.617-1.505 5.876-3.377 7.218-7.855 1.256-4.195.517-7.633-.134-10.665-.508-2.363-.947-4.4019-.329-6.4639.426-1.424 1.181-1.7644 3.296-2.5402 2.384-.8738 5.647-2.0697 7.656-6.298 4.659-9.8042-2.252-16.5148-6.557-18.6934-.282-.1424-2.851-1.3992-6.241-1.59

Chrome Cache Entry: 60

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	4.241202481433726
Encrypted:	false
SSDEEP:	3:YozDD/RNgQJzRWWlKFiFD3e4xCzY:YovtNgmzR/wYFDxkY
MD5:	9E576E34B18E986347909C29AE6A82C6
SHA1:	532C767978DC2B55854B3CA2D2DF5B4DB221C934
SHA-256:	88BDF5AF090328963973990DE427779F9C4DF3B8E1F5BADC3D972BAC3087006D
SHA-512:	5EF6DCFFD93434D45760888BF4B95FF134D53F34DA9DC904AD3C5EBEDC58409073483F531FEA4233869ED3EC75F38B022A70B2E179A5D3A13BDB10AB5C46B124
Malicious:	false
Reputation:	low
Preview:	{"Message":"The requested resource does not support http method 'GET'."}

Chrome Cache Entry: 61

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (4212)
Category:	downloaded
Size (bytes):	31054
Entropy (8bit):	5.115262666558672
Encrypted:	false
SSDEEP:	384:dZJPRAKEMuYgmJT0cISW6Z6qDD6b9nQFFQUR2IVf69AWhLX47SHTlk4nO8FIYTJ8:DE2tUsIW8FhdVG
MD5:	62624B374594C5B37AC2840166D36869
SHA1:	4F1ED0D897D0A729DB319A914DDC0607875C39C6
SHA-256:	80270CC751ED1DE7959C538CD7032E811207AF63B73477A446865AA3870ED3F8
SHA-512:	CD01101EFAE2A9AF2194AE020B00E68C8F453BA53293CC17618968065001D79E76F729A084E8214F29E82DD11BA8424CD50BCA694EBB476AB65E8246228B40C7
Malicious:	false
Reputation:	low
URL:	https://statics.teams.cdn.live.net/hashedcss-launcher/launcher.d6cd10b8b26b2130799c.css
Preview:	@font-face{font-family:"Segoe UI";src:local("Segoe UI Light");font-style:normal;font-weight:200}@font-face{font-family:"Segoe UI";src:local("Segoe UI Semilight");font-style:normal;font-weight:300}@font-face{font-family:"Segoe UI";src:local("Segoe UI");font-style:normal;font-weight:400}@font-face{font-family:"Segoe UI";src:local("Segoe UI Semibold");font-style:normal;font-weight:600}@font-face{font-family:"Segoe UI";src:local("Segoe UI Bold");font-style:normal;font-weight:700}@font-face{font-family:"Segoe UI";src:local("Segoe UI Light Italic");font-style:italic;font-weight:200}@font-face{font-family:"Segoe UI";src:local("Segoe UI Semilight Italic");font-style:italic;font-weight:300}@font-face{font-family:"Segoe UI";src:local("Segoe UI Italic");font-style:italic;font-weight:400}@font-face{font-family:"Segoe UI";src:local("Segoe UI Semibold Italic");font-style:italic;font-weight:600}@font-face{font-family:"Segoe UI";src:local("Segoe UI Bold Italic");font-style:italic;font-weight:700}body,

Chrome Cache Entry: 62

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	5621
Entropy (8bit):	4.2543291215767
Encrypted:	false
SSDEEP:	96:Rf6psAY2NMgC2s2K2U72u+qz3L3K2AtLP5y2YTDzGKOMSH0H2u+qz3LZ:96pNNlC7yu+qYVP42YTDz9S1u+qx
MD5:	EE0F7622A71A597595C5A8FB2F89A097
SHA1:	0D9768FDBA8B1D89A6DBA27D5CECC27737BF5CDD
SHA-256:	433388EFC4567EF14D3FED6F2DA976D457D43D09F6753E289C7FE544E0175281
SHA-512:	55E1161AC6A533B67FA3D073691E936090019B10283BC40F248F47DA38788A7A00FAF307BD5001B6327DAF38F874DC578A0CD212ECCF94520801C37DF668D9FF
Malicious:	false
Reputation:	low
URL:	https://statics.teams.cdn.live.net/hashedassets-launcher/logo.9a06a31283bb958af1e6112179685b71.svg
Preview:	<?xml version="1.0" encoding="utf-8"?>.<svg class="msft-teams-logo" version="1.1" id="Layer_1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px".. viewBox="0 0 141.5 16.2" style="enable-background:new 0 0 141.5 16.2;" xml:space="preserve">.<style type="text/css">...msft-teams-logo .st0{fill:#5b5fc7;}.</style>.<g>..<path class="st0" d="M15.2,16h-1.7V6c0-0.8,0-1.8,0.1-2.9h0c-0.1,0.5-0.3,1-0.4,1.4L8,16H7.2L2.1,4.6c-0.2-0.5-0.3-1-0.4-1.5h0...C1.7,3.7,1.7,4.6,1.7,6v10H0V1.1h2.3l4.6,10.4c0.3,0.6,0.5,1.2,0.7,1.8h0.1c0.3-0.8,0.5-1.4,0.7-1.8L13,1.1h2.2V16z"/>..<path class="st0" d="M19.1,2.6c-0.3,0-0.6-0.1-0.8-0.3C18.1,2.1,18,1.8,18,1.5c0-0.6,0.5-1.1,1.1-1.1c0,0,0,0,0,0...c0.3,0,0.6,0.1,0.8,0.3c0.4,0.4,0.4,1.1,0,1.6c0,0,0,0,0,0C19.7,2.5,19.4,2.6,19.1,2.6z M19.9,16h-1.7V5.3h1.7V16z"/>..<path class="st0" d="M29.9,15.5c-0.9,0.5-1.9,0.8-2.9,0.7c-1.4,0.1-2.7-0.5-3.7-1.5c-1-1-1.5-2.4-1.4-3.8c-0.1-1.5,0.5-3.1,1.5-4.2...c1-1.1,2.5-1.7,4-1.6c0.9,0,1.7,0.2,2.5,0

Chrome Cache Entry: 63

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 8 icons, 256x256 with PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced, 32 bits/pixel, 256x256 with PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced, 32 bits/pixel
Category:	downloaded
Size (bytes):	91302
Entropy (8bit):	5.083847889045784
Encrypted:	false
SSDEEP:	1536:59iJX9Lgm9iJX9Lgm9iJX9Lg/jHXZwuumF:54p4p4qXZwuumF
MD5:	2B4509D8A869917BBC5CE10982956619
SHA1:	DC21BD40ED9B873779F855026F253BDD3322723D
SHA-256:	397EDDF44E1BF7E557B0B4F5173DA95D8FD832B6F2F10D6E41C17DC539D5A822
SHA-512:	2D0A54E85C7BBDD653B1557A3741D44B621876503D6E8B8CFD5FC6BD3047E28B9702DFB132474DD3981174D96F994B46083008A327646C8D16467E80DA164BAB
Malicious:	false
Reputation:	low
URL:	https://statics.teams.cdn.live.net/hashedassets-launcher/favicon/favicon.ico
Preview:	............ ............... ............... ......7..``.... ......S..@@.... .(B......00.... ..%...).. .... ......O........ .h...>`...PNG........IHDR.............\r.f....pHYs..........o.d...:IDATx...{........Uu...f.......#ry.='^....1...A].q!...$^.2...`.h...&...0Q@7.=.{6.%z..-.]#....0.L.tW}.....KOOW.......Q...w..@)..RJ)..RJ)..RJ)..RJ)..R.....H...L[..7.j.....#.0..L.....y.U..@D%.i...g..3....x..Cd...R....-.^...nY...{..\..@.4..~.zz/..\|.....g..@6S......~....W.N...%.J....r.9G ./.2......_.`..L.b.7Z.%......["...1VB.;H.].o....~+....J....E..+>..h..............y...JH..mR..,..4.Y.Bp.k.+..#^..E...P.."&.{>.$D..y.Dz$ou..5'I.v....(r..GtKj...c;.P.\[.K...>..%....M..{...'.2.v.\...s..Fn..%....*77-.{.../....2..x..h....D..@..y......".....H.x._.p....D........=C../.(..%...._Z0...D..@....{O.3..%./d.q.3..@.h......#..........M.$=;P.z...$EL........80.-..I...,....@f..b;.?."rNf.F.9.@w.B...6)-.....o...;U...K..BLD..3.#.......3.%_.,P}...V...W....l.h.s.....3w..v.R...Rw.%

Chrome Cache Entry: 64

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	downloaded
Size (bytes):	17514
Entropy (8bit):	5.194383164357832
Encrypted:	false
SSDEEP:	384:0V262CyC63D6UpR6L66646F6Or6f6e2686D6t6b:UVylOUpwWN3M1CmDeEb
MD5:	BAA8CDEDEF47FD3950E654413765C8E6
SHA1:	C618384521AA608E6E895DED423AA5974CEEDFB7
SHA-256:	31534A922F42A7AE5672ED088270BA9BF07689774C375BC23A672614E86883BD
SHA-512:	683A0D41A8F73C40ABA73AAD0CD5937A7022C46885058D90FF991EF915A376A8D9D1FC9A8C351363EE81CCD2813AA77A286733CDBDC9A2130785C3BAE82BA423
Malicious:	false
Reputation:	low
URL:	https://teams.live.com/dl/launcher/attribution.txt
Preview:	.THIRD PARTY SOFTWARE NOTICES AND INFORMATION.Do Not Translate or Localize..This software incorporates material from third parties. Microsoft makes certain.open source code available at http://3rdpartysource.microsoft.com, or you may.send a check or money order for US $5.00, including the product name, the open.source component name, and version number, to:..Source Code Compliance Team.Microsoft Corporation.One Microsoft Way.Redmond, WA 98052.USA..Notwithstanding any other terms, you may reverse engineer this software to the.extent required to debug changes to any libraries licensed under the GNU Lesser.General Public License...@babel/polyfill@7.6.0.Copyright (c) 2014-present Sebastian McKenzie and other contributors....Permission is hereby granted, free of charge, to any person obtaining a copy.of this software and associated documentation files (the "Software"), to deal.in the Software without restriction, including without limitation the rights.to use, copy, modify, merge, publish,

Chrome Cache Entry: 65

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	46672
Entropy (8bit):	4.699890563164541
Encrypted:	false
SSDEEP:	768:fnUjUVjWqCODE7ZDP38TsXYfAMoM6wgjnlsuOK8TTI:fnUjkrE7ZDP38T8JZigbGKP
MD5:	570F11D9E530B70ED3FCC44B355C1D64
SHA1:	824EF8F872B2E7F86CF5AD2F6FFC6D2EE4018FDE
SHA-256:	DCDA18533910157B38C266C465CE4E099C77DAC8F2DB94C21BEDE074A5A7583C
SHA-512:	E0F36108A7D18109BB9A98D3D69D817F18F6AB13144669881179DFDB42BC46BD6DFF6F062F904AF3DD3FE06D4985398AE44E9CBC41E2FE0983C77BF60F3BB427
Malicious:	false
Reputation:	low
Preview:	<svg xmlns="http://www.w3.org/2000/svg" fill="none" viewBox="0 0 588 263">. <g clip-path="url(#a)">. <path fill="#56A84F" d="M480.181 94.4848c.244-7.9042 8.288-9.7641 8.497-16.5133.208-6.749-6.389-8.3956-5.95-16.2692.688-12.3156 13.271-11.9275 13.271-11.9275s12.583.3881 12.509 12.7227c-.047 7.8858-6.732 9.1226-6.941 15.8716-.208 6.7492 7.707 9.1015 7.463 17.0057-.244 7.9042-6.478 10.8312-6.696 17.9082-.219 7.077 4.918 9.855 4.611 19.803-.307 9.947-12.708 23.562-12.708 23.562l-3.069-.095s-11.537-14.353-11.23-24.301c.307-9.947 5.605-12.403 5.823-19.48.218-7.077-5.824-10.383-5.58-18.2872Z"/>. <path fill="#77D672" d="M510.893 147.675c2.762-8.968-.522-13.684-1.243-16.159-.72-2.475-1.271-3.241-.841-5.206.382-1.737.855-2.644 3.174-3.976 2.617-1.505 5.876-3.377 7.218-7.855 1.256-4.195.517-7.633-.134-10.665-.508-2.363-.947-4.4019-.329-6.4639.426-1.424 1.181-1.7644 3.296-2.5402 2.384-.8738 5.647-2.0697 7.656-6.298 4.659-9.8042-2.252-16.5148-6.557-18.6934-.282-.1424-2.851-1.3992-6.241-1.59

Chrome Cache Entry: 66

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65449)
Category:	downloaded
Size (bytes):	727637
Entropy (8bit):	5.392624931706444
Encrypted:	false
SSDEEP:	6144:BzoNDcDzTDZqLLWkYx2H2quAi07Fkmoml9JlsObw1Zk220HBz1JCY8U4UYUKuIaC:BzoNE07FkmTp3CBgpWC
MD5:	1C620C053F64B1CC6580EB0976B03CF1
SHA1:	CE0F97846637599FDBA6C151FE37CF5B932DFCE0
SHA-256:	DE1C3258200DE22E0EB2850183FBC4EA15A1E39C4C5D979B88015D4EEA549F3B
SHA-512:	9C05543F692058A4913AE50186BDC44E1227EE40F7DB25A3F07DB6356392E66DADFAD7D106AB3EDA055944D82801170F4636A46E04E25AF9C5929C3BF97AAED3
Malicious:	false
Reputation:	low
URL:	https://statics.teams.cdn.live.net/hashedjs-launcher/launcher.3c5b23498b3a051ad013.js
Preview:	/! For license information please see launcher.3c5b23498b3a051ad013.js.LICENSE.txt /.!function(){var e={1247:function(e,t){"use strict";var n;Object.defineProperty(t,"__esModule",{value:!0}),(n=t._BondDataType\|\|(t._BondDataType={}))[n._BT_STOP=0]="_BT_STOP",n[n._BT_STOP_BASE=1]="_BT_STOP_BASE",n[n._BT_BOOL=2]="_BT_BOOL",n[n._BT_DOUBLE=8]="_BT_DOUBLE",n[n._BT_STRING=9]="_BT_STRING",n[n._BT_STRUCT=10]="_BT_STRUCT",n[n._BT_LIST=11]="_BT_LIST",n[n._BT_MAP=13]="_BT_MAP",n[n._BT_INT32=16]="_BT_INT32",n[n._BT_INT64=17]="_BT_INT64"},6601:function(e,t,n){"use strict";Object.defineProperty(t,"__esModule",{value:!0});var r=n(1953),i=n(8833),o=n(1486);t._Utf8_GetBytes=function(e){for(var t=[],n=0;n<e.length;++n){var r=e.charCodeAt(n);r<128?t.push(r):r<2048?t.push(192\|r>>6,128\|63&r):r<55296\|\|r>=57344?t.push(224\|r>>12,128\|r>>6&63,128\|63&r):(r=65536+((1023&r)<<10\|1023&e.charCodeAt(++n)),t.push(240\|r>>18,128\|r>>12&63,128\|r>>6&63,128\|63&r))}return t},t._Base64_GetString=function(e){for(var t,n="ABCDE

Chrome Cache Entry: 67

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 8 icons, 256x256 with PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced, 32 bits/pixel, 256x256 with PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced, 32 bits/pixel
Category:	dropped
Size (bytes):	91302
Entropy (8bit):	5.083847889045784
Encrypted:	false
SSDEEP:	1536:59iJX9Lgm9iJX9Lgm9iJX9Lg/jHXZwuumF:54p4p4qXZwuumF
MD5:	2B4509D8A869917BBC5CE10982956619
SHA1:	DC21BD40ED9B873779F855026F253BDD3322723D
SHA-256:	397EDDF44E1BF7E557B0B4F5173DA95D8FD832B6F2F10D6E41C17DC539D5A822
SHA-512:	2D0A54E85C7BBDD653B1557A3741D44B621876503D6E8B8CFD5FC6BD3047E28B9702DFB132474DD3981174D96F994B46083008A327646C8D16467E80DA164BAB
Malicious:	false
Reputation:	low
Preview:	............ ............... ............... ......7..``.... ......S..@@.... .(B......00.... ..%...).. .... ......O........ .h...>`...PNG........IHDR.............\r.f....pHYs..........o.d...:IDATx...{........Uu...f.......#ry.='^....1...A].q!...$^.2...`.h...&...0Q@7.=.{6.%z..-.]#....0.L.tW}.....KOOW.......Q...w..@)..RJ)..RJ)..RJ)..RJ)..R.....H...L[..7.j.....#.0..L.....y.U..@D%.i...g..3....x..Cd...R....-.^...nY...{..\..@.4..~.zz/..\|.....g..@6S......~....W.N...%.J....r.9G ./.2......_.`..L.b.7Z.%......["...1VB.;H.].o....~+....J....E..+>..h..............y...JH..mR..,..4.Y.Bp.k.+..#^..E...P.."&.{>.$D..y.Dz$ou..5'I.v....(r..GtKj...c;.P.\[.K...>..%....M..{...'.2.v.\...s..Fn..%....*77-.{.../....2..x..h....D..@..y......".....H.x._.p....D........=C../.(..%...._Z0...D..@....{O.3..%./d.q.3..@.h......#..........M.$=;P.z...$EL........80.-..I...,....@f..b;.?."rNf.F.9.@w.B...6)-.....o...;U...K..BLD..3.#.......3.%_.,P}...V...W....l.h.s.....3w..v.R...Rw.%

Chrome Cache Entry: 68

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 8 icons, 256x256 with PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced, 32 bits/pixel, 256x256 with PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced, 32 bits/pixel
Category:	dropped
Size (bytes):	91302
Entropy (8bit):	5.083847889045784
Encrypted:	false
SSDEEP:	1536:59iJX9Lgm9iJX9Lgm9iJX9Lg/jHXZwuumF:54p4p4qXZwuumF
MD5:	2B4509D8A869917BBC5CE10982956619
SHA1:	DC21BD40ED9B873779F855026F253BDD3322723D
SHA-256:	397EDDF44E1BF7E557B0B4F5173DA95D8FD832B6F2F10D6E41C17DC539D5A822
SHA-512:	2D0A54E85C7BBDD653B1557A3741D44B621876503D6E8B8CFD5FC6BD3047E28B9702DFB132474DD3981174D96F994B46083008A327646C8D16467E80DA164BAB
Malicious:	false
Reputation:	low
Preview:	............ ............... ............... ......7..``.... ......S..@@.... .(B......00.... ..%...).. .... ......O........ .h...>`...PNG........IHDR.............\r.f....pHYs..........o.d...:IDATx...{........Uu...f.......#ry.='^....1...A].q!...$^.2...`.h...&...0Q@7.=.{6.%z..-.]#....0.L.tW}.....KOOW.......Q...w..@)..RJ)..RJ)..RJ)..RJ)..R.....H...L[..7.j.....#.0..L.....y.U..@D%.i...g..3....x..Cd...R....-.^...nY...{..\..@.4..~.zz/..\|.....g..@6S......~....W.N...%.J....r.9G ./.2......_.`..L.b.7Z.%......["...1VB.;H.].o....~+....J....E..+>..h..............y...JH..mR..,..4.Y.Bp.k.+..#^..E...P.."&.{>.$D..y.Dz$ou..5'I.v....(r..GtKj...c;.P.\[.K...>..%....M..{...'.2.v.\...s..Fn..%....*77-.{.../....2..x..h....D..@..y......".....H.x._.p....D........=C../.(..%...._Z0...D..@....{O.3..%./d.q.3..@.h......#..........M.$=;P.z...$EL........80.-..I...,....@f..b;.?."rNf.F.9.@w.B...6)-.....o...;U...K..BLD..3.#.......3.%_.,P}...V...W....l.h.s.....3w..v.R...Rw.%

Chrome Cache Entry: 69

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	4.241202481433726
Encrypted:	false
SSDEEP:	3:YozDD/RNgQJzRWWlKFiFD3e4xCzY:YovtNgmzR/wYFDxkY
MD5:	9E576E34B18E986347909C29AE6A82C6
SHA1:	532C767978DC2B55854B3CA2D2DF5B4DB221C934
SHA-256:	88BDF5AF090328963973990DE427779F9C4DF3B8E1F5BADC3D972BAC3087006D
SHA-512:	5EF6DCFFD93434D45760888BF4B95FF134D53F34DA9DC904AD3C5EBEDC58409073483F531FEA4233869ED3EC75F38B022A70B2E179A5D3A13BDB10AB5C46B124
Malicious:	false
Reputation:	low
Preview:	{"Message":"The requested resource does not support http method 'GET'."}

Chrome Cache Entry: 70

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	4.241202481433726
Encrypted:	false
SSDEEP:	3:YozDD/RNgQJzRWWlKFiFD3e4xCzY:YovtNgmzR/wYFDxkY
MD5:	9E576E34B18E986347909C29AE6A82C6
SHA1:	532C767978DC2B55854B3CA2D2DF5B4DB221C934
SHA-256:	88BDF5AF090328963973990DE427779F9C4DF3B8E1F5BADC3D972BAC3087006D
SHA-512:	5EF6DCFFD93434D45760888BF4B95FF134D53F34DA9DC904AD3C5EBEDC58409073483F531FEA4233869ED3EC75F38B022A70B2E179A5D3A13BDB10AB5C46B124
Malicious:	false
Reputation:	low
Preview:	{"Message":"The requested resource does not support http method 'GET'."}

Static File Info

⊘No static file info

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 26, 2024 18:55:58.671798944 CEST	49675	443	192.168.2.4	173.222.162.32
Apr 26, 2024 18:56:08.436264992 CEST	49675	443	192.168.2.4	173.222.162.32
Apr 26, 2024 18:56:11.158353090 CEST	49736	443	192.168.2.4	52.123.129.14
Apr 26, 2024 18:56:11.158417940 CEST	443	49736	52.123.129.14	192.168.2.4
Apr 26, 2024 18:56:11.158512115 CEST	49736	443	192.168.2.4	52.123.129.14
Apr 26, 2024 18:56:11.290086985 CEST	49737	443	192.168.2.4	52.123.129.14
Apr 26, 2024 18:56:11.290133953 CEST	443	49737	52.123.129.14	192.168.2.4
Apr 26, 2024 18:56:11.290190935 CEST	49737	443	192.168.2.4	52.123.129.14
Apr 26, 2024 18:56:11.290791988 CEST	49737	443	192.168.2.4	52.123.129.14
Apr 26, 2024 18:56:11.290812969 CEST	443	49737	52.123.129.14	192.168.2.4
Apr 26, 2024 18:56:11.291095018 CEST	49736	443	192.168.2.4	52.123.129.14
Apr 26, 2024 18:56:11.291136980 CEST	443	49736	52.123.129.14	192.168.2.4
Apr 26, 2024 18:56:12.093116045 CEST	443	49737	52.123.129.14	192.168.2.4
Apr 26, 2024 18:56:12.095575094 CEST	49737	443	192.168.2.4	52.123.129.14
Apr 26, 2024 18:56:12.095593929 CEST	443	49737	52.123.129.14	192.168.2.4
Apr 26, 2024 18:56:12.096498966 CEST	443	49737	52.123.129.14	192.168.2.4
Apr 26, 2024 18:56:12.096574068 CEST	49737	443	192.168.2.4	52.123.129.14
Apr 26, 2024 18:56:12.098234892 CEST	49737	443	192.168.2.4	52.123.129.14
Apr 26, 2024 18:56:12.098293066 CEST	443	49737	52.123.129.14	192.168.2.4
Apr 26, 2024 18:56:12.098584890 CEST	49737	443	192.168.2.4	52.123.129.14
Apr 26, 2024 18:56:12.098592997 CEST	443	49737	52.123.129.14	192.168.2.4
Apr 26, 2024 18:56:12.106597900 CEST	443	49736	52.123.129.14	192.168.2.4
Apr 26, 2024 18:56:12.112026930 CEST	49736	443	192.168.2.4	52.123.129.14
Apr 26, 2024 18:56:12.112063885 CEST	443	49736	52.123.129.14	192.168.2.4
Apr 26, 2024 18:56:12.113913059 CEST	443	49736	52.123.129.14	192.168.2.4
Apr 26, 2024 18:56:12.113992929 CEST	49736	443	192.168.2.4	52.123.129.14
Apr 26, 2024 18:56:12.115413904 CEST	49736	443	192.168.2.4	52.123.129.14
Apr 26, 2024 18:56:12.115504980 CEST	443	49736	52.123.129.14	192.168.2.4
Apr 26, 2024 18:56:12.157506943 CEST	49736	443	192.168.2.4	52.123.129.14
Apr 26, 2024 18:56:12.157525063 CEST	443	49736	52.123.129.14	192.168.2.4
Apr 26, 2024 18:56:12.191021919 CEST	49737	443	192.168.2.4	52.123.129.14
Apr 26, 2024 18:56:12.206341982 CEST	49736	443	192.168.2.4	52.123.129.14
Apr 26, 2024 18:56:12.364563942 CEST	49739	443	192.168.2.4	142.250.189.132
Apr 26, 2024 18:56:12.364630938 CEST	443	49739	142.250.189.132	192.168.2.4
Apr 26, 2024 18:56:12.364726067 CEST	49739	443	192.168.2.4	142.250.189.132
Apr 26, 2024 18:56:12.365716934 CEST	49739	443	192.168.2.4	142.250.189.132
Apr 26, 2024 18:56:12.365731955 CEST	443	49739	142.250.189.132	192.168.2.4
Apr 26, 2024 18:56:12.709139109 CEST	443	49739	142.250.189.132	192.168.2.4
Apr 26, 2024 18:56:12.710616112 CEST	49739	443	192.168.2.4	142.250.189.132
Apr 26, 2024 18:56:12.710634947 CEST	443	49739	142.250.189.132	192.168.2.4
Apr 26, 2024 18:56:12.712075949 CEST	443	49739	142.250.189.132	192.168.2.4
Apr 26, 2024 18:56:12.712140083 CEST	49739	443	192.168.2.4	142.250.189.132
Apr 26, 2024 18:56:12.823134899 CEST	443	49737	52.123.129.14	192.168.2.4
Apr 26, 2024 18:56:12.823234081 CEST	443	49737	52.123.129.14	192.168.2.4
Apr 26, 2024 18:56:12.823288918 CEST	49737	443	192.168.2.4	52.123.129.14
Apr 26, 2024 18:56:12.823785067 CEST	49737	443	192.168.2.4	52.123.129.14
Apr 26, 2024 18:56:12.823810101 CEST	443	49737	52.123.129.14	192.168.2.4
Apr 26, 2024 18:56:13.136799097 CEST	49739	443	192.168.2.4	142.250.189.132
Apr 26, 2024 18:56:13.137026072 CEST	443	49739	142.250.189.132	192.168.2.4
Apr 26, 2024 18:56:13.137825966 CEST	49740	443	192.168.2.4	23.204.76.112
Apr 26, 2024 18:56:13.137866974 CEST	443	49740	23.204.76.112	192.168.2.4
Apr 26, 2024 18:56:13.138102055 CEST	49740	443	192.168.2.4	23.204.76.112
Apr 26, 2024 18:56:13.145040035 CEST	49740	443	192.168.2.4	23.204.76.112
Apr 26, 2024 18:56:13.145056009 CEST	443	49740	23.204.76.112	192.168.2.4
Apr 26, 2024 18:56:13.296915054 CEST	49739	443	192.168.2.4	142.250.189.132
Apr 26, 2024 18:56:13.296932936 CEST	443	49739	142.250.189.132	192.168.2.4
Apr 26, 2024 18:56:13.403480053 CEST	443	49740	23.204.76.112	192.168.2.4
Apr 26, 2024 18:56:13.403584957 CEST	49740	443	192.168.2.4	23.204.76.112
Apr 26, 2024 18:56:13.418220043 CEST	49740	443	192.168.2.4	23.204.76.112
Apr 26, 2024 18:56:13.418242931 CEST	443	49740	23.204.76.112	192.168.2.4
Apr 26, 2024 18:56:13.418477058 CEST	443	49740	23.204.76.112	192.168.2.4
Apr 26, 2024 18:56:13.491599083 CEST	49739	443	192.168.2.4	142.250.189.132
Apr 26, 2024 18:56:13.491601944 CEST	49740	443	192.168.2.4	23.204.76.112
Apr 26, 2024 18:56:15.656203985 CEST	49740	443	192.168.2.4	23.204.76.112
Apr 26, 2024 18:56:15.704118967 CEST	443	49740	23.204.76.112	192.168.2.4
Apr 26, 2024 18:56:15.789582014 CEST	443	49740	23.204.76.112	192.168.2.4
Apr 26, 2024 18:56:15.789665937 CEST	443	49740	23.204.76.112	192.168.2.4
Apr 26, 2024 18:56:15.789721966 CEST	49740	443	192.168.2.4	23.204.76.112
Apr 26, 2024 18:56:15.791599989 CEST	49740	443	192.168.2.4	23.204.76.112
Apr 26, 2024 18:56:15.791620970 CEST	443	49740	23.204.76.112	192.168.2.4
Apr 26, 2024 18:56:15.791646957 CEST	49740	443	192.168.2.4	23.204.76.112
Apr 26, 2024 18:56:15.791655064 CEST	443	49740	23.204.76.112	192.168.2.4
Apr 26, 2024 18:56:16.068356991 CEST	49743	443	192.168.2.4	23.204.76.112
Apr 26, 2024 18:56:16.068403959 CEST	443	49743	23.204.76.112	192.168.2.4
Apr 26, 2024 18:56:16.068486929 CEST	49743	443	192.168.2.4	23.204.76.112
Apr 26, 2024 18:56:16.069792986 CEST	49743	443	192.168.2.4	23.204.76.112
Apr 26, 2024 18:56:16.069811106 CEST	443	49743	23.204.76.112	192.168.2.4
Apr 26, 2024 18:56:16.324174881 CEST	443	49743	23.204.76.112	192.168.2.4
Apr 26, 2024 18:56:16.324259043 CEST	49743	443	192.168.2.4	23.204.76.112
Apr 26, 2024 18:56:16.325839996 CEST	49743	443	192.168.2.4	23.204.76.112
Apr 26, 2024 18:56:16.325845957 CEST	443	49743	23.204.76.112	192.168.2.4
Apr 26, 2024 18:56:16.326111078 CEST	443	49743	23.204.76.112	192.168.2.4
Apr 26, 2024 18:56:16.327532053 CEST	49743	443	192.168.2.4	23.204.76.112
Apr 26, 2024 18:56:16.368130922 CEST	443	49743	23.204.76.112	192.168.2.4
Apr 26, 2024 18:56:16.574318886 CEST	443	49743	23.204.76.112	192.168.2.4
Apr 26, 2024 18:56:16.574394941 CEST	443	49743	23.204.76.112	192.168.2.4
Apr 26, 2024 18:56:16.574929953 CEST	49743	443	192.168.2.4	23.204.76.112
Apr 26, 2024 18:56:16.575361967 CEST	49743	443	192.168.2.4	23.204.76.112
Apr 26, 2024 18:56:16.575377941 CEST	443	49743	23.204.76.112	192.168.2.4
Apr 26, 2024 18:56:16.575391054 CEST	49743	443	192.168.2.4	23.204.76.112
Apr 26, 2024 18:56:16.575397015 CEST	443	49743	23.204.76.112	192.168.2.4
Apr 26, 2024 18:56:22.263712883 CEST	49672	443	192.168.2.4	173.222.162.32
Apr 26, 2024 18:56:22.263819933 CEST	443	49672	173.222.162.32	192.168.2.4
Apr 26, 2024 18:56:22.393848896 CEST	49746	443	192.168.2.4	20.12.23.50
Apr 26, 2024 18:56:22.393903017 CEST	443	49746	20.12.23.50	192.168.2.4
Apr 26, 2024 18:56:22.393969059 CEST	49746	443	192.168.2.4	20.12.23.50
Apr 26, 2024 18:56:22.396308899 CEST	49746	443	192.168.2.4	20.12.23.50
Apr 26, 2024 18:56:22.396322966 CEST	443	49746	20.12.23.50	192.168.2.4
Apr 26, 2024 18:56:22.702761889 CEST	443	49739	142.250.189.132	192.168.2.4
Apr 26, 2024 18:56:22.702826977 CEST	443	49739	142.250.189.132	192.168.2.4
Apr 26, 2024 18:56:22.702877998 CEST	49739	443	192.168.2.4	142.250.189.132
Apr 26, 2024 18:56:22.875299931 CEST	443	49746	20.12.23.50	192.168.2.4
Apr 26, 2024 18:56:22.875511885 CEST	49746	443	192.168.2.4	20.12.23.50
Apr 26, 2024 18:56:22.879123926 CEST	49746	443	192.168.2.4	20.12.23.50
Apr 26, 2024 18:56:22.879137993 CEST	443	49746	20.12.23.50	192.168.2.4
Apr 26, 2024 18:56:22.879633904 CEST	443	49746	20.12.23.50	192.168.2.4
Apr 26, 2024 18:56:23.003334045 CEST	49739	443	192.168.2.4	142.250.189.132
Apr 26, 2024 18:56:23.003354073 CEST	443	49739	142.250.189.132	192.168.2.4
Apr 26, 2024 18:56:23.021898031 CEST	49746	443	192.168.2.4	20.12.23.50
Apr 26, 2024 18:56:23.478346109 CEST	49746	443	192.168.2.4	20.12.23.50
Apr 26, 2024 18:56:23.524106979 CEST	443	49746	20.12.23.50	192.168.2.4
Apr 26, 2024 18:56:23.789206982 CEST	443	49746	20.12.23.50	192.168.2.4
Apr 26, 2024 18:56:23.789235115 CEST	443	49746	20.12.23.50	192.168.2.4
Apr 26, 2024 18:56:23.789251089 CEST	443	49746	20.12.23.50	192.168.2.4
Apr 26, 2024 18:56:23.789272070 CEST	443	49746	20.12.23.50	192.168.2.4
Apr 26, 2024 18:56:23.789280891 CEST	443	49746	20.12.23.50	192.168.2.4
Apr 26, 2024 18:56:23.789288998 CEST	443	49746	20.12.23.50	192.168.2.4
Apr 26, 2024 18:56:23.789319038 CEST	49746	443	192.168.2.4	20.12.23.50
Apr 26, 2024 18:56:23.789339066 CEST	443	49746	20.12.23.50	192.168.2.4
Apr 26, 2024 18:56:23.789369106 CEST	443	49746	20.12.23.50	192.168.2.4
Apr 26, 2024 18:56:23.789380074 CEST	443	49746	20.12.23.50	192.168.2.4
Apr 26, 2024 18:56:23.789396048 CEST	49746	443	192.168.2.4	20.12.23.50
Apr 26, 2024 18:56:23.789407015 CEST	443	49746	20.12.23.50	192.168.2.4
Apr 26, 2024 18:56:23.789418936 CEST	49746	443	192.168.2.4	20.12.23.50
Apr 26, 2024 18:56:23.789427996 CEST	443	49746	20.12.23.50	192.168.2.4
Apr 26, 2024 18:56:23.789437056 CEST	49746	443	192.168.2.4	20.12.23.50
Apr 26, 2024 18:56:23.789504051 CEST	443	49746	20.12.23.50	192.168.2.4
Apr 26, 2024 18:56:23.790551901 CEST	49746	443	192.168.2.4	20.12.23.50
Apr 26, 2024 18:56:26.040967941 CEST	49746	443	192.168.2.4	20.12.23.50
Apr 26, 2024 18:56:26.040993929 CEST	443	49746	20.12.23.50	192.168.2.4
Apr 26, 2024 18:56:26.041008949 CEST	49746	443	192.168.2.4	20.12.23.50
Apr 26, 2024 18:56:26.041014910 CEST	443	49746	20.12.23.50	192.168.2.4
Apr 26, 2024 18:56:26.051331997 CEST	49723	80	192.168.2.4	23.55.103.106
Apr 26, 2024 18:56:26.247386932 CEST	80	49723	23.55.103.106	192.168.2.4
Apr 26, 2024 18:56:26.247466087 CEST	49723	80	192.168.2.4	23.55.103.106
Apr 26, 2024 18:56:57.159811974 CEST	49736	443	192.168.2.4	52.123.129.14
Apr 26, 2024 18:56:57.159837008 CEST	443	49736	52.123.129.14	192.168.2.4
Apr 26, 2024 18:57:06.995861053 CEST	49768	443	192.168.2.4	20.12.23.50
Apr 26, 2024 18:57:06.995909929 CEST	443	49768	20.12.23.50	192.168.2.4
Apr 26, 2024 18:57:06.995991945 CEST	49768	443	192.168.2.4	20.12.23.50
Apr 26, 2024 18:57:06.996510029 CEST	49768	443	192.168.2.4	20.12.23.50
Apr 26, 2024 18:57:06.996527910 CEST	443	49768	20.12.23.50	192.168.2.4
Apr 26, 2024 18:57:07.463556051 CEST	443	49768	20.12.23.50	192.168.2.4
Apr 26, 2024 18:57:07.463752985 CEST	49768	443	192.168.2.4	20.12.23.50
Apr 26, 2024 18:57:07.467951059 CEST	49768	443	192.168.2.4	20.12.23.50
Apr 26, 2024 18:57:07.467967033 CEST	443	49768	20.12.23.50	192.168.2.4
Apr 26, 2024 18:57:07.468225002 CEST	443	49768	20.12.23.50	192.168.2.4
Apr 26, 2024 18:57:07.477262974 CEST	49768	443	192.168.2.4	20.12.23.50
Apr 26, 2024 18:57:07.520118952 CEST	443	49768	20.12.23.50	192.168.2.4
Apr 26, 2024 18:57:07.921211004 CEST	443	49768	20.12.23.50	192.168.2.4
Apr 26, 2024 18:57:07.921236992 CEST	443	49768	20.12.23.50	192.168.2.4
Apr 26, 2024 18:57:07.921252012 CEST	443	49768	20.12.23.50	192.168.2.4
Apr 26, 2024 18:57:07.921504974 CEST	49768	443	192.168.2.4	20.12.23.50
Apr 26, 2024 18:57:07.921551943 CEST	443	49768	20.12.23.50	192.168.2.4
Apr 26, 2024 18:57:07.921624899 CEST	443	49768	20.12.23.50	192.168.2.4
Apr 26, 2024 18:57:07.921660900 CEST	49768	443	192.168.2.4	20.12.23.50
Apr 26, 2024 18:57:07.921667099 CEST	443	49768	20.12.23.50	192.168.2.4
Apr 26, 2024 18:57:07.921691895 CEST	443	49768	20.12.23.50	192.168.2.4
Apr 26, 2024 18:57:07.921704054 CEST	49768	443	192.168.2.4	20.12.23.50
Apr 26, 2024 18:57:07.921752930 CEST	443	49768	20.12.23.50	192.168.2.4
Apr 26, 2024 18:57:07.921777964 CEST	49768	443	192.168.2.4	20.12.23.50
Apr 26, 2024 18:57:07.921849012 CEST	49768	443	192.168.2.4	20.12.23.50
Apr 26, 2024 18:57:07.927993059 CEST	49768	443	192.168.2.4	20.12.23.50
Apr 26, 2024 18:57:07.928009033 CEST	443	49768	20.12.23.50	192.168.2.4
Apr 26, 2024 18:57:07.928044081 CEST	49768	443	192.168.2.4	20.12.23.50
Apr 26, 2024 18:57:07.928050995 CEST	443	49768	20.12.23.50	192.168.2.4
Apr 26, 2024 18:57:12.281945944 CEST	49736	443	192.168.2.4	52.123.129.14
Apr 26, 2024 18:57:12.282064915 CEST	443	49736	52.123.129.14	192.168.2.4
Apr 26, 2024 18:57:12.282218933 CEST	49736	443	192.168.2.4	52.123.129.14
Apr 26, 2024 18:57:12.282459021 CEST	49770	443	192.168.2.4	142.250.189.132
Apr 26, 2024 18:57:12.282495022 CEST	443	49770	142.250.189.132	192.168.2.4
Apr 26, 2024 18:57:12.282665968 CEST	49770	443	192.168.2.4	142.250.189.132
Apr 26, 2024 18:57:12.282851934 CEST	49770	443	192.168.2.4	142.250.189.132
Apr 26, 2024 18:57:12.282866955 CEST	443	49770	142.250.189.132	192.168.2.4
Apr 26, 2024 18:57:12.613018990 CEST	443	49770	142.250.189.132	192.168.2.4
Apr 26, 2024 18:57:12.613373041 CEST	49770	443	192.168.2.4	142.250.189.132
Apr 26, 2024 18:57:12.613396883 CEST	443	49770	142.250.189.132	192.168.2.4
Apr 26, 2024 18:57:12.613734961 CEST	443	49770	142.250.189.132	192.168.2.4
Apr 26, 2024 18:57:12.614247084 CEST	49770	443	192.168.2.4	142.250.189.132
Apr 26, 2024 18:57:12.614310026 CEST	443	49770	142.250.189.132	192.168.2.4
Apr 26, 2024 18:57:12.655602932 CEST	49770	443	192.168.2.4	142.250.189.132
Apr 26, 2024 18:57:22.625741959 CEST	443	49770	142.250.189.132	192.168.2.4
Apr 26, 2024 18:57:22.625824928 CEST	443	49770	142.250.189.132	192.168.2.4
Apr 26, 2024 18:57:22.625987053 CEST	49770	443	192.168.2.4	142.250.189.132
Apr 26, 2024 18:57:24.298465014 CEST	49770	443	192.168.2.4	142.250.189.132
Apr 26, 2024 18:57:24.298500061 CEST	443	49770	142.250.189.132	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 26, 2024 18:56:08.108740091 CEST	53	59715	1.1.1.1	192.168.2.4
Apr 26, 2024 18:56:08.197999954 CEST	53	58404	1.1.1.1	192.168.2.4
Apr 26, 2024 18:56:09.150949001 CEST	53	63210	1.1.1.1	192.168.2.4
Apr 26, 2024 18:56:11.013288975 CEST	60864	53	192.168.2.4	1.1.1.1
Apr 26, 2024 18:56:11.013446093 CEST	55399	53	192.168.2.4	1.1.1.1
Apr 26, 2024 18:56:11.138645887 CEST	53	55399	1.1.1.1	192.168.2.4
Apr 26, 2024 18:56:11.139879942 CEST	53	60864	1.1.1.1	192.168.2.4
Apr 26, 2024 18:56:12.221115112 CEST	58571	53	192.168.2.4	1.1.1.1
Apr 26, 2024 18:56:12.221393108 CEST	57093	53	192.168.2.4	1.1.1.1
Apr 26, 2024 18:56:12.346863031 CEST	53	57093	1.1.1.1	192.168.2.4
Apr 26, 2024 18:56:12.347654104 CEST	53	58571	1.1.1.1	192.168.2.4
Apr 26, 2024 18:56:13.133066893 CEST	59150	53	192.168.2.4	1.1.1.1
Apr 26, 2024 18:56:13.134035110 CEST	62232	53	192.168.2.4	1.1.1.1
Apr 26, 2024 18:56:13.261378050 CEST	53	62232	1.1.1.1	192.168.2.4
Apr 26, 2024 18:56:18.774238110 CEST	53741	53	192.168.2.4	1.1.1.1
Apr 26, 2024 18:56:18.774887085 CEST	60727	53	192.168.2.4	1.1.1.1
Apr 26, 2024 18:56:23.517782927 CEST	56882	53	192.168.2.4	1.1.1.1
Apr 26, 2024 18:56:23.517782927 CEST	59355	53	192.168.2.4	1.1.1.1
Apr 26, 2024 18:56:25.134462118 CEST	50708	53	192.168.2.4	1.1.1.1
Apr 26, 2024 18:56:25.210449934 CEST	63983	53	192.168.2.4	1.1.1.1
Apr 26, 2024 18:56:25.548998117 CEST	138	138	192.168.2.4	192.168.2.255
Apr 26, 2024 18:56:30.369573116 CEST	53	58533	1.1.1.1	192.168.2.4
Apr 26, 2024 18:56:55.442935944 CEST	53	49823	1.1.1.1	192.168.2.4
Apr 26, 2024 18:57:07.846262932 CEST	53	55691	1.1.1.1	192.168.2.4
Apr 26, 2024 18:57:20.329988003 CEST	53	58722	1.1.1.1	192.168.2.4
Apr 26, 2024 18:57:52.814214945 CEST	53	63903	1.1.1.1	192.168.2.4

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Apr 26, 2024 18:56:25.336682081 CEST	192.168.2.4	1.1.1.1	c2af	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Apr 26, 2024 18:56:11.013288975 CEST	192.168.2.4	1.1.1.1	0x8f1	Standard query (0)	urlshortener.teams.cloud.microsoft	A (IP address)	IN (0x0001)	false
Apr 26, 2024 18:56:11.013446093 CEST	192.168.2.4	1.1.1.1	0x906c	Standard query (0)	urlshortener.teams.cloud.microsoft	65	IN (0x0001)	false
Apr 26, 2024 18:56:12.221115112 CEST	192.168.2.4	1.1.1.1	0x5267	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 18:56:12.221393108 CEST	192.168.2.4	1.1.1.1	0xc5f5	Standard query (0)	www.google.com	65	IN (0x0001)	false
Apr 26, 2024 18:56:13.133066893 CEST	192.168.2.4	1.1.1.1	0x391b	Standard query (0)	teams.live.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 18:56:13.134035110 CEST	192.168.2.4	1.1.1.1	0xfb7a	Standard query (0)	teams.live.com	65	IN (0x0001)	false
Apr 26, 2024 18:56:18.774238110 CEST	192.168.2.4	1.1.1.1	0xa3a8	Standard query (0)	statics.teams.cdn.live.net	A (IP address)	IN (0x0001)	false
Apr 26, 2024 18:56:18.774887085 CEST	192.168.2.4	1.1.1.1	0x93a6	Standard query (0)	statics.teams.cdn.live.net	65	IN (0x0001)	false
Apr 26, 2024 18:56:23.517782927 CEST	192.168.2.4	1.1.1.1	0x6d5a	Standard query (0)	statics.teams.cdn.live.net	65	IN (0x0001)	false
Apr 26, 2024 18:56:23.517782927 CEST	192.168.2.4	1.1.1.1	0xbe24	Standard query (0)	statics.teams.cdn.live.net	A (IP address)	IN (0x0001)	false
Apr 26, 2024 18:56:25.134462118 CEST	192.168.2.4	1.1.1.1	0xca0f	Standard query (0)	statics.teams.cdn.live.net	A (IP address)	IN (0x0001)	false
Apr 26, 2024 18:56:25.210449934 CEST	192.168.2.4	1.1.1.1	0x7cd9	Standard query (0)	statics.teams.cdn.live.net	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Apr 26, 2024 18:56:11.138645887 CEST	1.1.1.1	192.168.2.4	0x906c	No error (0)	urlshortener.teams.cloud.microsoft	urlshortener-teams-cloud-microsoft.s-0005.dual-s-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 18:56:11.139879942 CEST	1.1.1.1	192.168.2.4	0x8f1	No error (0)	urlshortener.teams.cloud.microsoft	urlshortener-teams-cloud-microsoft.s-0005.dual-s-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 18:56:11.139879942 CEST	1.1.1.1	192.168.2.4	0x8f1	No error (0)	urlshortener-teams-cloud-microsoft.s-0005.dual-s-msedge.net	s-0005.dual-s-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 18:56:11.139879942 CEST	1.1.1.1	192.168.2.4	0x8f1	No error (0)	s-0005.dual-s-msedge.net		52.123.129.14	A (IP address)	IN (0x0001)	false
Apr 26, 2024 18:56:11.139879942 CEST	1.1.1.1	192.168.2.4	0x8f1	No error (0)	s-0005.dual-s-msedge.net		52.123.128.14	A (IP address)	IN (0x0001)	false
Apr 26, 2024 18:56:12.346863031 CEST	1.1.1.1	192.168.2.4	0xc5f5	No error (0)	www.google.com			65	IN (0x0001)	false
Apr 26, 2024 18:56:12.347654104 CEST	1.1.1.1	192.168.2.4	0x5267	No error (0)	www.google.com		142.250.189.132	A (IP address)	IN (0x0001)	false
Apr 26, 2024 18:56:13.261339903 CEST	1.1.1.1	192.168.2.4	0x391b	No error (0)	teams.live.com	s-0005.s-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 18:56:13.261378050 CEST	1.1.1.1	192.168.2.4	0xfb7a	No error (0)	teams.live.com	s-0005.s-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 18:56:18.904254913 CEST	1.1.1.1	192.168.2.4	0x93a6	No error (0)	statics.teams.cdn.live.net	tfl-staticscdn.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 18:56:18.904274940 CEST	1.1.1.1	192.168.2.4	0xa3a8	No error (0)	statics.teams.cdn.live.net	tfl-staticscdn.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 18:56:23.644092083 CEST	1.1.1.1	192.168.2.4	0xbe24	No error (0)	statics.teams.cdn.live.net	tfl-staticscdn.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 18:56:23.644273996 CEST	1.1.1.1	192.168.2.4	0x6d5a	No error (0)	statics.teams.cdn.live.net	tfl-staticscdn.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 18:56:25.262500048 CEST	1.1.1.1	192.168.2.4	0xca0f	No error (0)	statics.teams.cdn.live.net	tfl-staticscdn.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 18:56:25.336460114 CEST	1.1.1.1	192.168.2.4	0x7cd9	No error (0)	statics.teams.cdn.live.net	tfl-staticscdn.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 18:56:27.139178038 CEST	1.1.1.1	192.168.2.4	0xa81b	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 18:56:27.139178038 CEST	1.1.1.1	192.168.2.4	0xa81b	No error (0)	fp2e7a.wpc.phicdn.net		192.229.211.108	A (IP address)	IN (0x0001)	false
Apr 26, 2024 18:56:51.825284958 CEST	1.1.1.1	192.168.2.4	0x558f	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 18:56:51.825284958 CEST	1.1.1.1	192.168.2.4	0x558f	No error (0)	fp2e7a.wpc.phicdn.net		192.229.211.108	A (IP address)	IN (0x0001)	false
Apr 26, 2024 18:57:12.817029953 CEST	1.1.1.1	192.168.2.4	0x8480	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 18:57:12.817029953 CEST	1.1.1.1	192.168.2.4	0x8480	No error (0)	fp2e7a.wpc.phicdn.net		192.229.211.108	A (IP address)	IN (0x0001)	false
Apr 26, 2024 18:57:37.720367908 CEST	1.1.1.1	192.168.2.4	0x1f13	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 18:57:37.720367908 CEST	1.1.1.1	192.168.2.4	0x1f13	No error (0)	fp2e7a.wpc.phicdn.net		192.229.211.108	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

urlshortener.teams.cloud.microsoft

fs.microsoft.com

slscr.update.microsoft.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49737	52.123.129.14	443	4340	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 16:56:12 UTC	696	OUT	GET /8DC65F1626550D3-1-1 HTTP/1.1 Host: urlshortener.teams.cloud.microsoft Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 16:56:12 UTC	732	IN	HTTP/1.1 301 Moved Permanently Location: https://teams.live.com/l/chat/19:uni01_hwqyajis52lhbwhhort3bchwjsah7ugopu6ankkekjxscrbwtaka@thread.v2/conversations?tenantId=9188040d-6c67-4c5b-b112-36a304b66dad&launchAgent=ES&laEntry=MAE&v=MAE5&lm=deeplink&lmsrc=email&emltid=6d58df1f-2a83-46df-9008-d8bdd89ec852&linkpos=1&emltype=New_Activities_TFL&linktype=New_ChatActivity_TFL correlationTags: serverRequestId: aa8b3480-6401-4060-ace2-0501652e130a, clientRequestId: Strict-Transport-Security: max-age=31536000; includeSubDomains X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: 13C7457FC0F044E9A1C4F97DF745E237 Ref B: MIAEDGE2621 Ref C: 2024-04-26T16:56:12Z Date: Fri, 26 Apr 2024 16:56:12 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49740	23.204.76.112	443

Timestamp	Bytes transferred	Direction	Data
2024-04-26 16:56:15 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-04-26 16:56:15 UTC	466	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (chd/0758) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-eus-z1 Cache-Control: public, max-age=50850 Date: Fri, 26 Apr 2024 16:56:15 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49743	23.204.76.112	443

Timestamp	Bytes transferred	Direction	Data
2024-04-26 16:56:16 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-04-26 16:56:16 UTC	530	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Last-Modified: Tue, 16 May 2017 22:58:00 GMT ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-Azure-Ref: 0DZ+oYgAAAABSxwJpMgMuSLkfS640ajfFQVRBRURHRTEyMTkAY2VmYzI1ODMtYTliMi00NGE3LTk3NTUtYjc2ZDE3ZTA1Zjdm Cache-Control: public, max-age=50843 Date: Fri, 26 Apr 2024 16:56:16 GMT Content-Length: 55 Connection: close X-CID: 2
2024-04-26 16:56:16 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49746	20.12.23.50	443

Timestamp	Bytes transferred	Direction	Data
2024-04-26 16:56:23 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=9lZxm4dKhGl2+5y&MD=6exllT7+ HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-04-26 16:56:23 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 71c74505-cbd4-4518-8dbc-b2d28455ecd2 MS-RequestId: 2c95c900-f352-486b-8658-5493aaed6eda MS-CV: tbNIFbViaUi8FaCI.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Fri, 26 Apr 2024 16:56:22 GMT Connection: close Content-Length: 24490
2024-04-26 16:56:23 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-04-26 16:56:23 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49768	20.12.23.50	443

Timestamp	Bytes transferred	Direction	Data
2024-04-26 16:57:07 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=9lZxm4dKhGl2+5y&MD=6exllT7+ HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-04-26 16:57:07 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "Mx1RoJH/qEwpWfKllx7sbsl28AuERz5IYdcsvtTJcgM=_2160" MS-CorrelationId: d016379c-6d09-421c-a8ac-d4713b95b680 MS-RequestId: 84fb4180-969c-4add-9cca-30c0f5a3ff2a MS-CV: hNn3NtmKZ0aVTM/E.0 X-Microsoft-SLSClientCache: 2160 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Fri, 26 Apr 2024 16:57:06 GMT Connection: close Content-Length: 25457
2024-04-26 16:57:07 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 51 22 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 db 8e 00 00 14 00 00 00 00 00 10 00 51 22 00 00 20 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 f3 43 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 0d 92 6f db e5 21 f3 43 43 4b ed 5a 09 38 55 5b df 3f 93 99 90 29 99 e7 29 ec 73 cc 4a 66 32 cf 84 32 64 c8 31 c7 11 52 38 87 90 42 66 09 99 87 32 0f 19 0a 09 51 a6 a8 08 29 53 86 4a 52 84 50 df 46 83 ba dd 7b df fb 7e ef 7d ee 7d bf ef 9e e7 d9 67 ef 35 ee b5 fe eb 3f ff b6 96 81 a2 0a 04 fc 31 40 21 5b 3f a5 ed 1b 04 0e 85 42 a0 10 04 64 12 6c a5 de aa a1 d8 ea f3 58 01 f2 f5 67 0b 5e 9b bd e8 a0 90 1d bf 40 88 9d eb 49 b4 87 9b ab 8b 9d 2b 46 c8 c7 c5 19 92 Data Ascii: MSCFQ"DQ" AdCenvironment.cabo!CCKZ8U[?))sJf22d1R8Bf2Q)SJRPF{~}}g5?1@![?BdlXg^@I+F
2024-04-26 16:57:07 UTC	9633	IN	Data Raw: 21 6f b3 eb a6 cc f5 31 be cf 05 e2 a9 fe fa 57 6d 19 30 b3 c2 c5 66 c9 6a df f5 e7 f0 78 bd c7 a8 9e 25 e3 f9 bc ed 6b 54 57 08 2b 51 82 44 12 fb b9 53 8c cc f4 60 12 8a 76 cc 40 40 41 9b dc 5c 17 ff 5c f9 5e 17 35 98 24 56 4b 74 ef 42 10 c8 af bf 7f c6 7f f2 37 7d 5a 3f 1c f2 99 79 4a 91 52 00 af 38 0f 17 f5 2f 79 81 65 d9 a9 b5 6b e4 c7 ce f6 ca 7a 00 6f 4b 30 44 24 22 3c cf ed 03 a5 96 8f 59 29 bc b6 fd 04 e1 70 9f 32 4a 27 fd 55 af 2f fe b6 e5 8e 33 bb 62 5f 9a db 57 40 e9 f1 ce 99 66 90 8c ff 6a 62 7f dd c5 4a 0b 91 26 e2 39 ec 19 4a 71 63 9d 7b 21 6d c3 9c a3 a2 3c fa 7f 7d 96 6a 90 78 a6 6d d2 e1 9c f9 1d fc 38 d8 94 f4 c6 a5 0a 96 86 a4 bd 9e 1a ae 04 42 83 b8 b5 80 9b 22 38 20 b5 25 e5 64 ec f7 f4 bf 7e 63 59 25 0f 7a 2e 39 57 76 a2 71 aa 06 8a Data Ascii: !o1Wm0fjx%kTW+QDS`v@@A\\^5$VKtB7}Z?yJR8/yekzoK0D$"<Y)p2J'U/3b_W@fjbJ&9Jqc{!m<}jxm8B"8 %d~cY%z.9Wvq

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

Behavior

Click to jump to process

System Behavior

Analysis Process: chrome.exePID: 5580, Parent PID: 1800

General

Target ID:	0
Start time:	18:56:02
Start date:	26/04/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Chronological Activities

Analysis Process: chrome.exePID: 4340, Parent PID: 5580

General

Target ID:	2
Start time:	18:56:06
Start date:	26/04/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2492 --field-trial-handle=2488,i,5596698943673808519,4703168147859055955,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Chronological Activities

Analysis Process: chrome.exePID: 6464, Parent PID: 1800

General

Target ID:	3
Start time:	18:56:09
Start date:	26/04/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://urlshortener.teams.cloud.microsoft/8DC65F1626550D3-1-1"
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://urlshortener.teams.cloud.microsoft/8DC65F1626550D3-1-1

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Chrome Cache Entry: 56

Chrome Cache Entry: 57

Chrome Cache Entry: 58

Chrome Cache Entry: 59

Chrome Cache Entry: 60

Chrome Cache Entry: 61

Chrome Cache Entry: 62

Chrome Cache Entry: 63

Chrome Cache Entry: 64

Chrome Cache Entry: 65

Chrome Cache Entry: 66

Chrome Cache Entry: 67

Chrome Cache Entry: 68

Chrome Cache Entry: 69

Chrome Cache Entry: 70

Static File Info

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

ICMP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTPS Proxied Packets

Statistics

CPU Usage

Memory Usage

Behavior

Windows Analysis Report
https://urlshortener.teams.cloud.microsoft/8DC65F1626550D3-1-1