Edit tour

Windows Analysis Report
https://auth.wetransfer.com/u/email-verification?ticket=sOfHe06FaLKeBlvUSZSpsfeqvFtInnsm

Overview

General Information

Sample URL:	https://auth.wetransfer.com/u/email-verification?ticket=sOfHe06FaLKeBlvUSZSpsfeqvFtInnsm
Analysis ID:	1438427
Infos:

Detection

Score:	3
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found iframes

HTML body contains low number of good links

HTML body contains password input but no form action

HTML page contains hidden URLs or javascript code

Invalid 'forgot password' link found

Program does not show much activity (idle)

Classification

Process Tree

System is w10x64

chrome.exe (PID: 3916 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 3848 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2624 --field-trial-handle=2268,i,3564403640156923666,3971517337339682263,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 5460 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5848 --field-trial-handle=2268,i,3564403640156923666,3971517337339682263,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6552 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://auth.wetransfer.com/u/email-verification?ticket=sOfHe06FaLKeBlvUSZSpsfeqvFtInnsm" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: https://auth.wetransfer.com/login?state=hKFo2SBJOGxpcnBSRjFRZ0U3TXdQR2VNQTkyQmRNQkEyb0FmTaFupWxvZ2luo3RpZNkgZktKU1c4OTVhWXBiVEVwZkpNS3FkTFRRVTBkcUlSb0KjY2lk2SBkWFdGUWppVzFqeFdDRkcwaE9WcHFyazRoOXZHZWFuYw&client=dXWFQjiW1jxWCFG0hOVpqrk4h9vGeanc&protocol=oauth2&audience=aud%3A%2F%2Ftransfer-api-prod.wetransfer%2F&redirect_uri=https%3A%2F%2Fwetransfer.com%2Faccount%2Fcallback%3Fmessage%3DThis%2BURL%2Bcan%2Bbe%2Bused%2Bonly%2Bonce%26success%3Dfalse%26finalizeSSOAuth%3D1%26login%3D1&cache=%5Bobject%20Object%5D&initialScreen=login&lang=en&scope=openid%20profile%20email%20offline_access&response_type=code&response_mode=query&nonce=dzZFQjNPUEF6OU9kS35rN0xPYi5TSUlIVFByZXBjdFN6dE44alpFUzZFcg%3D%3D&code_challenge=Gagwqgf8R4qUWF_s6X4Iy6moBCG6jCMFBH7PqTRPCrY&code_challenge_method=S256&auth0Client=eyJuYW1lIjoiYXV0aDAtc3BhLWpzIiwidmVyc2lvbiI6IjEuMjIuMyJ9	HTTP Parser: Iframe src: https://tagging.wetransfer.com/ns.html?id=GTM-NS54WBW
Source: https://auth.wetransfer.com/login?state=hKFo2SBJOGxpcnBSRjFRZ0U3TXdQR2VNQTkyQmRNQkEyb0FmTaFupWxvZ2luo3RpZNkgZktKU1c4OTVhWXBiVEVwZkpNS3FkTFRRVTBkcUlSb0KjY2lk2SBkWFdGUWppVzFqeFdDRkcwaE9WcHFyazRoOXZHZWFuYw&client=dXWFQjiW1jxWCFG0hOVpqrk4h9vGeanc&protocol=oauth2&audience=aud%3A%2F%2Ftransfer-api-prod.wetransfer%2F&redirect_uri=https%3A%2F%2Fwetransfer.com%2Faccount%2Fcallback%3Fmessage%3DThis%2BURL%2Bcan%2Bbe%2Bused%2Bonly%2Bonce%26success%3Dfalse%26finalizeSSOAuth%3D1%26login%3D1&cache=%5Bobject%20Object%5D&initialScreen=login&lang=en&scope=openid%20profile%20email%20offline_access&response_type=code&response_mode=query&nonce=dzZFQjNPUEF6OU9kS35rN0xPYi5TSUlIVFByZXBjdFN6dE44alpFUzZFcg%3D%3D&code_challenge=Gagwqgf8R4qUWF_s6X4Iy6moBCG6jCMFBH7PqTRPCrY&code_challenge_method=S256&auth0Client=eyJuYW1lIjoiYXV0aDAtc3BhLWpzIiwidmVyc2lvbiI6IjEuMjIuMyJ9	HTTP Parser: Iframe src: https://insight.adsrvr.org/track/up?adv=81c3jgn&ref=https%3A%2F%2Fauth.wetransfer.com%2Flogin%3Fstate%3DhKFo2SBJOGxpcnBSRjFRZ0U3TXdQR2VNQTkyQmRNQkEyb0FmTaFupWxvZ2luo3RpZNkgZktKU1c4OTVhWXBiVEVwZkpNS3FkTFRRVTBkcUlSb0KjY2lk2SBkWFdGUWppVzFqeFdDRkcwaE9WcHFyazRoOXZHZWFuYw%26client%3DdXWFQjiW1jxWCFG0hOVpqrk4h9vGeanc%26protocol%3Doauth2%26audience%3Daud%253A%252F%252Ftransfer-api-prod.wetransfer%252F%26redirect_uri%3Dhttps%253A%252F%252Fwetransfer.com%252Faccount%252Fcallback%253Fmessage%253DThis%252BURL%252Bcan%252Bbe%252Bused%252Bonly%252Bonce%2526success%253Dfalse%2526finalizeSSOAuth%253D1%2526login%253D1%26cache%3D%255Bobject%2520Object%255D%26initialScreen%3Dlogin%26lang%3Den%26scope%3Dopenid%2520profile%2520email%2520offline_access%26response_type%3Dcode%26response_mode%3Dquery%26nonce%3DdzZFQjNPUEF6OU9kS35rN0xPYi5TSUlIVFByZXBjdFN6dE44alpFUzZFcg%253D%253D%26code_challenge%3DGagwqgf8R4qUWF_s6X4Iy6moBCG6jCMFBH7PqTRPCrY%26code_challenge_method%3DS256%26auth0Client%3DeyJuYW1lIjoiYXV0aDAtc3BhLWpzIiwidmVyc2lvbiI6IjEuMjIuMyJ9&upid=re36kbe&upv=1.1.0
Source: https://auth.wetransfer.com/login?state=hKFo2SBJOGxpcnBSRjFRZ0U3TXdQR2VNQTkyQmRNQkEyb0FmTaFupWxvZ2luo3RpZNkgZktKU1c4OTVhWXBiVEVwZkpNS3FkTFRRVTBkcUlSb0KjY2lk2SBkWFdGUWppVzFqeFdDRkcwaE9WcHFyazRoOXZHZWFuYw&client=dXWFQjiW1jxWCFG0hOVpqrk4h9vGeanc&protocol=oauth2&audience=aud%3A%2F%2Ftransfer-api-prod.wetransfer%2F&redirect_uri=https%3A%2F%2Fwetransfer.com%2Faccount%2Fcallback%3Fmessage%3DThis%2BURL%2Bcan%2Bbe%2Bused%2Bonly%2Bonce%26success%3Dfalse%26finalizeSSOAuth%3D1%26login%3D1&cache=%5Bobject%20Object%5D&initialScreen=login&lang=en&scope=openid%20profile%20email%20offline_access&response_type=code&response_mode=query&nonce=dzZFQjNPUEF6OU9kS35rN0xPYi5TSUlIVFByZXBjdFN6dE44alpFUzZFcg%3D%3D&code_challenge=Gagwqgf8R4qUWF_s6X4Iy6moBCG6jCMFBH7PqTRPCrY&code_challenge_method=S256&auth0Client=eyJuYW1lIjoiYXV0aDAtc3BhLWpzIiwidmVyc2lvbiI6IjEuMjIuMyJ9	HTTP Parser: Iframe src: https://tagging.wetransfer.com/ns.html?id=GTM-NS54WBW
Source: https://auth.wetransfer.com/login?state=hKFo2SBJOGxpcnBSRjFRZ0U3TXdQR2VNQTkyQmRNQkEyb0FmTaFupWxvZ2luo3RpZNkgZktKU1c4OTVhWXBiVEVwZkpNS3FkTFRRVTBkcUlSb0KjY2lk2SBkWFdGUWppVzFqeFdDRkcwaE9WcHFyazRoOXZHZWFuYw&client=dXWFQjiW1jxWCFG0hOVpqrk4h9vGeanc&protocol=oauth2&audience=aud%3A%2F%2Ftransfer-api-prod.wetransfer%2F&redirect_uri=https%3A%2F%2Fwetransfer.com%2Faccount%2Fcallback%3Fmessage%3DThis%2BURL%2Bcan%2Bbe%2Bused%2Bonly%2Bonce%26success%3Dfalse%26finalizeSSOAuth%3D1%26login%3D1&cache=%5Bobject%20Object%5D&initialScreen=login&lang=en&scope=openid%20profile%20email%20offline_access&response_type=code&response_mode=query&nonce=dzZFQjNPUEF6OU9kS35rN0xPYi5TSUlIVFByZXBjdFN6dE44alpFUzZFcg%3D%3D&code_challenge=Gagwqgf8R4qUWF_s6X4Iy6moBCG6jCMFBH7PqTRPCrY&code_challenge_method=S256&auth0Client=eyJuYW1lIjoiYXV0aDAtc3BhLWpzIiwidmVyc2lvbiI6IjEuMjIuMyJ9	HTTP Parser: Iframe src: https://insight.adsrvr.org/track/up?adv=81c3jgn&ref=https%3A%2F%2Fauth.wetransfer.com%2Flogin%3Fstate%3DhKFo2SBJOGxpcnBSRjFRZ0U3TXdQR2VNQTkyQmRNQkEyb0FmTaFupWxvZ2luo3RpZNkgZktKU1c4OTVhWXBiVEVwZkpNS3FkTFRRVTBkcUlSb0KjY2lk2SBkWFdGUWppVzFqeFdDRkcwaE9WcHFyazRoOXZHZWFuYw%26client%3DdXWFQjiW1jxWCFG0hOVpqrk4h9vGeanc%26protocol%3Doauth2%26audience%3Daud%253A%252F%252Ftransfer-api-prod.wetransfer%252F%26redirect_uri%3Dhttps%253A%252F%252Fwetransfer.com%252Faccount%252Fcallback%253Fmessage%253DThis%252BURL%252Bcan%252Bbe%252Bused%252Bonly%252Bonce%2526success%253Dfalse%2526finalizeSSOAuth%253D1%2526login%253D1%26cache%3D%255Bobject%2520Object%255D%26initialScreen%3Dlogin%26lang%3Den%26scope%3Dopenid%2520profile%2520email%2520offline_access%26response_type%3Dcode%26response_mode%3Dquery%26nonce%3DdzZFQjNPUEF6OU9kS35rN0xPYi5TSUlIVFByZXBjdFN6dE44alpFUzZFcg%253D%253D%26code_challenge%3DGagwqgf8R4qUWF_s6X4Iy6moBCG6jCMFBH7PqTRPCrY%26code_challenge_method%3DS256%26auth0Client%3DeyJuYW1lIjoiYXV0aDAtc3BhLWpzIiwidmVyc2lvbiI6IjEuMjIuMyJ9&upid=re36kbe&upv=1.1.0
Source: https://auth.wetransfer.com/login?state=hKFo2SBJOGxpcnBSRjFRZ0U3TXdQR2VNQTkyQmRNQkEyb0FmTaFupWxvZ2luo3RpZNkgZktKU1c4OTVhWXBiVEVwZkpNS3FkTFRRVTBkcUlSb0KjY2lk2SBkWFdGUWppVzFqeFdDRkcwaE9WcHFyazRoOXZHZWFuYw&client=dXWFQjiW1jxWCFG0hOVpqrk4h9vGeanc&protocol=oauth2&audience=aud%3A%2F%2Ftransfer-api-prod.wetransfer%2F&redirect_uri=https%3A%2F%2Fwetransfer.com%2Faccount%2Fcallback%3Fmessage%3DThis%2BURL%2Bcan%2Bbe%2Bused%2Bonly%2Bonce%26success%3Dfalse%26finalizeSSOAuth%3D1%26login%3D1&cache=%5Bobject%20Object%5D&initialScreen=login&lang=en&scope=openid%20profile%20email%20offline_access&response_type=code&response_mode=query&nonce=dzZFQjNPUEF6OU9kS35rN0xPYi5TSUlIVFByZXBjdFN6dE44alpFUzZFcg%3D%3D&code_challenge=Gagwqgf8R4qUWF_s6X4Iy6moBCG6jCMFBH7PqTRPCrY&code_challenge_method=S256&auth0Client=eyJuYW1lIjoiYXV0aDAtc3BhLWpzIiwidmVyc2lvbiI6IjEuMjIuMyJ9	HTTP Parser: Iframe src: https://tagging.wetransfer.com/ns.html?id=GTM-NS54WBW
Source: https://auth.wetransfer.com/login?state=hKFo2SBJOGxpcnBSRjFRZ0U3TXdQR2VNQTkyQmRNQkEyb0FmTaFupWxvZ2luo3RpZNkgZktKU1c4OTVhWXBiVEVwZkpNS3FkTFRRVTBkcUlSb0KjY2lk2SBkWFdGUWppVzFqeFdDRkcwaE9WcHFyazRoOXZHZWFuYw&client=dXWFQjiW1jxWCFG0hOVpqrk4h9vGeanc&protocol=oauth2&audience=aud%3A%2F%2Ftransfer-api-prod.wetransfer%2F&redirect_uri=https%3A%2F%2Fwetransfer.com%2Faccount%2Fcallback%3Fmessage%3DThis%2BURL%2Bcan%2Bbe%2Bused%2Bonly%2Bonce%26success%3Dfalse%26finalizeSSOAuth%3D1%26login%3D1&cache=%5Bobject%20Object%5D&initialScreen=login&lang=en&scope=openid%20profile%20email%20offline_access&response_type=code&response_mode=query&nonce=dzZFQjNPUEF6OU9kS35rN0xPYi5TSUlIVFByZXBjdFN6dE44alpFUzZFcg%3D%3D&code_challenge=Gagwqgf8R4qUWF_s6X4Iy6moBCG6jCMFBH7PqTRPCrY&code_challenge_method=S256&auth0Client=eyJuYW1lIjoiYXV0aDAtc3BhLWpzIiwidmVyc2lvbiI6IjEuMjIuMyJ9	HTTP Parser: Iframe src: https://insight.adsrvr.org/track/up?adv=81c3jgn&ref=https%3A%2F%2Fauth.wetransfer.com%2Flogin%3Fstate%3DhKFo2SBJOGxpcnBSRjFRZ0U3TXdQR2VNQTkyQmRNQkEyb0FmTaFupWxvZ2luo3RpZNkgZktKU1c4OTVhWXBiVEVwZkpNS3FkTFRRVTBkcUlSb0KjY2lk2SBkWFdGUWppVzFqeFdDRkcwaE9WcHFyazRoOXZHZWFuYw%26client%3DdXWFQjiW1jxWCFG0hOVpqrk4h9vGeanc%26protocol%3Doauth2%26audience%3Daud%253A%252F%252Ftransfer-api-prod.wetransfer%252F%26redirect_uri%3Dhttps%253A%252F%252Fwetransfer.com%252Faccount%252Fcallback%253Fmessage%253DThis%252BURL%252Bcan%252Bbe%252Bused%252Bonly%252Bonce%2526success%253Dfalse%2526finalizeSSOAuth%253D1%2526login%253D1%26cache%3D%255Bobject%2520Object%255D%26initialScreen%3Dlogin%26lang%3Den%26scope%3Dopenid%2520profile%2520email%2520offline_access%26response_type%3Dcode%26response_mode%3Dquery%26nonce%3DdzZFQjNPUEF6OU9kS35rN0xPYi5TSUlIVFByZXBjdFN6dE44alpFUzZFcg%253D%253D%26code_challenge%3DGagwqgf8R4qUWF_s6X4Iy6moBCG6jCMFBH7PqTRPCrY%26code_challenge_method%3DS256%26auth0Client%3DeyJuYW1lIjoiYXV0aDAtc3BhLWpzIiwidmVyc2lvbiI6IjEuMjIuMyJ9&upid=re36kbe&upv=1.1.0

Source: https://auth.wetransfer.com/login?state=hKFo2SBJOGxpcnBSRjFRZ0U3TXdQR2VNQTkyQmRNQkEyb0FmTaFupWxvZ2luo3RpZNkgZktKU1c4OTVhWXBiVEVwZkpNS3FkTFRRVTBkcUlSb0KjY2lk2SBkWFdGUWppVzFqeFdDRkcwaE9WcHFyazRoOXZHZWFuYw&client=dXWFQjiW1jxWCFG0hOVpqrk4h9vGeanc&protocol=oauth2&audience=aud%3A%2F%2Ftransfer-api-prod.wetransfer%2F&redirect_uri=https%3A%2F%2Fwetransfer.com%2Faccount%2Fcallback%3Fmessage%3DThis%2BURL%2Bcan%2Bbe%2Bused%2Bonly%2Bonce%26success%3Dfalse%26finalizeSSOAuth%3D1%26login%3D1&cache=%5Bobject%20Object%5D&initialScreen=login&lang=en&scope=openid%20profile%20email%20offline_access&response_type=code&response_mode=query&nonce=dzZFQjNPUEF6OU9kS35rN0xPYi5TSUlIVFByZXBjdFN6dE44alpFUzZFcg%3D%3D&code_challenge=Gagwqgf8R4qUWF_s6X4Iy6moBCG6jCMFBH7PqTRPCrY&code_challenge_method=S256&auth0Client=eyJuYW1lIjoiYXV0aDAtc3BhLWpzIiwidmVyc2lvbiI6IjEuMjIuMyJ9	HTTP Parser: Number of links: 0
Source: https://accounts.google.com/gsi/button?theme=outline&size=large&shape=circle&logo_alignment=center&text=signup_with&width=300&client_id=49625052041-kgt0hghf445lmcmhijv46b715m2mpbct.apps.googleusercontent.com&iframe_id=gsi_153239_844821&as=6IPsK503NYjIJpyZz0dJ8Q&hl=en	HTTP Parser: Number of links: 0

Source: https://auth.wetransfer.com/login?state=hKFo2SBJOGxpcnBSRjFRZ0U3TXdQR2VNQTkyQmRNQkEyb0FmTaFupWxvZ2luo3RpZNkgZktKU1c4OTVhWXBiVEVwZkpNS3FkTFRRVTBkcUlSb0KjY2lk2SBkWFdGUWppVzFqeFdDRkcwaE9WcHFyazRoOXZHZWFuYw&client=dXWFQjiW1jxWCFG0hOVpqrk4h9vGeanc&protocol=oauth2&audience=aud%3A%2F%2Ftransfer-api-prod.wetransfer%2F&redirect_uri=https%3A%2F%2Fwetransfer.com%2Faccount%2Fcallback%3Fmessage%3DThis%2BURL%2Bcan%2Bbe%2Bused%2Bonly%2Bonce%26success%3Dfalse%26finalizeSSOAuth%3D1%26login%3D1&cache=%5Bobject%20Object%5D&initialScreen=login&lang=en&scope=openid%20profile%20email%20offline_access&response_type=code&response_mode=query&nonce=dzZFQjNPUEF6OU9kS35rN0xPYi5TSUlIVFByZXBjdFN6dE44alpFUzZFcg%3D%3D&code_challenge=Gagwqgf8R4qUWF_s6X4Iy6moBCG6jCMFBH7PqTRPCrY&code_challenge_method=S256&auth0Client=eyJuYW1lIjoiYXV0aDAtc3BhLWpzIiwidmVyc2lvbiI6IjEuMjIuMyJ9

HTTP Parser: <input type="password" .../> found but no <form action="...

HTTP Parser: Base64 decoded: {"icon":"https://images.ctfassets.net/ncozpa9tpd50/1MB6eBlCBzD9fflql7h8Mf/c3bddc7933c2c625bbedd65bf6b654a1/icon-wt.png","assetsUrl":"","auth0Domain":"auth.wetransfer.com","auth0Tenant":"wetransfer-prod","clientConfigurationBaseUrl":"https://auth.wetransfe...

Source: https://wetransfer.com/log-in?message=This%20URL%20can%20be%20used%20only%20once&success=false	HTTP Parser: No favicon
Source: https://wetransfer.com/log-in?message=This%20URL%20can%20be%20used%20only%20once&success=false	HTTP Parser: No favicon
Source: https://wetransfer.com/log-in?message=This%20URL%20can%20be%20used%20only%20once&success=false	HTTP Parser: No favicon
Source: https://wetransfer.com/log-in?message=This%20URL%20can%20be%20used%20only%20once&success=false	HTTP Parser: No favicon
Source: https://wetransfer.com/blog/newsroom	HTTP Parser: No favicon
Source: https://wetransfer.com/blog/newsroom/	HTTP Parser: No favicon
Source: https://wetransfer.com/blog/newsroom/	HTTP Parser: No favicon
Source: https://wetransfer.com/blog/newsroom/	HTTP Parser: No favicon
Source: https://insight.adsrvr.org/track/up?adv=81c3jgn&ref=https%3A%2F%2Fwetransfer.com%2Fexplore%2Fcareers&upid=re36kbe&upv=1.1.0	HTTP Parser: No favicon
Source: https://accounts.google.com/gsi/button?theme=outline&size=large&shape=circle&logo_alignment=center&text=signup_with&width=300&client_id=49625052041-kgt0hghf445lmcmhijv46b715m2mpbct.apps.googleusercontent.com&iframe_id=gsi_153239_844821&as=6IPsK503NYjIJpyZz0dJ8Q&hl=en	HTTP Parser: No favicon

Source: https://auth.wetransfer.com/login?state=hKFo2SBJOGxpcnBSRjFRZ0U3TXdQR2VNQTkyQmRNQkEyb0FmTaFupWxvZ2luo3RpZNkgZktKU1c4OTVhWXBiVEVwZkpNS3FkTFRRVTBkcUlSb0KjY2lk2SBkWFdGUWppVzFqeFdDRkcwaE9WcHFyazRoOXZHZWFuYw&client=dXWFQjiW1jxWCFG0hOVpqrk4h9vGeanc&protocol=oauth2&audience=aud%3A%2F%2Ftransfer-api-prod.wetransfer%2F&redirect_uri=https%3A%2F%2Fwetransfer.com%2Faccount%2Fcallback%3Fmessage%3DThis%2BURL%2Bcan%2Bbe%2Bused%2Bonly%2Bonce%26success%3Dfalse%26finalizeSSOAuth%3D1%26login%3D1&cache=%5Bobject%20Object%5D&initialScreen=login&lang=en&scope=openid%20profile%20email%20offline_access&response_type=code&response_mode=query&nonce=dzZFQjNPUEF6OU9kS35rN0xPYi5TSUlIVFByZXBjdFN6dE44alpFUzZFcg%3D%3D&code_challenge=Gagwqgf8R4qUWF_s6X4Iy6moBCG6jCMFBH7PqTRPCrY&code_challenge_method=S256&auth0Client=eyJuYW1lIjoiYXV0aDAtc3BhLWpzIiwidmVyc2lvbiI6IjEuMjIuMyJ9	HTTP Parser: No <meta name="author".. found
Source: https://auth.wetransfer.com/login?state=hKFo2SBJOGxpcnBSRjFRZ0U3TXdQR2VNQTkyQmRNQkEyb0FmTaFupWxvZ2luo3RpZNkgZktKU1c4OTVhWXBiVEVwZkpNS3FkTFRRVTBkcUlSb0KjY2lk2SBkWFdGUWppVzFqeFdDRkcwaE9WcHFyazRoOXZHZWFuYw&client=dXWFQjiW1jxWCFG0hOVpqrk4h9vGeanc&protocol=oauth2&audience=aud%3A%2F%2Ftransfer-api-prod.wetransfer%2F&redirect_uri=https%3A%2F%2Fwetransfer.com%2Faccount%2Fcallback%3Fmessage%3DThis%2BURL%2Bcan%2Bbe%2Bused%2Bonly%2Bonce%26success%3Dfalse%26finalizeSSOAuth%3D1%26login%3D1&cache=%5Bobject%20Object%5D&initialScreen=login&lang=en&scope=openid%20profile%20email%20offline_access&response_type=code&response_mode=query&nonce=dzZFQjNPUEF6OU9kS35rN0xPYi5TSUlIVFByZXBjdFN6dE44alpFUzZFcg%3D%3D&code_challenge=Gagwqgf8R4qUWF_s6X4Iy6moBCG6jCMFBH7PqTRPCrY&code_challenge_method=S256&auth0Client=eyJuYW1lIjoiYXV0aDAtc3BhLWpzIiwidmVyc2lvbiI6IjEuMjIuMyJ9	HTTP Parser: No <meta name="author".. found
Source: https://auth.wetransfer.com/login?state=hKFo2SBJOGxpcnBSRjFRZ0U3TXdQR2VNQTkyQmRNQkEyb0FmTaFupWxvZ2luo3RpZNkgZktKU1c4OTVhWXBiVEVwZkpNS3FkTFRRVTBkcUlSb0KjY2lk2SBkWFdGUWppVzFqeFdDRkcwaE9WcHFyazRoOXZHZWFuYw&client=dXWFQjiW1jxWCFG0hOVpqrk4h9vGeanc&protocol=oauth2&audience=aud%3A%2F%2Ftransfer-api-prod.wetransfer%2F&redirect_uri=https%3A%2F%2Fwetransfer.com%2Faccount%2Fcallback%3Fmessage%3DThis%2BURL%2Bcan%2Bbe%2Bused%2Bonly%2Bonce%26success%3Dfalse%26finalizeSSOAuth%3D1%26login%3D1&cache=%5Bobject%20Object%5D&initialScreen=login&lang=en&scope=openid%20profile%20email%20offline_access&response_type=code&response_mode=query&nonce=dzZFQjNPUEF6OU9kS35rN0xPYi5TSUlIVFByZXBjdFN6dE44alpFUzZFcg%3D%3D&code_challenge=Gagwqgf8R4qUWF_s6X4Iy6moBCG6jCMFBH7PqTRPCrY&code_challenge_method=S256&auth0Client=eyJuYW1lIjoiYXV0aDAtc3BhLWpzIiwidmVyc2lvbiI6IjEuMjIuMyJ9	HTTP Parser: No <meta name="author".. found
Source: https://accounts.google.com/gsi/button?theme=outline&size=large&shape=circle&logo_alignment=center&text=signup_with&width=300&client_id=49625052041-kgt0hghf445lmcmhijv46b715m2mpbct.apps.googleusercontent.com&iframe_id=gsi_153239_844821&as=6IPsK503NYjIJpyZz0dJ8Q&hl=en	HTTP Parser: No <meta name="author".. found

Source: https://auth.wetransfer.com/login?state=hKFo2SBJOGxpcnBSRjFRZ0U3TXdQR2VNQTkyQmRNQkEyb0FmTaFupWxvZ2luo3RpZNkgZktKU1c4OTVhWXBiVEVwZkpNS3FkTFRRVTBkcUlSb0KjY2lk2SBkWFdGUWppVzFqeFdDRkcwaE9WcHFyazRoOXZHZWFuYw&client=dXWFQjiW1jxWCFG0hOVpqrk4h9vGeanc&protocol=oauth2&audience=aud%3A%2F%2Ftransfer-api-prod.wetransfer%2F&redirect_uri=https%3A%2F%2Fwetransfer.com%2Faccount%2Fcallback%3Fmessage%3DThis%2BURL%2Bcan%2Bbe%2Bused%2Bonly%2Bonce%26success%3Dfalse%26finalizeSSOAuth%3D1%26login%3D1&cache=%5Bobject%20Object%5D&initialScreen=login&lang=en&scope=openid%20profile%20email%20offline_access&response_type=code&response_mode=query&nonce=dzZFQjNPUEF6OU9kS35rN0xPYi5TSUlIVFByZXBjdFN6dE44alpFUzZFcg%3D%3D&code_challenge=Gagwqgf8R4qUWF_s6X4Iy6moBCG6jCMFBH7PqTRPCrY&code_challenge_method=S256&auth0Client=eyJuYW1lIjoiYXV0aDAtc3BhLWpzIiwidmVyc2lvbiI6IjEuMjIuMyJ9	HTTP Parser: No <meta name="copyright".. found
Source: https://auth.wetransfer.com/login?state=hKFo2SBJOGxpcnBSRjFRZ0U3TXdQR2VNQTkyQmRNQkEyb0FmTaFupWxvZ2luo3RpZNkgZktKU1c4OTVhWXBiVEVwZkpNS3FkTFRRVTBkcUlSb0KjY2lk2SBkWFdGUWppVzFqeFdDRkcwaE9WcHFyazRoOXZHZWFuYw&client=dXWFQjiW1jxWCFG0hOVpqrk4h9vGeanc&protocol=oauth2&audience=aud%3A%2F%2Ftransfer-api-prod.wetransfer%2F&redirect_uri=https%3A%2F%2Fwetransfer.com%2Faccount%2Fcallback%3Fmessage%3DThis%2BURL%2Bcan%2Bbe%2Bused%2Bonly%2Bonce%26success%3Dfalse%26finalizeSSOAuth%3D1%26login%3D1&cache=%5Bobject%20Object%5D&initialScreen=login&lang=en&scope=openid%20profile%20email%20offline_access&response_type=code&response_mode=query&nonce=dzZFQjNPUEF6OU9kS35rN0xPYi5TSUlIVFByZXBjdFN6dE44alpFUzZFcg%3D%3D&code_challenge=Gagwqgf8R4qUWF_s6X4Iy6moBCG6jCMFBH7PqTRPCrY&code_challenge_method=S256&auth0Client=eyJuYW1lIjoiYXV0aDAtc3BhLWpzIiwidmVyc2lvbiI6IjEuMjIuMyJ9	HTTP Parser: No <meta name="copyright".. found
Source: https://auth.wetransfer.com/login?state=hKFo2SBJOGxpcnBSRjFRZ0U3TXdQR2VNQTkyQmRNQkEyb0FmTaFupWxvZ2luo3RpZNkgZktKU1c4OTVhWXBiVEVwZkpNS3FkTFRRVTBkcUlSb0KjY2lk2SBkWFdGUWppVzFqeFdDRkcwaE9WcHFyazRoOXZHZWFuYw&client=dXWFQjiW1jxWCFG0hOVpqrk4h9vGeanc&protocol=oauth2&audience=aud%3A%2F%2Ftransfer-api-prod.wetransfer%2F&redirect_uri=https%3A%2F%2Fwetransfer.com%2Faccount%2Fcallback%3Fmessage%3DThis%2BURL%2Bcan%2Bbe%2Bused%2Bonly%2Bonce%26success%3Dfalse%26finalizeSSOAuth%3D1%26login%3D1&cache=%5Bobject%20Object%5D&initialScreen=login&lang=en&scope=openid%20profile%20email%20offline_access&response_type=code&response_mode=query&nonce=dzZFQjNPUEF6OU9kS35rN0xPYi5TSUlIVFByZXBjdFN6dE44alpFUzZFcg%3D%3D&code_challenge=Gagwqgf8R4qUWF_s6X4Iy6moBCG6jCMFBH7PqTRPCrY&code_challenge_method=S256&auth0Client=eyJuYW1lIjoiYXV0aDAtc3BhLWpzIiwidmVyc2lvbiI6IjEuMjIuMyJ9	HTTP Parser: No <meta name="copyright".. found
Source: https://accounts.google.com/gsi/button?theme=outline&size=large&shape=circle&logo_alignment=center&text=signup_with&width=300&client_id=49625052041-kgt0hghf445lmcmhijv46b715m2mpbct.apps.googleusercontent.com&iframe_id=gsi_153239_844821&as=6IPsK503NYjIJpyZz0dJ8Q&hl=en	HTTP Parser: No <meta name="copyright".. found

Source: chromecache_510.2.dr	String found in binary or memory: ","externalLink":"https://wetransfer.com/paper","tracking":{"eventLabel":"footer_link_paper"}},{"title":"Pricing","externalLink":"https://wetransfer.com/pricing","tracking":{"eventLabel":"footer_link_pricing"}}]},{"title":"About Us","items":[{"title":"Company","externalLink":"/explore","tracking":{"eventLabel":"footer_link_company"}},{"title":"Advertising","externalLink":"/explore/advertising","tracking":{"eventLabel":"footer_link_advertising"}},{"title":"Careers","externalLink":"/explore/careers","tracking":{"eventLabel":"footer_link_careers"}},{"title":"Culture","externalLink":"/explore/culture","tracking":{"eventLabel":"footer_link_culture"}},{"title":"Locations","externalLink":"/explore/locations","tracking":{"eventLabel":"footer_link_Locations"}},{"title":"How to apply","externalLink":"/explore/how-to-apply","tracking":{"eventLabel":"footer_link_how-to-apply"}},{"title":"B Corp","externalLink":"https://wetransfer.com/blog/story/we-are-a-bcorp","tracking":{"eventLabel":"footer_link_b-corp"}},{"title":"Newsroom","externalLink":"/blog/newsroom","tracking":{"eventLabel":"footer_link_newsroom"}},{"title":"Leadership","externalLink":"/explore/corporate/leadership","tracking":{"eventLabel":"footer_link_leadership"}}]},{"title":"Resources","items":[{"title":"Help Center","externalLink":"https://wetransfer.zendesk.com","tracking":{"eventLabel":"footer_link_help-center"}},{"title":"Accessibility","externalLink":"/explore/accessibility","tracking":{"eventLabel":"footer_link_accessibility"}}]},{"title":"Explore","items":[{"title":"WePresent","externalLink":"https://wepresent.wetransfer.com","tracking":{"eventLabel":"footer_link_wepresent"}},{"title":"Ideas Report","externalLink":"https://wetransfer.com/ideas-report/2022","tracking":{"eventLabel":"footer_link_ideas-report"}},{"title":"The Supporting Act Foundation","externalLink":"https://www.thesupportingact.org/","tracking":{"eventLabel":"footer_link_supporting-act"}},{"title":"Creative Hubs Index","externalLink":"https://wetransfer.com/emerging-creative-hubs-index-2022","tracking":{"eventLabel":"footer_link_creative-hubs"}},{"title":"Blog","externalLink":"https://wetransfer.com/blog","tracking":{"eventLabel":"footer_link_blog"}}]}]},"terms":{"items":[{"title":"Terms","externalLink":"/explore/legal/terms","tracking":{"eventLabel":"/footer_link_terms"}},{"title":"Privacy","externalLink":"/explore/legal/privacy","tracking":{"eventLabel":"footer_link_privacy"}}]},"social":{"items":[{"title":"Twitter","externalLink":"https://twitter.com/WeTransfer","tracking":{"eventLabel":"footer_link_twitter"}},{"title":"Facebook","externalLink":"https://www.facebook.com/wetransfer/","tracking":{"eventLabel":"footer_link_facebook"}},{"title":"Instagram","externalLink":"https://www.instagram.com/wetransfer/","tracking":{"eventLabel":"footer_link_instagram"}},{"title":"Youtube","externalLink":"https://www.youtube.com/channel/UCFHZRaJORf-Pffh2rnF8WaQ","tracking":{"eventLabel":"footer_link_youtube"}}]}}},"slug":"careers","ri
Source: chromecache_510.2.dr	String found in binary or memory: ","externalLink":"https://wetransfer.com/paper","tracking":{"eventLabel":"footer_link_paper"}},{"title":"Pricing","externalLink":"https://wetransfer.com/pricing","tracking":{"eventLabel":"footer_link_pricing"}}]},{"title":"About Us","items":[{"title":"Company","externalLink":"/explore","tracking":{"eventLabel":"footer_link_company"}},{"title":"Advertising","externalLink":"/explore/advertising","tracking":{"eventLabel":"footer_link_advertising"}},{"title":"Careers","externalLink":"/explore/careers","tracking":{"eventLabel":"footer_link_careers"}},{"title":"Culture","externalLink":"/explore/culture","tracking":{"eventLabel":"footer_link_culture"}},{"title":"Locations","externalLink":"/explore/locations","tracking":{"eventLabel":"footer_link_Locations"}},{"title":"How to apply","externalLink":"/explore/how-to-apply","tracking":{"eventLabel":"footer_link_how-to-apply"}},{"title":"B Corp","externalLink":"https://wetransfer.com/blog/story/we-are-a-bcorp","tracking":{"eventLabel":"footer_link_b-corp"}},{"title":"Newsroom","externalLink":"/blog/newsroom","tracking":{"eventLabel":"footer_link_newsroom"}},{"title":"Leadership","externalLink":"/explore/corporate/leadership","tracking":{"eventLabel":"footer_link_leadership"}}]},{"title":"Resources","items":[{"title":"Help Center","externalLink":"https://wetransfer.zendesk.com","tracking":{"eventLabel":"footer_link_help-center"}},{"title":"Accessibility","externalLink":"/explore/accessibility","tracking":{"eventLabel":"footer_link_accessibility"}}]},{"title":"Explore","items":[{"title":"WePresent","externalLink":"https://wepresent.wetransfer.com","tracking":{"eventLabel":"footer_link_wepresent"}},{"title":"Ideas Report","externalLink":"https://wetransfer.com/ideas-report/2022","tracking":{"eventLabel":"footer_link_ideas-report"}},{"title":"The Supporting Act Foundation","externalLink":"https://www.thesupportingact.org/","tracking":{"eventLabel":"footer_link_supporting-act"}},{"title":"Creative Hubs Index","externalLink":"https://wetransfer.com/emerging-creative-hubs-index-2022","tracking":{"eventLabel":"footer_link_creative-hubs"}},{"title":"Blog","externalLink":"https://wetransfer.com/blog","tracking":{"eventLabel":"footer_link_blog"}}]}]},"terms":{"items":[{"title":"Terms","externalLink":"/explore/legal/terms","tracking":{"eventLabel":"/footer_link_terms"}},{"title":"Privacy","externalLink":"/explore/legal/privacy","tracking":{"eventLabel":"footer_link_privacy"}}]},"social":{"items":[{"title":"Twitter","externalLink":"https://twitter.com/WeTransfer","tracking":{"eventLabel":"footer_link_twitter"}},{"title":"Facebook","externalLink":"https://www.facebook.com/wetransfer/","tracking":{"eventLabel":"footer_link_facebook"}},{"title":"Instagram","externalLink":"https://www.instagram.com/wetransfer/","tracking":{"eventLabel":"footer_link_instagram"}},{"title":"Youtube","externalLink":"https://www.youtube.com/channel/UCFHZRaJORf-Pffh2rnF8WaQ","tracking":{"eventLabel":"footer_link_youtube"}}]}}},"slug":"careers","ri
Source: chromecache_510.2.dr	String found in binary or memory: ","externalLink":"https://wetransfer.com/paper","tracking":{"eventLabel":"footer_link_paper"}},{"title":"Pricing","externalLink":"https://wetransfer.com/pricing","tracking":{"eventLabel":"footer_link_pricing"}}]},{"title":"About Us","items":[{"title":"Company","externalLink":"/explore","tracking":{"eventLabel":"footer_link_company"}},{"title":"Advertising","externalLink":"/explore/advertising","tracking":{"eventLabel":"footer_link_advertising"}},{"title":"Careers","externalLink":"/explore/careers","tracking":{"eventLabel":"footer_link_careers"}},{"title":"Culture","externalLink":"/explore/culture","tracking":{"eventLabel":"footer_link_culture"}},{"title":"Locations","externalLink":"/explore/locations","tracking":{"eventLabel":"footer_link_Locations"}},{"title":"How to apply","externalLink":"/explore/how-to-apply","tracking":{"eventLabel":"footer_link_how-to-apply"}},{"title":"B Corp","externalLink":"https://wetransfer.com/blog/story/we-are-a-bcorp","tracking":{"eventLabel":"footer_link_b-corp"}},{"title":"Newsroom","externalLink":"/blog/newsroom","tracking":{"eventLabel":"footer_link_newsroom"}},{"title":"Leadership","externalLink":"/explore/corporate/leadership","tracking":{"eventLabel":"footer_link_leadership"}}]},{"title":"Resources","items":[{"title":"Help Center","externalLink":"https://wetransfer.zendesk.com","tracking":{"eventLabel":"footer_link_help-center"}},{"title":"Accessibility","externalLink":"/explore/accessibility","tracking":{"eventLabel":"footer_link_accessibility"}}]},{"title":"Explore","items":[{"title":"WePresent","externalLink":"https://wepresent.wetransfer.com","tracking":{"eventLabel":"footer_link_wepresent"}},{"title":"Ideas Report","externalLink":"https://wetransfer.com/ideas-report/2022","tracking":{"eventLabel":"footer_link_ideas-report"}},{"title":"The Supporting Act Foundation","externalLink":"https://www.thesupportingact.org/","tracking":{"eventLabel":"footer_link_supporting-act"}},{"title":"Creative Hubs Index","externalLink":"https://wetransfer.com/emerging-creative-hubs-index-2022","tracking":{"eventLabel":"footer_link_creative-hubs"}},{"title":"Blog","externalLink":"https://wetransfer.com/blog","tracking":{"eventLabel":"footer_link_blog"}}]}]},"terms":{"items":[{"title":"Terms","externalLink":"/explore/legal/terms","tracking":{"eventLabel":"/footer_link_terms"}},{"title":"Privacy","externalLink":"/explore/legal/privacy","tracking":{"eventLabel":"footer_link_privacy"}}]},"social":{"items":[{"title":"Twitter","externalLink":"https://twitter.com/WeTransfer","tracking":{"eventLabel":"footer_link_twitter"}},{"title":"Facebook","externalLink":"https://www.facebook.com/wetransfer/","tracking":{"eventLabel":"footer_link_facebook"}},{"title":"Instagram","externalLink":"https://www.instagram.com/wetransfer/","tracking":{"eventLabel":"footer_link_instagram"}},{"title":"Youtube","externalLink":"https://www.youtube.com/channel/UCFHZRaJORf-Pffh2rnF8WaQ","tracking":{"eventLabel":"footer_link_youtube"}}]}}},"slug":"careers","ri
Source: chromecache_487.2.dr, chromecache_505.2.dr, chromecache_592.2.dr	String found in binary or memory: return b}yC.K="internal.enableAutoEventOnTimer";var dc=ka(["data-gtm-yt-inspected-"]),AC=["www.youtube.com","www.youtube-nocookie.com"],BC,CC=!1; equals www.youtube.com (Youtube)

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2624 --field-trial-handle=2268,i,3564403640156923666,3971517337339682263,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://auth.wetransfer.com/u/email-verification?ticket=sOfHe06FaLKeBlvUSZSpsfeqvFtInnsm"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5848 --field-trial-handle=2268,i,3564403640156923666,3971517337339682263,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2624 --field-trial-handle=2268,i,3564403640156923666,3971517337339682263,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5848 --field-trial-handle=2268,i,3564403640156923666,3971517337339682263,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source	Detection	Scanner	Label
https://support.x.com/articles/14016	0%	URL Reputation	safe
https://support.x.com/articles/20172060	0%	URL Reputation	safe
http://stuartk.com/jszip	0%	URL Reputation	safe
https://www.thesupportingact.org/	0%	Avira URL Cloud	safe
https://jobs.ashbyhq.com/wetransfer	0%	Avira URL Cloud	safe

Name	Malicious	Reputation
https://wetransfer.com/log-in?message=This%20URL%20can%20be%20used%20only%20once&success=false	false	high
https://wetransfer.com/blog/newsroom	false	high
https://a26744370346.cdn.optimizely.com/client_storage/a26744370346.html	false	high

Name	Source	Malicious	Antivirus Detection	Reputation
https://abs.twimg.com/hashflags/BF-11137_Mahindra_XUV3XO_Hashmoji_after/BF-11137_Mahindra_XUV3XO_Has	chromecache_350.2.dr	false		high
https://abs.twimg.com/hashflags/BF-10658_NetflixJP_18ce54ua4fy_Hashmoji_20240405-20240704_Suzume_/BF	chromecache_350.2.dr	false		high
https://images.ctfassets.net/ozc5on9ss4ee/3gjn3HryoHicnUViy1y0CC/4cb157c4817386f5edaa9e9f7c00cf39/Im	chromecache_510.2.dr	false		high
https://images.ctfassets.net/c0ooum8vvmnd/43hSaUSgvXBmUF6t5JUAFr/3959203b63e5548e6ccd070b2a1ef99a/22	chromecache_595.2.dr	false		high
https://stats.g.doubleclick.net/g/collect	chromecache_487.2.dr, chromecache_505.2.dr	false		high
https://images.ctfassets.net/ozc5on9ss4ee/5FPHhCRAUYkJ0wHRu6w1ub/1c13f77b7d4ac19fbe82339ecb7255d0/4_	chromecache_510.2.dr	false		high
https://ton.local.twitter.com/responsive-web-internal/sourcemaps/client-web/loader.tweetHandler.39f8	chromecache_637.2.dr	false		high
https://abs.twimg.com/hashflags/NBA_WarriorsHashmoji/NBA_WarriorsHashmoji.png	chromecache_350.2.dr	false		high
https://images.ctfassets.net/ozc5on9ss4ee/2NcCGw2YUF2fEOpwJqIG8m/1b01d1208c7ae4a519f8865cee0383e3/Im	chromecache_510.2.dr	false		high
https://wetransfer.com/pricing?trk=WT202005_signup	chromecache_510.2.dr, chromecache_589.2.dr	false		high
https://abs.twimg.com/hashflags/NHL_MWild_2023/NHL_MWild_2023.png	chromecache_350.2.dr	false		high
https://abs.twimg.com/hashflags/NWSL_Chicago_Hashtag2024/NWSL_Chicago_Hashtag2024.png	chromecache_350.2.dr	false		high
https://support.x.com/articles/14016	chromecache_366.2.dr	false	URL Reputation: safe	unknown
https://wetransfer.com/blog/story/making-a-difference-together/	chromecache_510.2.dr	false		high
https://abs.twimg.com/hashflags/MSI_Emoji_2024/MSI_Emoji_2024.png	chromecache_350.2.dr	false		high
https://abs.twimg.com/hashflags/World_Surf_League_2024/World_Surf_League_2024.png	chromecache_350.2.dr	false		high
https://ampcid.google.com/v1/publisher:getClientId	chromecache_522.2.dr	false		high
https://abs.twimg.com/hashflags/Sony_MarcAnthony_MuevenseAlbum_Music/Sony_MarcAnthony_MuevenseAlbum_	chromecache_350.2.dr	false		high
https://images.ctfassets.net/c0ooum8vvmnd/41rfqYhdVOSzml2zZXUuaM/e189b6ca3995c847adb9ebfbe31a419a/26	chromecache_595.2.dr	false		high
https://abs.twimg.com/hashflags/Asahi_Mitsuya_anniversary_Japan_2024_Emoji/Asahi_Mitsuya_anniversary	chromecache_350.2.dr	false		high
https://abs.twimg.com/hashflags/BF-10984_UngentlemanlyWarfare_AFTER_V3/BF-10984_UngentlemanlyWarfare	chromecache_350.2.dr	false		high
https://ton.local.twitter.com/responsive-web-internal/sourcemaps/client-web/shared~bundle.AccountAna	chromecache_679.2.dr	false		high
https://images.ctfassets.net/c0ooum8vvmnd/5wDh5p8fEvAQ5terFyPcN9/737acad063103b8bd16e35ab8c51b606/TO	chromecache_595.2.dr	false		high
https://abs.twimg.com/hashflags/Hashmoji_essential_jp_4_1/Hashmoji_essential_jp_4_1.png	chromecache_350.2.dr	false		high
https://abs.twimg.com/hashflags/BF-10329_wowow_mj_WOWOWkissmy_Hashmoji_2024/BF-10329_wowow_mj_WOWOWk	chromecache_350.2.dr	false		high
https://ton.local.twitter.com/responsive-web-internal/sourcemaps/client-web/shared~loader.DMDrawer~b	chromecache_381.2.dr, chromecache_364.2.dr, chromecache_630.2.dr, chromecache_357.2.dr, chromecache_640.2.dr, chromecache_716.2.dr, chromecache_629.2.dr	false		high
https://ekstrom.wetransfer.net	chromecache_597.2.dr	false		high
https://images.ctfassets.net/c0ooum8vvmnd/3a9lU5VDvk8IKbP9Q5Evff/8d44e84e879b6eea1808069210771855/Ar	chromecache_595.2.dr	false		high
https://abs.twimg.com/hashflags/Coachella2024/Coachella2024.png	chromecache_350.2.dr	false		high
https://stats.g.doubleclick.net/j/collect	chromecache_522.2.dr	false		high
http://www.amazon.com/b/?&node=7253015011.	chromecache_732.2.dr	false		high
https://images.ctfassets.net/ozc5on9ss4ee/5DfsX0Yc8ilLQgzGlGBbHb/89bcce13739b3e44579a1cb95b843f05/Ca	chromecache_510.2.dr	false		high
https://wetransfer.com/pricing	chromecache_510.2.dr	false		high
https://images.ctfassets.net/c0ooum8vvmnd/2BkMaxnE1PCZBauYZn2v8B/ca7127b5143b2b588c416c41d146f2a6/47	chromecache_595.2.dr	false		high
https://abs.twimg.com/hashflags/BF-10676_Hubbl_2024_Hashmojis/BF-10676_Hubbl_2024_Hashmojis.png	chromecache_350.2.dr	false		high
https://ton.local.twitter.com/responsive-web-internal/sourcemaps/client-web/ondemand.ProfileSidebar.	chromecache_497.2.dr	false		high
https://abs.twimg.com/hashflags/NHL_GoldenKnights_2023/NHL_GoldenKnights_2023.png	chromecache_350.2.dr	false		high
https://abs.twimg.com/hashflags/Twitter_DisabledAndAble/Twitter_DisabledAndAble.png	chromecache_350.2.dr	false		high
https://abs.twimg.com/hashflags/BF-10920_NetflixJP_18ce54ua4fy_Hashmoj_v2/BF-10920_NetflixJP_18ce54u	chromecache_350.2.dr	false		high
https://abs.twimg.com/hashflags/Romasaga_April_2024_emoji/Romasaga_April_2024_emoji.png	chromecache_350.2.dr	false		high
https://abs.twimg.com/hashflags/MiLB_Trophy_2024/MiLB_Trophy_2024.png	chromecache_350.2.dr	false		high
https://abs.twimg.com/hashflags/DignitasEmoji2024/DignitasEmoji2024.png	chromecache_350.2.dr	false		high
https://abs.twimg.com/hashflags/Hashmoji_lion_ochtune_4_12/Hashmoji_lion_ochtune_4_12.png	chromecache_350.2.dr	false		high
https://abs.twimg.com/hashflags/WNBA_2024_Season/WNBA_2024_Season.png	chromecache_350.2.dr	false		high
https://abs.twimg.com/hashflags/WWERaw2024Emoji/WWERaw2024Emoji.png	chromecache_350.2.dr	false		high
https://ton.local.twitter.com/responsive-web-internal/sourcemaps/client-web/shared~loader.AudioDock~	chromecache_696.2.dr, chromecache_729.2.dr, chromecache_416.2.dr	false		high
https://abs.twimg.com/hashflags/BF-10943_HASHMOJI_DeUna_BrandFormance_APRIL_2024/BF-10943_HASHMOJI_D	chromecache_350.2.dr	false		high
https://abs.twimg.com/hashflags/DK_Extension/DK_Extension.png	chromecache_350.2.dr	false		high
https://abs.twimg.com/hashflags/BF-10357_FineToday_Plus_tomorrow_Feb2024/BF-10357_FineToday_Plus_tom	chromecache_350.2.dr	false		high
https://abs.twimg.com/hashflags/BF-10998_HSR_Aventurine_Emoji_Q2_2024/BF-10998_HSR_Aventurine_Emoji_	chromecache_350.2.dr	false		high
https://abs.twimg.com/hashflags/NWSL_Utah_Hashtag2024/NWSL_Utah_Hashtag2024.png	chromecache_350.2.dr	false		high
https://images.ctfassets.net/c0ooum8vvmnd/4XEYvWmbdWxHSxTEwkArGu/92c08004953b31400be94921d83953fc/WT	chromecache_595.2.dr	false		high
https://support.x.com/articles/20172060	chromecache_366.2.dr	false	URL Reputation: safe	unknown
https://abs.twimg.com/hashflags/BF-10726_TheYearofCamels2024_Hashmoji_v3/BF-10726_TheYearofCamels202	chromecache_350.2.dr	false		high
https://images.ctfassets.net/ozc5on9ss4ee/1Ekamt4eri6NkgFCWkqmTX/615d9c12e22bca1e772fcd07582f7596/Im	chromecache_510.2.dr	false		high
https://abs.twimg.com/hashflags/BF-10398_Shiseido_MQ_Campaign_Q124/BF-10398_Shiseido_MQ_Campaign_Q12	chromecache_350.2.dr	false		high
https://abs.twimg.com/hashflags/JBApp_Hashmoji_2024/JBApp_Hashmoji_2024.png	chromecache_350.2.dr	false		high
https://stats.g.doubleclick.net/g/collect?v=2&	chromecache_487.2.dr, chromecache_505.2.dr	false		high
https://images.ctfassets.net/c0ooum8vvmnd/50dbi9ookdlUtptprVB6zn/e08bcf2d8c7a8fd095c4e51b5847a0c0/45	chromecache_595.2.dr	false		high
https://images.ctfassets.net/c0ooum8vvmnd/6nu18cWGJeyPSNYlXh4iWE/d79d711fc1523ac32011176f34b52efd/27	chromecache_595.2.dr	false		high
https://abs.twimg.com/hashflags/BF-10715_MorinagaIce_Mar_2024/BF-10715_MorinagaIce_Mar_2024.png	chromecache_350.2.dr	false		high
https://abs.twimg.com/hashflags/BF-10748_Changyou_haikyu_haifura_Mar2024/BF-10748_Changyou_haikyu_ha	chromecache_350.2.dr	false		high
https://images.ctfassets.net/c0ooum8vvmnd/8oIXwEiRDvGF5CMkp6nc5/812c0f7cd59e90711a3fb1e9b71cf4cf/276	chromecache_595.2.dr	false		high
https://ton.local.twitter.com/responsive-web-internal/sourcemaps/client-web/shared~bundle.ReaderMode	chromecache_502.2.dr	false		high
https://abs.twimg.com/hashflags/BF-10430-FF7R_Feb_emoji_2024/BF-10430-FF7R_Feb_emoji_2024.png	chromecache_350.2.dr	false		high
https://abs.twimg.com/hashflags/ASAHI_Superdry_drycrystal_Mar_Japan_2024_Emoji/ASAHI_Superdry_drycry	chromecache_350.2.dr	false		high
https://ton.local.twitter.com/responsive-web-internal/sourcemaps/client-web/shared~ondemand.ComposeS	chromecache_602.2.dr	false		high
https://abs.twimg.com/hashflags/SF_Giants_MLB_2024_Updated/SF_Giants_MLB_2024_Updated.png	chromecache_350.2.dr	false		high
https://images.ctfassets.net/c0ooum8vvmnd/1dg6ihgEQDsTxJvceGRPsX/f231c084b52f5e8c508f022113e70e70/Ar	chromecache_595.2.dr	false		high
https://abs.twimg.com/hashflags/Chicago_Bears_NFL_2024_2025_HASHMOJI/Chicago_Bears_NFL_2024_2025_HAS	chromecache_350.2.dr	false		high
https://www.thesupportingact.org/	chromecache_510.2.dr	false	Avira URL Cloud: safe	unknown
https://images.ctfassets.net/c0ooum8vvmnd/7iZtv0kL4hhGTZedFymLEg/e404e2c0650777cac09d933d8963ad03/32	chromecache_595.2.dr	false		high
https://abs.twimg.com/hashflags/BF-10662_Hashmoji_SBA_Ramadan_2024/BF-10662_Hashmoji_SBA_Ramadan_202	chromecache_350.2.dr	false		high
https://abs.twimg.com/hashflags/KaijuNo8/KaijuNo8.png	chromecache_350.2.dr	false		high
https://images.ctfassets.net/c0ooum8vvmnd/5gPLVpRXtSUJsj70E9lAHO/bf2c2fdb9db4f58124e151c3982ad02a/TO	chromecache_595.2.dr	false		high
https://jobs.ashbyhq.com/wetransfer	chromecache_510.2.dr	false	Avira URL Cloud: safe	unknown
https://abs.twimg.com/hashflags/DraftKings_Additional_hashtags/DraftKings_Additional_hashtags.png	chromecache_350.2.dr	false		high
http://stuartk.com/jszip	chromecache_746.2.dr	false	URL Reputation: safe	unknown
https://abs.twimg.com/hashflags/CricketTwitter_2021/CricketTwitter_2021.png	chromecache_350.2.dr	false		high
https://abs.twimg.com/hashflags/WNBA_2024_CommissionersCup/WNBA_2024_CommissionersCup.png	chromecache_350.2.dr	false		high
https://ton.local.twitter.com/responsive-web-internal/sourcemaps/client-web/shared~loader.AppModules	chromecache_697.2.dr, chromecache_544.2.dr, chromecache_664.2.dr	false		high
https://abs.twimg.com/hashflags/BF-11138_PlasticWisely/BF-11138_PlasticWisely.png	chromecache_350.2.dr	false		high
https://abs.twimg.com/hashflags/KansasCity_Royals_MLB_2024/KansasCity_Royals_MLB_2024.png	chromecache_350.2.dr	false		high
https://ton.local.twitter.com/responsive-web-internal/sourcemaps/client-web/loader.AbsolutePower.6ad	chromecache_508.2.dr	false		high
https://images.ctfassets.net/c0ooum8vvmnd/4UkOe8URuTTR1QzhwdQVR4/e67f1c25ec10fe38001a94c9641afd88/Ar	chromecache_595.2.dr	false		high
https://abs.twimg.com/hashflags/Arizona_Dbacks_MLB_2024/Arizona_Dbacks_MLB_2024.png	chromecache_350.2.dr	false		high
https://ton.local.twitter.com/responsive-web-internal/sourcemaps/client-web/shared~bundle.Articles~b	chromecache_533.2.dr	false		high
https://abs.twimg.com/hashflags/BF-10543_SaudiAirlinesFoundingDay_2024_Hashmoji/BF-10543_SaudiAirlin	chromecache_350.2.dr	false		high
https://abs.twimg.com/hashflags/BF-10645_Hashmoji_suntory_tennen_KirittoKajitsu_19th_Mar/BF-10645_Ha	chromecache_350.2.dr	false		high
https://abs.twimg.com/hashflags/BF-10646_Gamelaunch2024MarBrandedHashtag/BF-10646_Gamelaunch2024MarB	chromecache_350.2.dr	false		high
https://images.ctfassets.net/c0ooum8vvmnd/5Qyofqq6prMPhzQPMOgSom/a6a66ab36c64d2457d6c33f53b99d054/31	chromecache_595.2.dr	false		high
https://ton.local.twitter.com/responsive-web-internal/sourcemaps/client-web/shared~bundle.Birdwatch~	chromecache_694.2.dr	false		high
https://images.ctfassets.net/c0ooum8vvmnd/4WgypZFWUWkKvkZ7F61uvl/bcd7846ec52673788922aa0583751a4d/38	chromecache_595.2.dr	false		high
https://images.ctfassets.net/c0ooum8vvmnd/63oqmxDEDWOUG5OHdkSACd/d8e4cd102f7a5d153b156e1d907ef44c/40	chromecache_595.2.dr	false		high
https://abs.twimg.com/hashflags/NBA_Playoffs_2024/NBA_Playoffs_2024.png	chromecache_350.2.dr	false		high
https://abs.twimg.com/hashflags/ImmortalsEmoji2024/ImmortalsEmoji2024.png	chromecache_350.2.dr	false		high
https://abs.twimg.com/hashflags/NY_Mets_MLB_2024/NY_Mets_MLB_2024.png	chromecache_350.2.dr	false		high

IP	Domain	Country	ASN	ASN Name	Malicious
108.138.94.29	unknown	United States	16509	AMAZON-02US	false
173.194.202.154	unknown	United States	15169	GOOGLEUS	false
157.240.3.35	unknown	United States	32934	FACEBOOKUS	false
142.251.211.230	unknown	United States	15169	GOOGLEUS	false
151.101.193.140	unknown	United States	54113	FASTLYUS	false
151.101.65.140	unknown	United States	54113	FASTLYUS	false
104.244.43.131	unknown	United States	54113	FASTLYUS	false
23.59.151.205	unknown	United States	20940	AKAMAI-ASN1EU	false
151.101.200.84	unknown	United States	54113	FASTLYUS	false
13.224.0.51	unknown	United States	16509	AMAZON-02US	false
1.1.1.1	unknown	Australia	13335	CLOUDFLARENETUS	false
52.84.162.25	unknown	United States	16509	AMAZON-02US	false
142.250.217.67	unknown	United States	15169	GOOGLEUS	false
142.250.217.66	unknown	United States	15169	GOOGLEUS	false
142.251.33.102	unknown	United States	15169	GOOGLEUS	false
52.51.67.217	unknown	United States	16509	AMAZON-02US	false
157.240.3.29	unknown	United States	32934	FACEBOOKUS	false
142.250.217.68	unknown	United States	15169	GOOGLEUS	false
74.125.135.156	unknown	United States	15169	GOOGLEUS	false
52.84.162.118	unknown	United States	16509	AMAZON-02US	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
3.248.121.93	unknown	United States	16509	AMAZON-02US	false
151.101.192.84	unknown	United States	54113	FASTLYUS	false
54.194.10.165	unknown	United States	16509	AMAZON-02US	false
142.250.217.78	unknown	United States	15169	GOOGLEUS	false
3.163.158.96	unknown	United States	16509	AMAZON-02US	false
3.163.158.119	unknown	United States	16509	AMAZON-02US	false
3.163.158.116	unknown	United States	16509	AMAZON-02US	false
142.250.69.198	unknown	United States	15169	GOOGLEUS	false
142.250.69.194	unknown	United States	15169	GOOGLEUS	false
142.250.69.195	unknown	United States	15169	GOOGLEUS	false
13.224.0.72	unknown	United States	16509	AMAZON-02US	false
52.203.234.183	unknown	United States	14618	AMAZON-AESUS	false
23.213.36.158	unknown	United States	2914	NTT-COMMUNICATIONS-2914US	false
13.224.14.72	unknown	United States	16509	AMAZON-02US	false
3.163.158.129	unknown	United States	16509	AMAZON-02US	false
52.211.9.181	unknown	United States	16509	AMAZON-02US	false
104.244.42.195	unknown	United States	13414	TWITTERUS	false
104.244.42.194	unknown	United States	13414	TWITTERUS	false
152.199.24.185	unknown	United States	15133	EDGECASTUS	false
18.172.170.46	unknown	United States	3	MIT-GATEWAYSUS	false
3.163.189.97	unknown	United States	16509	AMAZON-02US	false
18.172.170.41	unknown	United States	3	MIT-GATEWAYSUS	false
142.251.33.99	unknown	United States	15169	GOOGLEUS	false
3.163.189.4	unknown	United States	16509	AMAZON-02US	false
151.101.129.140	unknown	United States	54113	FASTLYUS	false
13.224.14.127	unknown	United States	16509	AMAZON-02US	false
172.217.14.206	unknown	United States	15169	GOOGLEUS	false
142.250.217.99	unknown	United States	15169	GOOGLEUS	false
142.250.217.98	unknown	United States	15169	GOOGLEUS	false
151.101.193.229	unknown	United States	54113	FASTLYUS	false
18.172.170.115	unknown	United States	3	MIT-GATEWAYSUS	false
216.239.34.36	unknown	United States	15169	GOOGLEUS	false
52.46.128.147	unknown	United States	16509	AMAZON-02US	false
52.29.24.158	unknown	United States	16509	AMAZON-02US	false
18.172.170.93	unknown	United States	3	MIT-GATEWAYSUS	false
18.172.170.9	unknown	United States	3	MIT-GATEWAYSUS	false
3.123.206.73	unknown	United States	16509	AMAZON-02US	false
3.163.165.54	unknown	United States	16509	AMAZON-02US	false
13.224.14.122	unknown	United States	16509	AMAZON-02US	false
13.224.14.17	unknown	United States	16509	AMAZON-02US	false
13.107.21.237	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
99.86.36.4	unknown	United States	16509	AMAZON-02US	false
3.163.165.105	unknown	United States	16509	AMAZON-02US	false
3.163.179.42	unknown	United States	16509	AMAZON-02US	false
18.172.170.123	unknown	United States	3	MIT-GATEWAYSUS	false
131.253.33.237	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
104.244.42.130	unknown	United States	13414	TWITTERUS	false
52.223.40.198	unknown	United States	8987	AMAZONEXPANSIONGB	false
74.125.195.84	unknown	United States	15169	GOOGLEUS	false
104.17.25.14	unknown	United States	13335	CLOUDFLARENETUS	false
172.217.14.228	unknown	United States	15169	GOOGLEUS	false
172.217.14.226	unknown	United States	15169	GOOGLEUS	false
151.101.64.84	unknown	United States	54113	FASTLYUS	false
74.125.142.84	unknown	United States	15169	GOOGLEUS	false
142.251.215.230	unknown	United States	15169	GOOGLEUS	false
15.197.193.217	unknown	United States	7430	TANDEMUS	false
142.251.215.228	unknown	United States	15169	GOOGLEUS	false
142.251.215.227	unknown	United States	15169	GOOGLEUS	false
142.251.33.66	unknown	United States	15169	GOOGLEUS	false
23.196.147.117	unknown	United States	16625	AKAMAI-ASUS	false
93.184.215.217	unknown	European Union	15133	EDGECASTUS	false
176.34.201.149	unknown	Ireland	16509	AMAZON-02US	false
104.244.42.66	unknown	United States	13414	TWITTERUS	false
104.244.42.1	unknown	United States	13414	TWITTERUS	false
151.101.200.159	unknown	United States	54113	FASTLYUS	false
151.101.200.158	unknown	United States	54113	FASTLYUS	false
104.244.42.69	unknown	United States	13414	TWITTERUS	false
151.101.200.157	unknown	United States	54113	FASTLYUS	false
104.244.42.67	unknown	United States	13414	TWITTERUS	false
34.111.140.246	unknown	United States	15169	GOOGLEUS	false
34.49.212.111	unknown	United States	2686	ATGS-MMD-ASUS	false
142.251.215.238	unknown	United States	15169	GOOGLEUS	false
142.250.69.200	unknown	United States	15169	GOOGLEUS	false
142.250.69.206	unknown	United States	15169	GOOGLEUS	false
142.250.69.202	unknown	United States	15169	GOOGLEUS	false

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1438427
Start date and time:	2024-05-08 18:00:29 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 4s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://auth.wetransfer.com/u/email-verification?ticket=sOfHe06FaLKeBlvUSZSpsfeqvFtInnsm
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	9
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	CLEAN
Classification:	clean3.win@29/696@0/97
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Browse: https://wetransfer.pr.co/ Browse: https://wetransfer.com/jobs Browse: https://twitter.com/WeTransfer

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	70634
Entropy (8bit):	5.301203241034637
Encrypted:	false
SSDEEP:	1536:yWpyl+LEh5v7RENRA/DMshRGsHMeQvEn9BP8ExBJuw9DW:QALEh5v7WmAsTGePLkExBkw9DW
MD5:	B5F9CECE30103D44FF2FB44114A257E7
SHA1:	CB5751F115C908CDC339C8407D593B2D3053A071
SHA-256:	B3DD0C70FB3714BFCA6014CD8E74B96254D15A1DC483D5322F5F6ECB9C1547C5
SHA-512:	68AE7481FD6382B10A091C7B1D3E7F78B943972261211692A351CF693972757C6BFEF2C661C266A11505EFCE5BF0E94197A1DBBBB89F6F799752E0B293A3DD45
Malicious:	false
Reputation:	low
URL:	https://abs.twimg.com/responsive-web/client-web/modules.common.7e4c200a.js
Preview:	"use strict";(self.webpackChunk_twitter_responsive_web=self.webpackChunk_twitter_responsive_web\|\|[]).push([["modules.common"],{49898:(e,t,n)=>{n.d(t,{Z:()=>_});var o=n(2784),i=n(6555),r=n(82392),s=n(400),a=n(73186),l=n(88809),c=n(24949),d=n(92160),h=n(16657);const u=(e,t)=>t.entityId&&h.ZP.select(e,t.entityId)\|\|void 0,p=e=>`/${e.screen_name}`,m=e=>e.name,g=(0,d.Z)().propsFromState((()=>({user:u,badging:(0,c.P1)(u,(e=>e?{displayContext:"content",isBlueVerified:e.is_blue_verified,isProtected:e.protected,isVerified:e.verified,verifiedType:e.verified_type,translatorType:e.translator_type,affiliateBadgeInfo:e.highlightedLabel}:void 0))}))).adjustStateProps((({badging:e,user:t})=>({badging:e,link:t&&p(t),screenName:t&&t.screen_name,text:t&&m(t)\|\|""})));class b extends o.PureComponent{render(){const{color:e,link:t,onClick:n,screenName:r,text:s,weight:a,withHashflags:c}=this.props,d=o.createElement(i.Z.TextFragment,{color:e,link:t,onClick:n,style:y.wordBreak,weight:a,withHashflags:c},s,this._r

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	42
Entropy (8bit):	2.9881439641616536
Encrypted:	false
SSDEEP:	3:CUXPQE/xlEy:1QEoy
MD5:	D89746888DA2D9510B64A9F031EAECD5
SHA1:	D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
SHA-256:	EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
SHA-512:	D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
Malicious:	false
Reputation:	low
Preview:	GIF89a.............!.......,...........D.;

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 257x257, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=17, height=6196, bps=0, compression=none, PhotometricIntepretation=RGB, description=1995-08-1452-020-020A 001, orientation=upper-left, width=9240], baseline, precision 8, 1000x667, components 3
Category:	downloaded
Size (bytes):	166127
Entropy (8bit):	7.9146961684057064
Encrypted:	false
SSDEEP:	3072:5bn/F4ODlhhYP7LTLXQaui3fJCNKA53HqsTk9bioWWNO:5bn94C6rLXQ5i3PAks4pIt
MD5:	EDFB1D9F2BF997DF2D2496883E04A12E
SHA1:	FB273A7C5A0DAF642DE45D88ADF0E56EA80EB441
SHA-256:	791978A81BEAF66A7BC78D65AA4177987D29998A06A23D8A5F1CE84D48DD078A
SHA-512:	F149291BB505A48B83A25ABB4FAF1A5271554E72178EC9CC574A71B18268BE7F34A856EE869314FBF243D8B57CD28F16FC7B3ABF908246C74064A68D29C69EBD
Malicious:	false
Reputation:	low
URL:	https://ideas-blog.wetransfer.com/static/edfb1d9f2bf997df2d2496883e04a12e/525638-Bjo_rk_by_Spike_Jonze_3__Unreleased_-99ed72-large-1707748321.jpg
Preview:	......JFIF.............fPhotoshop 3.0.8BIM........................8BIM..................8BIM..................8BIM.......H./ff...lff........./ff...............2.....Z...........5.....-..........8BIM.......p................................................................................................................8BIM.......l..Z...%G............1995.....1995-08.....35mm.....Bands.....Bjork.....California.....Chateau Marmont.....Detour Magazine.....Icon Scan.....Kodak 5030 PJC-1.....Los Angeles.....West Hollywood.....color.....color corrected.....finished.....high resolution.....music.....swimming pool.....underwater..7..20231027..P..ICON..t..Spike Jonze..x..1995-08-1452-020-020A 0018BIM................8BIM...............@...@....8BIM..........8BIM...................k.....................Adobe_CM......Adobe.d.................................................................................................................................................k...."................?.........

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 43236
Category:	downloaded
Size (bytes):	12083
Entropy (8bit):	7.985559860570185
Encrypted:	false
SSDEEP:	192:26MV2PEUWRRI2V6SKbQ5W3YmOCf3OrXT9WV7ae9Jl4Qx4q8ai0jzybBwjJuVJXC9:+tjRIm6SoITu3khUF9Jlyq9ywMJp2vh
MD5:	337F63427080A8D6A60316B759DAB390
SHA1:	36802047BF72A8D87B166442ABCB5040C0DAC062
SHA-256:	4DCBF85BE581DB5602356F58B7E04ADFBC2AA298C14C30AE5A301CEC194D8F86
SHA-512:	2C5EC781C920A1C1488F590F53574233A629AB1B6DB31BC6485C1C6691180F9F6DC4FD4AD1FBAF2EB3975F28CB7DBA066FAAC3B8D6746859675EF5074DCFA16F
Malicious:	false
Reputation:	low
URL:	https://www.redditstatic.com/ads/pixel.js
Preview:	...........;ks.....n..i....k\....<.L..J..P"$F.q....{.%....;;.6.B.}N.w.>.....I.0(EF.J..t$T=4......yc....J...T.4..%......."\..F......d..%...U52..c+>F..f..JV...... ......."tW>..[.x....L.Q.P.u't..\]wF..w=.._.z....Boi...'.c.FIl<m6M..]u.;..K....F..'.Y.R........AK.M..3.c.N.....D....yf..&...Y2oz......uS..Q.j.]&$...8[.i..6cT..L5.....#..Q.&hj;I.=6I.L.^,F..v;z\&...S4.....N.h...\|.].@..D..B.=a..pz.P.....e.5...vQ....G~.fK...2..A.r9ko...ihO...R...[-...}.=.T.39O!.3"....(.....C.....q...8.E..6...}..]t.D...'gN.;.2.>....k.+.S)D.....0...".Q.i.,./r.(....Nn.Tmhz.m.Kx]Zj....y.<...;.D.r..H...U....@%.Kb...W.V.{..`i......._...'.!)5.CGd.....e.+^...E.8.Q..d.....4.#...\|_.7.UCm..I{.{.f['...`..c:mBjMp......N..F..1.>*. YR...N....~te.B.}n....M..q.<...x.....N:.6.....CT..+^.1........!;...8....P..d+>.q",3..qW.....qb....:....C@ey.$..c.D.e..D...-..<...!......$.d...I`sj.;yplf.....<Y.2I.y.L.Du1".K..... gWn.4.2.....l..0ri....I...Q......X.x.}.?.......A.I..).g.a4.....o..-c

Target ID:	0
Start time:	18:01:14
Start date:	08/05/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Target ID:	2
Start time:	18:01:16
Start date:	08/05/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2624 --field-trial-handle=2268,i,3564403640156923666,3971517337339682263,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Target ID:	3
Start time:	18:01:18
Start date:	08/05/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://auth.wetransfer.com/u/email-verification?ticket=sOfHe06FaLKeBlvUSZSpsfeqvFtInnsm"
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	7
Start time:	18:02:03
Start date:	08/05/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5848 --field-trial-handle=2268,i,3564403640156923666,3971517337339682263,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Description:	Adversaries may gain access to a system through a user visiting a website over the normal course of browsing. With this technique, the user's web browser is typically targeted for exploitation, but adversaries may also use compromised websites for non-exploitation behavior such as acquiring Application Access Token .
Tactics:	Initial Access
Data Sources:	Application Log: Application Log Content, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Process: Process Creation
Platforms:	Linux, macOS, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://auth.wetransfer.com/u/email-verification?ticket=sOfHe06FaLKeBlvUSZSpsfeqvFtInnsm

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

Phishing

Networking

System Summary

Malware Analysis System Evasion

Anti Debugging

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Chrome Cache Entry: 345

Chrome Cache Entry: 346

Chrome Cache Entry: 347

Chrome Cache Entry: 348

Chrome Cache Entry: 349

Chrome Cache Entry: 350

Chrome Cache Entry: 351

Chrome Cache Entry: 352

Chrome Cache Entry: 353

Chrome Cache Entry: 354

Chrome Cache Entry: 356

Chrome Cache Entry: 357

Chrome Cache Entry: 358

Chrome Cache Entry: 359

Chrome Cache Entry: 361

Chrome Cache Entry: 362

Chrome Cache Entry: 363

Chrome Cache Entry: 364

Chrome Cache Entry: 365

Chrome Cache Entry: 366

Chrome Cache Entry: 367

Chrome Cache Entry: 368

Chrome Cache Entry: 369

Chrome Cache Entry: 370

Chrome Cache Entry: 371

Chrome Cache Entry: 372

Chrome Cache Entry: 373

Chrome Cache Entry: 374

Windows Analysis Report
https://auth.wetransfer.com/u/email-verification?ticket=sOfHe06FaLKeBlvUSZSpsfeqvFtInnsm