Edit tour

Windows Analysis Report
http://bs-nakagawa.com/PMxdv77xgwVSyGqqOWzi/bf5c0b42c4aa8a1c13d9113627555356/anJhZGtlQGdwYWxhYi5jb20=

Overview

General Information

Sample URL:	http://bs-nakagawa.com/PMxdv77xgwVSyGqqOWzi/bf5c0b42c4aa8a1c13d9113627555356/anJhZGtlQGdwYWxhYi5jb20=
Analysis ID:	1438590
Infos:

Detection

Score:	56
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Phishing site detected (based on favicon image match)

LLM detected suspicious URL

LLM detected suspicious webpage text

Found iframes

HTML body contains low number of good links

HTML page contains hidden URLs or javascript code

HTML title does not match URL

Phishing site detected (based on OCR NLP Model)

Stores files to the Windows start menu directory

Classification

Process Tree

System is w10x64_ra

chrome.exe (PID: 7008 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://bs-nakagawa.com/PMxdv77xgwVSyGqqOWzi/bf5c0b42c4aa8a1c13d9113627555356/anJhZGtlQGdwYWxhYi5jb20= MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6188 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 --field-trial-handle=2084,i,263149200538029793,10909554523453968512,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Phishing

Phishing site detected (based on favicon image match)

Source: https://sacclmo.com/main/main.php#1Yl6b6xOOcVWt19Lc2cYB2iixWpxIgrKfNRrTofHAaE4bOPoR1ns4GLBCb9lrB6HoX8hloZWyE0KsQ9jSwMXcxyPIIaajhRHe0ZAoZwXDxH5oRpgnbdAIMpruABORtw6tvGRucO7Kwd8nCoKOClwpLYTmAId3ejwJ0nedclXIz65bvQZ7bwwXvqj58x8nRE6R2l4eH1Xg82sDTrL5Yi2uIlzRSHeJmlBpGFEnHBDPE5txxeCwwF0e1A6ThlDEGe3nUHKBjoqXuTu287zENzTO9ZHrkl61AaouS95byw82qD5yLEdye6mo64PrqWs06RuY1Aaz6jCxWI5ImigApDYvIOW8Lp9RhDQid0SkjuRgdXYzgfaFT9bBY8JJySBPwr8Ks05MvW3IU2hahsQbB1MAawjIpVxWmFGPGLCbIFTCIbN0EEbgFXQPuaxT55PsLwhriUC0AwDiIrin5tDLruBVE9PJeFcZbtrto4uYB8gkzzHF3lquP1qtbfdpUpp6TQAhU5gwdxQN6xt9STEHV4b6jpwePWlJMV1H0hdeO32VBv5tpJblNns7NYmCUHmHDnpDEDStGUoiqtMPdXb1lD99CvLwd8eQvDt9gmDXg2fHw1wJZHKllTuXpguCoIsTmW3DiHBzJRgfTNZTvKeQDJN3ZiFo08hn5l1o2CXMue1n21gxLvnpebset8CuhUSmfTKiwI40X6nZ7EwTaUio6LCzUf4b9WyoQiHm1MmZSKY0pvTzqcYwXB6RQa3Z7BoYU5kVRHUKsTKRoErPQplO1rGRCJQKkeIej2abK5VcZG4okwdbWy0X0GOCqFnLT5Zd8aoSgk5f0aDlGQxDoxApep1F4oqXuqaCAzvQUA5UKJgrzN4YlEnA3pf7OF5i5gVFQqwK0CELlVcVIgU3VhDYHT6vybODsJji9Q2asHVOC7KkoEojW2hDVo9tAY72HrkRhn1K4XyG4j1tXpMUs4xosHS3FZ5nqqeINgsSd1yikALi0ycsCKQ5rI87Ieu9EISsZkkdmTvHthZtPcWsWNxowFvfTZoyIg0HBlUXfqEIIEcxQ9ZNXxbtcHI5G7EooE6000XfrCY9hbG7kGVhd7LqOuwuBaT0PZ0P0Y4rA2ARehZyYVQc2BDQ59lHjfH9fIYfG3Hg6i8kA8Sy3JL5koWqxi8RxP1MyZ2e3Kv92EtDMmbQ5XWqlSRTaZLIPMunMxCPh7YkLsXyO9oU6kksdcmob761UBoH81wq8vKTXHrLQPFXa0pncMLoTSpOtOvBP22XxMRutjgk9WijWHH8utxnlWcOKIqAKsyhfpMII23SYlbU3T3xmAVHx8wiQXSAqqSFQEozGrrENDzQwDoSdkALs63i3VSumK9dpxM5ZeKMRjDnW2gamQVOXY71UZvhKEu9chfbvZYniCLfE1p1SlQPkXQfWlwH01Rcj7oP6ncpZXEEZ4GRqwGKtxZqTw7TyZ6R6vGcSTCSRgxQldHLJnwcUvCN2KHAJOsQj93c2F4TWCJhPr3yPzKK5mx76fIQ4aGnjKAlpFfmhZE6qHEfhpZmLxuSNcIRmpfF9P1zvhVMgzSHgxXxWXUHuoAiBiaXIpDRfFqKWmwcVpTbWQJTOEAi3bBEuLCcbg4qWvaSRH5M6ZY3QIWEnxXqIy5ckIpvYtWUY7NQOTCVSBYIjVnGsk7bTcoeVNJThGOgNC6BvJxnkw6ErulUOs5IFtWAhGuymjOaVUMrDjOYPVChqXbeqhX5KUF2A9AXtp7okTPYdEW3Azk0wwfWNc2x6IAHSaFlAMJUGzSUdPXOoiOVO4SBhU9nCJ5uUKPuxzpe8i8m76bvo0rc4jOldXJQHOkBza66KwkTOtgWzrrYrTbwcZRpXBgEqBgZLn6wTrpIUFEu76szZD5bDWBAyRfYswXeT4LNvawqQaUYhmxg0CsDz4e7Wt5pZ3ET7pGDzc3qnXoEkWVlyoY8scgpGlOFpsyxRfarsdSPbhuwdqRMOQVh3bGJxvpWXYuPeEgGS9w3q1ADrrqgilxmwe64Jv1HuvwI9No1WV5mWF0o7qEqMcMjqSnaooRSTnA3aZ56VatRQtgXUUnG690x2oHqNyjHWUK6UPdP0GHQaXN4SbLZlLwoaeOXN8EJ2oQWe3LeKt4UqSZi4KiqwOOG3DDQLhzNGqJVuv9eYe9p78IcT0CqPq6S3KIP2iCIImDcRNrQ2Af9JYlDYY3Np9FsUohWGUFogiA862Y8CeimdEZbC2Z1cEu62M3JGI7X1I57K4gnjyKwcJIOMHQZmk6p798NSfLTYR1IVh6fQQM2zuRmbIly2sXaB6XumJnkAo3wG9LwZxzz1qWd8hLbKJlmPjQb2dwDCz9jIUPHrohtPdHYvt9fcvB2OseRGKujjDC1xsJZR1tGeaEJDOZQjBT737ZKRt3a6GcE8WEZX8FcjkWX8WNrxGzBOylF1pQ853Nd0sdYASaTd6Rl2ENAlmcaUyPWXG43KSgKkuIVnSOAZGV2lJDG5PQ0nGWln1o7TFRe9A9wtY6sE2vZM8GRYxSmeOHBQ6JKLAYVa8rE6y6LBCLnLrfJZ75dWNPMTywF9vAkD2YKB4wcHhAsJQcIXiWT5LGZjcEtIfNlhL6TQC6xUG0DwcmuuioA44zoheRZtElLprEf4LNYrNCYZYtugR4kVEIdTzcney9D0OT4zG30tFZtDsXUk2egHXtAxGXLe6oeVhiuYmvr1uUEXRyhUNxBL1ciHa3Vhs9cKsGIOb9QF4uDW3VQRtrCuEUbOY75qhhaJXTy82oO7Ts3XnTOQlrlZlwNkETKVaVF7PdgSC5Zvx2sUVhLhI6h4D5ohY9c85SgU6xMICMd9OG4KXP2GVjKyo9Pmi2voULj1i6JUSX4HD8sAXuhSN1rbagytj3SeObf7hY2aV6RzfjadNr5BsxNDOl77oZmdbCltAoEwvv6KPgXDH3faA2OonWwMWS07vmB5KfCfLJZBZXfH0uSBwG0UDwHzpHHU4i0OyD?cfg=jradke@gpalab.com	Matcher: Template: outlook matched with high similarity
Source: https://sacclmo.com	Matcher: Template: outlook matched with high similarity

LLM detected suspicious URL

Source: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/hrk96/0x4AAAAAAAQ_ajLYJ-oSKSIN/auto/normal

LLM: Score: 7 Reasons: Medium risk of typosquatting due to the presence of a suspicious domain ('cloudflare-cdn.com') in the URL. It is recommended to verify the authenticity of the URL and ensure that it is associated with a trusted source. DOM: 2.2.pages.csv

LLM detected suspicious webpage text

Source: https://sacclmo.com/main/	LLM: Score: 7 Reasons: The text extracted from the OCR indicates a potential phishing attempt. It tries to mimic a legitimate website 'www.office.com' and manipulate the user into clicking on a link to 'verify' their humanity. However, the URL provided in the text, 'https://sacclmo.com/main/', does not match the legitimate website and poses a significant security risk. The combination of these factors suggests a phishing site with a high risk score of 7. DOM: 1.1.pages.csv
Source: https://sacclmo.com/main/	LLM: Score: 8 Reasons: The text contains potential phishing indicators, such as urging the user to 'Verify you are human' and a suspicious 'CLOuOFLARE' message. The URL provided does not match the text's claim of 'www.office.com' and is instead 'https://sacclmo.com/main/', which raises further concerns about the legitimacy of the site. DOM: 1.3.pages.csv

Source: https://www.office.com/

HTTP Parser: Iframe src: https://mem.gfx.ms/me/mecache?partner=office&wreply=https%3A%2F%2Fwww.office.com

Source: https://passwordreset.microsoftonline.com/?ru=https%3a%2f%2flogin.microsoftonline.com%2fcommon%2freprocess%3fctx%3drQQIARAAhZLNa9MAAMWbdq1b0dlNET0IEzzIJG2-0xR2SJt-pFuStU0amoOlaZM0bZqkbdK0uYseB8LAgRcPojt6Ei8Kehi7uPP8DwRFPMiObnoeXh7v8d7t_ZLLRBom0lAa2owhaSh3HyMJHMNwFUSRLgFilAqBWVQjQLhHoecVQhLdzmQ9mXr8xL-3_yNTePN8bbO59fnFIbDR9zx3mstkgiBIO7pudrV01xllrI7dM21jhrwDgBMAOIjGNRuUGofRKYFmYZTCYQInYRQlYRhJt0QabslsqAw4TyizGG9CkCJagx25OuTCoseLUtgKhwuuXMQUWYK4cAgrMhcI4tDjRmzIFy72tcWO2B8JIudxTG3BDaSAZySEZ2r4afS6QPteH7kQZ2KG2q_oiu5MRm3XmXoHsf0oa2_LVLkyq3f8Rcjy42q1gpCmQMlwFxs7xZaUX_TC1rRdsn18Z9uFFFrtg9VCXfLl4XAATjhyx9iFbFKCkOliYbCo2K-apqzkLV0k59uUU1B5vcD2XAItBc1i1RBMexdCbdjrBzZfLpXzou808Www5STOmtfAkS_DeAlSF0h7e9jlVa_RbWBzmOk4vR4KVXlZ1gJK1gdsVt015tREwAl80pg3CmatrxqjsSVW8CZV4uyybMrZPO-5TYyzS2irgyjCjDXyltFG9VCv0_zApcJsvUkTSjB383gFZECD7jShRnAYu3PJvTPkbSxxbkaOfRwjHVezzd6GO3F009IuQ2KGZIS_qeKMtDRtWSdLwLelW8uJVOp2ZCPy4CYUyy0vJ1ORi3S2BLyMnxMXxlcTj-4q9OuVr59-j6nIcTzTLNgMjVMGKs_6XmgV8g8JXrJ0oYQTZTxDDOcNX-34vfmYcbbgHLyXAPYSiePEGsu0-aLYEGmeo...

HTTP Parser: Number of links: 0

Source: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/hrk96/0x4AAAAAAAQ_ajLYJ-oSKSIN/auto/normal

HTTP Parser: Base64 decoded: http://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/hrk96/0x4AAAAAAAQ_ajLYJ-oSKSIN/auto/normal

Source: https://www.office.com/

HTTP Parser: Title: Login | Microsoft 365 does not match URL

Source: Chrome DOM: 1.1

ML Model on OCR Text: Matched 81.7% probability on "www.office.com Verify you are human by completing the action below. www.office.com needs to review the security of your connection before proceeding. "

Source: https://sacclmo.com/main/	HTTP Parser: No favicon
Source: https://sacclmo.com/main/	HTTP Parser: No favicon
Source: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/hrk96/0x4AAAAAAAQ_ajLYJ-oSKSIN/auto/normal	HTTP Parser: No favicon
Source: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/hrk96/0x4AAAAAAAQ_ajLYJ-oSKSIN/auto/normal	HTTP Parser: No favicon
Source: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/hrk96/0x4AAAAAAAQ_ajLYJ-oSKSIN/auto/normal	HTTP Parser: No favicon

Source: https://passwordreset.microsoftonline.com/?ru=https%3a%2f%2flogin.microsoftonline.com%2fcommon%2freprocess%3fctx%3drQQIARAAhZLNa9MAAMWbdq1b0dlNET0IEzzIJG2-0xR2SJt-pFuStU0amoOlaZM0bZqkbdK0uYseB8LAgRcPojt6Ei8Kehi7uPP8DwRFPMiObnoeXh7v8d7t_ZLLRBom0lAa2owhaSh3HyMJHMNwFUSRLgFilAqBWVQjQLhHoecVQhLdzmQ9mXr8xL-3_yNTePN8bbO59fnFIbDR9zx3mstkgiBIO7pudrV01xllrI7dM21jhrwDgBMAOIjGNRuUGofRKYFmYZTCYQInYRQlYRhJt0QabslsqAw4TyizGG9CkCJagx25OuTCoseLUtgKhwuuXMQUWYK4cAgrMhcI4tDjRmzIFy72tcWO2B8JIudxTG3BDaSAZySEZ2r4afS6QPteH7kQZ2KG2q_oiu5MRm3XmXoHsf0oa2_LVLkyq3f8Rcjy42q1gpCmQMlwFxs7xZaUX_TC1rRdsn18Z9uFFFrtg9VCXfLl4XAATjhyx9iFbFKCkOliYbCo2K-apqzkLV0k59uUU1B5vcD2XAItBc1i1RBMexdCbdjrBzZfLpXzou808Www5STOmtfAkS_DeAlSF0h7e9jlVa_RbWBzmOk4vR4KVXlZ1gJK1gdsVt015tREwAl80pg3CmatrxqjsSVW8CZV4uyybMrZPO-5TYyzS2irgyjCjDXyltFG9VCv0_zApcJsvUkTSjB383gFZECD7jShRnAYu3PJvTPkbSxxbkaOfRwjHVezzd6GO3F009IuQ2KGZIS_qeKMtDRtWSdLwLelW8uJVOp2ZCPy4CYUyy0vJ1ORi3S2BLyMnxMXxlcTj-4q9OuVr59-j6nIcTzTLNgMjVMGKs_6XmgV8g8JXrJ0oYQTZTxDDOcNX-34vfmYcbbgHLyXAPYSiePEGsu0-aLYEGmeo	HTTP Parser: No <meta name="author".. found
Source: https://www.office.com/	HTTP Parser: No <meta name="author".. found
Source: https://www.office.com/	HTTP Parser: No <meta name="author".. found
Source: https://www.office.com/	HTTP Parser: No <meta name="author".. found

Source: https://passwordreset.microsoftonline.com/?ru=https%3a%2f%2flogin.microsoftonline.com%2fcommon%2freprocess%3fctx%3drQQIARAAhZLNa9MAAMWbdq1b0dlNET0IEzzIJG2-0xR2SJt-pFuStU0amoOlaZM0bZqkbdK0uYseB8LAgRcPojt6Ei8Kehi7uPP8DwRFPMiObnoeXh7v8d7t_ZLLRBom0lAa2owhaSh3HyMJHMNwFUSRLgFilAqBWVQjQLhHoecVQhLdzmQ9mXr8xL-3_yNTePN8bbO59fnFIbDR9zx3mstkgiBIO7pudrV01xllrI7dM21jhrwDgBMAOIjGNRuUGofRKYFmYZTCYQInYRQlYRhJt0QabslsqAw4TyizGG9CkCJagx25OuTCoseLUtgKhwuuXMQUWYK4cAgrMhcI4tDjRmzIFy72tcWO2B8JIudxTG3BDaSAZySEZ2r4afS6QPteH7kQZ2KG2q_oiu5MRm3XmXoHsf0oa2_LVLkyq3f8Rcjy42q1gpCmQMlwFxs7xZaUX_TC1rRdsn18Z9uFFFrtg9VCXfLl4XAATjhyx9iFbFKCkOliYbCo2K-apqzkLV0k59uUU1B5vcD2XAItBc1i1RBMexdCbdjrBzZfLpXzou808Www5STOmtfAkS_DeAlSF0h7e9jlVa_RbWBzmOk4vR4KVXlZ1gJK1gdsVt015tREwAl80pg3CmatrxqjsSVW8CZV4uyybMrZPO-5TYyzS2irgyjCjDXyltFG9VCv0_zApcJsvUkTSjB383gFZECD7jShRnAYu3PJvTPkbSxxbkaOfRwjHVezzd6GO3F009IuQ2KGZIS_qeKMtDRtWSdLwLelW8uJVOp2ZCPy4CYUyy0vJ1ORi3S2BLyMnxMXxlcTj-4q9OuVr59-j6nIcTzTLNgMjVMGKs_6XmgV8g8JXrJ0oYQTZTxDDOcNX-34vfmYcbbgHLyXAPYSiePEGsu0-aLYEGmeo...	HTTP Parser: No <meta name="copyright".. found
Source: https://www.office.com/	HTTP Parser: No <meta name="copyright".. found
Source: https://www.office.com/	HTTP Parser: No <meta name="copyright".. found
Source: https://www.office.com/	HTTP Parser: No <meta name="copyright".. found

Source: unknown	HTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.16:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.192.208.109:443 -> 192.168.2.16:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.192.208.109:443 -> 192.168.2.16:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.16:49769 version: TLS 1.2

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 23.192.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.192.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.192.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.192.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.192.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.192.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.192.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.192.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.192.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.192.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.192.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.192.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.192.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.192.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.192.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10

Source: global traffic	HTTP traffic detected: GET /PMxdv77xgwVSyGqqOWzi/bf5c0b42c4aa8a1c13d9113627555356/anJhZGtlQGdwYWxhYi5jb20= HTTP/1.1Host: bs-nakagawa.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: bs-nakagawa.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://bs-nakagawa.com/PMxdv77xgwVSyGqqOWzi/bf5c0b42c4aa8a1c13d9113627555356/anJhZGtlQGdwYWxhYi5jb20=Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9

Source: global traffic	DNS traffic detected: DNS query: bs-nakagawa.com
Source: global traffic	DNS traffic detected: DNS query: sacclmo.com
Source: global traffic	DNS traffic detected: DNS query: challenges.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: cdnjs.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: outlook.office.com
Source: global traffic	DNS traffic detected: DNS query: bc1q3jc6cu9q5t35vc9jt7h47pw.com
Source: global traffic	DNS traffic detected: DNS query: aadcdn.msftauth.net
Source: global traffic	DNS traffic detected: DNS query: aadcdn.msauthimages.net
Source: global traffic	DNS traffic detected: DNS query: passwordreset.microsoftonline.com
Source: global traffic	DNS traffic detected: DNS query: ajax.aspnetcdn.com
Source: global traffic	DNS traffic detected: DNS query: office.com
Source: global traffic	DNS traffic detected: DNS query: www.office.com
Source: global traffic	DNS traffic detected: DNS query: portal.office.com
Source: global traffic	DNS traffic detected: DNS query: login.microsoftonline.com
Source: global traffic	DNS traffic detected: DNS query: substrate.office.com
Source: global traffic	DNS traffic detected: DNS query: mem.gfx.ms
Source: global traffic	DNS traffic detected: DNS query: js.monitor.azure.com

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 08 May 2024 19:42:50 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: keep-aliveVary: Accept-EncodingLast-Modified: Tue, 10 Jan 2023 05:26:54 GMTETag: W/"afe-5f1e221b8b3fd"Content-Encoding: gzipData Raw: 35 31 39 0d 0a 1f 8b 08 00 00 00 00 00 04 03 8d 56 cf 6f 13 47 14 3e 7b ff 8a 61 a3 4a 25 ca 66 63 27 71 a8 b1 ad 4a 10 0a 2d 90 08 4a a1 a7 6a bc 3b b6 a7 ac 77 ac dd 75 12 b7 ca 1f 63 32 53 d1 12 95 08 50 49 0a 88 aa a0 36 4d 4b 28 ad 82 2a 0e a0 aa 97 26 d0 0b 51 a5 1e fb 66 67 d6 5e 27 06 b1 17 7b df cf ef 7d ef cd db 29 1e 38 3a 73 e4 c3 8f 67 a7 51 3d 6a 78 65 a3 28 7f 90 87 fd 5a c9 fc 14 9b 52 40 b0 0b 3f 0d 12 61 e4 d4 71 10 92 a8 64 4e 9f 3b 62 bd 3f 6b 22 1b 34 11 8d 3c 52 9e 18 9b 40 c7 a8 47 d0 69 16 a1 63 ac e5 bb 45 5b 69 b4 af 8f 1b a4 64 3a ac d9 0e 68 ad 1e 99 c8 61 7e 44 7c 08 76 24 91 a1 0b 67 a7 cf 7c 34 7d 06 9d f0 9d 51 99 3b 4e aa 1c 03 56 61 51 98 f2 3a 71 fa e8 f4 85 91 63 33 27 4f ce 9c 57 40 52 d6 73 94 cc 37 59 90 ce 32 4f dd a8 5e 72 c9 1c 75 88 15 bf 8c 50 9f 46 14 7b 56 e8 60 8f 94 b2 a3 63 23 0d 10 35 5a 8d 9e 44 a2 08 a3 36 d4 15 b5 9b 80 3f 22 0b 91 ed 84 21 c8 87 d1 e7 06 82 a7 81 83 1a f5 0b 68 ec 70 fc da c4 ae 4b fd 5a fc be 68 d0 46 4d 9b 55 58 e0 92 40 8b 5b 9e 96 6a 6b cb 23 d5 a8 80 72 a4 71 d8 58 34 e2 1e a8 e0 6c 8e 04 55 8f cd 5b ed 02 0a 9d 80 79 9e ca 52 c1 ce c5 5a 20 69 2e a0 a1 f1 ca d4 3b 95 29 e9 59 61 6e 5b 47 ae 02 bd 56 15 37 a8 07 ae a6 f8 53 70 b1 23 be 32 47 d0 29 42 83 36 1b 41 e6 d2 83 a5 df d1 d2 af e2 86 b8 29 ee 89 ab a0 32 4f 9d 45 b3 ef b1 a8 4e 1d f9 26 7e 13 db e2 6b b1 79 fd 91 b8 81 66 03 86 ce 8f 4b f1 71 1a 60 a8 98 a1 0f f0 c5 16 52 e6 52 0d ba 10 fb a1 15 92 80 56 15 cc 3d dc 78 d4 27 56 9d c8 fe 17 50 76 74 42 19 c5 48 43 fa 19 29 a0 a9 c9 b7 94 4c f2 6c 61 8f d6 80 58 07 a6 84 04 4a ee 30 8f 01 89 f3 75 1a 91 98 aa 6c ba 5c 15 24 37 d1 5c 48 45 9e d7 f9 2a cc 73 f7 bb f4 6b 65 3f fb 41 aa 40 49 9b 60 06 23 d6 80 46 8d f5 a5 48 68 3e 4e bc 39 12 51 07 f7 33 01 1d cd 69 98 af aa 2b e6 60 3f 96 14 35 b9 29 99 72 d1 68 be 49 24 45 44 b6 4b c4 9e 3e a4 67 54 96 bc 97 d5 51 b2 d0 f4 30 f5 75 2a 35 ba 56 c4 9a d0 b5 e6 02 0a 99 47 5d 34 54 ad ea 2e 6b 7d 42 ce 20 93 7e 52 47 27 15 ad 09 ac 71 a0 13 e1 56 c4 fa d8 86 64 ba e6 21 07 b7 42 32 a0 70 79 6c 24 29 da c0 a3 da 46 17 34 94 cf e7 e3 96 8f 6b b9 47 22 18 25 2b 6c 62 27 3e a3 00 f5 95 93 22 89 49 13 05 59 e2 b1 fb a4 c2 16 74 b8 04 7f 76 52 e3 4f 96 40 ef 78 5a 7b b9 35 ec 61 54 1a f0 18 b0 3d c4 9a 78 da b9 2d d6 c5 96 f8 52 ec 1a c6 00 33 29 42 c3 b6 f1 6e 83 b8 14 23 e6 7b 6d b9 18 08 f1 11 f6 5d f4 36 6c 30 b5 dd 60 d3 1c d4 22 bc 90 88 a6 f2 c0 e8 41 40 9f 19 aa e0 98 d1 4c a6 5b 63 dc 85 6c 3c d9 99 45 23 53 97 47 2b 93 49 8f 60 5e d2 a5 75 c0 a1 9c 8f 3e 83 7c cf 59 0e 7c 9f 2e db 75 4e 4d 57 bf 45 3c ae 71 78 d9 af 4c 46 d1 ab e6 6e 02 28 86 dc 69 38 bd 88 dd f9 48 55 a3 8e 68 bf 43 4e e3 5f 34 5e d7 05 24 1e 89 3b e2 ba d8 ed fc 2b ee

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://bs-nakagawa.com/PMxdv77xgwVSyGqqOWzi/bf5c0b42c4aa8a1c13d9113627555356/anJhZGtlQGdwYWxhYi5jb20=
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 --field-trial-handle=2084,i,263149200538029793,10909554523453968512,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 --field-trial-handle=2084,i,263149200538029793,10909554523453968512,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Drive-by Compromise	Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	3 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Name	IP	Active	Malicious	Reputation
cs1100.wpc.omegacdn.net	152.199.4.44	true	false	unknown
b-0004.b-dc-msedge.net	13.107.9.156	true	false	unknown
bs-nakagawa.com	183.90.246.80	true	false	unknown
part-0042.t-0009.fb-t-msedge.net	13.107.226.70	true	false	unknown
part-0042.t-0009.t-msedge.net	13.107.213.70	true	false	unknown
ooc-g2.tm-4.office.com	52.96.164.114	true	false	high
EAT-efz.ms-acdc.office.com	52.96.91.34	true	false	high
bc1q3jc6cu9q5t35vc9jt7h47pw.com	193.222.96.119	true	false	unknown
cdnjs.cloudflare.com	104.17.24.14	true	false	high
sni1gl.wpc.upsiloncdn.net	152.195.19.97	true	false	unknown
challenges.cloudflare.com	104.17.2.184	true	false	high
office.com	13.107.6.156	true	false	high
www.google.com	142.250.217.100	true	false	high
sacclmo.com	198.98.54.45	true	true	unknown
sni1gl.wpc.sigmacdn.net	152.195.19.97	true	false	unknown
js.monitor.azure.com	unknown	unknown	false	high
www.office.com	unknown	unknown	false	high
outlook.office.com	unknown	unknown	false	high
aadcdn.msftauth.net	unknown	unknown	false	unknown
substrate.office.com	unknown	unknown	false	high
ajax.aspnetcdn.com	unknown	unknown	false	high
mem.gfx.ms	unknown	unknown	false	unknown
aadcdn.msauthimages.net	unknown	unknown	false	unknown
passwordreset.microsoftonline.com	unknown	unknown	false	high
login.microsoftonline.com	unknown	unknown	false	high
portal.office.com	unknown	unknown	false	high

Name	Malicious	Antivirus Detection	Reputation
https://sacclmo.com/main/	true		unknown
https://www.office.com/	false		high
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/hrk96/0x4AAAAAAAQ_ajLYJ-oSKSIN/auto/normal	false		high
http://bs-nakagawa.com/PMxdv77xgwVSyGqqOWzi/bf5c0b42c4aa8a1c13d9113627555356/anJhZGtlQGdwYWxhYi5jb20=	false		unknown
http://bs-nakagawa.com/favicon.ico	false	Avira URL Cloud: safe	unknown
https://passwordreset.microsoftonline.com/?ru=https%3a%2f%2flogin.microsoftonline.com%2fcommon%2freprocess%3fctx%3drQQIARAAhZLNa9MAAMWbdq1b0dlNET0IEzzIJG2-0xR2SJt-pFuStU0amoOlaZM0bZqkbdK0uYseB8LAgRcPojt6Ei8Kehi7uPP8DwRFPMiObnoeXh7v8d7t_ZLLRBom0lAa2owhaSh3HyMJHMNwFUSRLgFilAqBWVQjQLhHoecVQhLdzmQ9mXr8xL-3_yNTePN8bbO59fnFIbDR9zx3mstkgiBIO7pudrV01xllrI7dM21jhrwDgBMAOIjGNRuUGofRKYFmYZTCYQInYRQlYRhJt0QabslsqAw4TyizGG9CkCJagx25OuTCoseLUtgKhwuuXMQUWYK4cAgrMhcI4tDjRmzIFy72tcWO2B8JIudxTG3BDaSAZySEZ2r4afS6QPteH7kQZ2KG2q_oiu5MRm3XmXoHsf0oa2_LVLkyq3f8Rcjy42q1gpCmQMlwFxs7xZaUX_TC1rRdsn18Z9uFFFrtg9VCXfLl4XAATjhyx9iFbFKCkOliYbCo2K-apqzkLV0k59uUU1B5vcD2XAItBc1i1RBMexdCbdjrBzZfLpXzou808Www5STOmtfAkS_DeAlSF0h7e9jlVa_RbWBzmOk4vR4KVXlZ1gJK1gdsVt015tREwAl80pg3CmatrxqjsSVW8CZV4uyybMrZPO-5TYyzS2irgyjCjDXyltFG9VCv0_zApcJsvUkTSjB383gFZECD7jShRnAYu3PJvTPkbSxxbkaOfRwjHVezzd6GO3F009IuQ2KGZIS_qeKMtDRtWSdLwLelW8uJVOp2ZCPy4CYUyy0vJ1ORi3S2BLyMnxMXxlcTj-4q9OuVr59-j6nIcTzTLNgMjVMGKs_6XmgV8g8JXrJ0oYQTZTxDDOcNX-34vfmYcbbgHLyXAPYSiePEGsu0-aLYEGmeoesM0oZ-JoCnVyLvV_7L8OnVG8mkb7Ytp9uxtOn6P5Y_XoucrR59-fDs1d7R98of0&mkt=en-US&hosted=0&device_platform=Windows+10	false		high

IP	Domain	Country	ASN	ASN Name	Malicious
40.126.26.18	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
13.107.6.156	office.com	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.251.33.110	unknown	United States	15169	GOOGLEUS	false
142.250.217.78	unknown	United States	15169	GOOGLEUS	false
142.250.217.99	unknown	United States	15169	GOOGLEUS	false
152.195.19.97	sni1gl.wpc.upsiloncdn.net	United States	15133	EDGECASTUS	false
152.199.4.33	unknown	United States	15133	EDGECASTUS	false
74.125.142.84	unknown	United States	15169	GOOGLEUS	false
23.216.147.64	unknown	United States	7016	CCCH-3US	false
13.107.226.70	part-0042.t-0009.fb-t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
20.42.65.88	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
104.17.3.184	unknown	United States	13335	CLOUDFLARENETUS	false
52.96.113.162	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.250.217.100	www.google.com	United States	15169	GOOGLEUS	false
20.190.154.140	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
13.107.9.156	b-0004.b-dc-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
20.190.190.133	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
104.17.24.14	cdnjs.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
142.250.217.67	unknown	United States	15169	GOOGLEUS	false
52.96.164.114	ooc-g2.tm-4.office.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
152.199.4.44	cs1100.wpc.omegacdn.net	United States	15133	EDGECASTUS	false
183.90.246.80	bs-nakagawa.com	Japan	9371	SAKURA-CSAKURAInternetIncJP	false
173.222.197.159	unknown	United States	16625	AKAMAI-ASUS	false
13.107.246.70	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
13.107.253.70	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
20.189.173.26	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
198.98.54.45	sacclmo.com	United States	53667	PONYNETUS	true
142.251.33.74	unknown	United States	15169	GOOGLEUS	false
23.34.172.81	unknown	United States	16625	AKAMAI-ASUS	false
193.222.96.119	bc1q3jc6cu9q5t35vc9jt7h47pw.com	Germany	3303	SWISSCOMSwisscomSwitzerlandLtdCH	false
104.17.2.184	challenges.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
142.250.69.202	unknown	United States	15169	GOOGLEUS	false

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1438590
Start date and time:	2024-05-08 21:42:22 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Sample URL:	http://bs-nakagawa.com/PMxdv77xgwVSyGqqOWzi/bf5c0b42c4aa8a1c13d9113627555356/anJhZGtlQGdwYWxhYi5jb20=
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	14
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled
Analysis Mode:	stream
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal56.phis.win@22/132@54/207

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed May 8 18:42:49 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2673
Entropy (8bit):	3.991582637157884
Encrypted:	false
SSDEEP:
MD5:	DC51645DB3925588162D8339CD276FDB
SHA1:	AE8CF39E552936D4E1BD02B19381F5DC243F3CE4
SHA-256:	05C67811F0300CA672100700C348D43DFE312AE064301924A8FCEC476EE3D451
SHA-512:	C93D39DA30F656B813FEFC9D628D5577B03CC90D337E9D266830F1313388E6CABAE07EC494C3A2C71D2C76F2F7EED13475EA33E4110AAD9BCA8070B1404692C6
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,............N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.XO.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.XX.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.XX.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.XX............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.XY............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............!`{.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Description:	Adversaries may gain access to a system through a user visiting a website over the normal course of browsing. With this technique, the user's web browser is typically targeted for exploitation, but adversaries may also use compromised websites for non-exploitation behavior such as acquiring Application Access Token .
Tactics:	Initial Access
Data Sources:	Application Log: Application Log Content, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Process: Process Creation
Platforms:	Linux, macOS, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

IP
192.168.2.16
192.168.2.4

Input	Output
URL: https://sacclmo.com/main/	{ "riskscore": 7, "reasons": "The text extracted from the OCR indicates a potential phishing attempt. It tries to mimic a legitimate website 'www.office.com' and manipulate the user into clicking on a link to 'verify' their humanity. However, the URL provided in the text, 'https://sacclmo.com/main/', does not match the legitimate website and poses a significant security risk. The combination of these factors suggests a phishing site with a high risk score of 7." }"
www.office.com Verify you are human by completing the action below. www.office.com needs to review the security of your connection before proceeding.
URL: https://sacclmo.com/main/	{ "riskscore": 8, "reasons": "The text contains potential phishing indicators, such as urging the user to 'Verify you are human' and a suspicious 'CLOuOFLARE' message. The URL provided does not match the text's claim of 'www.office.com' and is instead 'https://sacclmo.com/main/', which raises further concerns about the legitimacy of the site." }"
www.office.com Verify you are human by completing the action below. : Verifying... CLOuOFLARE www.office.com needs to review the security of your connection before proceeding.
URL: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/hrk96/0x4AAAAAAAQ_ajLYJ-oSKSIN/auto/normal	{ "riskscore": 7, "reasons": "Medium risk of typosquatting due to the presence of a suspicious domain ('cloudflare-cdn.com') in the URL. It is recommended to verify the authenticity of the URL and ensure that it is associated with a trusted source." } Explanation: ============ The URL in question is: `https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/hrk96/0x4AAAAAAAQ_ajLYJ-oSKSIN/auto/normal` The domain name in the URL is `cloudflare.com`, which is a legitimate domain owned by Cloudflare, a well-known company that provides content delivery network (CDN) and security services. However, the suspicious part of the URL is the subdomain `cdn-cgi`. Upon further investigation, it appears that the subdomain `cdn-cgi` is used by Cloudflare for various purposes, including serving CGI scripts and handling security challenges. However, the use of this subdomain in the URL could still be a potential indicator of typosquatting, especially if the URL is being used in a phishing attack or other malicious context. To assess the risk of typosquatting in this URL, we can consider the following factors: * The domain name `cloudflare.com` is legitimate and associated with a well-known company. * The subdomain `cdn-cgi` is used by Cloudflare for various purposes, but its use in the URL could still be a potential indicator of typosquatting. * The rest of the URL appears to contain a unique identifier or token, which is consistent with the use of Cloudflare's security challenges. Based on these factors, we can assign a medium risk score of 7 to the URL. While the domain name is legitimate, the use of the `cdn-cgi` subdomain could still be a potential indicator of typosquatting, and it is recommended to verify the authenticity of the URL and ensure that it is associated with a trusted source."
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/hrk96/0x4AAAAAAAQ_ajLYJ-oSKSIN/auto/normal
URL: https://passwordreset.microsoftonline.com/?ru=https%3a%2f%2flogin.microsoftonline.com%2fcommon%2freprocess%3fctx%3drQQIARAAhZLNa9MAAMWbdq1b0dlNET0IEzzIJG2-0xR2SJt-pFuStU0amoOlaZM0bZqkbdK0uYseB8LAgRcPojt6Ei8Kehi7uPP8DwRFPMiObnoeXh7v8d7t_ZLLRBom0lAa2ow	{ "riskscore": 2, "reasons": "The JavaScript code provided is not malicious and is used for form submission. The URL provided is a legitimate Microsoft online page for password reset, with a complex query string that is typically used for redirection after a successful login. However, it is always recommended to verify the URL in the browser's address bar before entering any sensitive information." }"
//<![CDATA[ var theForm = document.forms['form1']; if (!theForm) { theForm = document.form1; } function __doPostBack(eventTarget, eventArgument) { if (!theForm.onsubmit \|\| (theForm.onsubmit() != false)) { theForm.__EVENTTARGET.value = eventTarget; theForm.__EVENTARGUMENT.value = eventArgument; theForm.submit(); } } //
URL: https://passwordreset.microsoftonline.com/?ru=https%3a%2f%2flogin.microsoftonline.com%2fcommon%2freprocess%3fctx%3drQQIARAAhZLNa9MAAMWbdq1b0dlNET0IEzzIJG2-0xR2SJt-pFuStU0amoOlaZM0bZqkbdK0uYseB8LAgRcPojt6Ei8Kehi7uPP8DwRFPMiObnoeXh7v8d7t_ZLLRBom0lAa2ow	```json { "riskscore": 1, "reasons": "The JavaScript code provided is not malicious, it is just creating an array of validators on the page. The URL provided is for a password reset page on Microsoft's online platform, which is a legitimate site. However, it is always important to verify the URL and ensure that it is the correct site before entering any sensitive information." } ```"
//<![CDATA[ var Page_Validators = new Array(document.getElementById("ContentPlaceholderMainContent_RequiredFieldValidatorUserIdentifier"), document.getElementById("ContentPlaceholderMainContent_RegularExpressionValidatorUserIdentifier"), document.getElementById("ContentPlaceholderMainContent_RegularExpressionNonOrgIDDomains")); //
URL: https://passwordreset.microsoftonline.com/?ru=https%3a%2f%2flogin.microsoftonline.com%2fcommon%2freprocess%3fctx%3drQQIARAAhZLNa9MAAMWbdq1b0dlNET0IEzzIJG2-0xR2SJt-pFuStU0amoOlaZM0bZqkbdK0uYseB8LAgRcPojt6Ei8Kehi7uPP8DwRFPMiObnoeXh7v8d7t_ZLLRBom0lAa2ow	```json { "riskscore": 0, "reasons": "The JavaScript code provided is not malicious. It is used for form validation to ensure that the email address entered is in the format user@contoso.onmicrosoft.com or user@contoso.com. The URL is also legitimate and points to the Microsoft Online password reset page. There are no phishing or malicious activities detected." } ```"
//<![CDATA[ var ContentPlaceholderMainContent_RequiredFieldValidatorUserIdentifier = document.all ? document.all["ContentPlaceholderMainContent_RequiredFieldValidatorUserIdentifier"] : document.getElementById("ContentPlaceholderMainContent_RequiredFieldValidatorUserIdentifier"); ContentPlaceholderMainContent_RequiredFieldValidatorUserIdentifier.controltovalidate = "ContentPlaceholderMainContent_TextBoxUserIdentifier"; ContentPlaceholderMainContent_RequiredFieldValidatorUserIdentifier.focusOnError = "t"; ContentPlaceholderMainContent_RequiredFieldValidatorUserIdentifier.errormessage = "Please type your email address in the format user@contoso.onmicrosoft.com or user@contoso.com"; ContentPlaceholderMainContent_RequiredFieldValidatorUserIdentifier.display = "Dynamic"; ContentPlaceholderMainContent_RequiredFieldValidatorUserIdentifier.evaluationfunction = "RequiredFieldValidatorEvaluateIsValid"; ContentPlaceholderMainContent_RequiredFieldValidatorUserIdentifier.initialvalue = ""; var ContentPlaceholderMainContent_RegularExpressionValidatorUserIdentifier = document.all ? document.all["ContentPlaceholderMainContent_RegularExpressionValidatorUserIdentifier"] : document.getElementById("ContentPlaceholderMainContent_RegularExpressionValidatorUserIdentifier"); ContentPlaceholderMainContent_RegularExpressionValidatorUserIdentifier.controltovalidate = "ContentPlaceholderMainContent_TextBoxUserIdentifier"; ContentPlaceholderMainContent_RegularExpressionValidatorUserIdentifier.focusOnError = "t"; ContentPlaceholderMainContent_RegularExpressionValidatorUserIdentifier.errormessage = "Please type your email address in the format user@contoso.onmicrosoft.com or user@contoso.com"; ContentPlaceholderMainContent_RegularExpressionValidatorUserIdentifier.display = "Dynamic"; ContentPlaceholderMainContent_RegularExpressionValidatorUserIdentifier.evaluationfunction = "RegularExpressionValidatorEvaluateIsValid"; ContentPlaceholderMainContent_RegularExpressionValidatorUserIdentifier.validationexpression = "^\\s[a-zA-Z0-9~;&#^\\\\!.\'_%-]+@[a-zA-Z0-9](?!.\\.\\..)[a-zA-Z0-9.-]\\.[a-zA-Z]{2,25}\\s$"; var ContentPlaceholderMainContent_RegularExpressionNonOrgIDDomains = document.all ? document.all["ContentPlaceholderMainContent_RegularExpressionNonOrgIDDomains"] : document.getElementById("ContentPlaceholderMainContent_RegularExpressionNonOrgIDDomains"); ContentPlaceholderMainContent_RegularExpressionNonOrgIDDomains.controltovalidate = "ContentPlaceholderMainContent_TextBoxUserIdentifier"; ContentPlaceholderMainContent_RegularExpressionNonOrgIDDomains.focusOnError = "t"; ContentPlaceholderMainContent_RegularExpressionNonOrgIDDomains.errormessage = "Microsoft Accounts or personal email addresses dont work here. Make sure you enter your work or school account (e.g. user@contoso.com). If you want to reset a Microsoft Account password, <a href=\"https://account.live.com/resetpassword.aspx\" >click here</a>."; ContentPlaceholderMainContent_RegularExpressionNonOrgIDDomains.display = "Dynamic"; ContentPlaceholderMainContent_RegularExpressionNonOrgIDDomains.evaluationfunction = "RegularExpressionValidatorEvaluateIsValid"; ContentPlaceholderMainContent_RegularExpressionNonOrgIDDomains.validationexpression = "^(?:(?!@gmail.com\|@hotmail.com\|@yahoo.com\|@aol.com\|@icloud.com\|@comcast.net\|@contoso.com\|@outlook.com\|@office.com\|@office365.com\|@microsoftonline.com\|@sharepoint.com\|@windows.com).)$\\r?\\n?"; //
URL: https://passwordreset.microsoftonline.com/?ru=https%3a%2f%2flogin.microsoftonline.com%2fcommon%2freprocess%3fctx%3drQQIARAAhZLNa9MAAMWbdq1b0dlNET0IEzzIJG2-0xR2SJt-pFuStU0amoOlaZM0bZqkbdK0uYseB8LAgRcPojt6Ei8Kehi7uPP8DwRFPMiObnoeXh7v8d7t_ZLLRBom0lAa2ow	{ "riskscore": 1, "reasons": "The code provided is relatively simple and does not contain any immediately obvious malicious behavior such as phishing or unauthorized data access. However, it is always important to thoroughly examine and test all code, and to verify the integrity of the URL. The URL provided appears to be a legitimate Microsoft online password reset page, but it should still be verified using secure protocols and trusted sources." }"
function pageLoad() { CheckWorkflowConsistency(); ShowPasswordPopup(); InitializePasswordStrengthMeterAndHelpContainerOnLoad(); repMapService.showRepMapServiceChallenge(); } var notifyAdministratorClicked = 0; function ButtonNextClick(sender) { if ($get('Buttons').style.display == 'none') { sender.disabled = 'true'; return false; } captchaError = $get('ContentPlaceholderMainContent_LabelCaptchaError'); SetDisplayStateNone(captchaError); // do client side validation if (typeof (Page_ClientValidate) == 'function') { if (Page_ClientValidate() == false) { // clear error strings that are set server side to show client side validation errors var userIdErrorLabel = $get('ContentPlaceholderMainContent_UserIdErrorLabel'); if (userIdErrorLabel) { userIdErrorLabel.style.display = 'none'; } var labelCaptchaError = $get('ContentPlaceholderMainContent_LabelCaptchaError'); if (labelCaptchaError) { labelCaptchaError.style.display = 'none'; } var labelSetPasswordErrorMessage = $get('ContentPlaceholderMainContent_LabelSetPasswordErrorMessage'); if (labelSetPasswordErrorMessage) { labelSetPasswordErrorMessage.style.display = 'none'; } return false; } } // hide buttons $get('Buttons').style.display = 'none'; } function ButtonCancelClick() { $get('Buttons').style.display = 'none'; } function ButtonContactAdministratorClick(button) { if (notifyAdministratorClicked != 0) { return false; } else { notifyAdministratorClicked = notifyAdministratorClicked + 1; } } function ButtonContactAdministrator_ClientClick(button) { var hiddenAnchor = $get('ContentPlaceholderMainContent_ContactAdmin_Hidden_Anchor'); if (hiddenAnchor && hiddenAnchor.click) { hiddenAnchor.click(); return false; } ButtonContactAdministratorClick(button); } // Toggles style.display of given element between 'none' and 'block' function ToggleDisplayState(elementId) { var element = $get(elementId); if (element) { if (element.style.display == 'none') { element.style.display = 'block'; } else { element.style.display = 'none'; } } } function FindAndSetDisplayState(elementId, displayState, ariaHidden) { var element = $get(elementId); if (element) { element.style.display = displayState; var tooltipLabel = $get('ContentPlaceholderMainContent_ViewNewPasswordInstructionsLabel'); tooltipLabel.setAttribute('aria-hidden', ariaHidden); } } // Changes style.display of given element to 'none' function SetDisplayStateNone(element) { if (element) { element.style.display = 'none'; } } function ShowPasswordPopup() { var popupControl= $find('PasswordPopupBehavior'); if(popupControl) popupControl.showPopup(); } function InitializePasswordStrengthMeterAndHelpContainerOnLoad() { var passwordTextBox = $get('ContentPlaceholderMainContent_TextBoxPassword1'); if (passwordTextBox) { var passwordStrengthControl = $get('ContentPlaceholderMainContent_StrengthMeterProgressBar'); if (passwordStrengthControl) { InitializePasswordStrengthMeter(); } else { FindAndSetDisplayState('HelpCalloutContainer', 'none', 'true'); } } } function HideUserIdErrorLabel() { var element = $get('ContentPlaceholderMainContent_UserIdErrorLabel'); if (element) element.style.display = 'none'; } var skipEmptyCheckO
URL: https://passwordreset.microsoftonline.com/?ru=https%3a%2f%2flogin.microsoftonline.com%2fcommon%2freprocess%3fctx%3drQQIARAAhZLNa9MAAMWbdq1b0dlNET0IEzzIJG2-0xR2SJt-pFuStU0amoOlaZM0bZqkbdK0uYseB8LAgRcPojt6Ei8Kehi7uPP8DwRFPMiObnoeXh7v8d7t_ZLLRBom0lAa2ow	{ "riskscore": 2, "reasons": "The provided JavaScript code is not malicious, it is a script from Microsoft's ASP.NET Web Forms framework used for managing partial-page updates. The URL seems to be a password reset link from Microsoft Online, but it's important to verify the URL's legitimacy by checking the certificate and ensuring it's not a phishing site. A risk score of 2 is given due to the need for caution when accessing the URL." }"
//<![CDATA[ Sys.WebForms.PageRequestManager._initialize('ctl00$ScriptManagerMain', 'form1', ['tctl00$UpdatePanelLogo','UpdatePanelLogo','tctl00$ContentPlaceholderMainContent$UpdatePanelMain','ContentPlaceholderMainContent_UpdatePanelMain'], [], [], 60, 'ctl00'); //
URL: https://passwordreset.microsoftonline.com/?ru=https%3a%2f%2flogin.microsoftonline.com%2fcommon%2freprocess%3fctx%3drQQIARAAhZLNa9MAAMWbdq1b0dlNET0IEzzIJG2-0xR2SJt-pFuStU0amoOlaZM0bZqkbdK0uYseB8LAgRcPojt6Ei8Kehi7uPP8DwRFPMiObnoeXh7v8d7t_ZLLRBom0lAa2ow	{ "riskscore": 1, "reasons": "The JavaScript code and URL provided do not appear to be malicious at first glance. The JavaScript code is defining an object with properties and methods for a captcha challenge system, and the URL is a password reset page for Microsoft Online. However, I cannot fully confirm their benign nature without further context, such as the surrounding HTML code and the behavior of the site. A risk score of 1 indicates a low risk, but I recommend further investigation if this is a critical system or if you notice any suspicious activity." }"
var repMapService = { _currentViewNameId: '#' + 'ContentPlaceholderMainContent_CurrentViewName', _challengeTypeVisual: 'Visual', _challengeTypeAudio: 'Audio', _challengeApiUrl: 'Default.aspx/GetCaptchaChallenge', _challengeApiMethod: 'POST', _challengeApiContentType: 'application/json; charset=utf-8', _challengeLoadingId: '#RepMapChallengeLoading', _audioIconId: '#' + 'ContentPlaceholderMainContent_RepMapChallengeTypeAudioIcon', _visualIconId: '#' + 'ContentPlaceholderMainContent_RepMapChallengeTypeVisualIcon', _repMapCaptchaRootContentId: '#' + 'ContentPlaceholderMainContent_RepMapCaptchaContent', _visualChallengeElementId: '#RepMapVisualChallenge', _audioChallengeElementId: '#RepMapAudioChallenge', _base64VisualPrefix: 'data:image/jpeg;base64, ', _base64AudioPrefix: 'data:audio/mp3;base64, ', _audioPlayControlId: '#RepMapAudioPlayControl', _challengeIdInputId: '#RepMapChallengeId', _challengeTypeInputId: '#RepMapChallengeType', _challengeAzureRegionInputId: '#RepMapChallengeAzureRegion', _getCaptchaErrorMsgId: '#GetCaptchaError', _toggleChallengeTypeControlId: '#toggleChallengeTypeControl', _toggleChallengeTypeControlTooltip: '#toggleChallengeTypeControl .tooltip', _currentChallenge: { challengeType: 'Visual', challengeId: '' }, toggleRepMapServiceChallengeType: function (clickEvent) { clickEvent.preventDefault(); // Preventing navigation to href="" var tooltipText = ''; if (this._currentChallenge.challengeType === this._challengeTypeVisual) { this._currentChallenge.challengeType = this._challengeTypeAudio; $(this._audioIconId).hide(); $(this._visualChallengeElementId).hide(); $(this._visualIconId).show(); tooltipText = "Use picture mode"; } else { this._currentChallenge.challengeType = this._challengeTypeVisual; $(this._audioIconId).show(); $(this._visualChallengeElementId).show(); $(this._visualIconId).hide(); $(this._audioPlayControlId).hide(); tooltipText = "Use audio mode"; } $(this._toggleChallengeTypeControlId).attr('aria-label', tooltipText); $(this._toggleChallengeTypeControlTooltip).text(tooltipText); $(this._visualChallengeElementId).attr("src", ''); $(this._audioChallengeElementId).attr("src", ''); this.reloadRepMapChallenge(); }, showRepMapServiceChallenge: function () { if ($(this._currentViewNameId).val() === 'ViewUserIdentifierVerification') { this.reloadRepMapChallenge(); } }, playAudioChallenge: function (clickEvent) { $(this._audioChallengeElementId)[0].play(); clickEvent && clickEvent.preventDefault && clickEvent.preventDefault(); }, reloadRepMapChallenge: function (clickEvent) { clickEvent && clickEvent.preventDefault && clickEvent.preventDefault(); // Preventing navigation to href="" $(this._audioPlayControlId).hide(); $(this._visualChallengeElementId).hide(); $(this._challengeLoadingId).show(); $(this._getCaptchaErrorMsgId).hide(); var self = this; $.ajax({ type: self._challengeApiMethod, url: self._challengeApiUrl, contentType: self._challengeApiContentType, data: JSON.stringify({ challengeType: self._currentChallenge.challengeType }), success: function (response) { var responseJson = JSON.parse(response.d); self._currentChallenge.challengeId = responseJson.ChallengeId; $(self._challengeIdInputId).val(responseJson.ChallengeId); $(self._challengeAzureRegionInputId).val(responseJson.AzureRegion); $(self._challengeTypeInputId).val(self._currentChallenge.challengeType); if (self._currentChallenge.challengeType === self._challengeTypeVisual) {
URL: https://passwordreset.microsoftonline.com/?ru=https%3a%2f%2flogin.microsoftonline.com%2fcommon%2freprocess%3fctx%3drQQIARAAhZLNa9MAAMWbdq1b0dlNET0IEzzIJG2-0xR2SJt-pFuStU0amoOlaZM0bZqkbdK0uYseB8LAgRcPojt6Ei8Kehi7uPP8DwRFPMiObnoeXh7v8d7t_ZLLRBom0lAa2ow	```json { "riskscore": 1, "reasons": "The provided JavaScript code and URL do not appear to be malicious at first glance. The code is using Microsoft's ASP.NET libraries for form validation and button handling, which is consistent with a legitimate Microsoft online page. The URL is also a Microsoft online page for password reset, which further supports its legitimacy. However, it is always important to verify the URL's SSL certificate and ensure that the page is being served over a secure connection (HTTPS) before entering any sensitive information." } ```"
//<![CDATA[ $addHandler(window.document.documentElement, 'mouseup', Button.MouseUp); Sys.Application.add_init(Button.ResizeButtons); var Page_ValidationActive = false; if (typeof(ValidatorOnLoad) == "function") { ValidatorOnLoad(); } function ValidatorOnSubmit() { if (Page_ValidationActive) { return ValidatorCommonOnSubmit(); } else { return true; } } WebForm_AutoFocus('ContentPlaceholderMainContent_TextBoxUserIdentifier'); document.getElementById('ContentPlaceholderMainContent_RequiredFieldValidatorUserIdentifier').dispose = function() { Array.remove(Page_Validators, document.getElementById('ContentPlaceholderMainContent_RequiredFieldValidatorUserIdentifier')); } document.getElementById('ContentPlaceholderMainContent_RegularExpressionValidatorUserIdentifier').dispose = function() { Array.remove(Page_Validators, document.getElementById('ContentPlaceholderMainContent_RegularExpressionValidatorUserIdentifier')); } document.getElementById('ContentPlaceholderMainContent_RegularExpressionNonOrgIDDomains').dispose = function() { Array.remove(Page_Validators, document.getElementById('ContentPlaceholderMainContent_RegularExpressionNonOrgIDDomains')); } Button.DefaultButton='ContentPlaceholderMainContent_ButtonNext';$addHandler(window.document.documentElement, 'keyup', Button.DefaultButtonKeyUpHandler);$addHandler(window.document.documentElement, 'keydown', Button.DefaultButtonKeyDownHandler);Button.AttachDefaultButtonHandlers();Sys.Application.add_init(function() { $create(Sys.UI._UpdateProgress, {"associatedUpdatePanelId":"ContentPlaceholderMainContent_UpdatePanelMain","displayAfter":0,"dynamicLayout":false}, null, null, $get("ContentPlaceholderMainContent_UpdateProgress1")); }); //
URL: https://passwordreset.microsoftonline.com/?ru=https%3a%2f%2flogin.microsoftonline.com%2fcommon%2freprocess%3fctx%3drQQIARAAhZLNa9MAAMWbdq1b0dlNET0IEzzIJG2-0xR2SJt-pFuStU0amoOlaZM0bZqkbdK0uYseB8LAgRcPojt6Ei8Kehi7uPP8DwRFPMiObnoeXh7v8d7t_ZLLRBom0lAa2ow	{ "riskscore": 1, "reasons": "The JavaScript code and URL provided appear to be legitimate. The code is using jQuery and AJAX to make requests to the server, which is a common practice in web development. The URL provided is for a Microsoft online service, which also appears legitimate. However, it is always important to verify the integrity of the code and URLs by checking their sources and ensuring they are from trusted parties. Additionally, the risk score of 1 indicates a low risk, but it is still important to exercise caution when dealing with any code or URLs from the internet." }"
var BANNER_LOGO_URL_KEY = "BannerLogoUrl"; var TENANT_BRAND_NAME_KEY = "TenantBrandName"; function SendCaptchaErrorToServer(result) { try { $.ajax({ type: "POST", url: "Default.aspx/ReportCaptchaResult", contentType: "application/json; charset=utf-8", dataType: "json", data: JSON.stringify({ captchaResult: result }), success: function (response) { }, error: function (response) { } }); } catch (error) { } } function UpdateTenantBrandingBannerLogo() { try { var orgIdTenantDomain = jQuery.trim($('#OrgIdTenantDomain').val()); var orgIdUserName = jQuery.trim($('#OrgIdUserName').val()); var NameCoexistenceAccountValue = jQuery.trim($('#NameCoexistenceAccount').val()); var localAccountRequest = false; if (NameCoexistenceAccountValue == "1") { localAccountRequest = true; } if (LogoHasBeenPreviouslyLoaded()) { UpdateLogo(localAccountRequest); } else if (orgIdTenantDomain.length > 0 \|\| orgIdUserName.length > 0) { $.ajax({ type: "POST", url: "Default.aspx/GetBrandingInfo", data: JSON.stringify({ tenantDomain: orgIdTenantDomain, userName: orgIdUserName, isLocalAccount: localAccountRequest }), contentType: "application/json; charset=utf-8", dataType: "json", success: function (response) { if (response.d && response.d.length > 0) { var tenantInfo = JSON.parse(response.d); if (tenantInfo.BannerLogoUrl && tenantInfo.TenantBrandName) { SetBannerLogoUrl(tenantInfo.BannerLogoUrl); SetTenantBrandName(tenantInfo.TenantBrandName); } else { SetDefaultTenantBrandNameAndBannerLogoUrl(); } UpdateLogo(localAccountRequest); } else { SetOrHideDefaultLogo(localAccountRequest); } }, error: function (response) { SetOrHideDefaultLogo(localAccountRequest); } }); } else { SetOrHideDefaultLogo(localAccountRequest); } } catch(error) { SetOrHideDefaultLogo(localAccountRequest); } } function LogoHasBeenPreviouslyLoaded() { return GetBannerLogoUrl().length > 0; } function SetOrHideDefaultLogo(isLocalAccountRequest) { SetDefaultTenantBrandNameAndBannerLogoUrl(); if (isLocalAccountRequest) { $("#HeaderImage").hide(); } else { UpdateLogo(isLocalAccountRequest); } } function UpdateLogo(isLocalAccountRequest) { if (isLocalAccountRequest) { $("#HeaderImage").attr("src", "images/wait_animation.gif"); } UpdateLogoTitle(); var logoUrl = GetBannerLogoUrl(); $("#HeaderImage").attr("src", logoUrl).show(); } function UpdateLogoTitle() { var tenantBrandName = GetTenantBrandName();
URL: https://passwordreset.microsoftonline.com/?ru=https%3a%2f%2flogin.microsoftonline.com%2fcommon%2freprocess%3fctx%3drQQIARAAhZLNa9MAAMWbdq1b0dlNET0IEzzIJG2-0xR2SJt-pFuStU0amoOlaZM0bZqkbdK0uYseB8LAgRcPojt6Ei8Kehi7uPP8DwRFPMiObnoeXh7v8d7t_ZLLRBom0lAa2owhaSh3	```json { "phishing_score": 2, "brands": "Microsoft", "phishing": false, "suspicious_domain": false, "has_loginform": true, "has_captcha": true, "setechniques": false, "reasons": "The URL 'https://passwordreset.microsoftonline.com/' is a legitimate domain owned by Microsoft for password resets. The image shows a typical Microsoft account recovery page, including a CAPTCHA, which is a common security feature. The design and layout are consistent with Microsoft's branding and user interface guidelines. The presence of a CAPTCHA and the use of HTTPS also indicate a legitimate site. There is no evidence of social engineering techniques such as urgency or fake offers. The domain matches the known legitimate domain for Microsoft account services." }

URL: https://www.office.com/	```json { "riskscore": 0, "reasons": "The provided JavaScript code and URL are not malicious. The JavaScript code is responsible for controlling the visibility of an element based on scroll position and the URL points to the official Microsoft Office website." } ```"
function showShyHeader(el) { const rect = el.getBoundingClientRect(); return (rect.bottom < 0) && (window.pageYOffset > (el.offsetTop + el.offsetHeight)); } function scrollShyHeader() { const personalizationSignIn = document.getElementById("hero-banner-sign-back-in-to-microsoft-365-link"); const defaultSignUp = document.getElementById("hero-banner-sign-in-microsoft-365-link"); const shyHeader = document.getElementsByClassName("shy-header-consumer")[0]; if ((window.scrollY > 200) && (!personalizationSignIn \|\| !elementInViewport(personalizationSignIn)) && (!defaultSignUp \|\| !elementInViewport(defaultSignUp))) { if (shyHeader.className.indexOf("visible") === -1) { shyHeader.className += " visible"; } } else { shyHeader.className = shyHeader.className.replace(" visible", ""); } } window.addEventListener("scroll", scrollShyHeader);
URL: https://www.office.com/	```json { "riskscore": 0, "reasons": "The provided JavaScript code and URL are not malicious. The JavaScript code is responsible for adjusting the visibility of an element based on scrolling and viewport positioning, while the URL points to a legitimate Microsoft Office website." } ```"
function elementInViewport(el) { var top = el.offsetTop; var left = el.offsetLeft; var width = el.offsetWidth; var height = el.offsetHeight; while (el.offsetParent) { el = el.offsetParent; top += el.offsetTop; left += el.offsetLeft; } return ( top < (window.pageYOffset + window.innerHeight) && left < (window.pageXOffset + window.innerWidth) && (top + height) > window.pageYOffset && (left + width) > window.pageXOffset ); } function scrollShyHeader() { const personalizationSignIn = document.getElementById("hero-banner-sign-back-in-to-microsoft-365-link"); const defaultSignUp = document.getElementById("hero-banner-sign-in-microsoft-365-link"); const shyHeader = document.getElementsByClassName("shy-header-commercial")[0]; if ((window.scrollY > 200) && (!personalizationSignIn \|\| !elementInViewport(personalizationSignIn)) && (!defaultSignUp \|\| !elementInViewport(defaultSignUp))) { if (shyHeader.className.indexOf("visible") === -1) { shyHeader.className += " visible"; } } else { shyHeader.className = shyHeader.className.replace(" visible", ""); } } window.addEventListener("scroll", scrollShyHeader);
URL: https://www.office.com/	```json { "riskscore": 0, "reasons": "The provided JavaScript code and URL are not malicious. The JavaScript code is responsible for adjusting the visibility of an element based on scrolling and viewport positioning, and the URL points to the official Microsoft Office website." } ```"
function elementInViewport(el) { var top = el.offsetTop; var left = el.offsetLeft; var width = el.offsetWidth; var height = el.offsetHeight; while (el.offsetParent) { el = el.offsetParent; top += el.offsetTop; left += el.offsetLeft; } return ( top < (window.pageYOffset + window.innerHeight) && left < (window.pageXOffset + window.innerWidth) && (top + height) > window.pageYOffset && (left + width) > window.pageXOffset ); } function scrollShyHeader() { const personalizationSignIn = document.getElementById("hero-banner-sign-back-in-to-microsoft-365-link"); const defaultSignUp = document.getElementById("hero-banner-sign-in-microsoft-365-link"); const shyHeader = document.getElementsByClassName("shy-header-edu")[0]; if ((window.scrollY > 200) && (!personalizationSignIn \|\| !elementInViewport(personalizationSignIn)) && (!defaultSignUp \|\| !elementInViewport(defaultSignUp))) { if (shyHeader.className.indexOf("visible") === -1) { shyHeader.className += " visible"; } } else { shyHeader.className = shyHeader.className.replace(" visible", ""); } } window.addEventListener("scroll", scrollShyHeader);
URL: https://www.office.com/	```json { "riskscore": 0, "reasons": "The JavaScript code provided is not malicious and only contains a function to hide an element with the class 'hero-section--mobile-banner' and an event listener to trigger the function when a button is clicked. The URL is a legitimate Microsoft Office website, making it highly likely that this is a safe and legitimate page." } ```"
function dismissBanner() { document.getElementsByClassName('hero-section--mobile-banner')[0].style.display = "none"; } var button = document.getElementById('hero-section--mobile-banner-dismiss-button'); if (button) { button.addEventListener('click', dismissBanner); }
URL: https://www.office.com/	```json { "riskscore": 1, "reasons": "The JavaScript code and URL in question present a low risk. The code is handling user sign-in and related functionality for a Microsoft Office web page. The URL points to the legitimate office.com domain. However, it is always important to verify the integrity of the code and the authenticity of the domain, especially in a production environment." } ```"
var appId = ''; var el = document.getElementById('unauthConfig'); var config = el && JSON.parse(el.textContent) \|\| {}; var signInUrl = config.loginUrl; if (false) { if (isSessionStorageAvailable && sessionStorage.getItem('DefaultSignInCalledBefore') !== 'true') { var viewType = 'NewUserView'; if (viewType !== "SignoutUserView") { var myConfigOptions = { msaConfig: { replyUri: 'https://www.office.com/', host: 'login.live.com' }, aadConfig: { replyUri: 'https://www.office.com/' , host: 'login.microsoftonline.com', appId: '4345a7b9-9a63-4910-a426-35363201d503' }, preferredIdp: AuthType.aad, enableConsoleLogging: false, msaFedEnabled: true }; DefaultSignInHandler.DefaultSignInAdapter.signIn(signInUrl, myConfigOptions, 500).then(function(loginUrl) { if (isSessionStorageAvailable) { sessionStorage.setItem('DefaultSignInCalledBefore', 'true'); } if (loginUrl) { window.location.href = loginUrl; } else { document.body.style.display = "block"; window.standaloneOteLogger && window.standaloneOteLogger.logPageView({ pageName: 'OfficeHome', pageType: viewType, isIntentional: true}); } }); } } } function setShellOptions(shellOptions) { if (window.msCommonShell) { window.msCommonShell.load(shellOptions); } else { window.onShellReadyToLoad = function () { window.onShellReadyToLoad = null; window.msCommonShell.load(shellOptions); } } } var SendMeControlSignInEvent = function() { unauth1dsAnalytics && unauth1dsAnalytics.isInitialized() && unauth1dsAnalytics.capturePageAction(document.getElementById('meControl'), { isAuto: false, behavior: oneDS.Behavior.SIGNIN, actionType: oneDS.ActionType.CLICKLEFT }); if (typeof StandaloneAriaLogger !== 'undefined' && typeof StandaloneAriaLogger.Logger !== 'undefined' && typeof StandaloneAriaLogger.Logger.LogUnauthClick !== 'undefined') { var viewType = 'NewUserView'; StandaloneAriaLogger.Logger.LogUnauthClick(viewType, 'meLnkSignin'); } window.standaloneOteLogger && window.standaloneOteLogger.logUnAuthUserAction({ id: 'meLnkSignin', area: 'MeControl', result: 'SignIn', target: 'Office', pageName: appId ? appId : 'OfficeHome', pageType: 'NewUserView' }); } function SetConsent() { var cookieConsentBannerNeeded = true; if (cookieConsentBannerNeeded) { var mscc = window.mscc; // Remove this SetConsent when WCP is 100% if (!window.WcpConsent && mscc && !mscc.hasConsent()) { mscc.setConsent(); } } } var shellOptions = { meControlOptions: { rpData: { aadInfo: { signInUrl: signInUrl, signOutUrl: 'https://login.microsoft.com/logout.srf' }, msaInfo: { meUrl: null }, preferredIdp: 'aad' }, events: { onEventLog: function(eventId) { switch (eventId) { case 'SignIn': SetConsent(); SendMeControlSignInEvent(); break; default: return; } } } } }; setShellOptions(shellOptions); if (window.history && window.history.replaceState) { config.pathAndQuery && window.history.replaceState(window.history.state \|\| {}, '', config.pathAndQuery); }
URL: https://www.office.com/	```json { "riskscore": 1, "reasons": "The JavaScript code and URL provided do not appear to be malicious at first glance. The code initializes a logging system for user interactions and analytics, and the URL is a legitimate Microsoft Office homepage. However, it is always important to thoroughly examine any code and URL for potential security vulnerabilities. A risk score of 1 indicates that there are no obvious red flags, but further investigation may still be warranted." } ```"
var unauth1dsAnalytics; $(function () { HomePage.init(); var cookieConsentBannerNeeded = true; var viewType = 'NewUserView'; function initializeLogging() { var el = document.getElementById('sharedClientStartupContext'); var sharedClientStartupContext = el && el.textContent && JSON.parse(el.textContent) \|\| {}; var unauthConfigEl = document.getElementById('unauthConfig'); var unauthConfig = unauthConfigEl && unauthConfigEl.textContent && JSON.parse(unauthConfigEl.textContent) \|\| {}; var analyticsConsentRequired = cookieConsentBannerNeeded && !unauthConfig.userConsentStatus.AnalyticsCookiesConsented; unauth1dsAnalytics = new oneDS.ApplicationInsights(); var unauth1dsAnalyticsConfigconfig = { instrumentationKey: "aa86c364bc9e4a5a94a6b232c110af26-72da2ec9-498a-44df-8cca-7fd88cf654c1-7527", channelConfiguration: { eventsLimitInMem: 50 }, propertyConfiguration: { env: "PROD" }, webAnalyticsConfiguration: { urlCollectQuery: false, autoCapture: { lineage: true, jsError: false }, coreData: { pageName: "UnauthOhp", market: "en-US" }, } }; unauth1dsAnalytics.initialize(unauth1dsAnalyticsConfigconfig, []); unauth1dsAnalytics.captureContentUpdate(); } initializeLogging(); // log OTEL PageView event if (true) { function initializeOtelLogging() { // TODO: We have to eventually move away from taking dependency on embedded config. var el = document.getElementById('sharedClientStartupContext'); var sharedClientStartupContext = el && el.textContent && JSON.parse(el.textContent) \|\| {}; var unauthConfigEl = document.getElementById('unauthConfig'); var unauthConfig = unauthConfigEl && unauthConfigEl.textContent && JSON.parse(unauthConfigEl.textContent) \|\| {}; var analyticsConsentRequired = cookieConsentBannerNeeded && !unauthConfig.userConsentStatus.AnalyticsCookiesConsented; var otelContext = { appName: sharedClientStartupContext.oTelAppName, appPlatform: sharedClientStartupContext.oTelAppPlatform, appWorkload: 'Web', // TODO: Replace the hardcoded value appWorkloadType: 'Web-Cosmic', bundleBuildDate: sharedClientStartupContext.buildDateUtc, bundleBuildId: sharedClientStartupContext.buildId, correlationId: sharedClientStartupContext.correlationId, deploymentEnvironment: sharedClientStartupContext.deploymentEnvironment, domainOrigin: sharedClientStartupContext.domainOrigin, eventCategoryConfig: { actionEnabled: sharedClientStartupContext.oTelClickEnabled, diagnosticEnabled: sharedClientStartupContext.oTelDiagnosticEnabled, errorEnabled: sharedClientStartupContext.oTelErrorEnabled, impressionEnabled: sharedClientStartupContext.oTelImpressionEnabled, pageViewEnabled: sharedClientStartupContext.oTelPageViewEnabled, perfEnabled: sharedClientStartupContext.oTelPerfEnabled, requestEnabled: sharedClientStartupContext.oTelRequestEnabled, featureEnabled: sharedClientStartupContext.oTelFeatureEnabled }, flights: sharedClientStartupContext.flights, isCorpNet: sharedClientStartupContext.corpNet, isTestTraffic: sharedClientStartupContext.testTraffic, oTelEnabled: sharedClientStartupContext.oTelEnabled, oTelAriaTenant: sharedClientStartupContext.oTelAriaTenant, oTelAriaNameSpace: sharedClientStartupContext.oTelNameSpace, sessionId: sharedClientStartupContext.sessionId, serverLocation: sharedClientStartupContext.geoName, requestOrigin: sharedClientStartupContext.requestOrigin, initialPageName: "" \|\| 'OfficeHome', initialPageType: viewType,
URL: https://www.office.com/	{ "riskscore": 1, "reasons": "The JavaScript code checks if session storage is available and if a specific item exists in it. If not, it sets the body's display style to block. This behavior is not inherently malicious, but it could be used for phishing or other malicious purposes. However, the URL provided is for a legitimate Microsoft Office website, which reduces the overall risk. The risk score is set to 1 due to the potential for misuse, but the actual risk is low given the context." }"
var isSessionStorageAvailable = (function() { try { return !!window['sessionStorage']; } catch (e) { return false; } })(); if (!false \|\| (isSessionStorageAvailable && sessionStorage.getItem('DefaultSignInCalledBefore') === 'true') \|\| 'NewUserView' === 'SignoutUserView') { document.body.style.display = "block"; }
URL: https://www.office.com/	```json { "riskscore": 1, "reasons": "The JavaScript code appears to be checking for the existence of a specific cookie ('3PAdsOptOut') and returning its value. This in itself is not malicious, but it could be used for tracking user behavior or serving targeted advertisements. The URL is for a legitimate site (office.com), but it is always important to verify that the connection is secure (look for 'https' in the URL) and that the site has not been compromised." } ```"
const globalPrivacyControlEnabled = navigator.globalPrivacyControl; const GPC_DataSharingOptIn = (globalPrivacyControlEnabled) ? false : checkThirdPartyAdsOptOutCookie(); function checkThirdPartyAdsOptOutCookie() { try { const ThirdPartyAdsOptOutCookieName = '3PAdsOptOut'; var cookieValue = getCookie(ThirdPartyAdsOptOutCookieName); return cookieValue != 1; } catch { return true; } } function getCookie(cookieName) { var cookieValue = document.cookie.match('(^\|;)\\s' + cookieName + '\\s=\\s*([^;]+)'); return (cookieValue) ? cookieValue[2] : ''; }

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report http://bs-nakagawa.com/PMxdv77xgwVSyGqqOWzi/bf5c0b42c4aa8a1c13d9113627555356/anJhZGtlQGdwYWxhYi5jb20=

Overview

General Information

Detection

Signatures

Classification

Process Tree

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Boot Survival

Mitre Att&ck Matrix

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

LLM Input / Output

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Chrome Cache Entry: 157

Chrome Cache Entry: 158

Chrome Cache Entry: 159

Chrome Cache Entry: 161

Chrome Cache Entry: 162

Chrome Cache Entry: 163

Chrome Cache Entry: 164

Chrome Cache Entry: 165

Chrome Cache Entry: 166

Chrome Cache Entry: 167

Chrome Cache Entry: 168

Chrome Cache Entry: 169

Chrome Cache Entry: 170

Chrome Cache Entry: 172

Chrome Cache Entry: 173

Chrome Cache Entry: 174

Chrome Cache Entry: 175

Chrome Cache Entry: 176

Chrome Cache Entry: 177

Chrome Cache Entry: 178

Chrome Cache Entry: 179

Chrome Cache Entry: 180

Chrome Cache Entry: 181

Chrome Cache Entry: 182

Chrome Cache Entry: 184

Chrome Cache Entry: 185

Chrome Cache Entry: 186

Chrome Cache Entry: 187

Chrome Cache Entry: 189

Chrome Cache Entry: 190

Chrome Cache Entry: 192

Chrome Cache Entry: 193

Windows Analysis Report
http://bs-nakagawa.com/PMxdv77xgwVSyGqqOWzi/bf5c0b42c4aa8a1c13d9113627555356/anJhZGtlQGdwYWxhYi5jb20=