Edit tour

Windows Analysis Report
http://account.hrblock.com

Overview

General Information

Sample URL:	http://account.hrblock.com
Analysis ID:	1635212
Infos:

Detection

Score:	48
Range:	0 - 100
Confidence:	100%

Signatures

Yara detected Powershell download and execute

Creates files inside the system directory

Deletes files inside the Windows folder

HTML body with high number of embedded SVGs detected

Classification

Process Tree

System is w10x64

chrome.exe (PID: 1696 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 6184 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2220,i,11535768605362149989,4949736296519859369,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2288 /prefetch:3 MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 5568 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://account.hrblock.com" MD5: E81F54E6C1129887AEA47E7D092680BF)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
dropped/chromecache_200	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
dropped/chromecache_253	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security

HTTP traffic detected: POST /rest/v1/delivery?client=hrblock&sessionId=d77d270a227b432ab161c99c9166215a&version=2.10.0 HTTP/1.1Host: hrblock.tt.omtrdc.netConnection: keep-aliveContent-Length: 1180sec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"Content-Type: text/plainsec-ch-ua-mobile: ?0Accept: */*Origin: https://account.hrblock.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeReferer: https://account.hrblock.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9

Source: global traffic

HTTP traffic detected: HTTP/1.1 403 ForbiddenMime-Version: 1.0Content-Type: text/htmlContent-Length: 449Cache-Control: max-age=60Expires: Tue, 11 Mar 2025 12:52:01 GMTDate: Tue, 11 Mar 2025 12:51:01 GMTConnection: closeStrict-Transport-Security: max-age=31536000 ; includeSubDomains

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.222
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.97.171
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.186.35
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.97.171
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.97.171
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.97.171
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.186.35
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: account.hrblock.com
Source: global traffic	DNS traffic detected: DNS query: cdn.decibelinsight.net
Source: global traffic	DNS traffic detected: DNS query: collection.decibelinsight.net
Source: global traffic	DNS traffic detected: DNS query: nebula-cdn.kampyle.com
Source: global traffic	DNS traffic detected: DNS query: assets.adobedtm.com
Source: global traffic	DNS traffic detected: DNS query: dpm.demdex.net
Source: global traffic	DNS traffic detected: DNS query: mp.hrblock.com
Source: global traffic	DNS traffic detected: DNS query: cdn.cookielaw.org
Source: global traffic	DNS traffic detected: DNS query: hrblock.tt.omtrdc.net
Source: global traffic	DNS traffic detected: DNS query: app.launchdarkly.com
Source: global traffic	DNS traffic detected: DNS query: smetrics.hrblock.com
Source: global traffic	DNS traffic detected: DNS query: geolocation.onetrust.com
Source: global traffic	DNS traffic detected: DNS query: clientstream.launchdarkly.com
Source: global traffic	DNS traffic detected: DNS query: events.launchdarkly.com
Source: global traffic	DNS traffic detected: DNS query: www.hrblock.com
Source: global traffic	DNS traffic detected: DNS query: dc.services.visualstudio.com
Source: global traffic	DNS traffic detected: DNS query: hrbent.scene7.com
Source: global traffic	DNS traffic detected: DNS query: rum.hlx.page
Source: global traffic	DNS traffic detected: DNS query: privacy-policy.truste.com
Source: global traffic	DNS traffic detected: DNS query: ds-aksb-a.akamaihd.net
Source: global traffic	DNS traffic detected: DNS query: www.hrblock.comhttps
Source: global traffic	DNS traffic detected: DNS query: zjngh6ej.micpn.com

Source: chromecache_146.3.dr	String found in binary or memory: http://code.google.com/p/episodes/
Source: chromecache_279.3.dr, chromecache_297.3.dr	String found in binary or memory: http://code.google.com/p/google-diff-match-patch/
Source: chromecache_300.3.dr	String found in binary or memory: http://jquery.com/
Source: chromecache_300.3.dr, chromecache_279.3.dr, chromecache_297.3.dr	String found in binary or memory: http://jquery.org/license
Source: chromecache_300.3.dr, chromecache_279.3.dr, chromecache_297.3.dr	String found in binary or memory: http://sizzlejs.com/
Source: chromecache_252.3.dr, chromecache_279.3.dr, chromecache_146.3.dr, chromecache_297.3.dr	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: chromecache_235.3.dr, chromecache_223.3.dr	String found in binary or memory: https://account-qa.hrblock.com/
Source: chromecache_235.3.dr, chromecache_223.3.dr	String found in binary or memory: https://account-qa.hrblock.com/#/myb-dashboard
Source: chromecache_213.3.dr	String found in binary or memory: https://account.hrblock.com
Source: chromecache_213.3.dr	String found in binary or memory: https://account.hrblock.com/
Source: chromecache_185.3.dr, chromecache_213.3.dr	String found in binary or memory: https://account.hrblock.com/SMMicroApp/hrb-secure-messaging.min.js
Source: chromecache_185.3.dr, chromecache_213.3.dr	String found in binary or memory: https://account.hrblock.com/ciam-cardproof/ciam-cardproof.js
Source: chromecache_185.3.dr, chromecache_213.3.dr	String found in binary or memory: https://account.hrblock.com/ciam-login/ciam-login.js
Source: chromecache_185.3.dr, chromecache_213.3.dr	String found in binary or memory: https://account.hrblock.com/ciam-manage-account/ma-custom-ui.js
Source: chromecache_185.3.dr, chromecache_213.3.dr	String found in binary or memory: https://account.hrblock.com/ciam-postauth/ciam-postauth.js
Source: chromecache_185.3.dr, chromecache_213.3.dr	String found in binary or memory: https://account.hrblock.com/ciam-sidp/ciam-sidp.js
Source: chromecache_185.3.dr, chromecache_213.3.dr	String found in binary or memory: https://account.hrblock.com/cpc-ui/main.min.js
Source: chromecache_185.3.dr, chromecache_213.3.dr	String found in binary or memory: https://account.hrblock.com/ddo-v2/ddo.js
Source: chromecache_185.3.dr, chromecache_213.3.dr	String found in binary or memory: https://account.hrblock.com/ddo/ddo.js
Source: chromecache_185.3.dr, chromecache_213.3.dr	String found in binary or memory: https://account.hrblock.com/eal-online-client/main.js
Source: chromecache_185.3.dr, chromecache_213.3.dr	String found in binary or memory: https://account.hrblock.com/eal-servicing-client/main.js
Source: chromecache_185.3.dr, chromecache_213.3.dr	String found in binary or memory: https://account.hrblock.com/gateway/videocollab
Source: chromecache_273.3.dr	String found in binary or memory: https://account.hrblock.com/loginCodeEx
Source: chromecache_185.3.dr, chromecache_213.3.dr	String found in binary or memory: https://account.hrblock.com/middle-flow-v2/middle-flow.js
Source: chromecache_185.3.dr, chromecache_213.3.dr	String found in binary or memory: https://account.hrblock.com/middle-flow/middle-flow.js
Source: chromecache_185.3.dr, chromecache_213.3.dr	String found in binary or memory: https://account.hrblock.com/to-do-app/hrb-todo-list.min.js
Source: chromecache_185.3.dr, chromecache_213.3.dr	String found in binary or memory: https://account.hrblock.com/virtual-return/virtual-return.js
Source: chromecache_225.3.dr, chromecache_273.3.dr	String found in binary or memory: https://api-nd.hrblock.com/
Source: chromecache_206.3.dr	String found in binary or memory: https://api.bazaarvoice.com/data
Source: chromecache_225.3.dr, chromecache_273.3.dr	String found in binary or memory: https://apps.apple.com/us/app/myblock/id490111274
Source: chromecache_160.3.dr	String found in binary or memory: https://assets.adobedtm.com/extensions/EP31dbb9c60e404ba1aa6e746d49be6f29/AppMeasurement.js
Source: chromecache_148.3.dr	String found in binary or memory: https://assets.adobedtm.com/f6306126288b/e9e814d2f623/adb45bc06700/RC6e5a7649f9f64fb29a2f2afc614f64e
Source: chromecache_238.3.dr	String found in binary or memory: https://assets.adobedtm.com/f6306126288b/e9e814d2f623/adb45bc06700/RCa57ac008c5ba44028e35f01d0c6ab5b
Source: chromecache_171.3.dr	String found in binary or memory: https://assets.adobedtm.com/f6306126288b/e9e814d2f623/adb45bc06700/RCa9391388963f436082bae5d120b20c9
Source: chromecache_255.3.dr, chromecache_141.3.dr	String found in binary or memory: https://assets.adobedtm.com/launch-ENf8b881eaea0c427ab85c67d659962b81.js
Source: chromecache_298.3.dr, chromecache_287.3.dr	String found in binary or memory: https://cdn.cookielaw.org/vendorlist/googleData.json
Source: chromecache_298.3.dr, chromecache_287.3.dr	String found in binary or memory: https://cdn.cookielaw.org/vendorlist/iab2Data.json
Source: chromecache_298.3.dr, chromecache_287.3.dr	String found in binary or memory: https://cdn.cookielaw.org/vendorlist/iab2V2Data.json
Source: chromecache_298.3.dr, chromecache_287.3.dr	String found in binary or memory: https://cdn.cookielaw.org/vendorlist/iabData.json
Source: chromecache_185.3.dr, chromecache_213.3.dr	String found in binary or memory: https://clientservices.hrblock.com/video-app/hrb-video-collaboration-client.js
Source: chromecache_185.3.dr, chromecache_213.3.dr	String found in binary or memory: https://clientservices.hrblock.com/video-app/index-video-client.html
Source: chromecache_298.3.dr, chromecache_287.3.dr	String found in binary or memory: https://cookies-data.onetrust.io/bannersdk/v1/domaingroupcheck
Source: chromecache_225.3.dr, chromecache_273.3.dr	String found in binary or memory: https://dir.dev.hrblock.proofidcloud.com
Source: chromecache_225.3.dr, chromecache_273.3.dr	String found in binary or memory: https://diyo-dv.hrblock.com
Source: chromecache_185.3.dr, chromecache_213.3.dr	String found in binary or memory: https://emeraldcardonline.hrblock.com/sso
Source: chromecache_298.3.dr, chromecache_287.3.dr	String found in binary or memory: https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location
Source: chromecache_185.3.dr, chromecache_213.3.dr	String found in binary or memory: https://idp.hrblock.com/idp/Authn/TIDSettings.html?tiIOSStatus=
Source: chromecache_185.3.dr, chromecache_213.3.dr	String found in binary or memory: https://imc2-staging.csid.co/federatedauth
Source: chromecache_185.3.dr, chromecache_213.3.dr	String found in binary or memory: https://login-api.a3d0dvcimase01t.appserviceenvironment.net/ciam/login/api/logout?ReturnUri=https://
Source: chromecache_225.3.dr, chromecache_273.3.dr	String found in binary or memory: https://login.hrblock.com
Source: chromecache_206.3.dr	String found in binary or memory: https://login.taxes.hrblock.com/
Source: chromecache_273.3.dr	String found in binary or memory: https://login.taxes.hrblock.com/HRBlock/login/LoginRegistration.hrbx
Source: chromecache_185.3.dr, chromecache_213.3.dr	String found in binary or memory: https://login.taxes.hrblock.com/sso
Source: chromecache_185.3.dr, chromecache_213.3.dr	String found in binary or memory: https://login.taxes.hrblock.com/sso?TaxType=TCD&TaxYear=2024
Source: chromecache_225.3.dr, chromecache_273.3.dr	String found in binary or memory: https://login.taxesp.hrblock.com/HRBlock/login/LoginRegistration.hrbx
Source: chromecache_273.3.dr	String found in binary or memory: https://loginapp.hrblock.com
Source: chromecache_206.3.dr	String found in binary or memory: https://loginrouter.hrblock.com/
Source: chromecache_185.3.dr, chromecache_213.3.dr	String found in binary or memory: https://myemeraldonline.hrblock.com/
Source: chromecache_185.3.dr, chromecache_213.3.dr	String found in binary or memory: https://nebula-cdn.kampyle.com/direct/form.html?region=prodUsOregon&websiteId=196413&formId=31972
Source: chromecache_225.3.dr, chromecache_273.3.dr	String found in binary or memory: https://play.google.com/store/apps/details?id=com.hrblock.blockmobile&hl=en&gl=US&pli=1
Source: chromecache_252.3.dr	String found in binary or memory: https://rum.hlx.page
Source: chromecache_225.3.dr, chromecache_273.3.dr	String found in binary or memory: https://sai-client.hrblock.com/login
Source: chromecache_278.3.dr	String found in binary or memory: https://static.cloud.coveo.com/atomic/v2/atomic.esm.js
Source: chromecache_206.3.dr	String found in binary or memory: https://stg.api.bazaarvoice.com/data
Source: chromecache_206.3.dr	String found in binary or memory: https://store.hrblock.com/
Source: chromecache_248.3.dr, chromecache_225.3.dr, chromecache_185.3.dr, chromecache_273.3.dr, chromecache_213.3.dr	String found in binary or memory: https://www.hrblock.com/
Source: chromecache_185.3.dr, chromecache_213.3.dr	String found in binary or memory: https://www.hrblock.com/tax-center/support/
Source: chromecache_185.3.dr, chromecache_213.3.dr	String found in binary or memory: https://www.hrblock.com/tax-offices/make-appointment/?app_method=GENERAL_TAX_PREP_METHOD
Source: chromecache_279.3.dr, chromecache_297.3.dr	String found in binary or memory: https://www.medallia.com/

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2220,i,11535768605362149989,4949736296519859369,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2288 /prefetch:3
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://account.hrblock.com"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2220,i,11535768605362149989,4949736296519859369,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2288 /prefetch:3	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Yara match	File source: dropped/chromecache_200, type: DROPPED
Source: Yara match	File source: dropped/chromecache_253, type: DROPPED

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	4 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 File Deletion	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	5 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Source	Detection	Scanner	Label
https://idp.hrblock.com/idp/Authn/TIDSettings.html?tiIOSStatus=	0%	Avira URL Cloud	safe
https://login.taxesp.hrblock.com/HRBlock/login/LoginRegistration.hrbx	0%	Avira URL Cloud	safe
https://dir.dev.hrblock.proofidcloud.com	0%	Avira URL Cloud	safe
https://login.taxes.hrblock.com/HRBlock/login/LoginRegistration.hrbx	0%	Avira URL Cloud	safe
https://emeraldcardonline.hrblock.com/sso	0%	Avira URL Cloud	safe
https://account-qa.hrblock.com/#/myb-dashboard	0%	Avira URL Cloud	safe
https://clientservices.hrblock.com/video-app/index-video-client.html	0%	Avira URL Cloud	safe

Name	IP	Active	Malicious	Reputation
account.hrblock.com	20.106.29.205	true	false	high
n.sni.global.fastly.net	151.101.129.91	true	false	high
j.shared.global.fastly.net	151.101.193.175	true	false	high
a1967.dscr.akamai.net	2.22.242.91	true	false	high
e4381.a.akamaiedge.net	23.196.247.193	true	false	high
clientstream-ga.launchdarkly.com	3.33.235.18	true	false	high
events.launchdarkly.com	3.228.204.222	true	false	high
d2pj9rkatqbt38.cloudfront.net	52.222.236.123	true	false	unknown
collection.decibelinsight.net	130.61.120.2	true	false	high
adobetarget.data.adobedc.net	66.235.152.225	true	false	high
mp.hrblock.com	15.197.170.101	true	false	high
a1910.dscq.akamai.net	95.101.54.106	true	false	high
e7808.dscg.akamaiedge.net	2.19.105.89	true	false	high
zjngh6ej.micpn.com	13.33.187.78	true	false	high
www.google.com	142.250.185.132	true	false	high
gig-ai-g-prod-westeurope-5-app-v4-tag.westeurope.cloudapp.azure.com	20.50.88.245	true	false	high
dcs-public-edge-irl1-150041215.eu-west-1.elb.amazonaws.com	63.35.2.123	true	false	high
hrblock.com.ssl.d1.sc.omtrdc.net	63.140.62.27	true	false	high
cdn.cookielaw.org	104.18.86.42	true	false	high
c3.shared.global.fastly.net	151.101.194.217	true	false	high
geolocation.onetrust.com	104.18.32.137	true	false	high
cdn.decibelinsight.net	130.61.120.2	true	false	high
clientstream.launchdarkly.com	unknown	unknown	false	high
rum.hlx.page	unknown	unknown	false	high
app.launchdarkly.com	unknown	unknown	false	high
nebula-cdn.kampyle.com	unknown	unknown	false	high
hrblock.tt.omtrdc.net	unknown	unknown	false	high
assets.adobedtm.com	unknown	unknown	false	high
smetrics.hrblock.com	unknown	unknown	false	high
www.hrblock.com	unknown	unknown	false	high
ds-aksb-a.akamaihd.net	unknown	unknown	false	high
hrbent.scene7.com	unknown	unknown	false	high
dc.services.visualstudio.com	unknown	unknown	false	high
www.hrblock.comhttps	unknown	unknown	false	unknown
dpm.demdex.net	unknown	unknown	false	high
privacy-policy.truste.com	unknown	unknown	false	high

Name	Malicious	Reputation
https://rum.hlx.page/.rum/@adobe/helix-rum-js@%5E2/dist/rum-standalone.js	false	high
https://www.hrblock.com/etc.clientlibs/reimagine/clientlibs/clientlib-page.min.js	false	high
https://collection.decibelinsight.net/i/13948/da/?type=multi&wid=332429&sid=DCC20EDF8E38AE8BF93FAA13A1D339B622&jspsf=1&pvid=1741697469320&dnt=1&dc=5&dv=1&dl=843&retryCode=socketNotConnected	false	high
https://hrbent.scene7.com/s7viewers/html5/js/FlyoutViewer.js	false	high
https://assets.adobedtm.com/f6306126288b/e9e814d2f623/launch-ENf8b881eaea0c427ab85c67d659962b81.min.js	false	high
https://account.hrblock.com/myblock-home/4786.cd97e42432bf1ae1.js	false	high
https://www.hrblock.com/etc.clientlibs/reimagine/components/structure/footer/clientlib.min.css	false	high
https://www.hrblock.com/libs/dam/components/scene7/dynamicmedia/clientlibs/dynamicmedia.min.js	false	high
https://account.hrblock.com/favicon.ico	false	high
https://collection.decibelinsight.net/i/13948/da/?type=multi&wid=332429&sid=DCC20EDF8E38AE8BF93FAA13A1D339B622&jspsf=1&pvid=1741697469320&dnt=1&dc=16&dv=1&dl=270	false	high
https://account.hrblock.com/gateway/dashboard/keepsessionalive	false	high
https://www.hrblock.com/etc.clientlibs/reimagine/components/content/disclaimer/clientlibs.min.js	false	high
https://hrbent.scene7.com/is/content/hrblock/hrb-navigation-finances-tab-spruce-80x80	false	high
https://account.hrblock.com/myblock-home/3835.8279f5e1cf85c2b7.js	false	high
https://www.hrblock.com/etc.clientlibs/reimagine/clientlibs/clientlib-global.min.js	false	high
https://account.hrblock.com/myblock-home/main.9f8ba5c2870e72f9.js	false	high
https://hrbent.scene7.com/is/image/hrblock/hrb-image-tax-pro-michael-o-1200x780?fmt=png-alpha&op_sharpen=1&wid=1200	false	high
https://hrbent.scene7.com/s7viewers/html5/js/BasicZoomViewer.js	false	high
https://collection.decibelinsight.net/i/13948/da/?type=html&wid=332429&sid=DCC20EDF8E38AE8BF93FAA13A1D339B622&jspsf=1&pvid=1741697469320&dnt=1&dc=14&dv=1&dl=156396&retryCode=socketNotConnected	false	high
https://collection.decibelinsight.net/i/13948/332429/c.json	false	high
https://www.hrblock.com/etc.clientlibs/clientlibs/granite/jquery.min.js	false	high
https://www.hrblock.com/content/dam/dev/angular-tools/tools-loader.min.js	false	high
https://account.hrblock.com/ciam-login/ciam-login.js?20250123093811.1	false	high
https://account.hrblock.com/ciam-login/ver.json?3488807897	false	high
https://collection.decibelinsight.net/i/13948/da/?type=multi&wid=332429&sid=DCC20EDF8E38AE8BF93FAA13A1D339B622&jspsf=1&pvid=1741697469320&dnt=1&dc=9&dv=1&dl=197&retryCode=socketNotConnected	false	high
https://mp.hrblock.com/c-sdk/MPycv6y2whnx633ixibt0ux.js	false	high
https://collection.decibelinsight.net/i/13948/da/?type=multi&wid=332429&sid=DCC20EDF8E38AE8BF93FAA13A1D339B622&jspsf=1&pvid=1741697469320&dnt=1&dc=2&dv=1&dl=990&retryCode=socketNotConnected	false	high
https://cdn.cookielaw.org/scripttemplates/202309.1.0/otBannerSdk.js	false	high
https://events.launchdarkly.com/events/diagnostic/5de9562519189e082d215096	false	high
https://collection.decibelinsight.net/i/13948/ws/	false	high
https://www.hrblock.com/etc.clientlibs/reimagine/clientlibs/clientlib-page.min.css	false	high
https://hrbent.scene7.com/is/content/hrblock/hrb-illustration-from-home-92x70	false	high
https://hrbent.scene7.com/s7viewers/html5/js/VideoViewer.js	false	high
https://clientstream.launchdarkly.com/eval/5de9562519189e082d215096/eyJrZXkiOiJkZWZhdWx0bXlidXNlciIsImZpcnN0TmFtZSI6IkRlZmF1bHQiLCJsYXN0TmFtZSI6IlVzZXIifQ	false	high
https://collection.decibelinsight.net/i/13948/332429/di.js	false	high
https://cdn.cookielaw.org/scripttemplates/otSDKStub.js	false	high
https://cdn.decibelinsight.net/i/13948/1596495/di.js	false	high
https://www.hrblock.com/etc.clientlibs/reimagine/clientlibs/clientlib-graphik-fonts-init/resources/fonts/Graphik-Medium.woff2	false	high
https://nebula-cdn.kampyle.com/wu/196413/onsite/embed.js	false	high
https://www.hrblock.com/etc.clientlibs/reimagine/components/content/chiclet/clientlib.min.js	false	high
https://account.hrblock.com/	false	high
https://hrbent.scene7.com/is/content/hrblock/hrb-illustration-spruce-app-92x70	false	high
https://collection.decibelinsight.net/i/13948/da/?type=samplingStatus&wid=1596495&sid=DCC20EDF8E38AE8BF93FAA13A1D339B622&jspsf=1&pvid=1741697426129&dnt=1&dc=5&dv=1&dl=77&retryCode=socketNotConnected	false	high
https://hrbent.scene7.com/is/content/hrblock/hrb-illustration-easy-switching-v2-113x113	false	high
https://hrbent.scene7.com/is/content/hrblock/hrb-illustration-in-office-92x70	false	high
https://hrbent.scene7.com/s7viewers/html5/js/MixedMediaViewer.js	false	high
https://collection.decibelinsight.net/i/13948/da/?type=page&wid=1596495&sid=DCC20EDF8E38AE8BF93FAA13A1D339B622&jspsf=1&pvid=1741697426129&dnt=1&dc=1&dv=1&dl=401&retryCode=socketNotConnected	false	high
https://smetrics.hrblock.com/id?d_visid_ver=5.5.0&d_fieldgroup=A&mcorgid=A78D3BC75245AD7C0A490D4D%40AdobeOrg&mid=19798893676898303502754158384987142623&ts=1741697408653	false	high
https://account.hrblock.com/myblock-home/common-scripts.fc7986292cc83cf8.js	false	high
https://cdn.cookielaw.org/consent/68d1a37f-2d10-4455-8ba9-25a43e6967b1/81767f6e-a7e2-43dc-9b9c-351bf720bc22/en.json	false	high
https://account.hrblock.com/myblock-home/6704.83a4ad3b8b4183bd.js	false	high
https://assets.adobedtm.com/extensions/EP31dbb9c60e404ba1aa6e746d49be6f29/AppMeasurement.min.js	false	high
https://account.hrblock.com/myblock-home/4961.4280f0bf21cceccd.js	false	high
https://collection.decibelinsight.net/i/13948/1596495/c.json	false	high
https://assets.adobedtm.com/f6306126288b/e9e814d2f623/adb45bc06700/RC6e5a7649f9f64fb29a2f2afc614f64eb-source.min.js	false	high
https://dpm.demdex.net/id?d_visid_ver=5.5.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=A78D3BC75245AD7C0A490D4D%40AdobeOrg&d_nsid=0&ts=1741697403593	false	high
https://hrbent.scene7.com/is/content/hrblock/hrb-my-block-qr-code-assisted-128x128	false	high
https://www.hrblock.com/etc.clientlibs/reimagine/clientlibs/clientlib-global.min.css	false	high
https://collection.decibelinsight.net/i/13948/da/?type=multi&wid=332429&sid=DCC20EDF8E38AE8BF93FAA13A1D339B622&jspsf=1&pvid=1741697469320&dnt=1&dc=6&dv=1&dl=130&retryCode=socketNotConnected	false	high
https://account.hrblock.com/ciam-login/assets/config/config.release.json?1741697422697	false	high
https://collection.decibelinsight.net/i/13948/da/?type=multi&wid=332429&sid=DCC20EDF8E38AE8BF93FAA13A1D339B622&jspsf=1&pvid=1741697469320&dnt=1&dc=11&dv=1&dl=163&retryCode=socketNotConnected	false	high
https://www.hrblock.com/libs/cq/i18n/dict.en_us.json	false	high
https://hrbent.scene7.com/s7viewers/html5/js/SpinViewer.js	false	high
https://www.hrblock.com/etc.clientlibs/reimagine/components/content/chiclet/clientlib.min.css	false	high
https://hrbent.scene7.com/is/content/hrblock/hrb-illustration-navigation-diy-80x801	false	high
https://hrbent.scene7.com/is/content/hrblock/hrb-illustration-navigation-payroll-80x80	false	high
https://account.hrblock.com/myblock-home/301.a099eaf0d022b713.js	false	high
https://www.hrblock.com/etc.clientlibs/reimagine/clientlibs/clientlib-dependencies.min.js	false	high
https://account.hrblock.com/myblock-home/4385.d735130aaf2c9107.js	false	high
https://cdn.cookielaw.org/scripttemplates/202309.1.0/assets/otFlat.json	false	high
https://cdn.cookielaw.org/scripttemplates/202309.1.0/assets/otCommonStyles.css	false	high
https://assets.adobedtm.com/f6306126288b/e9e814d2f623/adb45bc06700/RCa57ac008c5ba44028e35f01d0c6ab5bf-source.min.js	false	high
https://www.hrblock.com/etc.clientlibs/reimagine/components/content/herofullwidthcomponent/clientlib.min.js	false	high
https://assets.adobedtm.com/launch-ENf8b881eaea0c427ab85c67d659962b81.min.js	false	high

Name	Source	Malicious	Antivirus Detection	Reputation
https://account.hrblock.com/ciam-manage-account/ma-custom-ui.js	chromecache_185.3.dr, chromecache_213.3.dr	false		high
https://dir.dev.hrblock.proofidcloud.com	chromecache_225.3.dr, chromecache_273.3.dr	false	Avira URL Cloud: safe	unknown
https://www.medallia.com/	chromecache_279.3.dr, chromecache_297.3.dr	false		high
https://login.taxesp.hrblock.com/HRBlock/login/LoginRegistration.hrbx	chromecache_225.3.dr, chromecache_273.3.dr	false	Avira URL Cloud: safe	unknown
https://account.hrblock.com/eal-servicing-client/main.js	chromecache_185.3.dr, chromecache_213.3.dr	false		high
https://account.hrblock.com/to-do-app/hrb-todo-list.min.js	chromecache_185.3.dr, chromecache_213.3.dr	false		high
https://login.hrblock.com	chromecache_225.3.dr, chromecache_273.3.dr	false		high
https://account.hrblock.com/eal-online-client/main.js	chromecache_185.3.dr, chromecache_213.3.dr	false		high
https://account.hrblock.com/ciam-cardproof/ciam-cardproof.js	chromecache_185.3.dr, chromecache_213.3.dr	false		high
https://emeraldcardonline.hrblock.com/sso	chromecache_185.3.dr, chromecache_213.3.dr	false	Avira URL Cloud: safe	unknown
https://api.bazaarvoice.com/data	chromecache_206.3.dr	false		high
https://idp.hrblock.com/idp/Authn/TIDSettings.html?tiIOSStatus=	chromecache_185.3.dr, chromecache_213.3.dr	false	Avira URL Cloud: safe	unknown
http://code.google.com/p/episodes/	chromecache_146.3.dr	false		high
https://account.hrblock.com/middle-flow-v2/middle-flow.js	chromecache_185.3.dr, chromecache_213.3.dr	false		high
https://cdn.cookielaw.org/vendorlist/googleData.json	chromecache_298.3.dr, chromecache_287.3.dr	false		high
https://cdn.cookielaw.org/vendorlist/iab2Data.json	chromecache_298.3.dr, chromecache_287.3.dr	false		high
https://loginapp.hrblock.com	chromecache_273.3.dr	false		high
https://stg.api.bazaarvoice.com/data	chromecache_206.3.dr	false		high
https://nebula-cdn.kampyle.com/direct/form.html?region=prodUsOregon&websiteId=196413&formId=31972	chromecache_185.3.dr, chromecache_213.3.dr	false		high
https://account.hrblock.com/ciam-sidp/ciam-sidp.js	chromecache_185.3.dr, chromecache_213.3.dr	false		high
https://account.hrblock.com/gateway/videocollab	chromecache_185.3.dr, chromecache_213.3.dr	false		high
https://login.taxes.hrblock.com/HRBlock/login/LoginRegistration.hrbx	chromecache_273.3.dr	false	Avira URL Cloud: safe	unknown
https://clientservices.hrblock.com/video-app/index-video-client.html	chromecache_185.3.dr, chromecache_213.3.dr	false	Avira URL Cloud: safe	unknown
http://jquery.com/	chromecache_300.3.dr	false		high
https://account-qa.hrblock.com/#/myb-dashboard	chromecache_235.3.dr, chromecache_223.3.dr	false	Avira URL Cloud: safe	unknown
https://cdn.cookielaw.org/vendorlist/iab2V2Data.json	chromecache_298.3.dr, chromecache_287.3.dr	false		high

IP	Domain	Country	ASN	ASN Name	Malicious
3.228.204.222	events.launchdarkly.com	United States	14618	AMAZON-AESUS	false
15.197.170.101	mp.hrblock.com	United States	7430	TANDEMUS	false
20.50.88.245	gig-ai-g-prod-westeurope-5-app-v4-tag.westeurope.cloudapp.azure.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
151.101.129.91	n.sni.global.fastly.net	United States	54113	FASTLYUS	false
13.33.187.78	zjngh6ej.micpn.com	United States	16509	AMAZON-02US	false
3.33.235.18	clientstream-ga.launchdarkly.com	United States	8987	AMAZONEXPANSIONGB	false
63.140.62.27	hrblock.com.ssl.d1.sc.omtrdc.net	United States	15224	OMNITUREUS	false
66.235.152.225	adobetarget.data.adobedc.net	United States	15224	OMNITUREUS	false
72.247.153.192	unknown	United States	20940	AKAMAI-ASN1EU	false
2.19.105.89	e7808.dscg.akamaiedge.net	European Union	16625	AKAMAI-ASUS	false
2.22.242.91	a1967.dscr.akamai.net	European Union	20940	AKAMAI-ASN1EU	false
52.222.236.89	unknown	United States	16509	AMAZON-02US	false
104.18.32.137	geolocation.onetrust.com	United States	13335	CLOUDFLARENETUS	false
151.101.194.217	c3.shared.global.fastly.net	United States	54113	FASTLYUS	false
63.140.62.222	unknown	United States	15224	OMNITUREUS	false
130.61.120.2	collection.decibelinsight.net	United States	31898	ORACLE-BMC-31898US	false
20.106.29.205	account.hrblock.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
52.222.236.123	d2pj9rkatqbt38.cloudfront.net	United States	16509	AMAZON-02US	false
104.18.87.42	unknown	United States	13335	CLOUDFLARENETUS	false
23.196.247.193	e4381.a.akamaiedge.net	United States	16625	AKAMAI-ASUS	false
142.250.185.132	www.google.com	United States	15169	GOOGLEUS	false
151.101.193.175	j.shared.global.fastly.net	United States	54113	FASTLYUS	false
34.249.12.92	unknown	United States	16509	AMAZON-02US	false
23.55.230.244	unknown	United States	7725	COMCAST-7725US	false
66.235.152.156	unknown	United States	15224	OMNITUREUS	false
104.18.86.42	cdn.cookielaw.org	United States	13335	CLOUDFLARENETUS	false
95.101.54.106	a1910.dscq.akamai.net	European Union	34164	AKAMAI-LONGB	false
63.35.2.123	dcs-public-edge-irl1-150041215.eu-west-1.elb.amazonaws.com	United States	16509	AMAZON-02US	false

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1635212
Start date and time:	2025-03-11 13:48:46 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 30s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	http://account.hrblock.com
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	20
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal48.evad.win@22/283@74/29

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	21629
Entropy (8bit):	5.335194809144011
Encrypted:	false
SSDEEP:	384:LeEqgKuCgVkcCPT7o+6JZc7bugmJZlOcRomRuChzMX9QLp7QnCqX3DeQ6NCy3J0z:LMHeV9CPT7o+6JZc7bugmJZlOcRomRuV
MD5:	81E52680E8EC1975A854E1CD7562F23C
SHA1:	A48FDE2D21665733AA4A07047EAC261E4A0A66CD
SHA-256:	51A359D5926D0F8B70A130694F91CCC956A7991AE92BE22A438EB4486B72F1DD
SHA-512:	315930633BC99C5FA0C826FC7E06E8AA473A2D7942667F8EB0C53AB6F180306566FF1BCB4D7C9D9AE1B7D463E2CF2CDDE95FF36756370DE17C0CD1DA6F563A8A
Malicious:	false
Reputation:	low
URL:	https://collection.decibelinsight.net/i/13948/332429/c.json
Preview:	{"da_websiteId":332429,"da_account_flags":22527,"da_account_flags_orig":22527,"da_sessionId_e":"DCC20EDF8E38AE8BF93FAA13A1D339B622.1","da_leadId_e":"EFF13DEC9A78EA106C6EBB99E3D173BD91","da_dnsRecord":"collection.decibelinsight.net","da_anonymiseIP":true,"da_ipHandling":1,"da_sessCookieFlags":3,"da_leadCookieFlags":0,"analysisSessFlags":0,"analysisLeadFlags":0,"replaySessFlags":3,"replayLeadFlags":0,"int_state":"","curTime":1741697469,"domains":["expatonline.hrblock.com","expat.hrblock.com","www.hrblock.com","account.sprucemoney.com","www.sprucemoney.com","www.blockadvisors.com","idp.hrblock.com","web.blockadvisors.com","store.hrblock.com","search3.hrblock.com"],"accountNumber":13948,"branch":"7.1.6","da_iframeBased":false,"da_autoFragmentTrack":true,"da_autoQueryTrack":true,"da_maskEmail":true,"da_maskSSN":true,"da_recursiveMasking":true,"da_deepShadowRootSearch":false,"da_processBot":false,"da_noHTML":false,"da_httpsJourney":true,"da_aggregateFields":false,"da_allowDuplicateAttribute"

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	449
Entropy (8bit):	5.238825664776524
Encrypted:	false
SSDEEP:	6:wBqWekiTakpxxdGztoIhS3EaOARRRNF/8xRjLCmKXe8t9yebcaS3jfU0cMLe8t9q:dkK9dg5qEajTRv/8XKO0A1jfo0tm
MD5:	78E4F87A2118F58157A04354B3D19364
SHA1:	1930489E55F0C5711F70B96CEDD2BAB7C7BF452D
SHA-256:	C9DE0E537DC2EDC2CB975873BD2963C7F893F432B87B9E5E779C331BBDD6FC22
SHA-512:	E522CE8D4DC8C1912F75749230071851C1897AB23D726FDF18C182130B5D009C155F119836A1C281DB46DF0A9D93F1A878F93C3BD8F4E6C9686F1FAF12FD4C6E
Malicious:	false
Reputation:	low
Preview:	<HTML><HEAD>.<TITLE>Access Denied</TITLE>.</HEAD><BODY>.<H1>Access Denied</H1>. .You don't have permission to access "http://www.hrblock.com/libs/dam/components/scene7/common/clientlibs/i18n.js" on this server.<P>.Reference #18.efb10f17.1741697460.14385316.<P>https://errors.edgesuite.net/18.efb10f17.1741697460.14385316</P>.</BODY>.</HTML>.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report http://account.hrblock.com

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Dropped Files

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Phishing

Networking

System Summary

HIPS / PFW / Operating System Protection Evasion

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Chrome Cache Entry: 138

Chrome Cache Entry: 139

Chrome Cache Entry: 140

Chrome Cache Entry: 141

Chrome Cache Entry: 142

Chrome Cache Entry: 143

Chrome Cache Entry: 144

Chrome Cache Entry: 145

Chrome Cache Entry: 146

Chrome Cache Entry: 147

Chrome Cache Entry: 148

Chrome Cache Entry: 149

Chrome Cache Entry: 150

Chrome Cache Entry: 151

Chrome Cache Entry: 152

Chrome Cache Entry: 153

Chrome Cache Entry: 154

Chrome Cache Entry: 155

Chrome Cache Entry: 156

Chrome Cache Entry: 157

Chrome Cache Entry: 158

Chrome Cache Entry: 159

Chrome Cache Entry: 160

Chrome Cache Entry: 161

Chrome Cache Entry: 162

Chrome Cache Entry: 163

Chrome Cache Entry: 164

Chrome Cache Entry: 165

Windows Analysis Report
http://account.hrblock.com