Analysis Report https://app.box.com/s/4c3tf7iumvvg3c3q6e7udjiq7o0yealq

Overview

General Information

Sample URL:	https://app.box.com/s/4c3tf7iumvvg3c3q6e7udjiq7o0yealq
Analysis ID:	356834
Infos:
Most interesting Screenshot:

Detection

Score:	56
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Classification

Signatures

AV Detection:

Antivirus / Scanner detection for submitted sample

Source: https://app.box.com/s/4c3tf7iumvvg3c3q6e7udjiq7o0yealq

SlashNext: detection malicious, Label: Fake Login Page type: Phishing & Social Engineering

Antivirus detection for URL or domain

Source: https://dy2ln.csb.app/

SlashNext: Label: Fake Login Page type: Phishing & Social Engineering

Compliance:

Uses new MSVCR Dlls

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll

Jump to behavior

Uses secure TLS version for HTTPS connections

Source: unknown	HTTPS traffic detected: 185.235.236.201:443 -> 192.168.2.7:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.235.236.201:443 -> 192.168.2.7:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.235.236.197:443 -> 192.168.2.7:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.235.236.197:443 -> 192.168.2.7:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.235.236.200:443 -> 192.168.2.7:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.235.236.200:443 -> 192.168.2.7:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.26.114:443 -> 192.168.2.7:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.26.114:443 -> 192.168.2.7:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.22.207:443 -> 192.168.2.7:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.22.207:443 -> 192.168.2.7:49746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.22.207:443 -> 192.168.2.7:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.22.207:443 -> 192.168.2.7:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.22.207:443 -> 192.168.2.7:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.22.207:443 -> 192.168.2.7:49743 version: TLS 1.2

Networking:

Source: unknown

DNS traffic detected: queries for: app.box.com

Source: preview[1].js.2.dr	String found in binary or memory: http://blog.stevenlevithan.com/archives/parseuri
Source: preview[1].js.2.dr	String found in binary or memory: http://jedwatson.github.io/classnames
Source: core.min[1].js.2.dr	String found in binary or memory: http://rock.mit-license.org
Source: preview[1].js.2.dr	String found in binary or memory: http://www.box.com)
Source: {70671299-7640-11EB-90E6-ECF4BB82F7E0}.dat.1.dr	String found in binary or memory: https://app.box.c3tf7iumvvg3c3q6e7udjiq7o0yealqRoot
Source: {70671299-7640-11EB-90E6-ECF4BB82F7E0}.dat.1.dr	String found in binary or memory: https://app.box.cRoot
Source: {70671299-7640-11EB-90E6-ECF4BB82F7E0}.dat.1.dr	String found in binary or memory: https://app.box.chttps://app.box.com/s/4c3tf7iumvvg3c3q6e7udjiq7o0yealq
Source: {70671299-7640-11EB-90E6-ECF4BB82F7E0}.dat.1.dr	String found in binary or memory: https://app.box.com/s/4c3tf7iumvvg3c3q6e7udjiq7o0yealq
Source: {70671299-7640-11EB-90E6-ECF4BB82F7E0}.dat.1.dr	String found in binary or memory: https://app.box.com/s/4c3tf7iumvvg3c3q6e7udjiq7o0yealqRGuardian
Source: {70671299-7640-11EB-90E6-ECF4BB82F7E0}.dat.1.dr	String found in binary or memory: https://app.box.com/s/4c3tf7iumvvg3c3q6e7udjiq7o0yealqRoot
Source: 4c3tf7iumvvg3c3q6e7udjiq7o0yealq[1].htm.2.dr	String found in binary or memory: https://cdn01.boxcdn.net/_assets/img/favicons/android-chrome-192x192-96i97M.png
Source: 4c3tf7iumvvg3c3q6e7udjiq7o0yealq[1].htm.2.dr	String found in binary or memory: https://cdn01.boxcdn.net/_assets/img/favicons/apple-touch-icon-114x114-busq-D.png
Source: 4c3tf7iumvvg3c3q6e7udjiq7o0yealq[1].htm.2.dr	String found in binary or memory: https://cdn01.boxcdn.net/_assets/img/favicons/apple-touch-icon-120x120-K-u4U5.png
Source: 4c3tf7iumvvg3c3q6e7udjiq7o0yealq[1].htm.2.dr	String found in binary or memory: https://cdn01.boxcdn.net/_assets/img/favicons/apple-touch-icon-144x144-va9pYs.png
Source: 4c3tf7iumvvg3c3q6e7udjiq7o0yealq[1].htm.2.dr	String found in binary or memory: https://cdn01.boxcdn.net/_assets/img/favicons/apple-touch-icon-152x152-r5tWgh.png
Source: 4c3tf7iumvvg3c3q6e7udjiq7o0yealq[1].htm.2.dr	String found in binary or memory: https://cdn01.boxcdn.net/_assets/img/favicons/apple-touch-icon-180x180-tV001c.png
Source: 4c3tf7iumvvg3c3q6e7udjiq7o0yealq[1].htm.2.dr	String found in binary or memory: https://cdn01.boxcdn.net/_assets/img/favicons/apple-touch-icon-57x57-fLlEpj.png
Source: 4c3tf7iumvvg3c3q6e7udjiq7o0yealq[1].htm.2.dr	String found in binary or memory: https://cdn01.boxcdn.net/_assets/img/favicons/apple-touch-icon-60x60-Uv0qzu.png
Source: 4c3tf7iumvvg3c3q6e7udjiq7o0yealq[1].htm.2.dr	String found in binary or memory: https://cdn01.boxcdn.net/_assets/img/favicons/apple-touch-icon-72x72-7aVqne.png
Source: 4c3tf7iumvvg3c3q6e7udjiq7o0yealq[1].htm.2.dr	String found in binary or memory: https://cdn01.boxcdn.net/_assets/img/favicons/apple-touch-icon-76x76-ZVGnRV.png
Source: 4c3tf7iumvvg3c3q6e7udjiq7o0yealq[1].htm.2.dr	String found in binary or memory: https://cdn01.boxcdn.net/_assets/img/favicons/browserconfig-fdBReK.xml
Source: 4c3tf7iumvvg3c3q6e7udjiq7o0yealq[1].htm.2.dr	String found in binary or memory: https://cdn01.boxcdn.net/_assets/img/favicons/favicon-16x16-_kQSW4.png
Source: 4c3tf7iumvvg3c3q6e7udjiq7o0yealq[1].htm.2.dr, imagestore.dat.2.dr	String found in binary or memory: https://cdn01.boxcdn.net/_assets/img/favicons/favicon-32x32-VwW37b.png
Source: 4c3tf7iumvvg3c3q6e7udjiq7o0yealq[1].htm.2.dr	String found in binary or memory: https://cdn01.boxcdn.net/_assets/img/favicons/favicon-96x96-XU7UE1.png
Source: 4c3tf7iumvvg3c3q6e7udjiq7o0yealq[1].htm.2.dr	String found in binary or memory: https://cdn01.boxcdn.net/_assets/img/favicons/favicon-yz-tj-.ico
Source: 4c3tf7iumvvg3c3q6e7udjiq7o0yealq[1].htm.2.dr	String found in binary or memory: https://cdn01.boxcdn.net/_assets/img/favicons/manifest-rw1AEP.json
Source: 4c3tf7iumvvg3c3q6e7udjiq7o0yealq[1].htm.2.dr	String found in binary or memory: https://cdn01.boxcdn.net/_assets/img/favicons/mstile-144x144-pllCM8.png
Source: 4c3tf7iumvvg3c3q6e7udjiq7o0yealq[1].htm.2.dr	String found in binary or memory: https://cdn01.boxcdn.net/_assets/img/favicons/notification-favicon-16x16-Ou5N87.png
Source: 4c3tf7iumvvg3c3q6e7udjiq7o0yealq[1].htm.2.dr	String found in binary or memory: https://cdn01.boxcdn.net/_assets/img/favicons/notification-favicon-32x32-brwW_W.png
Source: 4c3tf7iumvvg3c3q6e7udjiq7o0yealq[1].htm.2.dr	String found in binary or memory: https://cdn01.boxcdn.net/_assets/img/favicons/notification-favicon-96x96-TOQ9Kg.png
Source: 4c3tf7iumvvg3c3q6e7udjiq7o0yealq[1].htm.2.dr	String found in binary or memory: https://cdn01.boxcdn.net/_assets/img/favicons/notification-favicon-EHWWyP.ico
Source: 4c3tf7iumvvg3c3q6e7udjiq7o0yealq[1].htm.2.dr	String found in binary or memory: https://cdn01.boxcdn.net/_assets/img/favicons/safari-pinned-tab-jyt2W4.svg
Source: 4c3tf7iumvvg3c3q6e7udjiq7o0yealq[1].htm.2.dr	String found in binary or memory: https://cdn01.boxcdn.net/enduser/app.e93a3fd295.css
Source: messagecenter~preview-components~uploads-manager-enduser.a1ab85c9dd[1].css.2.dr	String found in binary or memory: https://cdn01.boxcdn.net/fonts/1.0.2/lato/Lato-Bold.woff)
Source: messagecenter~preview-components~uploads-manager-enduser.a1ab85c9dd[1].css.2.dr	String found in binary or memory: https://cdn01.boxcdn.net/fonts/1.0.2/lato/Lato-Bold.woff2)
Source: messagecenter~preview-components~uploads-manager-enduser.a1ab85c9dd[1].css.2.dr	String found in binary or memory: https://cdn01.boxcdn.net/fonts/1.0.2/lato/Lato-Regular.woff)
Source: messagecenter~preview-components~uploads-manager-enduser.a1ab85c9dd[1].css.2.dr	String found in binary or memory: https://cdn01.boxcdn.net/fonts/1.0.2/lato/Lato-Regular.woff2)
Source: 4c3tf7iumvvg3c3q6e7udjiq7o0yealq[1].htm.2.dr	String found in binary or memory: https://cdn01.boxcdn.net/fonts/1.0.2/lato/Lato-woff.css
Source: MUI8VD1X.htm.2.dr	String found in binary or memory: https://codesandbox.io/static/browserfs12/browserfs.min.js
Source: MUI8VD1X.htm.2.dr	String found in binary or memory: https://codesandbox.io/static/js/common-sandbox.71780db40.chunk.js
Source: MUI8VD1X.htm.2.dr	String found in binary or memory: https://codesandbox.io/static/js/default~app~embed~sandbox.cc6bf977b.chunk.js
Source: MUI8VD1X.htm.2.dr	String found in binary or memory: https://codesandbox.io/static/js/sandbox-startup.788fc841a.js
Source: MUI8VD1X.htm.2.dr	String found in binary or memory: https://codesandbox.io/static/js/sandbox.ba8055760.js
Source: MUI8VD1X.htm.2.dr	String found in binary or memory: https://codesandbox.io/static/js/vendors~app~codemirror-editor~monaco-editor~sandbox.e68dd7bee.chunk
Source: MUI8VD1X.htm.2.dr	String found in binary or memory: https://codesandbox.io/static/js/vendors~app~embed~sandbox-startup.10f5f18b4.chunk.js
Source: MUI8VD1X.htm.2.dr	String found in binary or memory: https://codesandbox.io/static/js/vendors~app~sandbox.b5f1eee3a.chunk.js
Source: MUI8VD1X.htm.2.dr	String found in binary or memory: https://codesandbox.io/static/js/vendors~sandbox.4c1b5e5ac.chunk.js
Source: {70671299-7640-11EB-90E6-ECF4BB82F7E0}.dat.1.dr	String found in binary or memory: https://dy2ln.csb.app/
Source: content[1].pdf.2.dr	String found in binary or memory: https://dy2ln.csb.app/)
Source: {70671299-7640-11EB-90E6-ECF4BB82F7E0}.dat.1.dr	String found in binary or memory: https://dy2ln.csb.app/3tf7iumvvg3c3q6e7udjiq7o0yealq
Source: {70671299-7640-11EB-90E6-ECF4BB82F7E0}.dat.1.dr	String found in binary or memory: https://dy2ln.csb.app/4c3tf7iumvvg3c3q6e7udjiq7o0yealq
Source: imagestore.dat.2.dr	String found in binary or memory: https://dy2ln.csb.app/favicon.ico
Source: imagestore.dat.2.dr	String found in binary or memory: https://dy2ln.csb.app/favicon.ico~
Source: preview[1].js.2.dr	String found in binary or memory: https://feross.org
Source: preview[1].js.2.dr	String found in binary or memory: https://github.com/derek-watson/jsUri
Source: core.min[1].js.2.dr	String found in binary or memory: https://github.com/zloirock/core-js
Source: preview[1].js.2.dr	String found in binary or memory: https://support.box.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 185.235.236.201:443 -> 192.168.2.7:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.235.236.201:443 -> 192.168.2.7:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.235.236.197:443 -> 192.168.2.7:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.235.236.197:443 -> 192.168.2.7:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.235.236.200:443 -> 192.168.2.7:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.235.236.200:443 -> 192.168.2.7:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.26.114:443 -> 192.168.2.7:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.26.114:443 -> 192.168.2.7:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.22.207:443 -> 192.168.2.7:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.22.207:443 -> 192.168.2.7:49746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.22.207:443 -> 192.168.2.7:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.22.207:443 -> 192.168.2.7:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.22.207:443 -> 192.168.2.7:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.22.207:443 -> 192.168.2.7:49743 version: TLS 1.2

System Summary:

Source: classification engine

Classification label: mal56.win@3/63@7/5

Source: C:\Program Files\internet explorer\iexplore.exe

File created: C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{70671297-7640-11EB-90E6-ECF4BB82F7E0}.dat

Jump to behavior

Source: C:\Program Files\internet explorer\iexplore.exe

File created: C:\Users\user~1\AppData\Local\Temp\~DF06DEECED06AE8102.TMP

Jump to behavior

Source: C:\Program Files\internet explorer\iexplore.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: unknown	Process created: C:\Program Files\internet explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Source: unknown	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:580 CREDAT:17410 /prefetch:2
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:580 CREDAT:17410 /prefetch:2	Jump to behavior

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

File opened: C:\Windows\SysWOW64\Macromed\Flash\ss.cfg

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll

Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.235.236.200	unknown	Germany	33011	BOXNETUS	false
104.18.22.207	unknown	United States	13335	CLOUDFLARENETUS	false
185.235.236.197	unknown	Germany	33011	BOXNETUS	false
185.235.236.201	unknown	Germany	33011	BOXNETUS	false
104.18.26.114	unknown	United States	13335	CLOUDFLARENETUS	false

Contacted Domains

Name	IP	Active
api.box.com	185.235.236.197	true
public.boxcloud.com	185.235.236.200	true
codesandbox.io	104.18.22.207	true
app.box.com	185.235.236.201	true
dy2ln.csb.app	104.18.26.114	true
cdn01.boxcdn.net	unknown	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://app.box.com/s/4c3tf7iumvvg3c3q6e7udjiq7o0yealq	false		high
https://dy2ln.csb.app/	true	SlashNext: Fake Login Page type: Phishing & Social Engineering	unknown

ID:	356834
Product:	CloudBasic
Start time:	17:33:42
Start date:	23.02.2021
Cookbook:	browseurl.jbs
System description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Architecture:	WINDOWS

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\DOMStore\IUHEMSR9\dy2ln.csb[1].xml	ASCII text, with no line terminators	C1DDEA3EF6BBEF3E7060A1A9AD89E4C5	35E3224FCBD3E1AF306F2B6A2C6BBEA9B0867966	B71E4D17274636B97179BA2D97C742735B6510EB54F22893D3A2DAFF2CEB28DB
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\DOMStore\T8DRMTJ1\app.box[1].xml	ASCII text, with very long lines, with no line terminators	5AFA9A71F2AC1B69A2EFA9E3A5F904CF	CFA76B5615C29101B11A61EDCF14151C32A51FE9	D0EA4AEF47CDC50483AC7864BE7CFB357F394A024CCFE5962D999C36648B2FA3
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{70671297-7640-11EB-90E6-ECF4BB82F7E0}.dat	Microsoft Word Document	AAB506CF0877F26AEB557A8BC24A0ABF	731DD0C26D9159C3ECD38E319A46D54554A0504D	F8BA472D44A16490605382E62D651055738359EBE1F685E0AA7D32295CE4208D
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{70671299-7640-11EB-90E6-ECF4BB82F7E0}.dat	Microsoft Word Document	D251D974A21F4FB81203000FF88D46E3	8CA6F16A831A61A10D1544D22C1ADD0BEC3BD21A	CE852C549DDB3FD153B5064F91D054F73029A2D39BD625BA67D61B1EA5C6ED5E
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{76EEC4C1-7640-11EB-90E6-ECF4BB82F7E0}.dat	Microsoft Word Document	7E11CBBA0343B5307CBC080982338AE9	875D58D165FC0F9EC159A3A1E8536704E179A117	1BC596B6198798CDEC04E8781EB2E43E895C723E712C58AD7BF77C808FE27F97
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\imagestore\po60zt0\imagestore.dat	data	6213F11D135332925B1218B499A917F2	02552F27626387F1A20F37E29ED903DFDDDC4361	8612364AEF9DEAE7659E6F2CC74D1BE689FEA0D7BFA8E1F019A0FA8EB19DD032
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0MX4YUS9\favicon-32x32-VwW37b[1].png	PNG image data, 32 x 32, 8-bit colormap, non-interlaced	86AEDF25C0B3AE1224D92E32D80FFEF8	D75B54256BC48B27E6D7DF1C2A6F4635DE2FE5EE	D1A4A65AC84A381199843B9722E6470470C8093885CF2A6481C2FF0DEF618C64
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0MX4YUS9\favicon[1].ico	MS Windows icon resource - 3 icons, 48x48, 32 bits/pixel, 32x32, 32 bits/pixel	0D12B0988F1DC712ABC372BA0C65F5B9	6F60EE69D91F6CD34C7C91006F0D9828DBF6AE2B	CCD3CA64728E901AC38D851337946A53BB3D573CF39A075C8F367303B5CE673B
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0MX4YUS9\messagecenter~preview-components~uploads-manager-enduser.a1ab85c9dd[1].css	ASCII text, with very long lines, with no line terminators	F2129188D79DCC9425F90ABCCC0B59A7	7E59C068211D195C19C91FE2581BB359FEA828B8	CBB9726F5F3DCA04530F69D2B6C0B60B22E79BA8A0800167EA6AB365B19C95A0
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0MX4YUS9\pdf.min[1].js	ASCII text, with very long lines	9A9AC5F2FB76274116C651226A647C95	EEDC500FC742C9762BF5789AE470132B2011AF77	6CF4C965636CFA49500C3A95FDEF2C5F4722FD0367ED26D70A19F1A13DFFE173
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0MX4YUS9\pdf_viewer.min[1].css	assembler source, ASCII text, with very long lines, with no line terminators	8CE5E0CD4EE723D76683E50A1A3A6C6B	43D9D8CEECAA52C55735CBBF46DA3AE27146018D	5179C456D56674CA0C710DBC43C90DDF2710C716779D53B94BF2A018F31154DA
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0MX4YUS9\pdf_viewer.min[1].js	ASCII text, with very long lines	C1B5589ABBA40B2ED3D3AE6EB0F45373	D3F971D2C68F79F055E986F687F5F259DAED3226	8FC790E9167754C61FFCD21E2382D2B6F55903C708239A5CDC7A15748F864B1B
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0MX4YUS9\preview-components~shared-file.058e604af1[1].css	ASCII text, with no line terminators	0628C102A3DA83FE10C4AC340F055329	F290C0DC982CA76807C00EEAE59B3335983BBDC4	B23D25ACC423D13F6DE5278961700C672B481E93EC189A8179BF27AE43824279
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0MX4YUS9\promise[1].js	ASCII text, with very long lines, with no line terminators	B669DFC7109AB90A425DB6A9349E92F5	0EF23DF3B07C637DB6DDF6766EFC8A2A528C1C0E	977A170836C79F74599A27B28F7A487ABB29EBB5E50EB0CD303FB70617A1CE13
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0MX4YUS9\shared-file.ae65917135[1].css	ASCII text, with very long lines, with no line terminators	30DBAF1AA2461B67BD0FBA1F018B7A8F	EB99C8D6124599E57C219DA1591D0F90DE9A68B6	7491367269A0C97C9EF859DBB361062FAB032FCF2F2807683A05ACA2A91245A8
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0MX4YUS9\uploads-manager-enduser.140e76ab37[1].js	ASCII text, with very long lines	A40926DDD2EE529EF65963E50B2ADF6F	ECD0C7B65CEC8E04255B12FF3D8ADED1A291362D	8FB30912A7F588D4570D710A7127B75689124D6C29187148939ABDAD35B69EAD
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0MX4YUS9\uploads-manager-enduser.e1818dd8a3[1].css	ASCII text, with very long lines, with no line terminators	2736E5D199EFCFE06501B7F72B3F5DD2	B9B553FBB2DFE567111B7D51CF682EB72D9EB9C6	6557DF16669DDFB8E5BF239CC8004991B1483568090013310857002CD051B85A
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2K7JPOQS\Lato-Bold[1].woff	Web Open Font Format, TrueType, length 118272, version 1.0	AEBA3FDF0CDB79BC1D33688D3E39B592	E3A34C01880116194309B7225A9CBF8001D23407	2D198961EFB291734102AC4281C4E004628960C80B7C378DD8E034D4B7425AD2
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2K7JPOQS\Lato-Regular[1].woff	Web Open Font Format, TrueType, length 119132, version 1.0	3E4A4FC6317C4C2CF35D7C77EC1789C3	40EA0D8678B92988824193587F707E3AEDC4591F	607EC0A4A29F6A4607F6E0A3CF486E50322DDF66F1F1870150CB69A7061E978D
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2K7JPOQS\browserfs.min[1].js	UTF-8 Unicode text, with very long lines	E9385D9DB309577674B8639FA0B061C4	B2E1DB9126DC513C7113B27437E294BE24A5E9A7	F71171D6AD30EED99E7680835128F8923C8EE43F70A316EB9F8E337A1E190080
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2K7JPOQS\content[1].jpg	[TIFF image data, big-endian, direntries=5, xresolution=74, yresolution=82, resolutionunit=1], baseline, precision 8, 723x1024, frames 3	E1524421E9480E1ED9FE2E41174FD5DB	7E231E260D47B89FF87BE133E008CB3EB1E83142	8A9C6D4505199A9EC85ED1E93B5DD16E55FE523B9E8BF172395C6C24558A43FF
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2K7JPOQS\content[1].pdf	PDF document, version 1.5	7E701440DD24159471D391CC1EA39700	B57E4872715FE92BBF26C7716093A3CE60A8C110	B2AC7A083C769B92BEFD961088A281C330AD579CB7838750A9CA789E1AD6FAEA
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2K7JPOQS\hub-details~messagecenter~uploads-manager-enduser.a7025cad8b[1].js	ASCII text, with very long lines, with no line terminators	2D2D636787920B874760FCEA4456A79B	7032F038BBA06182B76A7EB157F7185AA62455DE	FA967E9E25EEEE97D69789070A0664B8B7D74A49D19E18721A0296A4C726DD07
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2K7JPOQS\intersection-observer[1].js	ASCII text, with very long lines, with no line terminators	498AAC0CA5A2544927FAF2681402DE59	39F0C1FBF7452CC5568E5E9C499C898272C285CE	542FADAE21CB6CA75B99B8FC0A0FA8E300F18F679FAD27046D23C74C275F59EE
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2K7JPOQS\messagecenter~preview-components~uploads-manager-enduser.3fdcd5d60c[1].js	ASCII text, with very long lines	6399A0AB5D82D764B68F3DC93E24FE27	B13872213745A5D3C0D3B7226CB89C233D6FE0AB	16849FD80A3D6A797AE89EC1059CA697FFE16268592CE365FBED6A01DAE8D304
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2K7JPOQS\preview-components.c15b965048[1].css	ASCII text, with very long lines, with no line terminators	9AF8E1B956E70CCEBD85A9D3160A6DDA	30D31CFBA084F6A1F1DA1C8842730B22FF2CBD2E	040E778FE44D8F018644A17C4DE15DDDB65ABC85F2C81DE51DC10165F8911FC9
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2K7JPOQS\preview-components.fa55a1d652[1].js	ASCII text, with very long lines, with no line terminators	68A9B37D94A4DBEE120E8D841D94051E	2D4B9A0BAA396D03F5FD7B24CE7C72019F035836	1F93EED6583D22EFFFDB03D826886A64AB0E8B50038AD857C8ED12E904BE0AA6
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6M6D1PMD\4c3tf7iumvvg3c3q6e7udjiq7o0yealq[1].htm	HTML document, ASCII text, with very long lines	4EB3819C1DAD5D70772D2A4B5EF359BD	10F148C81EF62DD9243BD630EDE5298BE73D1250	EC436F1ED66131B93089EA3435B349FBBCC0C74BAA24F9F474D4CAC60BAD4A2A
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6M6D1PMD\Lato-woff[1].css	ASCII text, with very long lines	E1E5023A4D0B29824C8A6937ED303B03	93159BA90E4ACA126C45282D047E4E1D544AD100	80745E4A131F2F16302232F53845BFA223915A3465369A40A9AA777D2C0A30BD
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6M6D1PMD\app.0c21638046[1].js	ASCII text, with very long lines, with no line terminators	368D2001179C2E4D916F22E727E463A7	7795BD93B5B707BF372F2A4CB373F0806079EA48	939B2942A5946345DE61FEB1049F849A43A99EFD0A903A6EF0BBBB3BA5937767
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6M6D1PMD\app.e93a3fd295[1].css	ASCII text, with very long lines, with no line terminators	57A703EF257150F33A85AE8A21D5AE40	49472E68E82A4E4F449A4B6B02B64123D1BC6B1E	2765561E9AF306BE3494B36767CC0CC6C0F6EA8156F5467F6FF999BE1F2E603E
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6M6D1PMD\default~app~embed~sandbox.cc6bf977b.chunk[1].js	ASCII text, with very long lines	4399CAB9773865CC0C80261ACAA8EB91	1FC5F22E6A621D5C2B7713BC56D8AFBB43E1D96A	5E73C281D1AC1F7E71082B4732F092305EE0178C135614297FCEC42FD0B30E7B
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6M6D1PMD\exif.min[1].js	ASCII text, with very long lines	0DB669C9033252050E919900AD0BEFA0	23EDB95E1E737E0F23EE6C7CEF07D634236A52E3	ADD547634768E8CE49D67775D02F958597EFD5E6DF2D1077EF4DFC8C0878B688
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6M6D1PMD\lang-en-AU~lang-en-CA~lang-en-GB~lang-en-US~lang-en-x-pseudo.57dba5f597[1].js	ASCII text, with very long lines, with no line terminators	9BCCCA5979199B48DD2DCD6BAC31CDCA	380DBAED126862294356918B0AC8031C00BD492A	860E3603A72F16B016D971C6FA67386D8C1398A44A896F896082B6F7CDF2CC78
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6M6D1PMD\lang-en-US.ebc1f6441d[1].js	ASCII text, with very long lines, with no line terminators	C766F88E4FCBD749AB2158B054FD3F6C	CB46C08E9E8BA1532C1A8B0F3FD0045AAB62BA1B	6A2AF842418478CE8CE3E3675F283B8328162BC8210488D77EAAEE3EC21A43C3
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6M6D1PMD\loading[1].gif	GIF image data, version 89a, 30 x 30	2E4AAFDC48FD2295ADE1A275F1BAE547	D35E3EB9261AEF6827067E9D8D0C8C7B796E0AFB	B3A3C601451C06183AF82CBF2270C4D80F3D5D680EA9960ED0816B506FBB8C33
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6M6D1PMD\pdf.worker.min[1].js	ASCII text, with very long lines	8F43F3A32DF23400F995137BD39B3E96	9F368C68F4788C9565EDEA054541683CB6791E3F	1DFAD8C9B4B4981418A528C29A316683E17C222C0D27348264627C57580D2F37
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6M6D1PMD\runtime.fdaecdb86e[1].js	ASCII text, with very long lines, with no line terminators	C770B043F8FECCBFA79AEA8FFE684268	85535BE4D324CB7E2C469131C667370EAB9038F5	A7085823936AC112DDBC20562A6B869406C19C6CEF923EC4F92E78CBB431CA5E
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6M6D1PMD\vendors~app.15f4043a47[1].js	ASCII text, with very long lines	50E9EF7DA6BC3D8BC754629CEE07A001	42BD7F0A0B05876C102B8293CEF39A88C8418FD3	F397E9E436133209699121B8A66FDC47EE6741B09311C6E01FADAC16740862F1
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6M6D1PMD\vendors~app~codemirror-editor~monaco-editor~sandbox.e68dd7bee.chunk[1].js	ASCII text, with very long lines	DFC22954A1CE21CA5607EA467A764325	BFDCEE2933EEB8E002B719A808E023F779EBC6D7	2F6F6A9B071FA9524767820D3B6E454BC739BD6100558E4E8DB061D917BDAE6E
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6M6D1PMD\vendors~app~embed~sandbox-startup.10f5f18b4.chunk[1].js	ASCII text, with very long lines	086E4A580502FBE1864DD15D433F4DED	20FC820C3BB85D8F88F3884FB2080280E98B65FF	609E2F20F79864FFF8817C010DF5562F24178785F2B5DD98CA38407E5527210A
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6M6D1PMD\vendors~app~sandbox.b5f1eee3a.chunk[1].js	ASCII text, with very long lines	8E457B950D9552EDB389A01B9CEA82D5	1C511D7516D346A01A5F972CD3102009873D9678	6D5FA465593642814B127DC0E4D2CABE1C3D134D2F262629E939605B5180D38B
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6M6D1PMD\vendors~sandbox.4c1b5e5ac.chunk[1].js	HTML document, ASCII text, with very long lines	BA28DBB728A322AE3065FFF7190AA78B	BC858918CFC2FC0C901F51F0C66DC1DAFCB7C279	47FA05A21D981EEDD1EB926071651E19DD2A8AF8DB196E13916957225013693F
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\VAHFWDJC\MUI8VD1X.htm	HTML document, ASCII text, with very long lines, with no line terminators	FF96236A2FD58AC76C9C735880615564	534DCA2011C69C1B36084C489EA5A84A05397B25	EB02BD50FE009483957CECC8EA58FD55EF31B697CBDA2D1CECF1045300C1CE68
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\VAHFWDJC\as-security~change-current-user-role-modal~collaborators~collection-detail-page~content-explorer-mod~2da256af.a0db8de5f2[1].js	ASCII text, with very long lines, with no line terminators	A0A0AD79772308D2FA9C7FEB0D365E27	B6D6AD65CDE92616D62EB1593ED804FE9671ED48	8F27FA13A51FAF0B5264DCCA894F10471640F4BC6DE092DB4D54137635308312
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\VAHFWDJC\common-sandbox.71780db40.chunk[1].js	ASCII text, with very long lines	7A84D4394344E5E07063863F11656218	8B8D8EA4E0D5558CE4E336E165D0E43313769AB4	0BFCD135154F3AA7DA46B0F0A7E6CC1BD3402D710D4CB2E958C2C9ABA7E21EA3
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\VAHFWDJC\content-sidebar.0ff11d4a03[1].css	ASCII text, with very long lines, with no line terminators	159F5E7E94AF878664C6490270CD2998	EFB4B60AF7A7BB6E543339B4016A60BDC78C7D41	6E5D870B3EE59E9DAD6A378F1E264C193830BD895FAF1145383E709714A82D76
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\VAHFWDJC\content-sidebar.3947dacfa1[1].js	ASCII text, with very long lines, with no line terminators	8A1C89E8D11EDE23AE9A655603FDD326	A65C4BE8E894B920A766E9CE660B2110459DF461	4DA8D1F20E6A74286DEBD45DEE625FF77FCF3C1E0E9EC2FA7C2F7A97A3A63EED
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\VAHFWDJC\core.min[1].js	UTF-8 Unicode text, with very long lines, with LF, NEL line terminators	8F402D83489BA25EF87CDFC67BF47932	EFBCAE4F111F6CECF56E1B88857F688EEECABAF1	50DA66E885D183593100789E7376D6171310D22F64E798A1DDA6AD5940CF0967
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\VAHFWDJC\preview-components~shared-file.8b8bb8ddac[1].js	ASCII text, with very long lines, with no line terminators	81A4E9BF376814968ADA78905E39D8DB	7A30C05118B8723C66EF6E7F8F5A2A5116E0D374	D9912016553DA753EE9624D8CDD0D689100550CF27A821E3508129EA54B28339
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\VAHFWDJC\preview[1].css	ASCII text, with very long lines	7AE9D873A308184A7B92E65BAF78118B	AF043306849A84645F8AADF500DF40720A500D35	8E54B91D08B1193B9FB597DC92F7A993586DB33E90305846E79C8A0F0B186A45
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\VAHFWDJC\preview[1].js	UTF-8 Unicode text, with very long lines	DE225488B7DEC3D8D1DBB7582A3E3A7D	8F07E5A9D8EB7F1A585A97EA19CC70833D66C8A2	FDA0E2F087AB07302C76869E4EC36967C6480E13E65F03922E0960058DF09964
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\VAHFWDJC\sandbox-startup.788fc841a[1].js	ASCII text, with very long lines	6DD5F7A0D089D3A7352F99AE6C654A22	356B1A9B08442C712C1F130761B59B6AF5EB3163	4639E1FFC804275C280FAED339C11CCCA77ED5989687351F9E9434F544F83F49
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\VAHFWDJC\sandbox.ba8055760[1].js	ASCII text, with very long lines	D716E0ECCDC5C6C950EF8E5000239C2C	BB1B1D4F5E8C81DC21E04476EA7B7C799DF62306	6C8F493A3270D8C5D58AC43376683AEF39E6CFBF7BE242BF8684F4C2B93BE2A6
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\VAHFWDJC\shared-file.e033e213bd[1].js	ASCII text, with very long lines, with no line terminators	8638E4702A54C3F14D108C0577EDE6B4	A9BDA2BC73782504627CAE8803281BA9E2D5ED27	BAAA4397909DA2A9B0C4ED52B1EE2BA3B44C3C1A1816A5F213C6A8180BB6EF59
C:\Users\user\AppData\Local\Temp\datA757.tmp	Web Open Font Format, TrueType, length 119132, version 1.0	3E4A4FC6317C4C2CF35D7C77EC1789C3	40EA0D8678B92988824193587F707E3AEDC4591F	607EC0A4A29F6A4607F6E0A3CF486E50322DDF66F1F1870150CB69A7061E978D
C:\Users\user\AppData\Local\Temp\datA786.tmp	Web Open Font Format (Version 2), TrueType, length 84396, version 2.983	8A54EA1AEB67D07C751BD5F03068317B	CFBEE4F2FD7F359A2A60648BB6797CAC1FD4DA3E	4230A20B841519BDBE4B0C154BAD414E017CF80B3918127D45C4F907EEA07280
C:\Users\user\AppData\Local\Temp\datC4E3.tmp	OpenType font data	37E1D6CA7B9B67BF3DD4FE8FE8575D42	B94DE65905112B4E6EEA8AC43E5C6A527E231A2F	121EB290106B281FCF19391604B49F08698FBB275150F8349976773441F14A29
C:\Users\user\AppData\Local\Temp\datC523.tmp	OpenType font data	087A3AD3E3ACC6B97C9D29A36D4764CF	65751C20AB383C8F4581F1CBD70E300234A1D025	3D1BF20FB4235798679BD7CD9DE77F2200F529A80A1FF005C4149B2F2F7324B1
C:\Users\user\AppData\Local\Temp\datC543.tmp	2005Cal	328715CC611F65D834B7946F3AE7EAA3	0623BDC78EBBD9AF61FBDD01388B9E531BE5A294	B6642CCDB15668532C5FF0BEE45709326FA4FC0893212C4614978380ED9789F5
C:\Users\user\AppData\Local\Temp\~DF06DEECED06AE8102.TMP	data	8686B620BE166FAB955117EC102F465F	A43D2946395D0E39E03F6D35B11F328AE073EF72	864F91DCB6601D90C5AEE79C34998C9D290679ADADE5C620734710A7657BC45B
C:\Users\user\AppData\Local\Temp\~DF494EE8F4D493C88D.TMP	data	4BF43A43EA6A37416671EE28D1FC76B3	2CDBD6914136DA92C9214A69D9FBAC2B8438760D	C546FCF063307B85813ED2EF3C450D0D2D498064D8964FC3C7BCFB96483F6AB7
C:\Users\user\AppData\Local\Temp\~DF7291DDFAB2583D8F.TMP	data	AB889A32AB9ACD33E816C2422337C69A	1190C6B34DED2D295827C2A88310D10A8B90B59B	4D6EC54B8D244E63B0F04FBE2B97402A3DF722560AD12F218665BA440F4CEFDA

Analysis Report https://app.box.com/s/4c3tf7iumvvg3c3q6e7udjiq7o0yealq

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection:

Compliance:

Networking:

System Summary:

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted Domains

Contacted URLs