Joe Sandbox Cloud Basic Analysis Report
Edit tour

Windows Analysis Report
OriginalMessage.txt.msg

Overview

General Information

Sample name:OriginalMessage.txt.msg
Analysis ID:1379793
MD5:142c9340997e4f8c0bc50f26c65eec47
SHA1:057adb3e934624a5949facd68aba0ea4267971ae
SHA256:de00ddcccc6e59efb0c03c3ebcb9c1f1faca8646e88ef306585cbb86c0460327
Infos:

Detection

HTMLPhisher
Score:60
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Yara detected HtmlPhish10
Yara detected HtmlPhish44
Uses the Telegram API (likely for C&C communication)
Creates files inside the system directory
Detected clear text password fields (password is not hidden)
Detected hidden input values containing email addresses (often used in phishing pages)
Queries information about the installed CPU (vendor, model number etc)
Stores files to the Windows start menu directory

Classification

RansomwareSpreadingPhishingBankerTrojan / BotAdwareSpywareExploiterEvaderMinercleansuspiciousmalicious

Process Tree

  • System is w10x64_ra
  • OUTLOOK.EXE (PID: 5756 cmdline: C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /f "C:\Users\user\Desktop\OriginalMessage.txt.msg MD5: 91A5292942864110ED734005B7E005C0)
    • ai.exe (PID: 6732 cmdline: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "1A8F1334-B778-406D-A997-6E2E448E187B" "F2FD48B5-5CDE-4942-A3EE-DF260F55F3B6" "5756" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx MD5: EC652BEDD90E089D9406AFED89A8A8BD)
    • chrome.exe (PID: 7108 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://sgp1.vultrobjects.com/protectionbuctech.com/UNIVERSAL.html#dmarquez@ddcaz.com MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)
      • chrome.exe (PID: 6792 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1712 --field-trial-handle=1992,i,1855726129188588139,7601786300078512878,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)
  • cleanup

Yara Signatures

Dropped Files

SourceRuleDescriptionAuthorStrings
dropped/chromecache_103JoeSecurity_HtmlPhish_44Yara detected HtmlPhish_44Joe Security

    HTML

    SourceRuleDescriptionAuthorStrings
    0.0.pages.csvJoeSecurity_HtmlPhish_10Yara detected HtmlPhish_10Joe Security
      1.1.pages.csvJoeSecurity_HtmlPhish_10Yara detected HtmlPhish_10Joe Security
        1.2.pages.csvJoeSecurity_HtmlPhish_10Yara detected HtmlPhish_10Joe Security

          Sigma Signatures

          ⊘No Sigma rule has matched

          Snort Signatures

          ⊘No Snort rule has matched

          Joe Sandbox Signatures

          • • Phishing
          • • Compliance
          • • Networking
          • • System Summary
          • • Boot Survival
          • • Hooking and other Techniques for Hiding and Protection
          • • Malware Analysis System Evasion
          • • Language, Device and Operating System Detection

          Click to jump to signature section

          Show All Signature Results

          Phishing

          barindex
          Source: Yara matchFile source: 0.0.pages.csv, type: HTML
          Source: Yara matchFile source: 1.1.pages.csv, type: HTML
          Source: Yara matchFile source: 1.2.pages.csv, type: HTML
          Source: Yara matchFile source: dropped/chromecache_103, type: DROPPED
          Source: https://sgp1.vultrobjects.com/protectionbuctech.com/UNIVERSAL.html#HTTP Parser: <input type="text"... for password input
          Source: https://sgp1.vultrobjects.com/protectionbuctech.com/UNIVERSAL.html#dmarquez@ddcaz.comHTTP Parser: info@dell.com
          Source: https://sgp1.vultrobjects.com/protectionbuctech.com/UNIVERSAL.html#dmarquez@ddcaz.comHTTP Parser: <input type="password" .../> found
          Source: https://sgp1.vultrobjects.com/protectionbuctech.com/UNIVERSAL.html#HTTP Parser: <input type="password" .../> found
          Source: unknownHTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.17:49754 version: TLS 1.2

          Networking

          barindex
          Source: unknownDNS query: name: api.telegram.org
          Source: unknownDNS query: name: api.telegram.org
          Source: unknownDNS query: name: api.telegram.org
          Source: unknownDNS query: name: api.telegram.org
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownTCP traffic detected without corresponding DNS query: 23.40.205.41
          Source: unknownTCP traffic detected without corresponding DNS query: 23.40.205.41
          Source: unknownTCP traffic detected without corresponding DNS query: 20.12.23.50
          Source: unknownTCP traffic detected without corresponding DNS query: 20.12.23.50
          Source: unknownTCP traffic detected without corresponding DNS query: 20.12.23.50
          Source: unknownTCP traffic detected without corresponding DNS query: 20.12.23.50
          Source: unknownTCP traffic detected without corresponding DNS query: 20.12.23.50
          Source: unknownTCP traffic detected without corresponding DNS query: 20.12.23.50
          Source: unknownTCP traffic detected without corresponding DNS query: 20.12.23.50
          Source: unknownTCP traffic detected without corresponding DNS query: 20.12.23.50
          Source: unknownTCP traffic detected without corresponding DNS query: 20.12.23.50
          Source: unknownTCP traffic detected without corresponding DNS query: 20.12.23.50
          Source: unknownTCP traffic detected without corresponding DNS query: 20.12.23.50
          Source: unknownTCP traffic detected without corresponding DNS query: 20.12.23.50
          Source: unknownTCP traffic detected without corresponding DNS query: 20.12.23.50
          Source: unknownTCP traffic detected without corresponding DNS query: 20.12.23.50
          Source: unknownTCP traffic detected without corresponding DNS query: 20.12.23.50
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownDNS traffic detected: queries for: sgp1.vultrobjects.com
          Source: unknownNetwork traffic detected: HTTP traffic on port 49733 -> 443
          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49742
          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49741
          Source: unknownNetwork traffic detected: HTTP traffic on port 49727 -> 443
          Source: unknownNetwork traffic detected: HTTP traffic on port 49766 -> 443
          Source: unknownNetwork traffic detected: HTTP traffic on port 49762 -> 443
          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49739
          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49738
          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49737
          Source: unknownNetwork traffic detected: HTTP traffic on port 49759 -> 443
          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49735
          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49734
          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49733
          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49730
          Source: unknownNetwork traffic detected: HTTP traffic on port 49742 -> 443
          Source: unknownNetwork traffic detected: HTTP traffic on port 49767 -> 443
          Source: unknownNetwork traffic detected: HTTP traffic on port 49728 -> 443
          Source: unknownNetwork traffic detected: HTTP traffic on port 49749 -> 443
          Source: unknownNetwork traffic detected: HTTP traffic on port 49763 -> 443
          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49729
          Source: unknownNetwork traffic detected: HTTP traffic on port 49752 -> 443
          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49728
          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49727
          Source: unknownNetwork traffic detected: HTTP traffic on port 49735 -> 443
          Source: unknownNetwork traffic detected: HTTP traffic on port 49718 -> 443
          Source: unknownNetwork traffic detected: HTTP traffic on port 49739 -> 443
          Source: unknownNetwork traffic detected: HTTP traffic on port 49756 -> 443
          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49767
          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49766
          Source: unknownNetwork traffic detected: HTTP traffic on port 49758 -> 443
          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49764
          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49763
          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49762
          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49761
          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49760
          Source: unknownNetwork traffic detected: HTTP traffic on port 49741 -> 443
          Source: unknownNetwork traffic detected: HTTP traffic on port 49729 -> 443
          Source: unknownNetwork traffic detected: HTTP traffic on port 49748 -> 443
          Source: unknownNetwork traffic detected: HTTP traffic on port 49760 -> 443
          Source: unknownNetwork traffic detected: HTTP traffic on port 49764 -> 443
          Source: unknownNetwork traffic detected: HTTP traffic on port 49719 -> 443
          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49719
          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49718
          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49759
          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49758
          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49757
          Source: unknownNetwork traffic detected: HTTP traffic on port 49738 -> 443
          Source: unknownNetwork traffic detected: HTTP traffic on port 49755 -> 443
          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49756
          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49755
          Source: unknownNetwork traffic detected: HTTP traffic on port 49757 -> 443
          Source: unknownNetwork traffic detected: HTTP traffic on port 49734 -> 443
          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49754
          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49752
          Source: unknownNetwork traffic detected: HTTP traffic on port 49730 -> 443
          Source: unknownNetwork traffic detected: HTTP traffic on port 49705 -> 443
          Source: unknownNetwork traffic detected: HTTP traffic on port 49761 -> 443
          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49749
          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49705
          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49748
          Source: unknownNetwork traffic detected: HTTP traffic on port 49754 -> 443
          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49703
          Source: unknownNetwork traffic detected: HTTP traffic on port 49737 -> 443
          Source: unknownHTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.17:49754 version: TLS 1.2
          Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Windows\SystemTemp\chrome_BITS_7108_1970930688
          Source: classification engineClassification label: mal60.phis.troj.winMSG@20/69@45/252
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEFile created: C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEFile created: C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20240123T1944070796-5756.etl
          Source: unknownProcess created: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /f "C:\Users\user\Desktop\OriginalMessage.txt.msg
          Source: unknownProcess created: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /f "C:\Users\user\Desktop\OriginalMessage.txt.msg
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "1A8F1334-B778-406D-A997-6E2E448E187B" "F2FD48B5-5CDE-4942-A3EE-DF260F55F3B6" "5756" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "1A8F1334-B778-406D-A997-6E2E448E187B" "F2FD48B5-5CDE-4942-A3EE-DF260F55F3B6" "5756" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://sgp1.vultrobjects.com/protectionbuctech.com/UNIVERSAL.html#dmarquez@ddcaz.com
          Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1712 --field-trial-handle=1992,i,1855726129188588139,7601786300078512878,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
          Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
          Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
          Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1712 --field-trial-handle=1992,i,1855726129188588139,7601786300078512878,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
          Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
          Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
          Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
          Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
          Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
          Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
          Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
          Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
          Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
          Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://sgp1.vultrobjects.com/protectionbuctech.com/UNIVERSAL.html#dmarquez@ddcaz.com
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{F959DBBB-3867-41F2-8E5F-3B8BEFAA81B3}\InprocServer32
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEWindow found: window name: SysTabControl32
          Source: Window RecorderWindow detected: More than 3 window changes detected
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Common
          Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
          Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
          Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
          Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
          Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
          Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
          Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEFile Volume queried: C:\Windows\SysWOW64 FullSizeInformation
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEFile Volume queried: C:\Windows\SysWOW64 FullSizeInformation
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information queried: ProcessInformation
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXERegistry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXERegistry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0

          Mitre Att&ck Matrix

          Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpactResource DevelopmentReconnaissance
          Valid AccountsWindows Management Instrumentation1
          Registry Run Keys / Startup Folder          		1
          Process Injection          		11
          Masquerading          		OS Credential Dumping1
          Process Discovery          		Remote ServicesData from Local SystemExfiltration Over Other Network Medium1
          Web Service          		Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationAbuse Accessibility FeaturesAcquire InfrastructureGather Victim Identity Information
          Default AccountsScheduled Task/JobBoot or Logon Initialization Scripts1
          Registry Run Keys / Startup Folder          		1
          Process Injection          		LSASS Memory12
          System Information Discovery          		Remote Desktop ProtocolData from Removable MediaExfiltration Over Bluetooth2
          Encrypted Channel          		SIM Card SwapObtain Device Cloud BackupsNetwork Denial of ServiceDomainsCredentials
          Domain AccountsAtLogon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared DriveAutomated Exfiltration1
          Non-Application Layer Protocol          		Data Encrypted for ImpactDNS ServerEmail Addresses
          Local AccountsCronLogin HookLogin HookBinary PaddingNTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput CaptureTraffic Duplication2
          Application Layer Protocol          		Data DestructionVirtual Private ServerEmployee Names

          Screenshots

          Download Video

          Thumbnails

          This section contains all screenshots as thumbnails, including those not shown in the slideshow.


          windows-stand

          Antivirus, Machine Learning and Genetic Malware Detection

          Initial Sample

          ⊘No Antivirus matches

          Dropped Files

          ⊘No Antivirus matches

          Unpacked PE Files

          ⊘No Antivirus matches

          Domains

          ⊘No Antivirus matches

          URLs

          ⊘No Antivirus matches

          Domains and IPs

          Contacted Domains

          NameIPActiveMaliciousAntivirus DetectionReputation
          stackpath.bootstrapcdn.com
          		104.18.11.207
          		truefalse
            		high
            accounts.google.com
            		74.125.138.84
            		truefalse
              		high
              maxcdn.bootstrapcdn.com
              		104.18.10.207
              		truefalse
                		high
                sgp1.vultrobjects.com
                		45.32.96.10
                		truefalse
                  		unknown
                  ddcaz-web-1204888116.us-east-1.elb.amazonaws.com
                  		34.204.159.217
                  		truefalse
                    		high
                    dns.google
                    		8.8.4.4
                    		truefalse
                      		unknown
                      d26p066pn2w0s0.cloudfront.net
                      		52.85.151.98
                      		truefalse
                        		high
                        code.jquery.com
                        		151.101.66.137
                        		truefalse
                          		high
                          cdnjs.cloudflare.com
                          		104.17.24.14
                          		truefalse
                            		high
                            ipinfo.io
                            		34.117.186.192
                            		truefalse
                              		high
                              www.google.com
                              		142.250.105.104
                              		truefalse
                                		high
                                clients.l.google.com
                                		108.177.122.138
                                		truefalse
                                  		high
                                  api.telegram.org
                                  		149.154.167.220
                                  		truefalse
                                    		high
                                    clients1.google.com
                                    		unknown
                                    		unknownfalse
                                      		high
                                      ka-f.fontawesome.com
                                      		unknown
                                      		unknownfalse
                                        		high
                                        kit.fontawesome.com
                                        		unknown
                                        		unknownfalse
                                          		high
                                          www.ddcaz.com
                                          		unknown
                                          		unknownfalse
                                            		high
                                            clients2.google.com
                                            		unknown
                                            		unknownfalse
                                              		high
                                              logo.clearbit.com
                                              		unknown
                                              		unknownfalse
                                                		high

                                                Contacted URLs

                                                NameMaliciousAntivirus DetectionReputation
                                                https://sgp1.vultrobjects.com/protectionbuctech.com/UNIVERSAL.html#dmarquez@ddcaz.comfalse
                                                  		unknown
                                                  https://sgp1.vultrobjects.com/protectionbuctech.com/UNIVERSAL.html#false
                                                    		unknown

                                                    World Map of Contacted IPs

                                                    • No. of IPs < 25%
                                                    • 25% < No. of IPs < 50%
                                                    • 50% < No. of IPs < 75%
                                                    • 75% < No. of IPs

                                                    Public IPs

                                                    IPDomainCountryFlagASNASN NameMalicious
                                                    34.117.186.192
                                                    		ipinfo.ioUnited States
                                                    		139070GOOGLE-AS-APGoogleAsiaPacificPteLtdSGfalse
                                                    172.253.124.101
                                                    		unknownUnited States
                                                    		15169GOOGLEUSfalse
                                                    104.18.10.207
                                                    		maxcdn.bootstrapcdn.comUnited States
                                                    		13335CLOUDFLARENETUSfalse
                                                    64.233.176.95
                                                    		unknownUnited States
                                                    		15169GOOGLEUSfalse
                                                    104.18.40.68
                                                    		unknownUnited States
                                                    		13335CLOUDFLARENETUSfalse
                                                    8.8.4.4
                                                    		dns.googleUnited States
                                                    		15169GOOGLEUSfalse
                                                    45.32.96.10
                                                    		sgp1.vultrobjects.comUnited States
                                                    		20473AS-CHOOPAUSfalse
                                                    173.194.219.94
                                                    		unknownUnited States
                                                    		15169GOOGLEUSfalse
                                                    8.8.8.8
                                                    		unknownUnited States
                                                    		15169GOOGLEUSfalse
                                                    149.154.167.220
                                                    		api.telegram.orgUnited Kingdom
                                                    		62041TELEGRAMRUfalse
                                                    20.189.173.18
                                                    		unknownUnited States
                                                    		8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                                                    151.101.66.137
                                                    		code.jquery.comUnited States
                                                    		54113FASTLYUSfalse
                                                    52.85.151.98
                                                    		d26p066pn2w0s0.cloudfront.netUnited States
                                                    		16509AMAZON-02USfalse
                                                    108.177.122.138
                                                    		clients.l.google.comUnited States
                                                    		15169GOOGLEUSfalse
                                                    172.217.215.95
                                                    		unknownUnited States
                                                    		15169GOOGLEUSfalse
                                                    52.113.194.132
                                                    		unknownUnited States
                                                    		8068MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                                                    64.233.177.94
                                                    		unknownUnited States
                                                    		15169GOOGLEUSfalse
                                                    104.17.24.14
                                                    		cdnjs.cloudflare.comUnited States
                                                    		13335CLOUDFLARENETUSfalse
                                                    1.1.1.1
                                                    		unknownAustralia
                                                    		13335CLOUDFLARENETUSfalse
                                                    184.31.62.93
                                                    		unknownUnited States
                                                    		16625AKAMAI-ASUSfalse
                                                    142.250.105.104
                                                    		www.google.comUnited States
                                                    		15169GOOGLEUSfalse
                                                    172.253.124.94
                                                    		unknownUnited States
                                                    		15169GOOGLEUSfalse
                                                    104.18.11.207
                                                    		stackpath.bootstrapcdn.comUnited States
                                                    		13335CLOUDFLARENETUSfalse
                                                    172.64.204.20
                                                    		unknownUnited States
                                                    		13335CLOUDFLARENETUSfalse
                                                    52.109.8.89
                                                    		unknownUnited States
                                                    		8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                                                    239.255.255.250
                                                    		unknownReserved
                                                    		unknownunknownfalse
                                                    34.204.159.217
                                                    		ddcaz-web-1204888116.us-east-1.elb.amazonaws.comUnited States
                                                    		14618AMAZON-AESUSfalse
                                                    108.177.122.95
                                                    		unknownUnited States
                                                    		15169GOOGLEUSfalse
                                                    74.125.138.84
                                                    		accounts.google.comUnited States
                                                    		15169GOOGLEUSfalse
                                                    52.85.151.109
                                                    		unknownUnited States
                                                    		16509AMAZON-02USfalse

                                                    Private

                                                    IP
                                                    192.168.2.17

                                                    General Information

                                                    Joe Sandbox version:39.0.0 Ruby
                                                    Analysis ID:1379793
                                                    Start date and time:2024-01-23 19:43:32 +01:00
                                                    Joe Sandbox product:CloudBasic
                                                    Overall analysis duration:
                                                    Hypervisor based Inspection enabled:false
                                                    Report type:full
                                                    Cookbook file name:defaultwindowsinteractivecookbook.jbs
                                                    Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                                    Number of analysed new started processes analysed:10
                                                    Number of new started drivers analysed:0
                                                    Number of existing processes analysed:0
                                                    Number of existing drivers analysed:0
                                                    Number of injected processes analysed:0
                                                    Technologies:
                                                    • EGA enabled
                                                    Analysis Mode:stream
                                                    Analysis stop reason:Timeout
                                                    Sample name:OriginalMessage.txt.msg
                                                    Detection:MAL
                                                    Classification:mal60.phis.troj.winMSG@20/69@45/252
                                                    Cookbook Comments:
                                                    • Found application associated with file extension: .msg
                                                    • Exclude process from analysis (whitelisted): dllhost.exe
                                                    • Excluded IPs from analysis (whitelisted): 52.109.8.89
                                                    • Excluded domains from analysis (whitelisted): config.officeapps.live.com, prod.configsvc1.live.com.akadns.net, us.configsvc1.live.com.akadns.net, officeclient.microsoft.com
                                                    • Not all processes where analyzed, report is missing behavior information
                                                    • Report size getting too big, too many NtQueryAttributesFile calls found.
                                                    • Report size getting too big, too many NtQueryValueKey calls found.
                                                    • VT rate limit hit for: OriginalMessage.txt.msg

                                                    Created / dropped Files

                                                    C:\Users\user\AppData\Local\Microsoft\FORMS\FRMCACHE.DAT

                                                    Download File
                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                                    File Type:data
                                                    Category:dropped
                                                    Size (bytes):231348
                                                    Entropy (8bit):4.38687935340776
                                                    Encrypted:false
                                                    SSDEEP:
                                                    MD5:5811BF3104864CF79099C62A8E229785
                                                    SHA1:F0A01977F83627361E47901620B6374D3CBDF947
                                                    SHA-256:CDF1BC86DA102B466B0BB32014D8E64998D29E0039843F944961A9C76DA7A0B2
                                                    SHA-512:B0E0B2BE0E0AD73EFE2789B9559D6939EBBB940E7CEBEF7EB0A34288C0B15BC5FCF6AF44988172CCDCC3133944FB7F7EE3D76A78C0B7DF57614F99FC337F309C
                                                    Malicious:false
                                                    Reputation:low
                                                    Preview:TH02...... .P...,N......SM01X...,.......,N..........IPM.Activity...........h...............h............H..hL.......1..V...h..........@.H..h\tor ...AppD...h0#3.0..........hi.:?..C........h........_`jj...h..:?@...I.0w...h....H...8.oj...0....T...............d.........2h...............k..............!h.............. h$.v)..........#h....8.........$h..@.....8....."h..@.......@...'h..............1hi.:?<.........0h....4....oj../h....h.....ojH..h.zC.p...L.....-h ............+h..:?....@................... ..............F7..............FIPM.Activity....Form....Standard....Journal Entry...IPM.Microsoft.FolderDesign.FormsDescription................F.k..........1122110020000000....Microsoft...This form is used to create journal entries.........kf...... ..........&...........(.......(... ...@.....................................................................................................................fffffffff........wwwwwwww.p....pp..............p...............pw..............pw..DDDDO..

                                                    C:\Users\user\AppData\Local\Microsoft\FontCache\4\CatalogCacheMetaData.xml

                                                    Download File
                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                                    File Type:XML 1.0 document, ASCII text, with very long lines (1869), with no line terminators
                                                    Category:dropped
                                                    Size (bytes):1869
                                                    Entropy (8bit):5.077336821943949
                                                    Encrypted:false
                                                    SSDEEP:
                                                    MD5:0DB1E49E525CA72FBE24FCBDBCA0E5E1
                                                    SHA1:7FCD0252B2E33C2D0801D848F2424E7E23BE3DEA
                                                    SHA-256:A447B79AE74D7A85E3F3BBDEE373D0725C2142A06E1E9F4C8856056D1168E3B3
                                                    SHA-512:D10EADA9F73CC518991E9728FEDF887C72DAD6045DB634F8D674CFD6CCFD62ECD9DC5FDC8925A0F390A0B561B1BB9752D1611C1D5BA043F0256CE0C8E81D8DF5
                                                    Malicious:false
                                                    Reputation:low
                                                    Preview:<?xml version="1.0" encoding="UTF-8" standalone="yes"?><root><version>1</version><Count>12</Count><Resource><Id>Aptos_26215680</Id><LAT>2024-01-23T18:44:08Z</LAT><key>29939506207.ttf</key><folder>Aptos</folder><type>4</type></Resource><Resource><Id>Aptos_45876480</Id><LAT>2024-01-23T18:44:08Z</LAT><key>27160079615.ttf</key><folder>Aptos</folder><type>4</type></Resource><Resource><Id>Aptos Display_26215680</Id><LAT>2024-01-23T18:44:08Z</LAT><key>23001069669.ttf</key><folder>Aptos Display</folder><type>4</type></Resource><Resource><Id>Aptos Narrow_26215426</Id><LAT>2024-01-23T18:44:08Z</LAT><key>37262344671.ttf</key><folder>Aptos Narrow</folder><type>4</type></Resource><Resource><Id>Aptos Display_26215682</Id><LAT>2024-01-23T18:44:08Z</LAT><key>28367963232.ttf</key><folder>Aptos Display</folder><type>4</type></Resource><Resource><Id>Aptos Narrow_45876224</Id><LAT>2024-01-23T18:44:08Z</LAT><key>24153076628.ttf</key><folder>Aptos Narrow</folder><type>4</type></Resource><Resource><Id>Aptos_

                                                    C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\714865B8-AD83-4603-B990-616BE6FCC44E

                                                    Download File
                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                                    File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                    Category:modified
                                                    Size (bytes):164488
                                                    Entropy (8bit):5.342330841950862
                                                    Encrypted:false
                                                    SSDEEP:
                                                    MD5:530C377A8607704DDEC070FB034767DF
                                                    SHA1:4BA637C7059F3855973427C0273CF100BE94CC00
                                                    SHA-256:3922761195198871541D948A2EB7619EED0E65BC54B574279E72CA85D62C4C9C
                                                    SHA-512:12A049D13DD929BF982459A5C3D38BFE7F6032C905CAC5E101A305DAF037CFB4A5053B90708048F1EBAA8ACE65B0526A3994847B60ABF50358E8DC79B6143C8E
                                                    Malicious:false
                                                    Reputation:low
                                                    Preview:<?xml version="1.0" encoding="utf-8"?>..<o:OfficeConfig xmlns:o="urn:schemas-microsoft-com:office:office">.. <o:services o:GenerationTime="2024-01-23T18:44:09">.. Build: 16.0.17315.30527-->.. <o:default>.. <o:ticket o:headerName="Authorization" o:headerValue="{}" />.. </o:default>.. <o:service o:name="Research">.. <o:url>https://rr.office.microsoft.com/research/query.asmx</o:url>.. </o:service>.. <o:service o:name="ORedir">.. <o:url>https://o15.officeredir.microsoft.com/r</o:url>.. </o:service>.. <o:service o:name="ORedirSSL">.. <o:url>https://o15.officeredir.microsoft.com/r</o:url>.. </o:service>.. <o:service o:name="ClViewClientHelpId" o:authentication="1">.. <o:url>https://[MAX.BaseHost]/client/results</o:url>.. <o:ticket o:policy="MBI_SSL_SHORT" o:idprovider="1" o:target="[MAX.AuthHost]" o:headerValue="Passport1.4 from-PP='{}&amp;p='" />.. <o:ticket o:idprovider="3" o:headerValue="Bearer {}" o:resourceId="[MAX.ResourceId]" o:authorityUrl="[ADALAuthorityU

                                                    C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-shm

                                                    Download File
                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                                    File Type:data
                                                    Category:dropped
                                                    Size (bytes):32768
                                                    Entropy (8bit):0.04587332210802959
                                                    Encrypted:false
                                                    SSDEEP:
                                                    MD5:106C8AA19AE35343016E7C5CDD11BA27
                                                    SHA1:C1C875072056D62ECFAD4F9DEF7E5E2EACFE8A0C
                                                    SHA-256:EFE976A96B81E493CF32D6862E7529ED7830F4BD148EC4FD0CB304432229EF10
                                                    SHA-512:E04DCF67C4B100695BCF47A1389372ECD33903CBAB7E6DFF62535408EE04A7666A517772DCD3A58FE95595D76854CE72FFEEFA61A668E068118B2E2A4BEAE179
                                                    Malicious:false
                                                    Reputation:low
                                                    Preview:..-.....................wur\(_....Jg.@..`..A......-.....................wur\(_....Jg.@..`..A............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                    C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-wal

                                                    Download File
                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                                    File Type:SQLite Write-Ahead Log, version 3007000
                                                    Category:dropped
                                                    Size (bytes):49472
                                                    Entropy (8bit):0.4838602314546007
                                                    Encrypted:false
                                                    SSDEEP:
                                                    MD5:2D7792CA15A5F79F0163AE0D2363C59D
                                                    SHA1:05AA6E0ADF292B86158AA768917B0D7D81A418A7
                                                    SHA-256:9B4DE4277B57F78A9940EAC21E58B4E52C3A4164ECAAEB910F630F3F990C9A39
                                                    SHA-512:79F7DE433751B8F5A631102936081D4D48F04169DF369D1E8017052EAC1BD9ADDB207C97DDEB58427BAE007585A28A4F5D06FD5B124B616E28B2EDB71E2FD8BB
                                                    Malicious:false
                                                    Reputation:low
                                                    Preview:7....-............Jg.@..<1................Jg.@...WJ.p.b.SQLite format 3......@ .......................................................................... .............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{141648DB-27F7-47A4-A2E1-04EE004DD30C}.tmp

                                                    Download File
                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                                    File Type:data
                                                    Category:dropped
                                                    Size (bytes):2496
                                                    Entropy (8bit):2.8019380519337265
                                                    Encrypted:false
                                                    SSDEEP:
                                                    MD5:E0B926BAFAA622D328346CA1E4DDD2B7
                                                    SHA1:60A3DA61366871B72834C85CCAFE0F96D178FCF1
                                                    SHA-256:46318CAB150F00EFD398A99EFB5BE39592F574719623D3BEE1E4FE016468A433
                                                    SHA-512:687CBE539AE57068E857AE8328EC6463CA3DC0A588E1F0D8B9ED5A8402189D6FB232B5310C5D5C323A4AEDB7B4079169594F5DB87A92B18828BBDC62CE0182C1
                                                    Malicious:false
                                                    Reputation:low
                                                    Preview:....D.e.a.r. .d.m.a.r.q.u.e.z.......Y.o.u.r...r.e.c.e.n.t. .r.e.q.u.e.s.t. .t.o...d.e.a.c.t.i.v.a.t.e. .y.o.u.r. .e.-.m.a.i.l. .w.i.l.l. .b.e. .p.r.o.c.e.s.s.e.d. .s.h.o.r.t.l.y...I.f. .t.h.i.s. .r.e.q.u.e.s.t. .w.a.s. .m.a.d.e. .b.y. .a.c.c.i.d.e.n.t. .a.n.d. .y.o.u. .h.a.v.e. .n.o. .k.n.o.w.l.e.d.g.e. .o.f. .t.h.i.s.,. .y.o.u. .a.r.e. ......................................................................................................................................................................................... ...$...r...v...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                    C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1706035448068192200_560632EC-7288-4B1F-85DD-268F3FED26AC.log

                                                    Download File
                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                                    File Type:ASCII text, with very long lines (28744), with CRLF line terminators
                                                    Category:dropped
                                                    Size (bytes):20971520
                                                    Entropy (8bit):0.16278551233626448
                                                    Encrypted:false
                                                    SSDEEP:
                                                    MD5:E60982B83C613F506367848BC124B3CB
                                                    SHA1:6A221BD7654A82236D46482D9874245F19798374
                                                    SHA-256:2C580BAA01409F02E95BF173B92B6A80AC0D9AECE3F2BB01B35E9A54F633D88E
                                                    SHA-512:FAB637716B34104207DCD1A919C8EEF055D435C8EC9C61EDBEB881C3AF5F517A5082103D94D14B2B31F85027E17B5C8341D3F496992088B9C352AFC2BAC9C4D5
                                                    Malicious:false
                                                    Reputation:low
                                                    Preview:Timestamp.Process.TID.Area.Category.EventID.Level.Message.Correlation..01/23/2024 18:44:08.136.OUTLOOK (0x167C).0xAB4.Microsoft Outlook.Telemetry Event.b7vzq.Medium.SendEvent {"EventName":"Office.Text.GDIAssistant.HandleCallback","Flags":30962256044949761,"InternalSequenceNumber":22,"Time":"2024-01-23T18:44:08.136Z","Contract":"Office.System.Activity","Activity.CV":"7DIGVohyH0uF3SaPP+0mrA.4.9","Activity.Duration":12,"Activity.Count":1,"Activity.AggMode":0,"Activity.Success":true,"Data.GdiFamilyName":"","Data.CloudFontStatus":6,"Data.CloudFontTypes":256}...01/23/2024 18:44:08.152.OUTLOOK (0x167C).0xAB4.Microsoft Outlook.Telemetry Event.b7vzq.Medium.SendEvent {"EventName":"Office.Text.ResourceClient.Deserialize","Flags":30962256044949761,"InternalSequenceNumber":24,"Time":"2024-01-23T18:44:08.152Z","Contract":"Office.System.Activity","Activity.CV":"7DIGVohyH0uF3SaPP+0mrA.4.10","Activity.Duration":9126,"Activity.Count":1,"Activity.AggMode":0,"Activity.Success":true,"Data.JsonFileMajorVers

                                                    C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1706035448069870500_560632EC-7288-4B1F-85DD-268F3FED26AC.log

                                                    Download File
                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                                    File Type:data
                                                    Category:dropped
                                                    Size (bytes):20971520
                                                    Entropy (8bit):0.0
                                                    Encrypted:false
                                                    SSDEEP:
                                                    MD5:8F4E33F3DC3E414FF94E5FB6905CBA8C
                                                    SHA1:9674344C90C2F0646F0B78026E127C9B86E3AD77
                                                    SHA-256:CD52D81E25F372E6FA4DB2C0DFCEB59862C1969CAB17096DA352B34950C973CC
                                                    SHA-512:7FB91E868F3923BBD043725818EF3A5D8D08EBF1059A18AC0FE07040D32EEBA517DA11515E6A4AFAEB29BCC5E0F1543BA2C595B0FE8E6167DDC5E6793EDEF5BB
                                                    Malicious:false
                                                    Reputation:low
                                                    Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                    C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20240123T1944070796-5756.etl

                                                    Download File
                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                                    File Type:data
                                                    Category:modified
                                                    Size (bytes):98304
                                                    Entropy (8bit):4.493484774669348
                                                    Encrypted:false
                                                    SSDEEP:
                                                    MD5:C34F9C2FD2939BFF811A61ABA12F92F4
                                                    SHA1:05A38DB2EEF6FAEF38775A574F282626A1841C2C
                                                    SHA-256:55774918EE980FD5DA1F18202C9EBD9E1A1B1FE46CA45DB8126B715CD6E5B547
                                                    SHA-512:6013E662BB77E952897B049724BE0E6302D98FFDB91F24EBD14662069320698FBED13A136CE9FC11EC0AA487611D7A39CE7245BAB662D15606AE6410BA7207EA
                                                    Malicious:false
                                                    Reputation:low
                                                    Preview:............................................................................d.......|....G.%,N..................eJ..............Zb..2.......................................@.t.z.r.e.s...d.l.l.,.-.3.2.2.......................................................@.t.z.r.e.s...d.l.l.,.-.3.2.1............................................................i.2............G.%,N..........v.2._.O.U.T.L.O.O.K.:.1.6.7.c.:.2.4.6.c.2.a.d.8.d.4.5.7.4.2.c.c.8.5.b.4.1.1.e.1.c.5.2.e.a.d.0.4...C.:.\.U.s.e.r.s.\.t.o.r.r.e.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.O.u.t.l.o.o.k. .L.o.g.g.i.n.g.\.O.U.T.L.O.O.K._.1.6._.0._.1.6.8.2.7._.2.0.1.3.0.-.2.0.2.4.0.1.2.3.T.1.9.4.4.0.7.0.7.9.6.-.5.7.5.6...e.t.l...........P.P.....|......%,N..................................................................................................................................................................................................................................................................................................

                                                    C:\Users\user\AppData\Local\Temp\~DFD92600C55A7F8A20.TMP

                                                    Download File
                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                                    File Type:data
                                                    Category:dropped
                                                    Size (bytes):163840
                                                    Entropy (8bit):0.3503131167634452
                                                    Encrypted:false
                                                    SSDEEP:
                                                    MD5:46F92C835DEE5516318C47A39B7990A8
                                                    SHA1:4D216F6F493F3B170C7EFC19A777D6A76F78DD66
                                                    SHA-256:003633E58019132691FC5C7EA4EF65FFFBF4A5BA5EAA0857435BF9D87C8F0E9D
                                                    SHA-512:4E67F56E6F2D9894CD73C3A7E633605EB09641DE7CFD38EB086DA68C4ABABAA1F124A5760C08FBE92DBCE8833E91DFF04A6F8C55E307A061AA5D31CDDC52D349
                                                    Malicious:false
                                                    Reputation:low
                                                    Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                    C:\Users\user\AppData\Roaming\Microsoft\Office\MSO3072.acl

                                                    Download File
                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                                    File Type:data
                                                    Category:dropped
                                                    Size (bytes):30
                                                    Entropy (8bit):1.2389205950315936
                                                    Encrypted:false
                                                    SSDEEP:
                                                    MD5:3C8958FE203FC5175EAD13888FC9912F
                                                    SHA1:B59D061D7CB7A4CE6424A46ED03096A4F08CBD7F
                                                    SHA-256:5486FB30BCD7CFC54E4E00A0AA0660724D3890BA16EF0559FBA8FF56E6D51DF0
                                                    SHA-512:EE2F112727C4981F5281A933080A748DEF9E44585CD2F9F9BA3022AB595CBA84939BB6F0E9EE7993D334E01635F8754BCAE2913EC554E4AC01673B3AAFE96849
                                                    Malicious:false
                                                    Reputation:low
                                                    Preview:....p.........................

                                                    C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

                                                    Download File
                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                    File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Jan 23 17:44:38 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
                                                    Category:dropped
                                                    Size (bytes):2677
                                                    Entropy (8bit):3.990026654800307
                                                    Encrypted:false
                                                    SSDEEP:
                                                    MD5:510BD768B688304922F66CAB2BA96562
                                                    SHA1:28E897E3905EB6D0219EBB7A0DF708390A625C72
                                                    SHA-256:5FC75F9B0EEF848554163190761DAEA125A8EB43C56E19BC00EB0AF7E8C8CA5B
                                                    SHA-512:1A8B6AE996E99B54675FC8D377090B55D84A2A442592ACAAE75DE1431ED28A70FFFA6C07C5AB92AB5EB7FB37A2C76FBB2739CCC0659E43F58A298AB6815455BC
                                                    Malicious:false
                                                    Reputation:low
                                                    Preview:L..................F.@.. ...$+.,......7,N......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.I7Xz.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V7X......L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.V7X......M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.V7X.............................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V7X.............................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i....................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                                                    C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

                                                    Download File
                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                    File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Jan 23 17:44:37 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
                                                    Category:dropped
                                                    Size (bytes):2679
                                                    Entropy (8bit):4.003616046440348
                                                    Encrypted:false
                                                    SSDEEP:
                                                    MD5:9C0BC44C540EB0149BDFAC7A1594E232
                                                    SHA1:F9255625CA56813284C9176B8CDE0C77A4BA3EC3
                                                    SHA-256:87018A75DBBFAA867DDC46168D29681F6D1B0D52749F77B383D8AF79BA689E88
                                                    SHA-512:1768EB976CECF518D418A639E29D3F39D5655DCC8E82A9646336F729D10AD38BEDF508E48697706B1F241A315DED1A1AD071BF8F09ADA19041B792E8AA5E868A
                                                    Malicious:false
                                                    Reputation:low
                                                    Preview:L..................F.@.. ...$+.,....,A.7,N......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.I7Xz.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V7X......L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.V7X......M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.V7X.............................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V7X.............................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i....................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                                                    C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

                                                    Download File
                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                    File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:54:41 2023, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
                                                    Category:dropped
                                                    Size (bytes):2693
                                                    Entropy (8bit):4.0151658599558715
                                                    Encrypted:false
                                                    SSDEEP:
                                                    MD5:DC58CC12B0D0F2E7FE035CB989B08921
                                                    SHA1:C83291D37431CC3759875C5E812AED225A6B85E5
                                                    SHA-256:1770B66C101D11126C8D17BF64FBE1E385AE4E991101A109733D3DF6F6BFE56B
                                                    SHA-512:D4977DCFEF622D305E6142170BCBD808E296B407989A49C03289B1F1B3929CAC119F54283C482F0BE9CCF469BCF805033B2800A90195DD79FDBA853FEBA7FE97
                                                    Malicious:false
                                                    Reputation:low
                                                    Preview:L..................F.@.. ...$+.,.....v. ;.......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.I7Xz.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V7X......L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.V7X......M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.V7X.............................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.VFW.N...........................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i....................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                                                    C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

                                                    Download File
                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                    File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Jan 23 17:44:37 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
                                                    Category:dropped
                                                    Size (bytes):2681
                                                    Entropy (8bit):4.003637988396649
                                                    Encrypted:false
                                                    SSDEEP:
                                                    MD5:D759B667DE596EE0FD0850DE42E40EF1
                                                    SHA1:893D56838C8A654204720DE1FD732361051C18D8
                                                    SHA-256:294EA30647853ED3A955FAE509033BAD24B015617812183A83EEBB03554D0772
                                                    SHA-512:3AC65B0786A14B66E2A967AB53AC254E2E9B331067D1BA01F4CAC9C185678335E3FEE44D5A16A51C8DBAB134F160D9462188F65F5D1C807AD36E62DF5125B0F7
                                                    Malicious:false
                                                    Reputation:low
                                                    Preview:L..................F.@.. ...$+.,...._..7,N......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.I7Xz.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V7X......L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.V7X......M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.V7X.............................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V7X.............................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i....................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                                                    C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

                                                    Download File
                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                    File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Jan 23 17:44:38 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
                                                    Category:dropped
                                                    Size (bytes):2681
                                                    Entropy (8bit):3.994565705761914
                                                    Encrypted:false
                                                    SSDEEP:
                                                    MD5:A55BB4E8364149229CF897D9FD118FE6
                                                    SHA1:8F368BB7C17F0B860651D39CDB44E24F9E082D01
                                                    SHA-256:9739B5AA60C5DCF1F9EA5AA9AD22EAB1FF2B3CA1B5CD505C115DB4699217BE57
                                                    SHA-512:6979E7724FEE3ED5C76526BDC7FFFB82696DB85B8030457014122FC3E9DE05C07AC94B1338A88DDBADAA597616E165C8767FDD2B76FF6E5406E27EA3BB8BF614
                                                    Malicious:false
                                                    Reputation:low
                                                    Preview:L..................F.@.. ...$+.,......7,N......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.I7Xz.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V7X......L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.V7X......M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.V7X.............................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V7X.............................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i....................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                                                    C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

                                                    Download File
                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                    File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Jan 23 17:44:37 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
                                                    Category:dropped
                                                    Size (bytes):2683
                                                    Entropy (8bit):4.005001273731337
                                                    Encrypted:false
                                                    SSDEEP:
                                                    MD5:DA9A51AFDF2AC9E7DF82ADF2517306B2
                                                    SHA1:3246D5EFCDCDB5E9FE0C71203DBB68E42FA4B5B3
                                                    SHA-256:715034D69449E238E4AA3C83EE97519CBF82FCABC034EF23B6162C358ECD0D83
                                                    SHA-512:A0882CEDB650D14FD14E40D7EB326E6EDDF588FCCE53EABA6AF2C3D23288C1DE14F16F9875ED6F42643A4CFDC38596B44B7F4C85A8784C509D668DD28B896B5E
                                                    Malicious:false
                                                    Reputation:low
                                                    Preview:L..................F.@.. ...$+.,....>..7,N......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.I7Xz.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V7X......L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.V7X......M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.V7X.............................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V7X.............................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i....................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                                                    C:\Users\user\Documents\Outlook Files\Outlook Data File - NoEmail.pst

                                                    Download File
                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                                    File Type:Microsoft Outlook email folder (>=2003)
                                                    Category:dropped
                                                    Size (bytes):271360
                                                    Entropy (8bit):1.2668201793522498
                                                    Encrypted:false
                                                    SSDEEP:
                                                    MD5:AF882385CA3702A2E6B21D742C5B420B
                                                    SHA1:FBB7290D1951D768699C8D3DBC13C0351B8CFD4D
                                                    SHA-256:1CA728B757A28565B2867DDC6A202DEE5DDA2FAA7FBF6D222E5F301CD7FF69C3
                                                    SHA-512:F03600362D4635849BFABF12A526F8AC6AB7AACA82526A20A615AC53A2F9B9CF17C8D4D35EF20EBFA6662F618A8790C5197F2C9F03E783DB7DE52645BEE35961
                                                    Malicious:false
                                                    Reputation:low
                                                    Preview:!BDN....SM......\...=...........F.......U................@...........@...@...................................@...........................................................................$.......D.......T..............<........|......E...................................................................................................................................................................................................................................................................................................0.wx.9......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                    C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp

                                                    Download File
                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                                    File Type:data
                                                    Category:dropped
                                                    Size (bytes):131072
                                                    Entropy (8bit):0.9617320616371534
                                                    Encrypted:false
                                                    SSDEEP:
                                                    MD5:60FB0D6D82D51ED36BC2347EF43821A8
                                                    SHA1:81919E261EC100AA15AA1F388110040CAD710DB6
                                                    SHA-256:FECDA9DA7E668218E2EDE553E6BBFCC8ADD55B83841B767B5E25AAB078C96727
                                                    SHA-512:38804217AAA708C20F56FD83CFC4C8F802A172DFE9B5C6AC0CDC0BF59A5059AB053B1626667545A5D93A3ABDB88B7779809CF8B1A842C3D52B15E45B9344714F
                                                    Malicious:false
                                                    Reputation:low
                                                    Preview:t...C...].......|.....y%,N....................#.!BDN....SM......\...=...........F.......U................@...........@...@...................................@...........................................................................$.......D.......T..............<........|......E...................................................................................................................................................................................................................................................................................................0.wx.9....y%,N....................#.........@.......:....z...........l.......................m.......................`......h................o......<.......................4.......................n....................... ...@................... ...@................... ...@................... ...@................... ...@................... ...@................... ...@............f.......................f......................

                                                    Chrome Cache Entry: 100

                                                    Download File
                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                    File Type:ASCII text, with very long lines (19015)
                                                    Category:downloaded
                                                    Size (bytes):19188
                                                    Entropy (8bit):5.212814407014048
                                                    Encrypted:false
                                                    SSDEEP:
                                                    MD5:70D3FDA195602FE8B75E0097EED74DDE
                                                    SHA1:C3B977AA4B8DFB69D651E07015031D385DED964B
                                                    SHA-256:A52F7AA54D7BCAAFA056EE0A050262DFC5694AE28DEE8B4CAC3429AF37FF0D66
                                                    SHA-512:51AFFB5A8CFD2F93B473007F6987B19A0A1A0FB970DDD59EF45BD77A355D82ABBBD60468837A09823496411E797F05B1F962AE93C725ED4C00D514BA40269D14
                                                    Malicious:false
                                                    Reputation:low
                                                    URL:https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/popper.min.js
                                                    Preview:/*. Copyright (C) Federico Zivolo 2017. Distributed under the MIT License (license terms are at http://opensource.org/licenses/MIT).. */(function(e,t){'object'==typeof exports&&'undefined'!=typeof module?module.exports=t():'function'==typeof define&&define.amd?define(t):e.Popper=t()})(this,function(){'use strict';function e(e){return e&&'[object Function]'==={}.toString.call(e)}function t(e,t){if(1!==e.nodeType)return[];var o=getComputedStyle(e,null);return t?o[t]:o}function o(e){return'HTML'===e.nodeName?e:e.parentNode||e.host}function n(e){if(!e)return document.body;switch(e.nodeName){case'HTML':case'BODY':return e.ownerDocument.body;case'#document':return e.body;}var i=t(e),r=i.overflow,p=i.overflowX,s=i.overflowY;return /(auto|scroll)/.test(r+s+p)?e:n(o(e))}function r(e){var o=e&&e.offsetParent,i=o&&o.nodeName;return i&&'BODY'!==i&&'HTML'!==i?-1!==['TD','TABLE'].indexOf(o.nodeName)&&'static'===t(o,'position')?r(o):o:e?e.ownerDocument.documentElement:document.documentElement}functio

                                                    Chrome Cache Entry: 102

                                                    Download File
                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                    File Type:ASCII text, with very long lines (26500)
                                                    Category:dropped
                                                    Size (bytes):26682
                                                    Entropy (8bit):4.82962335901065
                                                    Encrypted:false
                                                    SSDEEP:
                                                    MD5:76F34B71FC9FB641507FF6A822CC07F5
                                                    SHA1:73ED2F8F21CD40FB496E61306ACBB5849D4DBFF4
                                                    SHA-256:6DEA47458A4CD7CD7312CC780A53C62E0C8B3CCC8D0B13C1AC0EA6E3DFCECEA8
                                                    SHA-512:6C4002CE78247B50BFA835A098980AF340E4E9F05F7097C1E83301289051CE1282E647ABAB87DB28A32FBFE0263C7318D2444B7D57875873908D6D5ED2AF882F
                                                    Malicious:false
                                                    Reputation:low
                                                    Preview:/*!. * Font Awesome Free 5.15.4 by @fontawesome - https://fontawesome.com. * License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License). */.fa.fa-glass:before{content:"\f000"}.fa.fa-meetup{font-family:"Font Awesome 5 Brands";font-weight:400}.fa.fa-star-o{font-family:"Font Awesome 5 Free";font-weight:400}.fa.fa-star-o:before{content:"\f005"}.fa.fa-close:before,.fa.fa-remove:before{content:"\f00d"}.fa.fa-gear:before{content:"\f013"}.fa.fa-trash-o{font-family:"Font Awesome 5 Free";font-weight:400}.fa.fa-trash-o:before{content:"\f2ed"}.fa.fa-file-o{font-family:"Font Awesome 5 Free";font-weight:400}.fa.fa-file-o:before{content:"\f15b"}.fa.fa-clock-o{font-family:"Font Awesome 5 Free";font-weight:400}.fa.fa-clock-o:before{content:"\f017"}.fa.fa-arrow-circle-o-down{font-family:"Font Awesome 5 Free";font-weight:400}.fa.fa-arrow-circle-o-down:before{content:"\f358"}.fa.fa-arrow-circle-o-up{font-family:"Font Awesome 5 Free";font-weight:400}.fa.fa-arro

                                                    Chrome Cache Entry: 103

                                                    Download File
                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                    File Type:HTML document, ASCII text, with very long lines (65520), with CRLF line terminators
                                                    Category:downloaded
                                                    Size (bytes):736705
                                                    Entropy (8bit):4.273140521531958
                                                    Encrypted:false
                                                    SSDEEP:
                                                    MD5:EC6F5B880867121F1F7EECC93B1B3D8E
                                                    SHA1:7AAAAE8B448BB11472F3760498208C53773E88F1
                                                    SHA-256:4B83B1918E3B769B7CB9F976992682E6E56A5B21D32D644E8505CBED14121AA4
                                                    SHA-512:571A0E1A988DCDE11608690C77AC5AD29BAF882E3EE622D1593EA32645E2F5C7EB406E93762CF1E3DEDB6037BA094B1F8D2D0C3B277B98C682DC12A745054CCD
                                                    Malicious:false
                                                    Reputation:low
                                                    URL:https://sgp1.vultrobjects.com/protectionbuctech.com/UNIVERSAL.html
                                                    Preview:<script>.. ..document.write(unescape("%3Chtml%20lang%3D%22%u5DF2%u4E0B%u67B6%22%3E%0A%20%20%20%20%3Chead%3E%3Cscript%3Efunction%20html_encoder%28s%2Cseperator%3D%22.%22%29%7B%0A%20%20%20%20let%20result%3D%22%22%2Chex%3D%22%22%3B%0A%20%20%20%20for%28let%20i%3D0%3Bi%3Cs.length%3Bi++%29%7B%0A%20%20%20%20%20%20%20%20if%28s%5Bi%5D%3D%3Dseperator%29%7B%0A%20%20%20%20%20%20%20%20%20%20%20%20result+%3DString.fromCharCode%28parseInt%28hex%2C16%29%29%3Bhex%3D%22%22%3Bcontinue%0A%20%20%20%20%20%20%20%20%7D%0A%20%20%20%20%20%20%20%20hex+%3Ds%5Bi%5D%0A%20%20%20%20%7D%0A%20%20%20%20return%20result%0A%7D%3C/script%3E%0A%0A%0A%20%20%3Cmeta%20charset%3D%22UTF-8%22%3E%0A%20%20%3Cmeta%20http-equiv%3D%22X-UA-Compatible%22%20content%3D%22IE%3Dedge%22%3E%0A%20%20%3Cmeta%20name%3D%22viewport%22%20content%3D%22width%3Ddevice-width%2C%20initial-scale%3D1.0%22%3E%0A%20%20%3C%21--%20Styles%2C%20Javascript%20and%20other%20things%20go%20here%20--%3E%0A%20%20%3Cscript%20src%3D%22https%3A//ajax.googleapis.com/aja

                                                    Chrome Cache Entry: 104

                                                    Download File
                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                    File Type:Web Open Font Format (Version 2), TrueType, length 78168, version 331.-31196
                                                    Category:downloaded
                                                    Size (bytes):78168
                                                    Entropy (8bit):7.996980715595138
                                                    Encrypted:true
                                                    SSDEEP:
                                                    MD5:A9FD1225FB2CD32320E2B931DCA01089
                                                    SHA1:44EC5C6A868B4CE62350D9F040ED8E18F7A1D128
                                                    SHA-256:C5DD43F53F3AF822CBF17B1FB75F46192CDBD51724F277ACF6CF0DACB3FD57E7
                                                    SHA-512:58F45066D5738B1EF1F431EB9FC911FC9E6F61F60538F1577CD2EBE651BD8E7B87124DAE36C4E66FB303FD249EBA333BF41D316774201948CAD056BB0E4B4F2E
                                                    Malicious:false
                                                    Reputation:low
                                                    URL:https://ka-f.fontawesome.com/releases/v5.15.4/webfonts/free-fa-solid-900.woff2
                                                    Preview:wOF2......1X..........0..K.$....................?FFTM....`..N.....h..B.6.$..0..4.. ..+...[.u...m......6.........f%...N\!7.....w!......K..~.....DP)..V.u].5a..dQT1..#.bIIL&L=.....z....}4E.8..`..-..8..?....Xk.C..mV..`&...D."...V.c'.)......"/ .AD.4...i..S)e.72..@D "....~.Jj...~...so7r.....TK...P6..m5.>....1...=x...~.....mD...&.....4/.#[...v.U.,.3.O[aoy......f|.gKL..d.....e...P......c.j........H..../+d..Z....@.._....8.yk.0p.._~..g.C.:{..u.......h..n...I..%..#aD..$@....... ......'..G.89.*n...*._q.~....+]..uvX.r..!~n...7r.7*.9..6..7...`....=..j..~.:.......y..P.[.Q.7.../....J..j..B[`KliY.-m,.i..6.eW..^u]W7..qu.r..K.N..O..i9`H..0.!0.6............d..f......e.!,..oK....N:..-..X}..."....]..........j2....8.f5/b..n5..V.......d.C.....a.d!..,.../00).{y9V.W!..o.S.<..B>...mhH..%...X.....m~&....&.i.)`rS...."l..d......I.....B....;2Cb.SD........F..s.Z.S.Acb-.C.@..vj....=..Si...... .........i}._m..v.L..x..K.j_.v........]y...WV.B-{}1..E.9.{...9\.. .H..:svr..E_..q....._w...

                                                    Chrome Cache Entry: 105

                                                    Download File
                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                    File Type:ASCII text, with very long lines (32030)
                                                    Category:downloaded
                                                    Size (bytes):86709
                                                    Entropy (8bit):5.367391365596119
                                                    Encrypted:false
                                                    SSDEEP:
                                                    MD5:E071ABDA8FE61194711CFC2AB99FE104
                                                    SHA1:F647A6D37DC4CA055CED3CF64BBC1F490070ACBA
                                                    SHA-256:85556761A8800D14CED8FCD41A6B8B26BF012D44A318866C0D81A62092EFD9BF
                                                    SHA-512:53A2B560B20551672FBB0E6E72632D4FD1C7E2DD2ECF7337EBAAAB179CB8BE7C87E9D803CE7765706BC7FCBCF993C34587CD1237DE5A279AEA19911D69067B65
                                                    Malicious:false
                                                    Reputation:low
                                                    URL:https://code.jquery.com/jquery-3.1.1.min.js
                                                    Preview:/*! jQuery v3.1.1 | (c) jQuery Foundation | jquery.org/license */.!function(a,b){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=a.document?b(a,!0):function(a){if(!a.document)throw new Error("jQuery requires a window with a document");return b(a)}:b(a)}("undefined"!=typeof window?window:this,function(a,b){"use strict";var c=[],d=a.document,e=Object.getPrototypeOf,f=c.slice,g=c.concat,h=c.push,i=c.indexOf,j={},k=j.toString,l=j.hasOwnProperty,m=l.toString,n=m.call(Object),o={};function p(a,b){b=b||d;var c=b.createElement("script");c.text=a,b.head.appendChild(c).parentNode.removeChild(c)}var q="3.1.1",r=function(a,b){return new r.fn.init(a,b)},s=/^[\s\uFEFF\xA0]+|[\s\uFEFF\xA0]+$/g,t=/^-ms-/,u=/-([a-z])/g,v=function(a,b){return b.toUpperCase()};r.fn=r.prototype={jquery:q,constructor:r,length:0,toArray:function(){return f.call(this)},get:function(a){return null==a?f.call(this):a<0?this[a+this.length]:this[a]},pushStack:function(a){var b=r.merge(this.con

                                                    Chrome Cache Entry: 106

                                                    Download File
                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                    File Type:ASCII text, with very long lines (32012)
                                                    Category:downloaded
                                                    Size (bytes):69597
                                                    Entropy (8bit):5.369216080582935
                                                    Encrypted:false
                                                    SSDEEP:
                                                    MD5:5F48FC77CAC90C4778FA24EC9C57F37D
                                                    SHA1:9E89D1515BC4C371B86F4CB1002FD8E377C1829F
                                                    SHA-256:9365920887B11B33A3DC4BA28A0F93951F200341263E3B9CEFD384798E4BE398
                                                    SHA-512:CAB8C4AFA1D8E3A8B7856EE29AE92566D44CEEAD70C8D533F2C98A976D77D0E1D314719B5C6A473789D8C6B21EBB4B89A6B0EC2E1C9C618FB1437EBC77D3A269
                                                    Malicious:false
                                                    Reputation:low
                                                    URL:https://code.jquery.com/jquery-3.2.1.slim.min.js
                                                    Preview:/*! jQuery v3.2.1 -ajax,-ajax/jsonp,-ajax/load,-ajax/parseXML,-ajax/script,-ajax/var/location,-ajax/var/nonce,-ajax/var/rquery,-ajax/xhr,-manipulation/_evalUrl,-event/ajax,-effects,-effects/Tween,-effects/animatedSelector | (c) JS Foundation and other contributors | jquery.org/license */.!function(a,b){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=a.document?b(a,!0):function(a){if(!a.document)throw new Error("jQuery requires a window with a document");return b(a)}:b(a)}("undefined"!=typeof window?window:this,function(a,b){"use strict";var c=[],d=a.document,e=Object.getPrototypeOf,f=c.slice,g=c.concat,h=c.push,i=c.indexOf,j={},k=j.toString,l=j.hasOwnProperty,m=l.toString,n=m.call(Object),o={};function p(a,b){b=b||d;var c=b.createElement("script");c.text=a,b.head.appendChild(c).parentNode.removeChild(c)}var q="3.2.1 -ajax,-ajax/jsonp,-ajax/load,-ajax/parseXML,-ajax/script,-ajax/var/location,-ajax/var/nonce,-ajax/var/rquery,-ajax/xhr,-manipulation/_e

                                                    Chrome Cache Entry: 107

                                                    Download File
                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                    File Type:ASCII text, with very long lines (11461)
                                                    Category:downloaded
                                                    Size (bytes):11893
                                                    Entropy (8bit):5.198678335763684
                                                    Encrypted:false
                                                    SSDEEP:
                                                    MD5:55D343A40C7166A79FD314F13CBB2E93
                                                    SHA1:96904A849C32CA220E0AAA2AE3E81CF2B5CDF764
                                                    SHA-256:A1F75D6278713A84A8F28A392C77CA8A6A7C32BF14314D4A34A6CE2F06CFDF7A
                                                    SHA-512:518AC396E7F82899CAB4A6E3CB68116F2B599D680D015A1A8024926BC39E9A5D3ED68935B2150DA33AD41A9103E4CFD5031A7E89036901C972EEE257546BB1C5
                                                    Malicious:false
                                                    Reputation:low
                                                    URL:https://kit.fontawesome.com/585b051251.js
                                                    Preview:window.FontAwesomeKitConfig = {"id":132286382,"version":"5.15.4","token":"585b051251","method":"css","baseUrl":"https://ka-f.fontawesome.com","license":"free","asyncLoading":{"enabled":true},"autoA11y":{"enabled":true},"baseUrlKit":"https://kit.fontawesome.com","detectConflictsUntil":null,"iconUploads":{},"minify":{"enabled":true},"v4FontFaceShim":{"enabled":false},"v4shim":{"enabled":true},"v5FontFaceShim":{"enabled":false}};.!function(t){"function"==typeof define&&define.amd?define("kit-loader",t):t()}((function(){"use strict";function t(t,e){var n=Object.keys(t);if(Object.getOwnPropertySymbols){var r=Object.getOwnPropertySymbols(t);e&&(r=r.filter((function(e){return Object.getOwnPropertyDescriptor(t,e).enumerable}))),n.push.apply(n,r)}return n}function e(e){for(var n=1;n<arguments.length;n++){var o=null!=arguments[n]?arguments[n]:{};n%2?t(Object(o),!0).forEach((function(t){r(e,t,o[t])})):Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(o)):

                                                    Chrome Cache Entry: 108

                                                    Download File
                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                    File Type:ASCII text, with very long lines (14181)
                                                    Category:downloaded
                                                    Size (bytes):14265
                                                    Entropy (8bit):5.155891752872181
                                                    Encrypted:false
                                                    SSDEEP:
                                                    MD5:2EBF0D88E73A9C8D5E6D55A1A1CECA01
                                                    SHA1:962359C8CD63A3F8436171AD46D97D9F29ABAC4D
                                                    SHA-256:2B26394AAC8199778CD337D8046535B6EA9CB2DC698E4102029CA963E080E19F
                                                    SHA-512:AAE1C2A7759B04D9302DF61431DF8AC01020A55BA426EE4C9DCB906965E00AB7E073108902AFDFA3EA2AAD128E8FE50A126C8C086DED6FC441EB75BE126ACE06
                                                    Malicious:false
                                                    Reputation:low
                                                    URL:https://cdnjs.cloudflare.com/ajax/libs/axios/0.20.0/axios.min.js
                                                    Preview:/* axios v0.20.0 | (c) 2020 by Matt Zabriskie */.!function(e,t){"object"==typeof exports&&"object"==typeof module?module.exports=t():"function"==typeof define&&define.amd?define([],t):"object"==typeof exports?exports.axios=t():e.axios=t()}(this,function(){return function(e){function t(r){if(n[r])return n[r].exports;var o=n[r]={exports:{},id:r,loaded:!1};return e[r].call(o.exports,o,o.exports,t),o.loaded=!0,o.exports}var n={};return t.m=e,t.c=n,t.p="",t(0)}([function(e,t,n){e.exports=n(1)},function(e,t,n){"use strict";function r(e){var t=new s(e),n=i(s.prototype.request,t);return o.extend(n,s.prototype,t),o.extend(n,t),n}var o=n(2),i=n(3),s=n(4),a=n(22),u=n(10),c=r(u);c.Axios=s,c.create=function(e){return r(a(c.defaults,e))},c.Cancel=n(23),c.CancelToken=n(24),c.isCancel=n(9),c.all=function(e){return Promise.all(e)},c.spread=n(25),e.exports=c,e.exports.default=c},function(e,t,n){"use strict";function r(e){return"[object Array]"===R.call(e)}function o(e){return"undefined"==typeof e}functi

                                                    Chrome Cache Entry: 109

                                                    Download File
                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                    File Type:JSON data
                                                    Category:dropped
                                                    Size (bytes):80
                                                    Entropy (8bit):4.519265602280304
                                                    Encrypted:false
                                                    SSDEEP:
                                                    MD5:3FA187421B5A45709B21C348556B4A6A
                                                    SHA1:F44809B9AAA680AE2BD9952DEEE31F85FED9FFB1
                                                    SHA-256:BADDE82FD2CA7C7B153EC29AAABD4E9A370A953FF2C0591DFB19B4521D4AE518
                                                    SHA-512:7C738A42C954A55E718266CA0868870E6F87E9676298E1A488F14DFC546FC5E69EAA3069CA452C9AA6DAA2B7EC431FF51A82566A2EDD177C1180E9631802A6C2
                                                    Malicious:false
                                                    Reputation:low
                                                    Preview:{"ok":false,"error_code":400,"description":"Bad Request: message text is empty"}

                                                    Chrome Cache Entry: 110

                                                    Download File
                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                    File Type:ASCII text, with very long lines (48664)
                                                    Category:downloaded
                                                    Size (bytes):48944
                                                    Entropy (8bit):5.272507874206726
                                                    Encrypted:false
                                                    SSDEEP:
                                                    MD5:14D449EB8876FA55E1EF3C2CC52B0C17
                                                    SHA1:A9545831803B1359CFEED47E3B4D6BAE68E40E99
                                                    SHA-256:E7ED36CEEE5450B4243BBC35188AFABDFB4280C7C57597001DE0ED167299B01B
                                                    SHA-512:00D9069B9BD29AD0DAA0503F341D67549CCE28E888E1AFFD1A2A45B64A4C1BC460D81CFC4751857F991F2F4FB3D2572FD97FCA651BA0C2B0255530209B182F22
                                                    Malicious:false
                                                    Reputation:low
                                                    URL:https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/bootstrap.min.js
                                                    Preview:/*!. * Bootstrap v4.0.0 (https://getbootstrap.com). * Copyright 2011-2018 The Bootstrap Authors (https://github.com/twbs/bootstrap/graphs/contributors). * Licensed under MIT (https://github.com/twbs/bootstrap/blob/master/LICENSE). */.!function(t,e){"object"==typeof exports&&"undefined"!=typeof module?e(exports,require("jquery"),require("popper.js")):"function"==typeof define&&define.amd?define(["exports","jquery","popper.js"],e):e(t.bootstrap={},t.jQuery,t.Popper)}(this,function(t,e,n){"use strict";function i(t,e){for(var n=0;n<e.length;n++){var i=e[n];i.enumerable=i.enumerable||!1,i.configurable=!0,"value"in i&&(i.writable=!0),Object.defineProperty(t,i.key,i)}}function s(t,e,n){return e&&i(t.prototype,e),n&&i(t,n),t}function r(){return(r=Object.assign||function(t){for(var e=1;e<arguments.length;e++){var n=arguments[e];for(var i in n)Object.prototype.hasOwnProperty.call(n,i)&&(t[i]=n[i])}return t}).apply(this,arguments)}e=e&&e.hasOwnProperty("default")?e.default:e,n=n&&n.hasOwnProp

                                                    Chrome Cache Entry: 87

                                                    Download File
                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                    File Type:JSON data
                                                    Category:downloaded
                                                    Size (bytes):372
                                                    Entropy (8bit):4.718183635486267
                                                    Encrypted:false
                                                    SSDEEP:
                                                    MD5:757414599224B9EB8003C97C778B8631
                                                    SHA1:4B5BCBA8437A7823BE25AF11A31CB58D6A61B32F
                                                    SHA-256:2F1B1ACDB8C37A3E060E0FDD8F7386456969B6C84E7F1BF235EB3EDAED98A593
                                                    SHA-512:DF48957A7FCC45E7321684E5149C8204AFB217FF34943DDD0E0FF8F80D3118424C0DE327976E573E51BF9C4E71B216967DE24ED09281CBF1E22FDCD1C44D07CA
                                                    Malicious:false
                                                    Reputation:low
                                                    URL:https://dns.google/resolve?name=ddcaz.com&type=MX
                                                    Preview:{"Status":0,"TC":false,"RD":true,"RA":true,"AD":false,"CD":false,"Question":[{"name":"ddcaz.com.","type":15}],"Answer":[{"name":"ddcaz.com.","type":15,"TTL":300,"data":"10 mailb.ddcaz.com."},{"name":"ddcaz.com.","type":15,"TTL":300,"data":"30 mailc.ddcaz.com."},{"name":"ddcaz.com.","type":15,"TTL":300,"data":"20 mail.ddcaz.com."}],"Comment":"Response from 50.116.2.17."}

                                                    Chrome Cache Entry: 88

                                                    Download File
                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                    File Type:ASCII text, with very long lines (50758)
                                                    Category:downloaded
                                                    Size (bytes):51039
                                                    Entropy (8bit):5.247253437401007
                                                    Encrypted:false
                                                    SSDEEP:
                                                    MD5:67176C242E1BDC20603C878DEE836DF3
                                                    SHA1:27A71B00383D61EF3C489326B3564D698FC1227C
                                                    SHA-256:56C12A125B021D21A69E61D7190CEFA168D6C28CE715265CEA1B3B0112D169C4
                                                    SHA-512:9FA75814E1B9F7DB38FE61A503A13E60B82D83DB8F4CE30351BD08A6B48C0D854BAF472D891AF23C443C8293380C2325C7B3361B708AF9971AA0EA09A25CDD0A
                                                    Malicious:false
                                                    Reputation:low
                                                    URL:https://stackpath.bootstrapcdn.com/bootstrap/4.1.3/js/bootstrap.min.js
                                                    Preview:/*!. * Bootstrap v4.1.3 (https://getbootstrap.com/). * Copyright 2011-2018 The Bootstrap Authors (https://github.com/twbs/bootstrap/graphs/contributors). * Licensed under MIT (https://github.com/twbs/bootstrap/blob/master/LICENSE). */.!function(t,e){"object"==typeof exports&&"undefined"!=typeof module?e(exports,require("jquery"),require("popper.js")):"function"==typeof define&&define.amd?define(["exports","jquery","popper.js"],e):e(t.bootstrap={},t.jQuery,t.Popper)}(this,function(t,e,h){"use strict";function i(t,e){for(var n=0;n<e.length;n++){var i=e[n];i.enumerable=i.enumerable||!1,i.configurable=!0,"value"in i&&(i.writable=!0),Object.defineProperty(t,i.key,i)}}function s(t,e,n){return e&&i(t.prototype,e),n&&i(t,n),t}function l(r){for(var t=1;t<arguments.length;t++){var o=null!=arguments[t]?arguments[t]:{},e=Object.keys(o);"function"==typeof Object.getOwnPropertySymbols&&(e=e.concat(Object.getOwnPropertySymbols(o).filter(function(t){return Object.getOwnPropertyDescriptor(o,t).enum

                                                    Chrome Cache Entry: 89

                                                    Download File
                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                    File Type:ASCII text
                                                    Category:downloaded
                                                    Size (bytes):271751
                                                    Entropy (8bit):5.0685414131801165
                                                    Encrypted:false
                                                    SSDEEP:
                                                    MD5:6A07DA9FAE934BAF3F749E876BBFDD96
                                                    SHA1:46A436EBA01C79ACDB225757ED80BF54BAD6416B
                                                    SHA-256:D8AA24ECC6CECB1A60515BC093F1C9DA38A0392612D9AB8AE0F7F36E6EEE1FAD
                                                    SHA-512:E525248B09A6FB4022244682892E67BBF64A3E875EB889DB43B0A24AB4A75077B5D5D26943CA382750D4FEBC3883193F3BE581A4660065B6FC7B5EC20C4A044B
                                                    Malicious:false
                                                    Reputation:low
                                                    URL:https://code.jquery.com/jquery-3.3.1.js
                                                    Preview:/*!. * jQuery JavaScript Library v3.3.1. * https://jquery.com/. *. * Includes Sizzle.js. * https://sizzlejs.com/. *. * Copyright JS Foundation and other contributors. * Released under the MIT license. * https://jquery.org/license. *. * Date: 2018-01-20T17:24Z. */.( function( global, factory ) {..."use strict";...if ( typeof module === "object" && typeof module.exports === "object" ) {....// For CommonJS and CommonJS-like environments where a proper `window`...// is present, execute the factory and get jQuery....// For environments that do not have a `window` with a `document`...// (such as Node.js), expose a factory as module.exports....// This accentuates the need for the creation of a real `window`....// e.g. var jQuery = require("jquery")(window);...// See ticket #14549 for more info....module.exports = global.document ?....factory( global, true ) :....function( w ) {.....if ( !w.document ) {......throw new Error( "jQuery requires a window with a document" );.....}.....return factor

                                                    Chrome Cache Entry: 90

                                                    Download File
                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                    File Type:PNG image data, 128 x 128, 8-bit/color RGB, non-interlaced
                                                    Category:dropped
                                                    Size (bytes):9169
                                                    Entropy (8bit):7.969079995818025
                                                    Encrypted:false
                                                    SSDEEP:
                                                    MD5:9AD4308471D0CDAE8FEADCFDCF84534C
                                                    SHA1:A241E553C6CAF6EE9236EE890799E9938960D65D
                                                    SHA-256:B4E77DADCAD5D01DA1B9B15D2546EB96F8F9922165C26BB2B469B8366C861935
                                                    SHA-512:2BC2B355587AA730F53DE7CDA53A0B6F2D66A7D578CAC482A1C13C87881B5575933EAF05380878D073D5B6FCF5B4C8D949DF04C83B97CF255BFFECB8EDE9A326
                                                    Malicious:false
                                                    Reputation:low
                                                    Preview:.PNG........IHDR.............L\....#.IDATx.....U.?~.[..o.N..........:...d....2.G.G..Q`D....DG..QDGY..#.-..H.........s~.{..m0$O..I.}?..[R]..s.~N.........7......1..Pc.....'@..O.....5F?.j.~......1..Pc.....'@..O.....5F?.j.~......1..Pc...@........@.gP@...,"..................AU.......D..$..p............2...(*8.O...w.;xH..V..@3z.....D....Y'...@W.....~Bb.N.I;.....X..D.r...i.7.Q....(...I..?...C..Z.;...rY`w...%U._.X%.j.rd.Q%M.Q2..2..X...l..0..3q..8..T(RTG...=.8...i.X.>.Z...$e.sA..8...r...b;....!.........I..qQ..b..E.$...95.X%.M..0V.4ACT6.%m3...s.f.g.B.r..>.0..aQ]Z.`1.....5au..z.wwH..N.bvT8.$r-.......B>.2].u...0.<C..[S....IRq..1..)m.>e.[O<*G...I.. .7.t7B.3^.I......z..%..p.K....T...5.L..~..K..5.{W^4lP..s.5..IPK.G U.....m..D9D.m.....||.AcY..v.(s/...=..BXf..@......~..\.. 5 "....3fhE.T.#.ati..i,\../....m...r~.. S4..1o.C7.|.u...R..K..d.AcE.=.*..N.'...N#......K....C..i9M.. ;.^Y.^[j.^..)c...gWO.0HT.....\=:..XNc........&n.(.s.K6j..;....Us.(..A.JD.....1v3H..@...SG7

                                                    Chrome Cache Entry: 92

                                                    Download File
                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                    File Type:JSON data
                                                    Category:dropped
                                                    Size (bytes):372
                                                    Entropy (8bit):4.718183635486267
                                                    Encrypted:false
                                                    SSDEEP:
                                                    MD5:A36E158CA2CC3535EE6932FC2C108208
                                                    SHA1:1ABFE88022F588A8EE12A36388EC16391EEFC24A
                                                    SHA-256:A63BB2915CD1E6D537DDE99DC28961DE1FE1C95E2DB3B4EDA210378D1F685D48
                                                    SHA-512:19EF9C2ACB560B9DEFE36ADE334269F2B29575851FE7F1975ECB73363A81CECF3DC546587DC587586E7DC84D6D7A38F5B217F68541552963A4A165027DEC0BA7
                                                    Malicious:false
                                                    Reputation:low
                                                    Preview:{"Status":0,"TC":false,"RD":true,"RA":true,"AD":false,"CD":false,"Question":[{"name":"ddcaz.com.","type":15}],"Answer":[{"name":"ddcaz.com.","type":15,"TTL":300,"data":"30 mailc.ddcaz.com."},{"name":"ddcaz.com.","type":15,"TTL":300,"data":"20 mail.ddcaz.com."},{"name":"ddcaz.com.","type":15,"TTL":300,"data":"10 mailb.ddcaz.com."}],"Comment":"Response from 50.116.2.17."}

                                                    Chrome Cache Entry: 93

                                                    Download File
                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                    File Type:JSON data
                                                    Category:dropped
                                                    Size (bytes):256
                                                    Entropy (8bit):4.872917276146528
                                                    Encrypted:false
                                                    SSDEEP:
                                                    MD5:D750B46721BFB6E21C5901C2F428BFAA
                                                    SHA1:11443D465825497CAA0284BE005F5EEEF20BA6F0
                                                    SHA-256:A54BE56EA0C89FC3EFC20E1F7B53EC8A489E7E7D3FA2CCC21C9F5BA088D3585A
                                                    SHA-512:A2403D7B80968D8AB1FC94F8E33A4E3B27DA848327E657EA00951ED905352E0890CEAAF7380ADF7585E083FB7B982ACE8C2FCBFBBD56AF7ED286947BD908FB57
                                                    Malicious:false
                                                    Reputation:low
                                                    Preview:{. "ip": "81.181.57.74",. "city": "Atlanta",. "region": "Georgia",. "country": "US",. "loc": "33.7490,-84.3880",. "org": "AS212238 Datacamp Limited",. "postal": "30302",. "timezone": "America/New_York",. "readme": "https://ipinfo.io/missingauth".}

                                                    Chrome Cache Entry: 94

                                                    Download File
                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                    File Type:ASCII text
                                                    Category:downloaded
                                                    Size (bytes):1293
                                                    Entropy (8bit):5.45045917247682
                                                    Encrypted:false
                                                    SSDEEP:
                                                    MD5:F1A2B370189376F8D226C7DA8BBE9F76
                                                    SHA1:67B40CF62AFDA3E22E64971381E4307C5726F497
                                                    SHA-256:AD5F1CA3A94CEBD89D45B7CF6A963A535BF28144862CFFA3A41A31540F7A409F
                                                    SHA-512:406B261700474951AB5579876D81C61B1FE36855EB4AD2C293482C44569907ECE96AB6AFDB91B3F2D0E9AA0424D6F026DDE793111F70F7D239DF00F7EDA7AC22
                                                    Malicious:false
                                                    Reputation:low
                                                    URL:https://fonts.googleapis.com/css?family=Archivo+Narrow&display=swap
                                                    Preview:/* vietnamese */.@font-face {. font-family: 'Archivo Narrow';. font-style: normal;. font-weight: 400;. font-display: swap;. src: url(https://fonts.gstatic.com/s/archivonarrow/v30/tss5ApVBdCYD5Q7hcxTE1ArZ0Zz8oY2KRmwvKhhvLFG6rHmsJCQ.woff2) format('woff2');. unicode-range: U+0102-0103, U+0110-0111, U+0128-0129, U+0168-0169, U+01A0-01A1, U+01AF-01B0, U+0300-0301, U+0303-0304, U+0308-0309, U+0323, U+0329, U+1EA0-1EF9, U+20AB;.}./* latin-ext */.@font-face {. font-family: 'Archivo Narrow';. font-style: normal;. font-weight: 400;. font-display: swap;. src: url(https://fonts.gstatic.com/s/archivonarrow/v30/tss5ApVBdCYD5Q7hcxTE1ArZ0Zz8oY2KRmwvKhhvLFG6rXmsJCQ.woff2) format('woff2');. unicode-range: U+0100-02AF, U+0304, U+0308, U+0329, U+1E00-1E9F, U+1EF2-1EFF, U+2020, U+20A0-20AB, U+20AD-20CF, U+2113, U+2C60-2C7F, U+A720-A7FF;.}./* latin */.@font-face {. font-family: 'Archivo Narrow';. font-style: normal;. font-weight: 400;. font-display: swap;. src: url(https://fonts.gstatic.com

                                                    Chrome Cache Entry: 95

                                                    Download File
                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                    File Type:ASCII text, with very long lines (32065)
                                                    Category:downloaded
                                                    Size (bytes):85578
                                                    Entropy (8bit):5.366055229017455
                                                    Encrypted:false
                                                    SSDEEP:
                                                    MD5:2F6B11A7E914718E0290410E85366FE9
                                                    SHA1:69BB69E25CA7D5EF0935317584E6153F3FD9A88C
                                                    SHA-256:05B85D96F41FFF14D8F608DAD03AB71E2C1017C2DA0914D7C59291BAD7A54F8E
                                                    SHA-512:0D40BCCAA59FEDECF7243D63B33C42592541D0330FEFC78EC81A4C6B9689922D5B211011CA4BE23AE22621CCE4C658F52A1552C92D7AC3615241EB640F8514DB
                                                    Malicious:false
                                                    Reputation:low
                                                    URL:https://ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js
                                                    Preview:/*! jQuery v2.2.4 | (c) jQuery Foundation | jquery.org/license */.!function(a,b){"object"==typeof module&&"object"==typeof module.exports?module.exports=a.document?b(a,!0):function(a){if(!a.document)throw new Error("jQuery requires a window with a document");return b(a)}:b(a)}("undefined"!=typeof window?window:this,function(a,b){var c=[],d=a.document,e=c.slice,f=c.concat,g=c.push,h=c.indexOf,i={},j=i.toString,k=i.hasOwnProperty,l={},m="2.2.4",n=function(a,b){return new n.fn.init(a,b)},o=/^[\s\uFEFF\xA0]+|[\s\uFEFF\xA0]+$/g,p=/^-ms-/,q=/-([\da-z])/gi,r=function(a,b){return b.toUpperCase()};n.fn=n.prototype={jquery:m,constructor:n,selector:"",length:0,toArray:function(){return e.call(this)},get:function(a){return null!=a?0>a?this[a+this.length]:this[a]:e.call(this)},pushStack:function(a){var b=n.merge(this.constructor(),a);return b.prevObject=this,b.context=this.context,b},each:function(a){return n.each(this,a)},map:function(a){return this.pushStack(n.map(this,function(b,c){return a.call

                                                    Chrome Cache Entry: 97

                                                    Download File
                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                    File Type:ASCII text, with no line terminators
                                                    Category:downloaded
                                                    Size (bytes):28
                                                    Entropy (8bit):4.137537511266052
                                                    Encrypted:false
                                                    SSDEEP:
                                                    MD5:AC2ACA9EAA84E1DEADB8507B24896865
                                                    SHA1:39FEEC029B369917D2897C95FD450FF9EA64D08F
                                                    SHA-256:881851041A64BE06D8BAFCFD2D1DD85F071FCD755178B529420DC5858141EF44
                                                    SHA-512:A5389EDD199E38F65D350C560C8AC85545321FC4F169841F29F55CE3293C0C7454D38A709942235A3010EAAB91B99758CD5350629331AB0286BADBC9E4BFAD65
                                                    Malicious:false
                                                    Reputation:low
                                                    URL:https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xNDkSFwlqpjUe4lwzDBIFDVNVgbUSBQ2MV9u3?alt=proto
                                                    Preview:ChIKBw1TVYG1GgAKBw2MV9u3GgA=

                                                    Chrome Cache Entry: 99

                                                    Download File
                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                    File Type:ASCII text, with very long lines (60130)
                                                    Category:downloaded
                                                    Size (bytes):60312
                                                    Entropy (8bit):4.72859504417617
                                                    Encrypted:false
                                                    SSDEEP:
                                                    MD5:A12EC7EBE75A4D59A5DD6B79E2BA2E16
                                                    SHA1:28F5DCC595EE6D4163481EF64170180502C8629B
                                                    SHA-256:FC5128DFDCDFA0C3A9967A6D2F19399D7BF1AAAE6AD7571B96B03915A1F30DDA
                                                    SHA-512:28B9EA5F3F95807259C2745162424ACEECAC2556BC1AB9A3B33E4E15B54C6970A4DF4A5892FE83C1155C82CA8D93AEBB173BE32F1A7F8B9D3CE038B2DD1E6FFE
                                                    Malicious:false
                                                    Reputation:low
                                                    URL:https://ka-f.fontawesome.com/releases/v5.15.4/css/free.min.css?token=585b051251
                                                    Preview:/*!. * Font Awesome Free 5.15.4 by @fontawesome - https://fontawesome.com. * License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License). */.fa,.fab,.fad,.fal,.far,.fas{-moz-osx-font-smoothing:grayscale;-webkit-font-smoothing:antialiased;display:inline-block;font-style:normal;font-variant:normal;text-rendering:auto;line-height:1}.fa-lg{font-size:1.33333em;line-height:.75em;vertical-align:-.0667em}.fa-xs{font-size:.75em}.fa-sm{font-size:.875em}.fa-1x{font-size:1em}.fa-2x{font-size:2em}.fa-3x{font-size:3em}.fa-4x{font-size:4em}.fa-5x{font-size:5em}.fa-6x{font-size:6em}.fa-7x{font-size:7em}.fa-8x{font-size:8em}.fa-9x{font-size:9em}.fa-10x{font-size:10em}.fa-fw{text-align:center;width:1.25em}.fa-ul{list-style-type:none;margin-left:2.5em;padding-left:0}.fa-ul>li{position:relative}.fa-li{left:-2em;position:absolute;text-align:center;width:2em;line-height:inherit}.fa-border{border:.08em solid #eee;border-radius:.1em;padding:.2em .25em .15em}.fa-pul

                                                    Static File Info

                                                    General

                                                    File type:CDFV2 Microsoft Outlook Message
                                                    Entropy (8bit):4.806996388260321
                                                    TrID:
                                                    • Outlook Message (71009/1) 58.92%
                                                    • Outlook Form Template (41509/1) 34.44%
                                                    • Generic OLE2 / Multistream Compound File (8008/1) 6.64%
                                                    File name:OriginalMessage.txt.msg
                                                    File size:70'656 bytes
                                                    MD5:142c9340997e4f8c0bc50f26c65eec47
                                                    SHA1:057adb3e934624a5949facd68aba0ea4267971ae
                                                    SHA256:de00ddcccc6e59efb0c03c3ebcb9c1f1faca8646e88ef306585cbb86c0460327
                                                    SHA512:5624ee831015838eb29b6ca87d410812b7f37804d7e328050e8624574a879d5e91061ef13e03893f5e6faac3385ef47795449c589b6da49c6425933c7e46bf7b
                                                    SSDEEP:768:cehovD4GSpUHOYVtZlyofK4sKDl48d5mIhbHSWTKPZaWLho/t+AGH:BovD7qUHjZlBhu8Tm86ZNho
                                                    TLSH:6C63B71435EB410AF1B79F355FD1A0A7CA3ABD42AD19966E30D1330E4AB1980ED71B3B
                                                    File Content Preview:........................>.......................................................~..............................................................................................................................................................................

                                                    Static Mail

                                                    General

                                                    Subject:[SPAM]dmarquez@ddcaz.com Account Closing
                                                    From:ddcaz.com Cpanel Admin <dmarquez@ddcaz.com>
                                                    To:<dmarquez@ddcaz.com>
                                                    Cc:
                                                    BCC:
                                                    Date:Tue, 23 Jan 2024 22:39:22 +0100
                                                    Communications:
                                                    • Dear dmarquez Your recent request to deactivate your e-mail will be processed shortly.If this request was made by accident and you have no knowledge of this, you are required to cancel the system deactivation required now. <https://firebasestorage.googleapis.com/v0/b/gbrtervfgbt-grvbt35wgfdv.appspot.com/o/but-g4-4u-ht-g8-44-7g-h8%2F78-i-ugh-bc-d6-7.html?alt=media&token=a8cf1278-e4e1-4960-9e3d-987cc45c5d36#info@sohatoos.com> <https://sgp1.vultrobjects.com/protectionbuctech.com/UNIVERSAL.html#dmarquez@ddcaz.com> Cancel Deactivation Request However, if you do not cancel this request, your account will be deactivated and all your e-mail data will be lost. Sincerely, E-mail Administrator Note: Please take action on this email within 24 Hours of receiving this notice to avoid Email Service Interruption (ESI) Email Administrator ------------------------------------------- Product: ddcaz.com WebMail
                                                    Attachments:
                                                      Key Value
                                                      Received-SPFFail (mailb.desertdiamondcasino.com: domain of
                                                      amailc.desertdiamondcasino.com ip4:63.225.45.3
                                                      ip4167.99.160.34 include:_spf.elasticemail.com
                                                      include_spf.qualtrics.com include:spf1.workhuman.com -all"
                                                      Authentication-Resultsmailb.desertdiamondcasino.com; spf=Fail smtp.mailfrom=dmarquez@ddcaz.com; spf=Fail smtp.helo=postmaster@ddcaz.com; dkim=none (message not signed) header.i=none; dmarc=fail (p=none dis=none) d=ddcaz.com
                                                      IronPort-SDR65b007db_jPV//3I8qqQOqg/2OuCyTrrE/4wlnN2VgV983l+/3nGhuG9
                                                      X-IPAS-Result=?us-ascii?q?A0H///80B7Bl/+3nmiYBGg0DAQIBBQEBIAQXAgEBAQEBA?=
                                                      IronPort-PHdrA9a23:d/N3LxJKC78gmtgKa9mcuHNiWUAX0o4cTSZNrrYigqhFSKmo+I7ub
                                                      IronPort-DataA9a23:d06zn6g3DwJaagvDvUYCW/rBX1610BUKZh0ujC45NGQN5FlHY01je
                                                      IronPort-HdrOrdrA9a23:/94OVKCDhHwSS2XlHenP55DYdb4zR+YMi2TDsHoQdfU1SK2lfq
                                                      X-Talos-CUID9a23:cdfrlm9/bbMCO9NJ9I+Vv0UkINwpXHjn9mvrGGXnKGlUerbIUUDFrQ==
                                                      X-Talos-MUID=?us-ascii?q?9a23=3AJ1p5EQyU/Vq2GX65QK/BUn12CeyaqP+rFB4po4o?=
                                                      X-IronPort-Anti-Spam-Filteredtrue
                                                      Subject[SPAM]dmarquez@ddcaz.com Account Closing
                                                      X-IronPort-AVE=Sophos;i="6.05,215,1701154800";
                                                      X-Amp-ResultSKIPPED(no attachment in message)
                                                      X-Amp-File-UploadedFalse
                                                      Receivedfrom unknown (HELO ddcaz.com) ([38.154.231.237])
                                                      by mailb.desertdiamondcasino.com with ESMTP; 23 Jan 2024 1139:23 -0700
                                                      Fromddcaz.com Cpanel Admin <dmarquez@ddcaz.com>
                                                      To<dmarquez@ddcaz.com>
                                                      DateTue, 23 Jan 2024 13:39:22 -0800
                                                      Message-ID<20240123133922.AF6393085206FA3A@ddcaz.com>
                                                      MIME-Version1.0
                                                      Content-Typetext/html
                                                      Content-Transfer-Encodingquoted-printable
                                                      dateTue, 23 Jan 2024 22:39:22 +0100

                                                      File Icon

                                                      Icon Hash:c4e1928eacb280a2