Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
https://www.eservce.co.uk/5dd61da52c0441af?l=10

Overview

General Information

Sample URL:https://www.eservce.co.uk/5dd61da52c0441af?l=10
Analysis ID:1448028

Detection

Score:21
Range:0 - 100
Whitelisted:false
Confidence:80%

Signatures

AI detected suspicious javascript
Detected non-DNS traffic on DNS port
Stores files to the Windows start menu directory

Classification

Process Tree

  • System is w10x64_ra
  • chrome.exe (PID: 2948 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www.eservce.co.uk/5dd61da52c0441af?l=10 MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)
    • chrome.exe (PID: 600 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2084 --field-trial-handle=2000,i,3420533159214593148,7926891901157317784,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)
  • cleanup

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Phishing

barindex
AI detected suspicious javascript
Source: https://www.eservce.co.uk/load_training?guid=a7d61dadfc0441cb&correlation_id=e722ffc8-419d-4888-b663-813e54c1f7dcLLM: Score: 8 Reasons: The JavaScript code contains elements that are indicative of a phishing attempt. Specifically, the 'from_email_address' field is set to 'Citrix Admin (admin@eservce.co.uk)', which could be used to impersonate a legitimate entity and trick users into believing the email is from a trusted source. Additionally, the 'subject_line' field states 'Nous avons suspendu votre compte' (We have suspended your account), which is a common tactic used in phishing to create a sense of urgency and prompt users to take immediate action, potentially leading them to a malicious site. DOM: 1.2.pages.csv
Source: https://www.eservce.co.uk/load_training?guid=a7d61dadfc0441cb&correlation_id=e722ffc8-419d-4888-b663-813e54c1f7dcHTTP Parser: No favicon
Source: https://www.eservce.co.uk/training_screenshot?guid=d61dac0441&correlation_id=e722ffc8-419d-4888-b663-813e54c1f7dcHTTP Parser: No favicon
Source: unknownHTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.17:49825 version: TLS 1.2
Source: unknownHTTPS traffic detected: 23.43.61.160:443 -> 192.168.2.17:49852 version: TLS 1.2
Source: unknownHTTPS traffic detected: 23.43.61.160:443 -> 192.168.2.17:49853 version: TLS 1.2
Source: unknownHTTPS traffic detected: 20.190.159.0:443 -> 192.168.2.17:49854 version: TLS 1.2
Source: unknownHTTPS traffic detected: 13.107.5.88:443 -> 192.168.2.17:49855 version: TLS 1.2
Source: unknownHTTPS traffic detected: 2.23.209.156:443 -> 192.168.2.17:49859 version: TLS 1.2
Source: unknownHTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.17:49860 version: TLS 1.2
Source: global trafficTCP traffic: 192.168.2.17:49722 -> 1.1.1.1:53
Source: global trafficTCP traffic: 192.168.2.17:49722 -> 1.1.1.1:53
Source: global trafficTCP traffic: 192.168.2.17:49722 -> 1.1.1.1:53
Source: global trafficTCP traffic: 192.168.2.17:49722 -> 1.1.1.1:53
Source: global trafficTCP traffic: 192.168.2.17:49722 -> 1.1.1.1:53
Source: global trafficTCP traffic: 192.168.2.17:49722 -> 1.1.1.1:53
Source: global trafficTCP traffic: 192.168.2.17:49722 -> 1.1.1.1:53
Source: global trafficTCP traffic: 192.168.2.17:49722 -> 1.1.1.1:53
Source: global trafficTCP traffic: 192.168.2.17:49722 -> 1.1.1.1:53
Source: global trafficTCP traffic: 192.168.2.17:49722 -> 1.1.1.1:53
Source: global trafficTCP traffic: 192.168.2.17:49722 -> 1.1.1.1:53
Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknownTCP traffic detected without corresponding DNS query: 184.30.122.249
Source: unknownTCP traffic detected without corresponding DNS query: 23.206.222.123
Source: unknownTCP traffic detected without corresponding DNS query: 23.206.222.123
Source: unknownTCP traffic detected without corresponding DNS query: 184.30.122.249
Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknownTCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownTCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownTCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownTCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownTCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownTCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownTCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknownTCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknownTCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknownTCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknownTCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknownTCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknownTCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknownTCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknownTCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknownTCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknownTCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknownTCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknownTCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknownTCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.200
Source: global trafficDNS traffic detected: DNS query: www.eservce.co.uk
Source: global trafficDNS traffic detected: DNS query: _49153._https.www.eservce.co.uk
Source: global trafficDNS traffic detected: DNS query: tslp.s3.amazonaws.com
Source: global trafficDNS traffic detected: DNS query: java.com
Source: global trafficDNS traffic detected: DNS query: www.google.com
Source: global trafficDNS traffic detected: DNS query: d25q7gseii1o1q.cloudfront.net
Source: unknownNetwork traffic detected: HTTP traffic on port 49708 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49817 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49742
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49741
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49862
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49740
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49860
Source: unknownNetwork traffic detected: HTTP traffic on port 49789 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49800 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49766 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49720 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49852 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49795 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49739
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49738
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49859
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49737
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49858
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49736
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49857
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49735
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49856
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49734
Source: unknownNetwork traffic detected: HTTP traffic on port 49772 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49855
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49733
Source: unknownNetwork traffic detected: HTTP traffic on port 49841 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49854
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49732
Source: unknownNetwork traffic detected: HTTP traffic on port 49675 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49853
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49731
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49852
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49730
Source: unknownNetwork traffic detected: HTTP traffic on port 49732 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49812 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49703 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49858 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49784 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49806 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49823 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49729
Source: unknownNetwork traffic detected: HTTP traffic on port 49777 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49728
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49727
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49726
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49725
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49846
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49724
Source: unknownNetwork traffic detected: HTTP traffic on port 49790 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49845
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49723
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49844
Source: unknownNetwork traffic detected: HTTP traffic on port 49674 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49843
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49721
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49842
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49720
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49841
Source: unknownNetwork traffic detected: HTTP traffic on port 49731 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49840
Source: unknownNetwork traffic detected: HTTP traffic on port 49834 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49760 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49828 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49805 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49719
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49718
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49839
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49717
Source: unknownNetwork traffic detected: HTTP traffic on port 49715 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49716
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49837
Source: unknownNetwork traffic detected: HTTP traffic on port 49680 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49715
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49836
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49835
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49713
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49834
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49712
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49833
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49832
Source: unknownNetwork traffic detected: HTTP traffic on port 49709 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49710
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49831
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49830
Source: unknownNetwork traffic detected: HTTP traffic on port 49839 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49822 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49726 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49765 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49853 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49796 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49709
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49708
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49829
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49707
Source: unknownNetwork traffic detected: HTTP traffic on port 49811 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49828
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49706
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49827
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49705
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49826
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49704
Source: unknownNetwork traffic detected: HTTP traffic on port 49754 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49825
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49703
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49824
Source: unknownNetwork traffic detected: HTTP traffic on port 49737 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49702
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49823
Source: unknownNetwork traffic detected: HTTP traffic on port 49771 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49822
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49788
Source: unknownNetwork traffic detected: HTTP traffic on port 49699 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49787
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49786
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49785
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49784
Source: unknownNetwork traffic detected: HTTP traffic on port 49813 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49676 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49783
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49782
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49781
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49780
Source: unknownNetwork traffic detected: HTTP traffic on port 49836 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49785 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49807 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49776 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49713 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49845 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49736 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49791 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49759 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49753 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49779
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49778
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49777
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49776
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49775
Source: unknownNetwork traffic detected: HTTP traffic on port 49707 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49774
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49773
Source: unknownNetwork traffic detected: HTTP traffic on port 49862 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49772
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49771
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49770
Source: unknownNetwork traffic detected: HTTP traffic on port 49724 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49742 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49780 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49802 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49830 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49769
Source: unknownNetwork traffic detected: HTTP traffic on port 49718 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49768
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49767
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49766
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49765
Source: unknownNetwork traffic detected: HTTP traffic on port 49758 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49764
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49763
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49762
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49761
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49760
Source: unknownNetwork traffic detected: HTTP traffic on port 49840 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49702 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49725 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49741 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49857 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49764 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49770 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49719 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49797 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49801 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49824 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49759
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49758
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49757
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49756
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49755
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49754
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49753
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49752
Source: unknownNetwork traffic detected: HTTP traffic on port 49730 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49818 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49835 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49786 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49829 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49775 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49846 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49792 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49746
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49745
Source: unknownNetwork traffic detected: HTTP traffic on port 49746 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49781 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49769 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49803 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49826 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49717 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49699
Source: unknownNetwork traffic detected: HTTP traffic on port 49820 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49837 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49690
Source: unknownNetwork traffic detected: HTTP traffic on port 49728 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49763 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49855 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49752 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49798 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49735 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49706 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49712 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49819 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49844 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49787 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49729 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49745 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49793 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49831 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49774 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49757 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49782 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49799
Source: unknownNetwork traffic detected: HTTP traffic on port 49734 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49798
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49797
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49796
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49795
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49794
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49793
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49792
Source: unknownNetwork traffic detected: HTTP traffic on port 49814 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49791
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49790
Source: unknownNetwork traffic detected: HTTP traffic on port 49740 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49856 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49768 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49723 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49825 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49808 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49789
Source: unknownNetwork traffic detected: HTTP traffic on port 49733 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49821
Source: unknownNetwork traffic detected: HTTP traffic on port 49710 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49820
Source: unknownNetwork traffic detected: HTTP traffic on port 49842 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49779 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49727 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49859 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49704 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49762 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49833 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49819
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49818
Source: unknownNetwork traffic detected: HTTP traffic on port 49799 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49810 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49817
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49816
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49815
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49814
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49813
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49812
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49811
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49810
Source: unknownNetwork traffic detected: HTTP traffic on port 49816 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49788 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49767 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49721 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49794 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49827 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49809
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49808
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49807
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49806
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49805
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49804
Source: unknownNetwork traffic detected: HTTP traffic on port 49773 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49803
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49802
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49801
Source: unknownNetwork traffic detected: HTTP traffic on port 49756 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49739 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49800
Source: unknownNetwork traffic detected: HTTP traffic on port 49783 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49678 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49821 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49815 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49854 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49690 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49809 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49860 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49778 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49755 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49738 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49673 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49705 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49843 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49761 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49804 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49832 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49716 -> 443
Source: unknownHTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.17:49825 version: TLS 1.2
Source: unknownHTTPS traffic detected: 23.43.61.160:443 -> 192.168.2.17:49852 version: TLS 1.2
Source: unknownHTTPS traffic detected: 23.43.61.160:443 -> 192.168.2.17:49853 version: TLS 1.2
Source: unknownHTTPS traffic detected: 20.190.159.0:443 -> 192.168.2.17:49854 version: TLS 1.2
Source: unknownHTTPS traffic detected: 13.107.5.88:443 -> 192.168.2.17:49855 version: TLS 1.2
Source: unknownHTTPS traffic detected: 2.23.209.156:443 -> 192.168.2.17:49859 version: TLS 1.2
Source: unknownHTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.17:49860 version: TLS 1.2
Source: classification engineClassification label: sus21.phis.win@14/31@18/175
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: unknownProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www.eservce.co.uk/5dd61da52c0441af?l=10
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2084 --field-trial-handle=2000,i,3420533159214593148,7926891901157317784,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2084 --field-trial-handle=2000,i,3420533159214593148,7926891901157317784,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management Instrumentation1
Registry Run Keys / Startup Folder		1
Process Injection		1
Masquerading		OS Credential DumpingSystem Service DiscoveryRemote ServicesData from Local System2
Encrypted Channel		Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization Scripts1
Registry Run Keys / Startup Folder		1
Process Injection		LSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable Media1
Non-Application Layer Protocol		Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared Drive2
Application Layer Protocol		Automated ExfiltrationData Encrypted for Impact

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
https://www.eservce.co.uk/5dd61da52c0441af?l=100%Avira URL Cloudsafe

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

SourceDetectionScannerLabelLink
about:blank0%Avira URL Cloudsafe

Domains and IPs

Contacted Domains

NameIPActiveMaliciousAntivirus DetectionReputation
s3-w.us-east-1.amazonaws.com
52.217.136.121
truefalse
    		unknown
    prod-lp-alb-323408969.eu-west-1.elb.amazonaws.com
    		52.210.231.227
    		truefalse
      		unknown
      java.com
      		2.23.209.148
      		truefalse
        		unknown
        www.google.com
        		142.250.184.196
        		truefalse
          		unknown
          d25q7gseii1o1q.cloudfront.net
          		18.239.63.153
          		truefalse
            		unknown
            tslp.s3.amazonaws.com
            		unknown
            		unknownfalse
              		unknown
              www.eservce.co.uk
              		unknown
              		unknownfalse
                		unknown
                _49153._https.www.eservce.co.uk
                		unknown
                		unknownfalse
                  		unknown

                  Contacted URLs

                  NameMaliciousAntivirus DetectionReputation
                  https://www.eservce.co.uk/load_training?guid=a7d61dadfc0441cb&correlation_id=e722ffc8-419d-4888-b663-813e54c1f7dctrue
                    		unknown
                    https://www.eservce.co.uk/training_screenshot?guid=d61dac0441&correlation_id=e722ffc8-419d-4888-b663-813e54c1f7dcfalse
                      		unknown
                      about:blankfalse
                      • Avira URL Cloud: safe
                      		unknown

                      World Map of Contacted IPs

                      • No. of IPs < 25%
                      • 25% < No. of IPs < 50%
                      • 50% < No. of IPs < 75%
                      • 75% < No. of IPs

                      Public IPs

                      IPDomainCountryFlagASNASN NameMalicious
                      142.250.185.99
                      		unknownUnited States
                      		15169GOOGLEUSfalse
                      142.250.184.196
                      		www.google.comUnited States
                      		15169GOOGLEUSfalse
                      2.23.209.148
                      		java.comEuropean Union
                      		1273CWVodafoneGroupPLCEUfalse
                      1.1.1.1
                      		unknownAustralia
                      		13335CLOUDFLARENETUSfalse
                      216.58.206.74
                      		unknownUnited States
                      		15169GOOGLEUSfalse
                      74.125.71.84
                      		unknownUnited States
                      		15169GOOGLEUSfalse
                      34.253.170.76
                      		unknownUnited States
                      		16509AMAZON-02USfalse
                      142.250.185.170
                      		unknownUnited States
                      		15169GOOGLEUSfalse
                      142.250.181.238
                      		unknownUnited States
                      		15169GOOGLEUSfalse
                      52.210.231.227
                      		prod-lp-alb-323408969.eu-west-1.elb.amazonaws.comUnited States
                      		16509AMAZON-02USfalse
                      239.255.255.250
                      		unknownReserved
                      		unknownunknownfalse
                      18.239.63.153
                      		d25q7gseii1o1q.cloudfront.netUnited States
                      		16509AMAZON-02USfalse
                      52.217.136.121
                      		s3-w.us-east-1.amazonaws.comUnited States
                      		16509AMAZON-02USfalse
                      142.250.186.110
                      		unknownUnited States
                      		15169GOOGLEUSfalse
                      172.217.18.99
                      		unknownUnited States
                      		15169GOOGLEUSfalse
                      142.250.74.195
                      		unknownUnited States
                      		15169GOOGLEUSfalse
                      16.182.99.41
                      		unknownUnited States
                      		unknownunknownfalse

                      Private

                      IP
                      192.168.2.17
                      192.168.2.16

                      General Information

                      Joe Sandbox version:40.0.0 Tourmaline
                      Analysis ID:1448028
                      Start date and time:2024-05-27 14:57:19 +02:00
                      Joe Sandbox product:CloudBasic
                      Overall analysis duration:
                      Hypervisor based Inspection enabled:false
                      Report type:full
                      Cookbook file name:defaultwindowsinteractivecookbook.jbs
                      Sample URL:https://www.eservce.co.uk/5dd61da52c0441af?l=10
                      Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                      Number of analysed new started processes analysed:18
                      Number of new started drivers analysed:0
                      Number of existing processes analysed:0
                      Number of existing drivers analysed:0
                      Number of injected processes analysed:0
                      Technologies:
                      • EGA enabled
                      Analysis Mode:stream
                      Analysis stop reason:Timeout
                      Detection:SUS
                      Classification:sus21.phis.win@14/31@18/175

                      Warnings

                      • Exclude process from analysis (whitelisted): SIHClient.exe
                      • Excluded IPs from analysis (whitelisted): 142.250.185.99, 74.125.71.84, 142.250.181.238, 34.104.35.123, 142.250.185.170, 216.58.206.74, 172.217.18.99, 93.184.221.240
                      • Excluded domains from analysis (whitelisted): fonts.googleapis.com, clients2.google.com, accounts.google.com, edgedl.me.gvt1.com, slscr.update.microsoft.com, ajax.googleapis.com, fonts.gstatic.com, ctldl.windowsupdate.com, clientservices.googleapis.com, clients.l.google.com, fe3cr.delivery.mp.microsoft.com
                      • Not all processes where analyzed, report is missing behavior information
                      • VT rate limit hit for: about:blank

                      LLM Input / Output

                      InputOutput
                      URL: https://www.eservce.co.uk/load_training?guid=a7d61dadfc0441cb&correlation_id=e722ffc8-419d-4888-b663-813e54c1f7dc Model: Perplexity: mixtral-8x7b-instruct
                      {
"loginform": false,
"reasons": [
"The text does not contain any HTML or form elements that would suggest it is a login form.",
"The text appears to be a phishing simulation and not an actual login form."
]
}
                      Language: English OOPS! 'feJ] for a pnjz}J! Do not worry, this was an approved phishing simulation run by Mulliez - Norauto International. We are here to help. Below is the simulated phishing message Hackers want access to passwords, you just received. Like a real phishing attack, credentials and other sensitive information. on the surface, the email seems to be If this had been an actual attack, your data legitimate  but it isn't. would be in the hands of a cybercriminal. From: Citrix Admin (admin@eservce.co.uk) Subject: Nous avons suspendu votre compte Cher utilisateur de Citrix: Nous avons suspendu votre compte de manlre temporalre cause d'activits suspicieuses rcentes_ IT Security a implant des prcautlons supplmentaires pour vous alder  protger votre compte dans le cas o quelqu'un d'autre aurait pu essayer de se connecter. Vous recevez peut-tre ce message car vous vous tes connect depuls un autre Ileu ou un autre appareil. Sl c'est le cas: votre aces sera restaur quand vous vous connecterez nouveau de la mamre habituelle_ Veulllez vous connecter  votre compte Citrix depuls votre ordinateur normal Cliquez ci-dessous pour rinltlallser votre compte_
                      URL: https://www.eservce.co.uk/training_screenshot?guid=d61dac0441&correlation_id=e722ffc8-419d-4888-b663-813e54c1f7dc Model: Perplexity: mixtral-8x7b-instruct
                      {
"loginform": false,
"reasons": [
"The text does not contain a login form.",
"The text is a phishing simulation and not a legitimate login form."
]
}
                      Language: English OOPS! 'feJ] for a pnjz}J! Do not worry, this was an approved phishing simulation run by Mulliez - Norauto International. We are here to help. Below is the simulated phishing message Hackers want access to passwords, you just received. Like a real phishing attack, credentials and other sensitive information. on the surface, the email seems to be If this had been an actual attack, your data legitimate  but it isn't. would be in the hands of a cybercriminal. From: Citrix Admin (admin@eservce.co.uk) Subject: Nous avons suspendu votre compte Cher utilisateur de Citrix: Nous avons suspendu votre compte de manlre temporalre cause d'activits suspicieuses rcentes_ IT Security a implant des prcautlons supplmentaires pour vous alder  protger votre compte dans le cas o quelqu'un d'autre aurait pu essayer de se connecter. Vous recevez peut-tre ce message car vous vous tes connect depuls un autre Ileu ou un autre appareil. Sl c'est le cas: votre aces sera restaur quand vous vous connecterez nouveau de la mamre habituelle_ Veulllez vous connecter  votre compte Citrix depuls votre ordinateur normal Cliquez ci-dessous pour rinltlallser votre compte_
                      URL: https://www.eservce.co.uk/load_training?guid=a7d61dadfc0441cb&correlation_id=e722ffc8-419d-4888-b663-813e54c1f7dc Model: gpt-4o
                      ```json
{
  "riskscore": 8,
  "reasons": "The JavaScript code contains elements that are indicative of a phishing attempt. Specifically, the 'from_email_address' field is set to 'Citrix Admin (admin@eservce.co.uk)', which could be used to impersonate a legitimate entity and trick users into believing the email is from a trusted source. Additionally, the 'subject_line' field states 'Nous avons suspendu votre compte' (We have suspended your account), which is a common tactic used in phishing to create a sense of urgency and prompt users to take immediate action, potentially leading them to a malicious site."
}
                      window.plugin_detector          = PluginDetect;
              window.account_logo             = "";
              window.campaign_guid            = "461cba4e2f";
              window.company_name             = "Mulliez - Norauto International";
              window.company_name_possessive  = "Mulliez - Norauto International's";
              window.content_bucket           = "https://ts-content-eu.s3-eu-west-1.amazonaws.com/";
              window.correlation_id           = "e722ffc8-419d-4888-b663-813e54c1f7dc";
              window.environment              = "production";
              window.from_email_address       = "Citrix Admin (admin@eservce.co.uk)";
              window.subject_line             = "Nous avons suspendu votre compte";
              window.target_guid              = "d61dac0441";
              window.template                 = "embedded_html_data";

                      Created / dropped Files

                      C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

                      Download File
                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                      File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon May 27 11:58:19 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
                      Category:dropped
                      Size (bytes):2677
                      Entropy (8bit):3.982802077190622
                      Encrypted:false
                      SSDEEP:
                      MD5:EA640B9BBD142E4EA8EBAE61FADCF9B1
                      SHA1:00318771B51CF32C42D791DB3BB72DE01D5082B7
                      SHA-256:37D4DE67CB39AF505EBEF2A36FF6244AC7A13CACD1C0FB9559835D6738A5B4FD
                      SHA-512:5EC3567010A1CACD6B7CC1657A8646938B0F49BF0DC49278148475B90588A199F459395D7EBA4D077963EA71BC03CACC21FF476B09F2F0BC527D2CB34ECE71B3
                      Malicious:false
                      Reputation:unknown
                      Preview:L..................F.@.. ...$+.,....<Cq.5.......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.I.XAg....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.XIg....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.V.XIg....M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.V.XIg...........................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V.XJg...........................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........P..(.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                      C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

                      Download File
                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                      File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon May 27 11:58:19 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
                      Category:dropped
                      Size (bytes):2679
                      Entropy (8bit):3.9976825217331555
                      Encrypted:false
                      SSDEEP:
                      MD5:41719D0BAA5871DF1532F5D903B12B8A
                      SHA1:206F2E2F04A9557A734A281AF266A3235ED8F5E4
                      SHA-256:D9051E53077AAD27E31FC6A93340ECD4561C1687C1824AB13EBA6D08D304ABEB
                      SHA-512:B2E73CF134BD98561477D0A7CE6CF33ACBBB5D6EEDB61F6C246997AA11AA14C8EB5ABA3ACA78E9B7AD3D7575BA51E745482BD4FA3FBA13E4E240BBB212DB822D
                      Malicious:false
                      Reputation:unknown
                      Preview:L..................F.@.. ...$+.,.....Jd.5.......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.I.XAg....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.XIg....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.V.XIg....M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.V.XIg...........................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V.XJg...........................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........P..(.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                      C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

                      Download File
                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                      File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:54:41 2023, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
                      Category:dropped
                      Size (bytes):2693
                      Entropy (8bit):4.008009718470106
                      Encrypted:false
                      SSDEEP:
                      MD5:94160F7A7C1E6960881A4F912367EAB3
                      SHA1:3C259AD8D56356342F21C2B0288775983779A9D1
                      SHA-256:A1D05F0FC014B45F10BD3263BAE2258F64C0DF73B811B175A82BB25BF3EF2138
                      SHA-512:AB8D59DA023AC693BA170ACB7C5D73E12A70D9693B6187D2305810BD4F53D2019ED31FF0E96C9CB9ED67EBA522578B0B0D1F67A58497B79591452FE76DABFA78
                      Malicious:false
                      Reputation:unknown
                      Preview:L..................F.@.. ...$+.,.....v. ;.......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.I.XAg....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.XIg....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.V.XIg....M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.V.XIg...........................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.VFW.N...........................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........P..(.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                      C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

                      Download File
                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                      File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon May 27 11:58:19 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
                      Category:dropped
                      Size (bytes):2681
                      Entropy (8bit):3.9974358677079347
                      Encrypted:false
                      SSDEEP:
                      MD5:AD6F9E88E332BB3F437984CD4EA8A5D3
                      SHA1:6597FF4179753C042A0328FA80025D8F00FE0653
                      SHA-256:A62684A4D93DFA178A2FADCBCC1274C20462C01E89868C65561BE2E0C29D32BB
                      SHA-512:B46128EAD45F8D3AEDE50A30501E887D6D82DC4FA857542E8B2A828C7F662A0BFE75B6DDAE2F36742AE38F60758AC05FE021575CB8BDBB28772114A257DE812E
                      Malicious:false
                      Reputation:unknown
                      Preview:L..................F.@.. ...$+.,....^.].5.......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.I.XAg....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.XIg....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.V.XIg....M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.V.XIg...........................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V.XJg...........................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........P..(.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                      C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

                      Download File
                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                      File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon May 27 11:58:19 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
                      Category:dropped
                      Size (bytes):2681
                      Entropy (8bit):3.9862811199998345
                      Encrypted:false
                      SSDEEP:
                      MD5:22F7E031E64BD43806D93359BBB81FD5
                      SHA1:AFC7557EC3B318B5D5B27A1802F20CBD315C631F
                      SHA-256:361041430FBEE43FB2FA26471884B425111F27AA8795F414EE6611A5740E9B68
                      SHA-512:9172AB1FF4666385E2C78ADCA2242F04EDF564D39E23A4B21193B556FE2F6785AD9504C51951A19156A120381EAB26A03D379321F6284D7178F443B558C3383D
                      Malicious:false
                      Reputation:unknown
                      Preview:L..................F.@.. ...$+.,......j.5.......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.I.XAg....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.XIg....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.V.XIg....M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.V.XIg...........................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V.XJg...........................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........P..(.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                      C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

                      Download File
                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                      File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon May 27 11:58:19 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
                      Category:dropped
                      Size (bytes):2683
                      Entropy (8bit):3.9949743807199876
                      Encrypted:false
                      SSDEEP:
                      MD5:D6DC16754E62CC2E550FF9445E99AA88
                      SHA1:317C298D6F7103CBBFE6AA26BD0347FA8C35F078
                      SHA-256:2FD1E0552D1A3C26089C11F53B98B505BA694A5B7C0D0BA3878967308EB26724
                      SHA-512:4D96E70BEFA4DA531E963A964115D7440E70989160E55794659B92BFF35B6AD911C89B7C942F340447F9B57696C8E63B5BA690C32BE57BE738EBD1A651B1FAFB
                      Malicious:false
                      Reputation:unknown
                      Preview:L..................F.@.. ...$+.,....2ET.5.......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.I.XAg....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.XIg....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.V.XIg....M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.V.XIg...........................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V.XJg...........................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........P..(.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                      Chrome Cache Entry: 101

                      Download File
                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                      File Type:ASCII text
                      Category:downloaded
                      Size (bytes):4234
                      Entropy (8bit):3.7012321814825753
                      Encrypted:false
                      SSDEEP:
                      MD5:E6DD596D2BC204EA573B868B92028C26
                      SHA1:FA58BBA4C9A01B3764A881949A8423B773D8A338
                      SHA-256:0730A7E6770925FA4232096E4D9874514985EC791A63FE873F0E4E3CD7722381
                      SHA-512:4857A83D1F1AC1127A578B2BDE94973BCE3ECD2720CBC4D72DDF8CB193F0F3676BF932D0352F0F45CA3A553677D3960A61B472CA15C66E74F3E6384E36E018B4
                      Malicious:false
                      Reputation:unknown
                      URL:https://tslp.s3.amazonaws.com/detect/silverlight.js?guid=d61dac0441&correlation_id=e722ffc8-419d-4888-b663-813e54c1f7dc
                      Preview:/*.PluginDetect v0.9.1.www.pinlady.net/PluginDetect/license/.[ Silverlight ].[ isMinVersion getVersion hasMimeType getInfo onDetectionDone ].[ AllowActiveX BetterIE ].*/.(function() {. j = window.detector;. var h = {. getVersion: function() {. var r = this,. p = null,. q = 0;. if ((!q || j.dbug) && r.nav.query().installed) {. q = 1. }. if ((!p || j.dbug) && r.nav.query().version) {. p = r.nav.version. }. if ((!q || j.dbug) && r.axo.query().installed) {. q = 1. }. if ((!p || j.dbug) && r.axo.query().version) {. p = r.axo.version. }. r.version = j.formatNum(p);. r.installed = p ? 1 : (q ? 0 : -1). },. nav: {. hasRun: 0,. installed: 0,. version: null,. mimeType: ["application/x-silverlight", "application/x-silve

                      Chrome Cache Entry: 104

                      Download File
                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                      File Type:HTML document, ASCII text
                      Category:downloaded
                      Size (bytes):3847
                      Entropy (8bit):4.865258040802451
                      Encrypted:false
                      SSDEEP:
                      MD5:D36CA3230E4D855B98A9743383C0A82A
                      SHA1:72C3CDA78DED4B2CCD576CA007F9059955927025
                      SHA-256:38EADFAC192C5FA31F51B4E92A5E776DC7567063D7191A64946A25F19FF6D8FC
                      SHA-512:F39503E33C1FEFC5C6EC6264AFB324AD7778229B99C5A184C2B81149FC061E0DB820D66C4DE3C85B052FD33F1F55B7A150C827F1F92EF8834BE96F23FDB52640
                      Malicious:false
                      Reputation:unknown
                      URL:https://www.eservce.co.uk/5dd61da52c0441af?l=10
                      Preview: <html>. <head>. <title></title>. <noscript><meta http-equiv="refresh" content="1;url=/load_training?guid=a7d61dadfc0441cb&correlation_id=e722ffc8-419d-4888-b663-813e54c1f7dc"></noscript>. </head>. <body>. <noscript><img src="/trace.png?id=d61dac0441&msg=JavascriptDisabled&correlation_id=e722ffc8-419d-4888-b663-813e54c1f7dc" width="1" height="1" style="display: none;"></noscript>. <img src="https://www.eservce.co.uk:49153/alt_pixel_click_d61dac0441.gif?correlation_id=e722ffc8-419d-4888-b663-813e54c1f7dc" width="1" height="1" />. </body>. <script type="text/javascript" src="https://tslp.s3.amazonaws.com/detect/plugin_detect.js?guid=d61dac0441&correlation_id=e722ffc8-419d-4888-b663-813e54c1f7dc"></script>.<script type="text/javascript" src="https://tslp.s3.amazonaws.com/detect/java.js?guid=d61dac0441&correlation_id=e722ffc8-419d-4888-b663-813e54c1f7dc"></script>.<script type="t

                      Chrome Cache Entry: 105

                      Download File
                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                      File Type:ASCII text
                      Category:downloaded
                      Size (bytes):9775
                      Entropy (8bit):3.5887745114878893
                      Encrypted:false
                      SSDEEP:
                      MD5:3D7BE656672C16A34806C13388410325
                      SHA1:C391646C980C60D75C35B33A974C97AE88114EEF
                      SHA-256:88BE902CC76B5EC1EC932B6AE93457B6B0CA69D7A36BFADEFC2F24DB225DC238
                      SHA-512:E4BFA1B906B6F12F9CE8FBB1CFC41FFD5341149B6AFFEB8567A6486E386C000C501AF6040D7986046CBF3E0E0C99C4F08B4011003302753536BA0166DE49CE0F
                      Malicious:false
                      Reputation:unknown
                      URL:https://tslp.s3.amazonaws.com/detect/realplayer.js?guid=d61dac0441&correlation_id=e722ffc8-419d-4888-b663-813e54c1f7dc
                      Preview:/*.PluginDetect v0.9.1.www.pinlady.net/PluginDetect/license/.[ RealPlayer ].[ isMinVersion getVersion hasMimeType getInfo onDetectionDone ].[ AllowActiveX BetterIE ].*/.(function() {. j = PluginDetect;. var n = {. mimeType: ["audio/x-pn-realaudio-plugin", "audio/x-pn-realaudio"],. classID: "clsid:CFCDAA03-8BE4-11cf-B84B-0020AFBBCCFA",. setPluginStatus: function(r, p) {. var s = this,. q;. if (p) {. s.version = j.formatNum(j.getNum(p)). }. s.installed = s.version ? 1 : (r ? 0 : -1);. q = s.installed == -1 || s.instance.version;. q = q || s.axo.version;. s.getVersionDone = q ? 1 : 0;. },. navObj: {. hasRun: 0,. installed: null,. version: null,. find: "RealPlayer.*Plug-?in",. avoid: "Totem|QuickTime|Helix|VLC|Download",. plugins: ["RealPlayer(tm) G2 LiveConnect-Enabled Plug-In (

                      Chrome Cache Entry: 106

                      Download File
                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                      File Type:HTML document, Unicode text, UTF-8 (with BOM) text
                      Category:downloaded
                      Size (bytes):8561
                      Entropy (8bit):5.078728618578694
                      Encrypted:false
                      SSDEEP:
                      MD5:5741183576E6260D9D06F2E1B811291D
                      SHA1:72CEB054A12D8FE82C1B8978EEA460A62A116139
                      SHA-256:E5DB266D2827055B395629F74DC4653D518C9AD1E698EED4AE740B69E451F38D
                      SHA-512:1F5F876A34813E517CE95C64D1D913F72EAF4A9A558E37A88A27EEAECEA3366742BF2538136562FA6C5C979061B7A97B895C2A8068FBB5D2B368AB76B145B88D
                      Malicious:false
                      Reputation:unknown
                      URL:https://www.eservce.co.uk/load_training?guid=a7d61dadfc0441cb&correlation_id=e722ffc8-419d-4888-b663-813e54c1f7dc
                      Preview:.<!doctype html>.<html lang="en">.<head>..<meta charset="UTF-8" />..<title data-text="title">You have been Phished!</title>..<link href="https://fonts.googleapis.com/css?family=Open+Sans:400,700" rel="stylesheet" type="text/css" />..<link href="https://tslp.s3.amazonaws.com/training/embedded/css/data.css" rel="stylesheet" type="text/css" />. <link rel="stylesheet" type="text/css" href="https://tslp.s3.amazonaws.com/training/teachable_moments/css/langdrop.css">. <meta content="width=device-width, initial-scale=1" name="viewport" /> [if lt IE 9]>. <style type="text/css">. header .fish { background: url(https://d25q7gseii1o1q.cloudfront.net/training/fish/fish.gif) no-repeat }. header .bubble { background: url(https://d25q7gseii1o1q.cloudfront.net/training/fish/bubble2.gif) no-repeat }. header .bubble:first-of-type { background: url(https://d25q7gseii1o1q.cloudfront.net/training/fish/bubble1.gif) no-repeat }. header .bubble:last-of-type { background: url(https

                      Chrome Cache Entry: 107

                      Download File
                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                      File Type:ASCII text, with very long lines (1572)
                      Category:downloaded
                      Size (bytes):11194
                      Entropy (8bit):5.3411998506500575
                      Encrypted:false
                      SSDEEP:
                      MD5:B69C29C8C917C014D6F4B79752D8CE0B
                      SHA1:71A580B2E8792BA930815BCCA3BDA73E7715CA3F
                      SHA-256:5CCCC465F4C8CDCEC789A0B28846823F18646206351BC9FF794F1AEC7F58F5B0
                      SHA-512:72D5BA23DB12BE9AF117A3BE682801E3839639EBEB656E426A05367250D26B1520BBF4D1FE981083EF4F92DDEE3F50B62E69B82322FE18C697460D22F06A5209
                      Malicious:false
                      Reputation:unknown
                      URL:"https://fonts.googleapis.com/css?family=Open+Sans:400,700"
                      Preview:/* cyrillic-ext */.@font-face {. font-family: 'Open Sans';. font-style: normal;. font-weight: 400;. font-stretch: 100%;. src: url(https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTSKmu1aB.woff2) format('woff2');. unicode-range: U+0460-052F, U+1C80-1C88, U+20B4, U+2DE0-2DFF, U+A640-A69F, U+FE2E-FE2F;.}./* cyrillic */.@font-face {. font-family: 'Open Sans';. font-style: normal;. font-weight: 400;. font-stretch: 100%;. src: url(https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTSumu1aB.woff2) format('woff2');. unicode-range: U+0301, U+0400-045F, U+0490-0491, U+04B0-04B1, U+2116;.}./* greek-ext */.@font-face {. font-family: 'Open Sans';. font-style: normal;. font-weight: 400;. font-stretch: 100%;. src: url(https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTSOmu1aB.woff2) format('woff2');. unicode-range: U+1F00-1FFF;.}./* greek */.@font-face {. font-family: 'Open Sans';. font-style: normal;

                      Chrome Cache Entry: 79

                      Download File
                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                      File Type:JSON data
                      Category:downloaded
                      Size (bytes):1859
                      Entropy (8bit):4.738675770543238
                      Encrypted:false
                      SSDEEP:
                      MD5:A15AE6B93DA289454A88A2450EF08E84
                      SHA1:F262E2CF5236D91B12E43ACA9F8471A335DC8E38
                      SHA-256:F857219C795F8BEAC05CDA0E90E7E4997BF91970301070DF30C903E04D492C5E
                      SHA-512:AF952E1F0B8E1085BBF13D0C2D644D79483FB781AA0A6D93B736388D23E64C401A3C12F3427FD7F2E840AE2272EDA0947488C1F73242B4E7E2D0F54DA2563FA0
                      Malicious:false
                      Reputation:unknown
                      URL:https://tslp.s3.amazonaws.com/training/embedded/translations/data/en-us.json
                      Preview:{. "replacements":{. "title":"You have been Phished!",. "h1":"OOPS!",. "h2":"You fell for a <strong>phish!</strong>",. "p0":"Do not worry, this was an approved phishing simulation run by %COMPANY%.<br> <strong>We are here to help.</strong>",. "p1":"Below is the simulated phishing message you just received. Like a real phishing attack, on the surface, the email seems to be legitimate.. but it isn't..",. "p2":"Hackers want access to passwords,<br> credentials and other sensitive information. If this had been an actual attack, your data would be in the hands of a cybercriminal.",. "p3":"<br> When you receive an unsolicited email that asks for sensitive data, keep the following tips in mind:",. "ul1":"<li>Be immediately suspicious if the message tries to scare you, asks for financial or tax information, or prompts you to reset a password or update an account.</li> <li>Remind yourself that legitimate organizations are highly unlikely to request sensitive data vi

                      Chrome Cache Entry: 80

                      Download File
                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                      File Type:ASCII text
                      Category:downloaded
                      Size (bytes):6680
                      Entropy (8bit):3.6986423324780655
                      Encrypted:false
                      SSDEEP:
                      MD5:F9AD9A096894BA248E4A1F73E7EBA1BE
                      SHA1:F2449CE5F7A5C42FFDCC5F087A75B2513E73592C
                      SHA-256:A26D01D5912459798481786640DC44FD7605D09F2F9E6DD24720205EFCAB6861
                      SHA-512:230C6B3F64BAD4A1681A90CD835FD2037068AD951D1BFB027E2B90F832C074D0AF686D2AA51175BE538BFAE9A08D96E9D46C941AEF223567937E0CD280B76DD4
                      Malicious:false
                      Reputation:unknown
                      URL:https://tslp.s3.amazonaws.com/detect/flash.js?guid=d61dac0441&correlation_id=e722ffc8-419d-4888-b663-813e54c1f7dc
                      Preview:/*.PluginDetect v0.9.1.www.pinlady.net/PluginDetect/license/.[ Flash ].[ isMinVersion getVersion hasMimeType getInfo ].[ AllowActiveX BetterIE ].*/.(function() {. j = PluginDetect;. var e = {. mimeType: "application/x-shockwave-flash",. setPluginStatus: function(t, q, p) {. var s = this,. r;. s.installed = q ? 1 : (t ? 0 : -1);. s.precision = p;. s.version = j.formatNum(q);. r = s.installed == -1 || s.instance.version;. r = r || s.axo.version;. s.getVersionDone = r ? 1 : 0;. },. getPrecision: function(t) {. if (j.isString(t)) {. var q, s = "\\d+",. r = "[\\._,]",. p = [s, s, s, s];. for (q = 4; q > 0; q--) {. if ((new RegExp(p.slice(0, q).join(r))).test(t)) {. return q. }. }. }. return 0.

                      Chrome Cache Entry: 81

                      Download File
                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                      File Type:ASCII text, with very long lines (32089)
                      Category:downloaded
                      Size (bytes):92629
                      Entropy (8bit):5.303443527492463
                      Encrypted:false
                      SSDEEP:
                      MD5:397754BA49E9E0CF4E7C190DA78DDA05
                      SHA1:AE49E56999D82802727455F0BA83B63ACD90A22B
                      SHA-256:C12F6098E641AACA96C60215800F18F5671039AECF812217FAB3C0D152F6ADB4
                      SHA-512:8C64754F77507AB2C24A6FC818419B9DD3F0CECCC9065290E41AFDBEE0743F0DA2CB13B2FBB00AFA525C082F1E697CB3FFD76EF9B902CB81D7C41CA1C641DFFB
                      Malicious:false
                      Reputation:unknown
                      URL:https://www.eservce.co.uk/assets/ajax/libs/jquery/1.9.1/jquery.min.js
                      Preview:/*! jQuery v1.9.1 | (c) 2005, 2012 jQuery Foundation, Inc. | jquery.org/license.//@ sourceMappingURL=jquery.min.map.*/(function(e,t){var n,r,i=typeof t,o=e.document,a=e.location,s=e.jQuery,u=e.$,l={},c=[],p="1.9.1",f=c.concat,d=c.push,h=c.slice,g=c.indexOf,m=l.toString,y=l.hasOwnProperty,v=p.trim,b=function(e,t){return new b.fn.init(e,t,r)},x=/[+-]?(?:\d*\.|)\d+(?:[eE][+-]?\d+|)/.source,w=/\S+/g,T=/^[\s\uFEFF\xA0]+|[\s\uFEFF\xA0]+$/g,N=/^(?:(<[\w\W]+>)[^>]*|#([\w-]*))$/,C=/^<(\w+)\s*\/?>(?:<\/\1>|)$/,k=/^[\],:{}\s]*$/,E=/(?:^|:|,)(?:\s*\[)+/g,S=/\\(?:["\\\/bfnrt]|u[\da-fA-F]{4})/g,A=/"[^"\\\r\n]*"|true|false|null|-?(?:\d+\.|)\d+(?:[eE][+-]?\d+|)/g,j=/^-ms-/,D=/-([\da-z])/gi,L=function(e,t){return t.toUpperCase()},H=function(e){(o.addEventListener||"load"===e.type||"complete"===o.readyState)&&(q(),b.ready())},q=function(){o.addEventListener?(o.removeEventListener("DOMContentLoaded",H,!1),e.removeEventListener("load",H,!1)):(o.detachEvent("onreadystatechange",H),e.detachEvent("onload",H)

                      Chrome Cache Entry: 82

                      Download File
                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                      File Type:ASCII text
                      Category:downloaded
                      Size (bytes):5941
                      Entropy (8bit):3.890139995787555
                      Encrypted:false
                      SSDEEP:
                      MD5:FFD2CC77BB64D40BEEB5D561FFFE1F79
                      SHA1:6CB535641677D27E4DE591CEB3C4E2F408826E7D
                      SHA-256:CDB16CA3DDD3CEAD71121799751FA80D3033375ABCDBC5FC84D35FB82C7FC9DE
                      SHA-512:F47EC76CE96D8652D068FE13DFF15D76CE31B1292061765844BEFCDF668270BA75A1D0757A993F2B73F8D509BCC1883DDE2D4CC5B58B320CF21B77A526F43556
                      Malicious:false
                      Reputation:unknown
                      URL:https://tslp.s3.amazonaws.com/detect/wmp.js?guid=d61dac0441&correlation_id=e722ffc8-419d-4888-b663-813e54c1f7dc
                      Preview:/*.PluginDetect v0.9.1.www.pinlady.net/PluginDetect/license/.[ WindowsMediaPlayer ].[ isMinVersion getVersion hasMimeType getInfo onDetectionDone ].[ AllowActiveX BetterIE ].*/.(function() {. j = PluginDetect;. var o = {. setPluginStatus: function(p, r) {. var q = this;. if (p) {. q.version = j.formatNum(p). }. q.installed = q.version ? 1 : (r ? 0 : -1);. q.getVersionDone = q.installed === 0 ? 0 : 1;. },. getVersion: function(t, q) {. var r = this,. s, p = null;. if ((!s || j.dbug) && r.nav.query().installed) {. s = 1. }. if ((!s || j.dbug) && r.axo.query().installed) {. s = 1. }. if ((!p || j.dbug) && r.axo.query().version) {. p = r.axo.version. }. if (((!s && !p) || q || j.dbug) && r.FirefoxPlugin.query().version) {. s = 1;.

                      Chrome Cache Entry: 83

                      Download File
                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                      File Type:ASCII text
                      Category:downloaded
                      Size (bytes):8207
                      Entropy (8bit):5.018706942766982
                      Encrypted:false
                      SSDEEP:
                      MD5:8B9A9D305BD69C962B600C08F3C69EDF
                      SHA1:9A907E240CDF81D8265C9FB1322CFE10ED027288
                      SHA-256:73F360F08E8C2A1719C098491E17D53CDAA98D246585BFD0285A2AFAD75C51A7
                      SHA-512:813A8B088B07A36A02994D0EC09EBB1CCD3974BF88C617606F7BD9F632B32D1FBDBFE4C45A421BB17B6E8BDB0CFCD6D965D7CAEF6085CFA915E99B4D34CA5109
                      Malicious:false
                      Reputation:unknown
                      URL:https://tslp.s3.amazonaws.com/languages/language.18071.js
                      Preview:jQuery.support.cors = true;..window.updatePage = function(language, data) {. var direction = data.dir || "ltr";. var company_name = window.company_name || "%COMPANY%";. var company_name_possessive = window.company_name_possessive || "%COMPANY's%";.. $("#module-container" ).css({. "font-size": data.fontsize,. "line-height": data.lineheight. });. $("#module-container").attr("class", "ict-" + language);. $("#module-container").attr("dir", direction);.. var replacements = data.replacements || data;. $.each( replacements, function( key, val ) {. var data_key = "*[data-text='"+ key + "']";. if ( $(data_key) ) {. $(data_key).not('input').html(val.replace(/%COMPANY%/g,company_name).replace(/%COMPANY_POSSESSIVE%/g,company_name_possessive)).attr("dir", direction);. $(data_key).html(val.replace(/%COMPANY%/g,company_name).replace(/%COMPANY_POSSESSIVE%/g,company_name_possessive)).attr("dir", direction);. if (direction == "rtl") {. $(data_key).attr("ali

                      Chrome Cache Entry: 84

                      Download File
                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                      File Type:ASCII text, with very long lines (412)
                      Category:downloaded
                      Size (bytes):6364
                      Entropy (8bit):4.955265521715946
                      Encrypted:false
                      SSDEEP:
                      MD5:EBE84E06C29C5D2CBD7EE1614448A7BE
                      SHA1:512098B3D8E72831689FC19086BD39D28E28FA67
                      SHA-256:ADF0C62899A527E2B0B1976FE4961F78AA362206982FA2C4486FF0A6BDC360CC
                      SHA-512:8C1E334C521F240A5C14B1D87668351F2D2813B8CB7D8B3A0DD952A0B6E804CDD6D09A002CDBB3AF17852A5D9755B0C903C742C57EEC5118E4C6DE761C81812E
                      Malicious:false
                      Reputation:unknown
                      URL:https://tslp.s3.amazonaws.com/training/embedded/css/data.css
                      Preview:.cf:after {. clear: both;. content: '';. display: table;.}..html,body,div,span,applet,object,iframe,h1,h2,h3,h4,h5,h6,p,blockquote,pre,a,abbr,acronym,address,big,cite,code,del,dfn,em,img,ins,kbd,q,s,samp,small,strike,strong,sub,sup,tt,var,b,u,i,center,dl,dt,dd,ol,ul,li,fieldset,form,label,legend,table,caption,tbody,tfoot,thead,tr,th,td,article,aside,canvas,details,embed,figure,figcaption,footer,header,hgroup,menu,nav,output,ruby,section,summary,time,mark,audio,video {. margin: 0;. padding: 0;. border: 0;. font-size: 100%;. font: inherit;. vertical-align: baseline;.}..article,aside,details,figcaption,figure,footer,header,hgroup,menu,nav,section,main {. display: block;.}..body {. line-height: 1;.}..ol,ul {. list-style: none;.}..blockquote,q {. quotes: none;.}..blockquote:before,blockquote:after,q:before,q:after {. content: '';. content: none;.}..table {. border-collapse: collapse;. border-spacing: 0;.}..strong {. font-weight: bold;.}..em {. font-style: italic;.}..a {.

                      Chrome Cache Entry: 85

                      Download File
                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                      File Type:Unicode text, UTF-8 text, with very long lines (65480)
                      Category:downloaded
                      Size (bytes):93435
                      Entropy (8bit):5.372924511876392
                      Encrypted:false
                      SSDEEP:
                      MD5:0B6ECF17E30037994D3FFEE51B525914
                      SHA1:D09D3A99ED25D0F1FBE6856DE9E14FFD33557256
                      SHA-256:F554D2F09272C6F71447EBFE4532D3B1DD1959BCE669F9A5CCC99E64EF511729
                      SHA-512:468C0F964014D76EC5966F5589B2CCC0A7B5F3E8A785134897DFA282A3E6824CE9A75584C9404B77A6962FEF99547356AABE8AA71A6499E2568B9DE792D90579
                      Malicious:false
                      Reputation:unknown
                      URL:https://ajax.googleapis.com/ajax/libs/jquery/1.8.2/jquery.min.js
                      Preview:/*! jQuery v1.8.2 jquery.com | jquery.org/license */.(function(a,b){function G(a){var b=F[a]={};return p.each(a.split(s),function(a,c){b[c]=!0}),b}function J(a,c,d){if(d===b&&a.nodeType===1){var e="data-"+c.replace(I,"-$1").toLowerCase();d=a.getAttribute(e);if(typeof d=="string"){try{d=d==="true"?!0:d==="false"?!1:d==="null"?null:+d+""===d?+d:H.test(d)?p.parseJSON(d):d}catch(f){}p.data(a,c,d)}else d=b}return d}function K(a){var b;for(b in a){if(b==="data"&&p.isEmptyObject(a[b]))continue;if(b!=="toJSON")return!1}return!0}function ba(){return!1}function bb(){return!0}function bh(a){return!a||!a.parentNode||a.parentNode.nodeType===11}function bi(a,b){do a=a[b];while(a&&a.nodeType!==1);return a}function bj(a,b,c){b=b||0;if(p.isFunction(b))return p.grep(a,function(a,d){var e=!!b.call(a,d,a);return e===c});if(b.nodeType)return p.grep(a,function(a,d){return a===b===c});if(typeof b=="string"){var d=p.grep(a,function(a){return a.nodeType===1});if(be.test(b))return p.filter(b,d,!c);b=p.filter(b,

                      Chrome Cache Entry: 86

                      Download File
                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                      File Type:ASCII text, with very long lines (32341)
                      Category:downloaded
                      Size (bytes):96381
                      Entropy (8bit):5.38156916982579
                      Encrypted:false
                      SSDEEP:
                      MD5:8FC25E27D42774AEAE6EDBC0A18B72AA
                      SHA1:B66ED708717BF0B4A005A4D0113AF8843EF3B8FF
                      SHA-256:B294E973896F8F874E90A8EB1A8908AC790980D034C4C4BDF0FC3D37B8ABF682
                      SHA-512:87D90A665C15D71AC872BD8BC003D9863964C7EC7ADA6370B902B93C0BBD7770FE25730D946C7C6A465BAA95EFA74BC0E78AF3F83AEA615AF35060CC8702A6C1
                      Malicious:false
                      Reputation:unknown
                      URL:https://www.eservce.co.uk/assets/ajax/libs/jquery/1.11.0/jquery.min.js
                      Preview:/*! jQuery v1.11.0 | (c) 2005, 2014 jQuery Foundation, Inc. | jquery.org/license */.!function(a,b){"object"==typeof module&&"object"==typeof module.exports?module.exports=a.document?b(a,!0):function(a){if(!a.document)throw new Error("jQuery requires a window with a document");return b(a)}:b(a)}("undefined"!=typeof window?window:this,function(a,b){var c=[],d=c.slice,e=c.concat,f=c.push,g=c.indexOf,h={},i=h.toString,j=h.hasOwnProperty,k="".trim,l={},m="1.11.0",n=function(a,b){return new n.fn.init(a,b)},o=/^[\s\uFEFF\xA0]+|[\s\uFEFF\xA0]+$/g,p=/^-ms-/,q=/-([\da-z])/gi,r=function(a,b){return b.toUpperCase()};n.fn=n.prototype={jquery:m,constructor:n,selector:"",length:0,toArray:function(){return d.call(this)},get:function(a){return null!=a?0>a?this[a+this.length]:this[a]:d.call(this)},pushStack:function(a){var b=n.merge(this.constructor(),a);return b.prevObject=this,b.context=this.context,b},each:function(a,b){return n.each(this,a,b)},map:function(a){return this.pushStack(n.map(this,functio

                      Chrome Cache Entry: 87

                      Download File
                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                      File Type:ASCII text
                      Category:downloaded
                      Size (bytes):352
                      Entropy (8bit):4.685775248288353
                      Encrypted:false
                      SSDEEP:
                      MD5:029AB28CA3C245DC425E3F3F6599D480
                      SHA1:845057D3630D0A06E797A7049B3E9658D7650AF1
                      SHA-256:8A1170223599205267C6EE3A3072855F1727461D9DD1066BB94F39180F963AF9
                      SHA-512:5429DDC21DD62EBF7192985BAD0E22BD350C6C65051CA005BBFC27A9CD64088AEAE2B7AA2BC1065155B74509BE36E1524E04488A3E05D0407F5031F9E43480AB
                      Malicious:false
                      Reputation:unknown
                      URL:https://tslp.s3.amazonaws.com/assets/js/training.js
                      Preview:$(document).ready(function () {. $('#training-form').prop('action', function (i, val) {. var correlation_id = new RegExp('correlation_id=([^&#]*)').exec(window.location.href);. if (correlation_id === null) {. correlation_id = "";. } else {. correlation_id = '?' + correlation_id[0];. }. return val + correlation_id;. });.});.

                      Chrome Cache Entry: 88

                      Download File
                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                      File Type:HTML document, Unicode text, UTF-8 text, with very long lines (606)
                      Category:downloaded
                      Size (bytes):1062
                      Entropy (8bit):4.949992896489901
                      Encrypted:false
                      SSDEEP:
                      MD5:EB739F38A6E22CF830552CBFC490AEAB
                      SHA1:4547D70D372E49DA074D64F30B77865E6731AF30
                      SHA-256:8AECDB807BF68B98A2B876A4B16CAB87814F65FEC7138ACFCC7885F1C22CD1AB
                      SHA-512:64016817B9C35F2DA22150980AB3AB3BFE7BA1C1C3D5A5220430A97F3DE0E0226CA73342DC044F719B0DDEC1F781E932FF8DF528C58FAE4EC4954E66B85C5A9D
                      Malicious:false
                      Reputation:unknown
                      URL:https://www.eservce.co.uk/training_screenshot?guid=d61dac0441&correlation_id=e722ffc8-419d-4888-b663-813e54c1f7dc
                      Preview:<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">.<html>.<head>..<title></title>..<meta http-equiv="Content-Type" content="text/html; charset=utf-8;">.</head>.<body>Cher utilisateur de Citrix,<span class="Apple-converted-space">.</span><br>.<br>.Nous avons suspendu votre compte de mani.re temporaire . cause d'activit.s suspicieuses r.centes. IT Security a implant. des pr.cautions suppl.mentaires pour vous aider . prot.ger votre compte dans le cas o. quelqu'un d'autre aurait pu essayer de se connecter. Vous recevez peut-.tre ce message car vous vous .tes connect. depuis un autre lieu ou un autre appareil. Si c'est le cas, votre acc.s sera restaur. quand vous vous connecterez . nouveau de la mani.re habituelle. Veuillez vous connecter . votre compte Citrix depuis votre ordinateur normal. Cliquez ci-dessous pour r.initialiser votre compte.<br>.<br>.<a href="javascript:void(0)">Cliquez pour r.initialiser votre compte.</a><br>.<br>.Cordialement, IT Securit

                      Chrome Cache Entry: 89

                      Download File
                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                      File Type:ASCII text
                      Category:downloaded
                      Size (bytes):28356
                      Entropy (8bit):5.215232550543418
                      Encrypted:false
                      SSDEEP:
                      MD5:A6B682FEC1E95D9A565627499E1B0FD2
                      SHA1:9D9B94C97C01446AE496006BEAFA2B3A05AB7C6A
                      SHA-256:940DA9FCC9AEF9C6F5EC3E47002962DC008A6B70D9A012F5D22AF8C53DA29210
                      SHA-512:0AB6339098AF3CFA0D1F500D93FD2773472415DDAE8E33C0819A44DB3CFD46F10B20FEA1D18BF20CEE1757F1F3DB1F9B7E83BB8724E1528487EF4CE03D377DEA
                      Malicious:false
                      Reputation:unknown
                      URL:https://www.eservce.co.uk/assets/all.js?guid=d61dac0441&correlation_id=e722ffc8-419d-4888-b663-813e54c1f7dc
                      Preview:(function() {.window.base_post_url || (window.base_post_url = ""), window.log_error = function(e, i) {.window.log_to_console(i), new Image().src = window.base_post_url + "/log?id=" + encodeURIComponent(window.tracking_id) + "&sev=" + encodeURIComponent(e) + "&msg=" + encodeURIComponent(i) + "&correlation_id=" + window.correlation_id;.}, window.log_to_console = function() {.void 0 !== window.console_debug && console.log;.}, window.log_message = function(e) {.window.log_to_console(e), new Image().src = window.base_post_url + "/trace?id=" + encodeURIComponent(window.tracking_id) + "&msg=" + encodeURIComponent(e) + "&correlation_id=" + window.correlation_id;.};.}).call(this), window.log_message || (window.log_message = function(e) {.new Image().src = window.base_post_url + "/trace?id=" + encodeURIComponent(window.tracking_id) + "&msg=" + encodeURIComponent(e);.});..var BrowserDetect = {.init: function() {.this.browser = this.searchString(this.dataBrowser) || "unknown", this.browserString =

                      Chrome Cache Entry: 91

                      Download File
                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                      File Type:Unicode text, UTF-8 text
                      Category:downloaded
                      Size (bytes):1713
                      Entropy (8bit):4.909213983910174
                      Encrypted:false
                      SSDEEP:
                      MD5:BC7F970AD0F163BC72C9AE9AA09E1CDE
                      SHA1:BF67B0D0F3BB4038CAF1021A692B6EB6024C3E02
                      SHA-256:5243766EEDFCBA70128C2931DBEF8875F942B81E39002D80DC0110167D4EF742
                      SHA-512:86662D26C0D26E1DD10BA4E355385AEA41F8CD9859E0F0BC1A3759ED553CCC7A86D650512439E1E0CFA4142FF78352C9AC0A96DACD5B074CA196A9C9C785ECF8
                      Malicious:false
                      Reputation:unknown
                      URL:https://tslp.s3.amazonaws.com/training/teachable_moments/css/langdrop.css
                      Preview:html {. margin: 0;. padding: 0;. -ms-text-size-adjust: 100%;. -webkit-text-size-adjust: 100%;.}..body {. line-height: 1;. margin: 0; padding: 0;.}..* {. -webkit-box-sizing: border-box;. -moz-box-sizing: border-box;. box-sizing: border-box;.}..ol,ul,li {. font-size: 100%;. font: inherit;. margin: 0;. padding: 0;.}...langDrop {. font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif;. background: #484c55;. border: 1px solid white;. border-radius: 4px;. color: white;. display: inline-block;. font-size: 14px;. line-height: 160%;. margin-left: 10px;. padding: 5px 15px;. position: fixed;. top: 10px; right: 10px;. vertical-align: middle;. z-index: 2;. min-width:150px;. text-align: center;.}...langDrop span:before {. content: 'Language:';. position: absolute;. top: 5px; left: -80%;.}...langDrop span:after {. content: ' .';.}...langDrop ul {. border: 1px solid transparent;. border-top: 0 none;. list-style: none;. max-height: 0;. opacity: 0;. overflo

                      Chrome Cache Entry: 92

                      Download File
                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                      File Type:PNG image data, 48 x 48, 4-bit colormap, non-interlaced
                      Category:downloaded
                      Size (bytes):926
                      Entropy (8bit):7.650083871007416
                      Encrypted:false
                      SSDEEP:
                      MD5:3C506B80D78539262795C9BA59A0631A
                      SHA1:0B7EF5BDEADE81C3FFC8ABC8EF8A17F7566A10F4
                      SHA-256:A35DE3A30E58BF477FEBCA8B47225959F48FD384FAF088A218D6BF2251F06CBE
                      SHA-512:AA04687DE6D0C6DF36B655891B055FA3BC22BF8A5619589CA012150B7F64036A5F21FF8EBBD6C604C6FBCBA686D1946AC23712EE052FFFEB163C16E29A9A23E6
                      Malicious:false
                      Reputation:unknown
                      URL:https://d25q7gseii1o1q.cloudfront.net/training/fish/mail.png
                      Preview:.PNG........IHDR...0...0......,.....PLTE..............................`.......tRNS...........F.X...%IDATx^u.;o.W....:.4..vK:...%.0....v.. fG#v.vd^.v+E..s.K-...N..N..f.......G....]~/|"V...ss..i......AF.(..G..q......3..=...0....2.*..E..._v.y......8..@..z*..\.]3..+6..~...r.r.>R...............'=..W......NO........M#.,.]..67.c..A.......o..^..'H.b>....i.....C..(....\c...*.,....M..j:.M......9[ ..BY>...u....+mUD..d..n..E...F..{1.d.d%......FUUg..........E.<?h.......".......X.m->c....I...V..O9k.........f.yf#!.xn.N.......`.M._..<C.Z.>%.K!.J.........#q........W5.5..Dq...UX..&.3.1..<;.C.x'..S.N...........R......g......=...Ez.."=l.tNU.$...s.Z#..~.-..W.0.}"..W!Rr...V....@..5=........D..>.h3....J..^..*]......%..2:R_.2U...M.Mp....."..1=.w..y....b?.0...jc.....d...K.Xh.z+.I...iH..?F#....E.d.P....7....u.C...@.{ip.j..n.]..gW...!.N..E.Z.M...M.@<.$..a.}..<.........HCW.b:s..j+....R...c5....IEND.B`.

                      Chrome Cache Entry: 93

                      Download File
                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                      File Type:PNG image data, 167 x 181, 8-bit/color RGBA, non-interlaced
                      Category:dropped
                      Size (bytes):10591
                      Entropy (8bit):7.974319119188993
                      Encrypted:false
                      SSDEEP:
                      MD5:AA94E3EB1F29367FF60B2B22DB9D4F5B
                      SHA1:A36206097D532B79DEDA64F2328ABC2EFA8AE041
                      SHA-256:CE2DF3CD5ABE9350AB496BDD0192FE991AE9C74E29EE0537BB3FBFEDF70A10E9
                      SHA-512:310025FAE8C753ADCE361D6F57EDBD7744BE3198694AFE7A49745948974379A0F55A2A31C022167AC988EE462598EAB6E2CD9F17ABC9470DB4A2DCEEB2DB5C0D
                      Malicious:false
                      Reputation:unknown
                      Preview:.PNG........IHDR.............:..|..)&IDATx..].p.U.:~.e........0........PB...B(!t.B1..w...5.)J...".(X..AA.)"..nA).y..aw.{...7{f.x.n9.....=..!...b........<A.I*.Py...K...3..O........N.....A%..d*....r...Q.....^'...c6"mpr`|.J{*.,X...Bg..?He6.t...r.NvyM.2..i...UN....~.........dS).r."...;.s.y...iAp......T.Y..rr.}><..68M.N..B..R..@T..&.c.HF. .i ..:....$.:......9..=k....02,+..N.I2....q..zD...Z.>w..N.....d*..x.+...qAdHZ )..@v..@...O./.@.T..6.$.v...[.r...........3..u..u+..T.C..N..I_..T...q.e.U.&/...e}..)..e.@.*8...{=H..d......8R;... =...68..N...A.+/-..`.)1.,..@.....D=.)%...@..5!..V...f=...#68=.N:.)TJ\Y.s......4/.f..x;.q\s........b.Sg.....2...W.. W.<.Ho../7..JV.hJR.^..=ie;....i*.T.k..p.l.k.H.O... ..N.|E..#:......}v^..Q..0....:.5.....W0..F......df.DR#..3 =o...`P...*.....L... ....J....o[.....H.s .|..F.20..\.2.1a....y@i.p.A:77..kv._...(..7.S.[m.+..................dT.zt.4Y.....q........Z~....7.....Y....vh..U..}T(..L......:7..]Q...438!...I.j.u..{I(....@m.z...K...@8.

                      Chrome Cache Entry: 94

                      Download File
                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                      File Type:Web Open Font Format (Version 2), TrueType, length 48236, version 1.0
                      Category:downloaded
                      Size (bytes):48236
                      Entropy (8bit):7.994912604882335
                      Encrypted:true
                      SSDEEP:
                      MD5:015C126A3520C9A8F6A27979D0266E96
                      SHA1:2ACF956561D44434A6D84204670CF849D3215D5F
                      SHA-256:3C4D6A1421C7DDB7E404521FE8C4CD5BE5AF446D7689CD880BE26612EAAD3CFA
                      SHA-512:02A20F2788BB1C3B2C7D3142C664CDEC306B6BA5366E57E33C008EDB3EB78638B98DC03CDF932A9DC440DED7827956F99117E7A3A4D55ACADD29B006032D9C5C
                      Malicious:false
                      Reputation:unknown
                      URL:https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
                      Preview:wOF2.......l......D...............................O..B..h?HVAR.x.`?STAT.$'...0+...|.../V........+..2.0..6.6.$..`. ..~......[B4q.....t..P.M_.z...1..R.S*...u.#..R....fR.1.N.v.N.P...;.2........!Z......Qs...5f.G.K.an2&....2...*......C.H.t..N!.....nh.<(.vN.....j.._.L.P.t..Ai.%.............._I.i,..o,C.].H.X9.....a.=N....k.....n.L..k.f.u..{...:.}^\[..~5...Z`...........`!...%4..,...K0..&.a/....P....S....m.Z......u...D.j.F...f.0`I.`.`.h#..)(FQ.F!o$........S.).MV8%Rh...r...x...T]$.=......Y...!.3.&U..."....Q....{.l/0..d..4iJ/..}...3....i[Z..NG.WD...>.[U..Q.h..@m.=..S...1C2...d...<..v.?.q.f..n...OUz.....&Z......Z."..N.....n...9.B..C..W....}...W..6Zs.i.+Z........jB.n..x.8M.....q..@I....-.%..,C,..K..#.2...4)/.v_..x.<....t.....%[.4?.=j.V..jj''..W.u..q....I.L.=......E...\.M.7{.>......W........C.`...,9$......\..o........y...4A..m.P.,X..=?.:................wF`..+.P..........M!.4.......l.>M..t.ff5r..^..Z.g...!fA,hIIQ...e.R>B.AH.VuX..>..\.=.ky...1>C....>C.c.;...6D.

                      Chrome Cache Entry: 95

                      Download File
                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                      File Type:ASCII text, with very long lines (306)
                      Category:downloaded
                      Size (bytes):50085
                      Entropy (8bit):3.5610506396954245
                      Encrypted:false
                      SSDEEP:
                      MD5:00A513F07603DF01E3B99BE00F370754
                      SHA1:F0C03B1C50F39C95075DF687CD55F18861631526
                      SHA-256:4BAB432979D731F8264BCD9D40422CA7DFCFCB0E0E703288DB78BBFA555F853A
                      SHA-512:9824C521D8B214847E6193CB8046488CFF1F113D6C9637241D5EE1042ADC6C8C7724452611DD0994E7A478768860E69A29B4F4E6B51FD726761DE520D5C05765
                      Malicious:false
                      Reputation:unknown
                      URL:https://tslp.s3.amazonaws.com/detect/plugin_detect.js?guid=d61dac0441&correlation_id=e722ffc8-419d-4888-b663-813e54c1f7dc
                      Preview:/*.PluginDetect v0.9.1.www.pinlady.net/PluginDetect/license/.[ ].[ isMinVersion getVersion hasMimeType getInfo ].[ AllowActiveX BetterIE ].*/.(function() {. var j = {. version: "0.9.1",. name: "PluginDetect",. addPlugin: function(p, q) {. if (p && j.isString(p) && q && j.isFunc(q.getVersion)) {. p = p.replace(/\s/g, "").toLowerCase();. j.Plugins[p] = q;. if (!j.isDefined(q.getVersionDone)) {. q.installed = null;. q.version = null;. q.version0 = null;. q.getVersionDone = null;. q.pluginName = p;. }. }. },. uniqueName: function() {. return j.name + "998". },. openTag: "<",. hasOwnPROP: ({}).constructor.prototype.hasOwnProperty,. hasOwn: function(s, t) {. var p;. try {. p = j.hasOwnPROP.call(s, t).

                      Chrome Cache Entry: 96

                      Download File
                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                      File Type:ASCII text
                      Category:downloaded
                      Size (bytes):22855
                      Entropy (8bit):3.5177544592160155
                      Encrypted:false
                      SSDEEP:
                      MD5:0D5882D41C8B6E40059C8D9ACBCF1518
                      SHA1:53103565F3C07416FC691583A43A91943DBF0809
                      SHA-256:D9B7C6163477008469AF64B211E2DBD4F4171B85B51E3714F11C99F9BA2C32F9
                      SHA-512:2E70A43F053797DF07CF2A7F6CF4CDD99A0082CB3DC1FBF661FAB775E98EDC18866FC762576B9E26A9DF4C094523AF98D7B46C92F9D6A7BED2CBFE6CBA01447E
                      Malicious:false
                      Reputation:unknown
                      URL:https://tslp.s3.amazonaws.com/detect/pdf.js?guid=d61dac0441&correlation_id=e722ffc8-419d-4888-b663-813e54c1f7dc
                      Preview:/*.PluginDetect v0.9.1.www.pinlady.net/PluginDetect/license/.[ AdobeReader PDFjs ].[ isMinVersion getVersion hasMimeType getInfo onDetectionDone ].[ AllowActiveX ].*/.(function() {. j = PluginDetect;. var c = {. OTF: null,. setPluginStatus: function() {. var p = this,. B = p.OTF,. v = p.nav.detected,. x = p.nav.version,. z = p.nav.precision,. C = z,. u = x,. s = v > 0;. var H = p.axo.detected,. r = p.axo.version,. w = p.axo.precision,. D = p.doc.detected,. G = p.doc.version,. t = p.doc.precision,. E = p.doc2.detected,. F = p.doc2.version,. y = p.doc2.precision;. u = F || u || r || G;. C = y || C || w || t;. s = E > 0 || s || H > 0 || D > 0;. u = u || null;. p.version =

                      Chrome Cache Entry: 97

                      Download File
                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                      File Type:HTML document, ASCII text
                      Category:dropped
                      Size (bytes):2511
                      Entropy (8bit):4.169228539892239
                      Encrypted:false
                      SSDEEP:
                      MD5:118032089FF5601C26DB331DC455DC1C
                      SHA1:DA0F04C3B17DE1EBB03701F5760F1D53CFFA29B6
                      SHA-256:FF15EE304B9FA684507D889A5A342F7C89116739B04B0A160BE65E0A63718F0F
                      SHA-512:100161F784BF69F7BBD6FF9D80EF6DD30B7DDD7774CE877F889DDF91CF6F26EECE08E24B55900D8706169E43CC4406507D4FCB30DAC0FD03BD106DEE260C9807
                      Malicious:false
                      Reputation:unknown
                      Preview:<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN"."http://www.w3.org/TR/html4/strict.dtd">.<html>. <head>. <script>window.test_mode = true;</script>. <title>. The page cannot be found. </title>. <meta http-equiv="Content-Type" content="text/html; charset=us-ascii">. <style type="text/css">. BODY { font: 8pt/12pt verdana }. H1 { font: 13pt/15pt verdana }. H2 { font: 8pt/12pt verdana }. A:link { color: red }. A:visited { color: maroon }. </style>. </head>. <body>. <script src="/assets/ajax/libs/jquery/1.8.0/jquery.min.js" type="text/javascript">.</script><script src="/assets/all.js?g=404" type="text/javascript">.</script>. <table width="500" border="0" cellspacing="10">. <tr>. <td>. <h1>. The page cannot be found. </h1>The page you are looking for might have been removed, had its name changed,

                      Chrome Cache Entry: 98

                      Download File
                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                      File Type:ASCII text, with very long lines (322)
                      Category:downloaded
                      Size (bytes):6999
                      Entropy (8bit):3.826075419802806
                      Encrypted:false
                      SSDEEP:
                      MD5:EE73F2F47D51116DC40B85A6B57EAF20
                      SHA1:6C42011667BAC1FA6C3272A11B510F22962D72A2
                      SHA-256:6AE53963F41133561C78B4332B564C01F551C471CD91D980436A9F5DACDD8F19
                      SHA-512:162F426E8C5787B989C07332EC466A68F97164400EE09562B925D3B4FE34D4BF393214C8A173174F22B0A47F635A0864D81D9E1BD3CB8D73DA4335A3F715A37D
                      Malicious:false
                      Reputation:unknown
                      URL:https://tslp.s3.amazonaws.com/detect/quicktime.js?guid=d61dac0441&correlation_id=e722ffc8-419d-4888-b663-813e54c1f7dc
                      Preview:/*.PluginDetect v0.9.1.www.pinlady.net/PluginDetect/license/.[ QuickTime ].[ isMinVersion getVersion hasMimeType getInfo ].[ AllowActiveX BetterIE ].*/.(function() {. j = PluginDetect;. var i = {. setPluginStatus: function(q, p, s) {. var r = this;. r.version = p ? j.formatNum(p, 3) : null;. r.installed = r.version ? 1 : (s ? (s > 0 ? 0.7 : -0.1) : (q ? 0 : -1));. r.getVersionDone = r.installed == 0.7 || r.installed == -0.1 || r.nav.done === 0 ? 0 : 1;. },. getVersion: function(s, t) {. var u = this,. p = null,. r = 0,. q;. t = j.browser.isIE ? 0 : t;. if ((!r || j.dbug) && u.nav.query(t).installed) {. r = 1. }. if ((!p || j.dbug) && u.nav.query(t).version) {. p = u.nav.version. }. q = !p ? u.codebase.isMin(s) : 0;. if (q) {. u.setPluginStat

                      Chrome Cache Entry: 99

                      Download File
                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                      File Type:ASCII text
                      Category:downloaded
                      Size (bytes):50717
                      Entropy (8bit):3.4749180527505756
                      Encrypted:false
                      SSDEEP:
                      MD5:2BEC0061039DC3FB25FC20AAF611D5B9
                      SHA1:DFC11B0662AC5950D309E2615E887032DD1DDE0C
                      SHA-256:4805FC6ABDAD8075AF2165E241B781C3073D4769AE725E4004BF79064ACB5F24
                      SHA-512:A0B342EED3291E1E48E5DBECBBBE74370D06C15269196B5E5CFEC1EE58B401D5F24058E842222747B5144DC4902852B417EC3DC37A8799FD451C875C584AD8DF
                      Malicious:false
                      Reputation:unknown
                      URL:https://tslp.s3.amazonaws.com/detect/java.js?guid=d61dac0441&correlation_id=e722ffc8-419d-4888-b663-813e54c1f7dc
                      Preview:/*.PluginDetect v0.9.1.www.pinlady.net/PluginDetect/license/.[ Java ].[ isMinVersion getVersion hasMimeType getInfo onDetectionDone ].[ AllowActiveX BetterIE ].*/.(function() {. j = PluginDetect;. var a = {. Property_names: [],. Property_values: [],. Property_values_lock: [],. JAVATOJSBRIDGE: 0,. JSTOJAVABRIDGE: 1,. mimeType: ["application/x-java-applet", "application/x-java-vm", "application/x-java-bean"],. mimeType_dummy: "application/dummymimejavaapplet",. classID: "clsid:8AD9C840-044E-11D1-B3E9-00805F499D93",. classID_dummy: "clsid:8AD9C840-044E-11D1-B3E9-BA9876543210",. navigator: {. init: function() {. var q = this,. p = a;. q.mimeObj = j.hasMimeType(p.mimeType);. if (q.mimeObj) {. q.pluginObj = q.mimeObj.enabledPlugin. }. },. a: (function() {. try {.

                      Static File Info

                      ⊘No static file info