Edit tour
Windows
Analysis Report
https://forms.office.com/e/tBp2XcGpEy
Overview
General Information
| Sample URL: | https://forms.office.com/e/tBp2XcGpEy |
| Analysis ID: | 1465354 |
 | |
Detection
HTMLPhisher
| Score: | 68 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
AI detected phishing page
Phishing site detected (based on favicon image match)
Yara detected HtmlPhish54
Phishing site detected (based on image similarity)
Detected hidden input values containing email addresses (often used in phishing pages)
HTML body contains low number of good links
HTML body contains password input but no form action
HTML title does not match URL
Stores files to the Windows start menu directory
Classification
- System is w10x64_ra
chrome.exe (PID: 7096 cmdline: "C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" --st art-maximi zed --sing le-argumen t https:// forms.offi ce.com/e/t Bp2XcGpEy MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4) - chrome.exe (PID: 6212 cmdline:
"C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" --ty pe=utility --utility -sub-type= network.mo jom.Networ kService - -lang=en-U S --servic e-sandbox- type=none --mojo-pla tform-chan nel-handle =2156 --fi eld-trial- handle=197 2,i,695162 2617809385 496,118996 9762365263 7181,26214 4 --disabl e-features =Optimizat ionGuideMo delDownloa ding,Optim izationHin ts,Optimiz ationHints Fetching,O ptimizatio nTargetPre diction /p refetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
- cleanup
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| JoeSecurity_HtmlPhish_54 | Yara detected HtmlPhish_54 | Joe Security | ||
| JoeSecurity_HtmlPhish_54 | Yara detected HtmlPhish_54 | Joe Security | ||
| JoeSecurity_HtmlPhish_54 | Yara detected HtmlPhish_54 | Joe Security | ||
| JoeSecurity_HtmlPhish_54 | Yara detected HtmlPhish_54 | Joe Security | ||
| JoeSecurity_HtmlPhish_54 | Yara detected HtmlPhish_54 | Joe Security | ||
| Click to see the 6 entries | ||||
⊘No Sigma rule has matched
⊘No Snort rule has matched
Click to jump to signature section
Show All Signature Results
Phishing |   |
|---|
| Source: | LLM: | ||
| Source: | LLM: | ||
| Source: | LLM: | ||
| Source: | Matcher: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | Matcher: | ||
| Source: | HTTP Parser: | ||
| Source: | HTTP Parser: | ||
| Source: | HTTP Parser: | ||
| Source: | HTTP Parser: | ||
| Source: | HTTP Parser: | ||
| Source: | HTTP Parser: | ||
| Source: | HTTP Parser: | ||
| Source: | HTTP Parser: | ||
| Source: | HTTP Parser: | ||
| Source: | HTTP Parser: | ||
| Source: | HTTP Parser: | ||
| Source: | HTTP Parser: | ||
| Source: | HTTP Parser: | ||
| Source: | HTTP Parser: | ||
| Source: | HTTP Parser: | ||
| Source: | HTTP Parser: | ||
| Source: | HTTP Parser: | ||
| Source: | HTTP Parser: | ||
| Source: | HTTP Parser: | ||
| Source: | HTTP Parser: | ||
| Source: | HTTP Parser: | ||
| Source: | HTTP Parser: | ||
| Source: | HTTP Parser: | ||
| Source: | HTTP Parser: | ||
| Source: | HTTP Parser: | ||
| Source: | HTTP Parser: | ||
| Source: | HTTP Parser: | ||
| Source: | HTTP Parser: | ||
| Source: | HTTP Parser: | ||
| Source: | HTTP Parser: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | Classification label: | ||
| Source: | File created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Window detected: | ||
| Source: | File created: | ||
| Source: | File created: | ||
| Source: | File created: | ||
| Source: | File created: | ||
| Source: | File created: | ||
| Source: | File created: | ||
| Source: | File created: | ||
| Reconnaissance | Resource Development | Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Command and Control | Exfiltration | Impact |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Gather Victim Identity Information | Acquire Infrastructure | Valid Accounts | Windows Management Instrumentation | 1 Registry Run Keys / Startup Folder | 1 Process Injection | 1 Masquerading | OS Credential Dumping | System Service Discovery | Remote Services | Data from Local System | 2 Encrypted Channel | Exfiltration Over Other Network Medium | Abuse Accessibility Features |
| Credentials | Domains | Default Accounts | Scheduled Task/Job | Boot or Logon Initialization Scripts | 1 Registry Run Keys / Startup Folder | 1 Process Injection | LSASS Memory | Application Window Discovery | Remote Desktop Protocol | Data from Removable Media | 1 Non-Application Layer Protocol | Exfiltration Over Bluetooth | Network Denial of Service |
| Email Addresses | DNS Server | Domain Accounts | At | Logon Script (Windows) | Logon Script (Windows) | Obfuscated Files or Information | Security Account Manager | Query Registry | SMB/Windows Admin Shares | Data from Network Shared Drive | 2 Application Layer Protocol | Automated Exfiltration | Data Encrypted for Impact |
This section contains all screenshots as thumbnails, including those not shown in the slideshow.
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 0% | Avira URL Cloud | safe |
⊘No Antivirus matches
⊘No Antivirus matches
⊘No Antivirus matches
⊘No Antivirus matches
| Name | IP | Active | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|---|---|
| s-part-0014.t-0009.t-msedge.net | 13.107.246.42 | true | false | unknown | |
| prdia888neu0aks.mkt.dynamics.com | 52.146.128.240 | true | false | unknown | |
| s-part-0044.t-0009.fb-t-msedge.net | 13.107.253.72 | true | false | unknown | |
| mmhnzmefkqeqeuthdhbhgeez.from-wa.com | 85.10.151.176 | true | true | unknown | |
| sni1gl.wpc.alphacdn.net | 152.199.21.175 | true | false | unknown | |
| sni1gl.wpc.omegacdn.net | 152.199.21.175 | true | false | unknown | |
| www.google.com | 142.250.74.196 | true | false | unknown | |
| s-part-0035.t-0009.t-msedge.net | 13.107.246.63 | true | false | unknown | |
| s-part-0039.t-0009.fb-t-msedge.net | 13.107.253.67 | true | false | unknown | |
| s-part-0032.t-0009.t-msedge.net | 13.107.246.60 | true | false | unknown | |
| forms.office.com | unknown | unknown | false | unknown | |
| aadcdn.msftauth.net | unknown | unknown | false | unknown | |
| logincdn.msftauth.net | unknown | unknown | false | unknown | |
| ywnjb.mmhnzmefkqeqeuthdhbhgeez.from-wa.com | unknown | unknown | true | unknown | |
| cdn.forms.office.net | unknown | unknown | false | unknown | |
| lists.office.com | unknown | unknown | false | unknown | |
| www.mmhnzmefkqeqeuthdhbhgeez.from-wa.com | unknown | unknown | false | unknown | |
| login.mmhnzmefkqeqeuthdhbhgeez.from-wa.com | unknown | unknown | true | unknown | |
| identity.nel.measure.office.net | unknown | unknown | false | unknown | |
| c.office.com | unknown | unknown | false | unknown | |
| public-eur.mkt.dynamics.com | unknown | unknown | false | unknown | |
| acctcdn.msftauth.net | unknown | unknown | false | unknown | |
| assets-eur.mkt.dynamics.com | unknown | unknown | false | unknown |
| Name | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|
| true | unknown | ||
| false | unknown | ||
| true | unknown | ||
| true | unknown | ||
| false | unknown | ||
| true | unknown |
- No. of IPs < 25%
- 25% < No. of IPs < 50%
- 50% < No. of IPs < 75%
- 75% < No. of IPs
| IP | Domain | Country | Flag | ASN | ASN Name | Malicious |
|---|---|---|---|---|---|---|
| 13.107.246.63 | s-part-0035.t-0009.t-msedge.net | United States | 8068 | MICROSOFT-CORP-MSN-AS-BLOCKUS | false | |
| 52.168.117.171 | unknown | United States | 8075 | MICROSOFT-CORP-MSN-AS-BLOCKUS | false | |
| 216.58.206.78 | unknown | United States | 15169 | GOOGLEUS | false | |
| 13.107.6.194 | unknown | United States | 8068 | MICROSOFT-CORP-MSN-AS-BLOCKUS | false | |
| 13.107.246.60 | s-part-0032.t-0009.t-msedge.net | United States | 8068 | MICROSOFT-CORP-MSN-AS-BLOCKUS | false | |
| 52.182.141.63 | unknown | United States | 8075 | MICROSOFT-CORP-MSN-AS-BLOCKUS | false | |
| 40.126.32.76 | unknown | United States | 8075 | MICROSOFT-CORP-MSN-AS-BLOCKUS | false | |
| 88.221.110.176 | unknown | European Union | 20940 | AKAMAI-ASN1EU | false | |
| 13.74.129.1 | unknown | United States | 8075 | MICROSOFT-CORP-MSN-AS-BLOCKUS | false | |
| 2.18.121.147 | unknown | European Union | 16625 | AKAMAI-ASUS | false | |
| 85.10.151.176 | mmhnzmefkqeqeuthdhbhgeez.from-wa.com | France | 21283 | A1SI-ASA1SlovenijaSI | true | |
| 2.18.64.204 | unknown | European Union | 6057 | AdministracionNacionaldeTelecomunicacionesUY | false | |
| 142.250.74.196 | www.google.com | United States | 15169 | GOOGLEUS | false | |
| 66.102.1.84 | unknown | United States | 15169 | GOOGLEUS | false | |
| 204.79.197.237 | unknown | United States | 8068 | MICROSOFT-CORP-MSN-AS-BLOCKUS | false | |
| 1.1.1.1 | unknown | Australia | 13335 | CLOUDFLARENETUS | false | |
| 216.58.212.131 | unknown | United States | 15169 | GOOGLEUS | false | |
| 52.111.243.106 | unknown | United States | 8075 | MICROSOFT-CORP-MSN-AS-BLOCKUS | false | |
| 2.16.241.17 | unknown | European Union | 20940 | AKAMAI-ASN1EU | false | |
| 2.16.164.113 | unknown | European Union | 20940 | AKAMAI-ASN1EU | false | |
| 216.58.206.46 | unknown | United States | 15169 | GOOGLEUS | false | |
| 88.221.110.240 | unknown | European Union | 20940 | AKAMAI-ASN1EU | false | |
| 88.221.169.152 | unknown | European Union | 16625 | AKAMAI-ASUS | false | |
| 13.107.253.72 | s-part-0044.t-0009.fb-t-msedge.net | United States | 8068 | MICROSOFT-CORP-MSN-AS-BLOCKUS | false | |
| 239.255.255.250 | unknown | Reserved | unknown | unknown | false | |
| 172.217.18.106 | unknown | United States | 15169 | GOOGLEUS | false | |
| 142.250.185.131 | unknown | United States | 15169 | GOOGLEUS | false | |
| 152.199.21.175 | sni1gl.wpc.alphacdn.net | United States | 15133 | EDGECASTUS | false | |
| 52.146.128.240 | prdia888neu0aks.mkt.dynamics.com | United States | 8075 | MICROSOFT-CORP-MSN-AS-BLOCKUS | false | |
| 2.18.121.134 | unknown | European Union | 16625 | AKAMAI-ASUS | false | |
| 20.50.73.9 | unknown | United States | 8075 | MICROSOFT-CORP-MSN-AS-BLOCKUS | false |
| IP |
|---|
| 192.168.2.17 |
| 192.168.2.16 |
| 192.168.2.22 |
| Joe Sandbox version: | 40.0.0 Tourmaline |
| Analysis ID: | 1465354 |
| Start date and time: | 2024-07-01 15:24:08 +02:00 |
| Joe Sandbox product: | CloudBasic |
| Overall analysis duration: | |
| Hypervisor based Inspection enabled: | false |
| Report type: | full |
| Cookbook file name: | defaultwindowsinteractivecookbook.jbs |
| Sample URL: | https://forms.office.com/e/tBp2XcGpEy |
| Analysis system description: | Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01 |
| Number of analysed new started processes analysed: | 14 |
| Number of new started drivers analysed: | 0 |
| Number of existing processes analysed: | 0 |
| Number of existing drivers analysed: | 0 |
| Number of injected processes analysed: | 0 |
| Technologies: |
|
| Analysis Mode: | stream |
| Analysis stop reason: | Timeout |
| Detection: | MAL |
| Classification: | mal68.phis.win@16/57@48/268 |
- Exclude process from analysis (whitelisted): svchost.exe
- Excluded IPs from analysis (whitelisted): 216.58.212.131, 13.107.6.194, 66.102.1.84, 216.58.206.78, 34.104.35.123, 2.18.121.134, 2.18.121.147, 52.111.243.106, 199.232.214.172, 13.74.129.1
- Excluded domains from analysis (whitelisted): a1894.dscms.akamai.net, b-0039.b-msedge.net, clients2.google.com, accounts.google.com, edgedl.me.gvt1.com, prod.lists.office.com.akadns.net, c-msn-com-nsatc.trafficmanager.net, cdn.forms.office.net.edgesuite.net, ctldl.windowsupdate.com, clientservices.googleapis.com, clients.l.google.com, forms.office.com.b-0039.b-msedge.net
- Not all processes where analyzed, report is missing behavior information
- VT rate limit hit for: https://forms.office.com/e/tBp2XcGpEy
| Input | Output |
|---|---|
| URL: https://forms.office.com/pages/responsepage.aspx?id=g05NLYN6pUWwSUaSYRcBTPWlbxK0xypPh7PdVHAOShFUN0NZNENZOVpEUkFMOFE3MzFYNFFaRkFESS4u Model: Perplexity: mixtral-8x7b-instruct | {"loginform": false,"urgency": false,"captcha": false,"reasons": ["The webpage does not contain a login form as there is no explicit request for sensitive information such as passwords, email addresses, usernames, phone numbers or credit card numbers (CVV).","The text does not create a sense of urgency as it only informs the user about a new PDF document for review and provides two options to access it.","The webpage does not contain a CAPTCHA or any other anti-robot detection mechanism."]} |
Title: PROJECT REPORT OCR: PROJECT REPORT You have received a new PDF document for your review (Copy the URL to your browser or Click to access it) 1-8406- 7aef6-0232-ef11-8409-6045bdddSe05? | |
| URL: https://assets-eur.mkt.dynamics.com/21f9f50d-1320-ef11-8406-000d3adc9e50/digitalassets/standaloneforms/b957aef6-0232-ef11-8409-6045bddd5e05?=outlook.office.com/mail/inbox/id/xMwAQAP%2FO5QhSWQBJt%2Bdd51R9eCU%3D?actSwt=true Model: Perplexity: mixtral-8x7b-instruct | {"loginform": false,"urgency": false,"captcha": false,"reasons": ["The webpage does not contain a login form explicitly requesting sensitive information.","The text does not create a sense of urgency or interest.","The webpage does not contain a CAPTCHA or any other anti-robot detection mechanism."]} |
Title: Microsoft OCR: Ski to main content Microsoft Microsoft Account Home Microsoft Security We use cookies and similar tools which are necessary to improve your experience on our websites, such as through social media connections, and to display personalised advertising based on your online activity. Coninue Sign in Powered by M icrosoft Performance & security by Cloudflare | |
| URL: https://assets-eur.mkt.dynamics.com/21f9f50d-1320-ef11-8406-000d3adc9e50/digitalassets/standaloneforms/b957aef6-0232-ef11-8409-6045bddd5e05?=outlook.office.com/mail/inbox/id/xMwAQAP%2FO5QhSWQBJt%2Bdd51R9eCU%3D?actSwt=true Model: Perplexity: mixtral-8x7b-instruct | {"loginform": false,"urgency": false,"captcha": false,"reasons": ["The webpage does not contain a login form requesting sensitive information.","The text does not create a sense of urgency or interest.","The webpage does not contain a CAPTCHA or any other anti-robot detection mechanism."]} |
Title: Microsoft OCR: Microsoft Microsoft Security We use cookies and similar tools which are necessary to improve your experience on our websites, such as through social media connections, and to display personalised advertising based on your online activity. Powered by M icrosoft Performance & security by Cloudflare | |
| URL: https://login.mmhnzmefkqeqeuthdhbhgeez.from-wa.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.o Model: Perplexity: mixtral-8x7b-instruct | {"loginform": true,"urgency": false,"captcha": false,"reasons": ["The webpage contains a login form which explicitly requests sensitive information such as passwords, email addresses, and usernames.","There is no sense of urgency created in the text.","There is no CAPTCHA or anti-robot detection mechanism present on the webpage."]} |
Title: Sign in to your account OCR: Microsoft Sign in k mail, phone, or Skype No account? Create one! Can't access your account? Back Next Sign-in options Terms of use Privacy & ckies | |
| URL: https://login.mmhnzmefkqeqeuthdhbhgeez.from-wa.com Model: gpt-4o | ```json{ "phishing_score": 9, "brands": "Microsoft", "phishing": true, "suspicious_domain": true, "has_prominent_loginform": true, "has_captcha": false, "setechniques": true, "has_suspicious_link": true, "legitmate_domain": "login.microsoftonline.com", "reasons": "The URL 'https://login.mmhnzmefkqeqeuthdhbhgeez.from-wa.com' is highly suspicious. It does not match the legitimate domain for Microsoft login, which is 'login.microsoftonline.com'. The presence of a prominent login form is a common tactic used in phishing attacks to capture user credentials. Additionally, the use of a subdomain with random characters is a known social engineering technique to mislead users. There is no CAPTCHA present, which is often used by legitimate sites to prevent automated attacks. The combination of these factors strongly indicates that this is a phishing site."} |
 | |
| URL: https://ywnjb.mmhnzmefkqeqeuthdhbhgeez.from-wa.com/oauth20_authorize.srf?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&scope=openid+profile+https%3a%2f%2fwww.mmhnzmefkqeqeuthdhbhgeez.from-wa.com%2fv2%2fOfficeHome.All&redirect_uri=https%3a%2f%2fwww.mmhnzm Model: Perplexity: mixtral-8x7b-instruct | {"loginform": true,"urgency": false,"captcha": false,"reasons": ["The webpage contains a login form which explicitly requests sensitive information such as email addresses and passwords.","The text does not create a sense of urgency or interest.","There is no CAPTCHA or anti-robot detection mechanism present on the webpage."]} |
Title: Sign in to your Microsoft account OCR: Microsoft bum@bum.com Enter password password Forgot password? Sign in Terms of use Privacy & cookies | |
| URL: https://ywnjb.mmhnzmefkqeqeuthdhbhgeez.from-wa.com/oauth20_authorize.srf?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&scope=openid+profile+https%3a%2f%2fwww.mmhnzmefkqeqeuthdhbhgeez.from-wa.com%2fv2%2fOfficeHome.All&redirect_uri=https%3a%2f%2fwww.mmhnzm Model: Perplexity: mixtral-8x7b-instruct | {"loginform": true,"urgency": false,"captcha": false,"reasons": ["The webpage contains a form that explicitly requests sensitive information such as email addresses and passwords, which is indicative of a login form.","The text does not create a sense of urgency as it does not contain phrases such as 'click here to view document' or 'to view secured document click here'.","There is no CAPTCHA or anti-robot detection mechanism present on the webpage."]} |
Title: Sign in to your Microsoft account OCR: Microsoft bum@bum.com Enter password Forgot password? Sign in Terms of use Privacy & cookies | |
| URL: https://ywnjb.mmhnzmefkqeqeuthdhbhgeez.from-wa.com Model: gpt-4o | ```json{ "phishing_score": 9, "brands": "Microsoft", "phishing": true, "suspicious_domain": true, "has_prominent_loginform": true, "has_captcha": false, "setechniques": true, "has_suspicious_link": true, "legitmate_domain": "microsoft.com", "reasons": "The URL 'https://ywnjb.mmhnzmefkqeqeuthdhbhgeez.from-wa.com' is highly suspicious. It does not match the legitimate domain for Microsoft, which is 'microsoft.com'. The presence of a prominent login form asking for a password is a common phishing tactic. Additionally, the URL structure and the use of a subdomain with random characters are typical of phishing attempts. The site also uses social engineering techniques by mimicking the legitimate Microsoft login page to deceive users into entering their credentials. There is no CAPTCHA present, which is often used in legitimate sites to prevent automated attacks. The 'Forgot password?' link could potentially lead to further phishing attempts."} |
 | |
| URL: https://ywnjb.mmhnzmefkqeqeuthdhbhgeez.from-wa.com Model: gpt-4o | ```json{ "phishing_score": 9, "brands": "Microsoft", "phishing": true, "suspicious_domain": true, "has_prominent_loginform": true, "has_captcha": false, "setechniques": true, "has_suspicious_link": true, "legitmate_domain": "microsoft.com", "reasons": "The URL 'https://ywnjb.mmhnzmefkqeqeuthdhbhgeez.from-wa.com' is highly suspicious. It does not match the legitimate domain 'microsoft.com' associated with the brand Microsoft. The domain name is convoluted and uses a subdomain structure often seen in phishing attacks. The webpage prominently displays a login form asking for a password, which is a common tactic used in phishing to steal credentials. Additionally, the presence of a 'Forgot password?' link is another common element used to make phishing sites appear legitimate. There is no CAPTCHA present, which is often used on legitimate login pages to prevent automated attacks. Overall, the combination of these factors strongly suggests that this is a phishing site."} |
 |
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk
Download File
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 2673 |
| Entropy (8bit): | 3.986687718835554 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | C6156AF5359A99F6923CEA83EA1224EC |
| SHA1: | BCF1A9271F724A15A8B0BF2A90E2CD99A9834576 |
| SHA-256: | 6A4F9F456D9E449E8BC331566754B1F8BF34D29234D1220A112A435A96E2FFE1 |
| SHA-512: | 1977DD76CFED49960D383B7508B524A148EFEAEFB1C9686B73520854337FD7D76D7CC377AF92E0DFFEAB3E1FBA5B6549D41FE3299DA66757750DEE9AC501C929 |
| Malicious: | false |
| Reputation: | unknown |
| Preview: |
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Download File
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 2675 |
| Entropy (8bit): | 4.004510575382147 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | 07D1255CA0519CB8B8E9BBC8BB94027F |
| SHA1: | 7C6726C951DDAED94EB8BE5BC4B924E1C6B64F8A |
| SHA-256: | E271D0073B24898C4338A42DF7DAB12D9E3068F15B4117B0883007F08F028E79 |
| SHA-512: | BB933CC589FF930716D4F76112C2FFB685A37B214F21B285E76132B5B89D06AA866557B49D47AD2FFE5BB2C8B55837E8DE45A7C1216C8798C924221CA395D42C |
| Malicious: | false |
| Reputation: | unknown |
| Preview: |
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Download File
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 2689 |
| Entropy (8bit): | 4.00902241649492 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | 2080CD8A12349D4CE72C88591895BA5F |
| SHA1: | 6B23388C743F17BA3C39AB427B69787F3DBD760B |
| SHA-256: | B7F3584B7D0E2C173E4496DA7AFEB196A71E03C2FE047FBDDF61F829A9E0E072 |
| SHA-512: | 7BD6988793AC5352412B6B2C10931C623A753DF7FEC0E3D2FA3C5925CF78FBEF66A3A036C7881CC5C38C312732083A2C191FD2354B1AB84ABAEE54AAD520EC49 |
| Malicious: | false |
| Reputation: | unknown |
| Preview: |
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Download File
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 2677 |
| Entropy (8bit): | 4.00084164511291 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | C245BA3418531FA996A56C34CDB7200A |
| SHA1: | A899565A48A6EA057398F3F18E5B6D87408D7037 |
| SHA-256: | 94DC4C2B6D9392E5620EB46256BDBF8786AA43DF39BF964576B6E165455CF288 |
| SHA-512: | D1DC1288D7ECDA403D583B59E5431DE1D6FA664D6F44E0F2366748536B64F56CB00A9CE894E57DC29B5A0C82A081F9452B0F60A963743BE0BC76911E5C651C8F |
| Malicious: | false |
| Reputation: | unknown |
| Preview: |
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Download File
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 2677 |
| Entropy (8bit): | 3.9893216987606404 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | 5CD68E5CDD041A69FCD24695F1B34EF9 |
| SHA1: | E02794650A2B827C21CDF70CFC33CD124AD7CED0 |
| SHA-256: | 2669673C10BCDF4BD08B04B9F0B8B054DCCC08A73BE9CFD7388B1ABBADCDF044 |
| SHA-512: | A5DC227AA07DA0FA3F3BFFA40C15E29C0A9E93ECC7924329888BD781069D932D85FB08B56715C1001BFBF18CD107118327E433C0BA0103978078C7770B1B9899 |
| Malicious: | false |
| Reputation: | unknown |
| Preview: |
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Download File
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 2679 |
| Entropy (8bit): | 4.000858666512784 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | D209CFCFB064D406231A493C68C632E9 |
| SHA1: | 7900F6F0BE7103D4601191392E34C580791EB982 |
| SHA-256: | 4D41C7BA1B59D4E7BEBA6E986AEA1FBCF0F0A8C966AF4C26649653B233A8E4CB |
| SHA-512: | 17A4519CF269D544724F7027CCF1E8A1DEB497D8B06B88625D661BCEB29AE124CA7BACA83EFEA89788FA98E2A6DF55F442DE5047866130592B18A9B23059D561 |
| Malicious: | false |
| Reputation: | unknown |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 493029 |
| Entropy (8bit): | 5.467496504307675 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | 8C174499C7E3C62F1ABCB0E95068E13A |
| SHA1: | 32315081EC027B1A6816E61CAD296D461D61618C |
| SHA-256: | CCF9D800FBAE0234C23D7E1536264977840B18177328F7E8221B74C3710530AE |
| SHA-512: | 33295510858A399D6E0F86C7CE8EEF6D79A735E7C612857E76011666F05A043B20C8E16C15112A318533F2270E339119E4F9D574194520CE4DFE39DE1E90A8AF |
| Malicious: | false |
| Reputation: | unknown |
| URL: | https://cdn.forms.office.net/forms/scripts/dists/light-response-page.min.d3c98fd.js |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 4054 |
| Entropy (8bit): | 7.797012573497454 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | 9F14C20150A003D7CE4DE57C298F0FBA |
| SHA1: | DAA53CF17CC45878A1B153F3C3BF47DC9669D78F |
| SHA-256: | 112FEC798B78AA02E102A724B5CB1990C0F909BC1D8B7B1FA256EAB41BBC0960 |
| SHA-512: | D4F6E49C854E15FE48D6A1F1A03FDA93218AB8FCDB2C443668E7DF478830831ACC2B41DAEFC25ED38FCC8D96C4401377374FED35C36A5017A11E63C8DAE5C487 |
| Malicious: | false |
| Reputation: | unknown |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 911559 |
| Entropy (8bit): | 5.416413084191307 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | 0796A9CE73B7BE5B58A217A51C099ADB |
| SHA1: | 7EBEE011246E111793827CF94B4E6AFBE260AFCD |
| SHA-256: | 725B38886F059F44300D563C21D4324B5CC464ED19479DCB1891104DA83C4D2A |
| SHA-512: | 4C2F2371CAB9C14BEC174B498DB4D928EA464378EC05B14DBB1022A388AF8AE4A0C7B919B95B23B3E51E2DAF9F69450D86BDEA0A092F00C46BE2E8C0CFCAC8FA |
| Malicious: | false |
| Reputation: | unknown |
| URL: | https://logincdn.msftauth.net/shared/5/js/login_en_B5apznO3vltYohelHAma2w2.js |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 5528 |
| Entropy (8bit): | 7.970866064773261 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | C64BD28F597CBB6156F45A3A07B0CA92 |
| SHA1: | C51015874C198D87278B62135727941675274760 |
| SHA-256: | 22BD6DC040C2B88155847410B59793DEBCDB8CACA308B07D65F86695B7CF5420 |
| SHA-512: | 445739E75528CD87400836F94BA9AE11A47B35AFAFBB3C466ABDE56C6E788150B8A06FA152FDD3D6DB0D7D07CB65DC62367A441C66E1852FE09E2914EDCE7CDD |
| Malicious: | false |
| Reputation: | unknown |
| URL: | https://aadcdn.msauth.net/shared/1.0/content/js/asyncchunk/convergedlogin_pfetchsessionsprogress_0b5ca5d48eeaf75b0528.js |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 1435 |
| Entropy (8bit): | 7.8613342322590265 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | 9F368BC4580FED907775F31C6B26D6CF |
| SHA1: | E393A40B3E337F43057EEE3DE189F197AB056451 |
| SHA-256: | 7ECBBA946C099539C3D9C03F4B6804958900E5B90D48336EEA7E5A2ED050FA36 |
| SHA-512: | 0023B04D1EEC26719363AED57C95C1A91244C5AFF0BB53091938798FB16E230680E1F972D166B633C1D2B314B34FE0B9D7C18442410DB7DD6024E279AAFD61B0 |
| Malicious: | false |
| Reputation: | unknown |
| URL: | https://aadcdn.msauth.net/shared/1.0/content/images/microsoft_logo_564db913a7fa0ca42727161c6d031bef.svg |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 22558 |
| Entropy (8bit): | 7.774597767634678 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | 8C74B93EF72790EC76B5020C4C24B58F |
| SHA1: | 8C9C97C0B592328E3F2309EAEAE8EDB9FADF15A9 |
| SHA-256: | 6482F94C071441D418F0566C325546CE51F07FA09782027851CB183DD3350E4A |
| SHA-512: | 1DCD61A95EA619E9B61CA8167349462C45C026A16471358D0E570437F66CF40124CA3BCEAC96EC30CA444C5BCB0A049D8A072F51960A5FAD384EFF52011BC4D8 |
| Malicious: | false |
| Reputation: | unknown |
| URL: | https://lists.office.com/Images/2d4d4e83-7a83-45a5-b049-46926117014c/126fa5f5-c7b4-4f2a-87b3-dd54700e4a11/T7CY4CY9ZDRAL8Q731X4QZFADI/5adcd565-32f8-46f3-8a13-67e99f4a064e |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 33092 |
| Entropy (8bit): | 5.517938818105581 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | C8A069A298CC1BB663397067D28F2101 |
| SHA1: | 4503DFC0E5C0B14A0C5E1AC8C346D7A281B4B75A |
| SHA-256: | 94E6E9E700A94F8D3F75AB64E5B6C865203963CDECFD9DBEBEA4D8E425CEE202 |
| SHA-512: | D7850EBE8869B0D38D6AA310767EC918D90B9ECE6DF6648F62557AD7769B3CA598B9CC8B907A0B0E775577CE26A6E6D0480FEFD7F4C701155DA7A3E426024249 |
| Malicious: | false |
| Reputation: | unknown |
| URL: | https://cdn.forms.office.net/forms/scripts/dists/light-response-page.chunk.lrp_saveresponse.9e5a54b.js |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 121713 |
| Entropy (8bit): | 7.997650146861334 |
| Encrypted: | true |
| SSDEEP: | |
| MD5: | 999B203DEA342A1621F1A453F84ADB3F |
| SHA1: | 811E81207007056E89FD3EC7217359149E01E555 |
| SHA-256: | 9C9F177DCEF35078BF57565329D04CB35CBE39C61D252F6BCA1DC2D72C86D837 |
| SHA-512: | D07629B8E5AC5B861F7981C7CD8B1A1B46C4AC28FD8E8103F0A73489423659B3EB4F13FC9CD26D13D85411C29D29282E263AC9A2FA02730A4D145FBA4D27CEFD |
| Malicious: | false |
| Reputation: | unknown |
| URL: | https://aadcdn.msauth.net/shared/1.0/content/js/ConvergedLogin_PCore_Kjlmc42uL0ATl_21eYcwVg2.js |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 72215 |
| Entropy (8bit): | 5.495467621836068 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | D5F3EE2DB5561A82699270EC94700A30 |
| SHA1: | 8CB342002352BAF4956346CAE4A4056BF240F09C |
| SHA-256: | E8E5F7D967C160D05E013E439FDD2165C35DECAC998D6411DF3AEAFCE1AF645D |
| SHA-512: | 2984433C1D0577815CDD69930F55A7AB54710984AD1789D075D92F04C51DD87D394F02D9DCF00BB24AD993C30436722BC9322B692110F763665A2C7242BCC02B |
| Malicious: | false |
| Reputation: | unknown |
| URL: | https://cdn.forms.office.net/forms/scripts/dists/light-response-page.chunk.lrp_cover.b0cd9b4.js |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 15 |
| Entropy (8bit): | 3.189898095464287 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | 39A19D0882684989864FA50BCED6A2D1 |
| SHA1: | 5CED55DAC2E0427E9DC605CEC1FEDAB0949EB15E |
| SHA-256: | 8FBEDED073249C3611742297EE96A976A95EE113F33B9A422A5D3A7A2DEB63E5 |
| SHA-512: | E795CB7DE27B42948B7DDFF19F3B401A8F95753AC7D37D9B5F52D8DACD2AA43A2AD9EACEC29F77D28080E20C21C48B9FA88A733FAC108939FB2F0EB036C7AEEE |
| Malicious: | false |
| Reputation: | unknown |
| URL: | https://statics-marketingsites-eus-ms-com.akamaized.net/statics/override.css |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 101666 |
| Entropy (8bit): | 5.420011181790742 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | 69B53C08ACFD81CB8659BB5193E96BBA |
| SHA1: | 439AE06C71C6CE8C01AF6599E3F7CEB7C96900CF |
| SHA-256: | 78537CEE7626C092BBB0ABE5749C3D07FC0C03FDDB3ECF770EBFDA6EAE395BD6 |
| SHA-512: | 0DDD047F0C8420A819971CAB5927EC6D3AD9939A79CADADBAEA44D410BF6F86AD83A1EC6DE82CE5353A021C6B5C7E2FABEF8749574CBA61300301665B7EED000 |
| Malicious: | false |
| Reputation: | unknown |
| URL: | https://cdn.forms.office.net/forms/scripts/dists/light-response-page.chunk.utel_1ds.6255456.js |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 912017 |
| Entropy (8bit): | 5.414635876106438 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | C055B54826187E9BFAD668452523BA80 |
| SHA1: | 33B9642B9C83F69640C4DC83EA34A47F8B347A41 |
| SHA-256: | AC96990B2665B91FD7FBBABDAB21EEEF5CBA8EBB93ECB802970B03B3C4733106 |
| SHA-512: | 6E1BB67C0B970B76573D9E6A255654846A35F7E08E5FE13E652F3D4745ADBB127D3B0649A2C1826C127C3F325190B88AF09FE4226C7C4E7A3F4B0D3D7158C25E |
| Malicious: | false |
| Reputation: | unknown |
| URL: | https://logincdn.msftauth.net/shared/5/js/login_en_wFW1SCYYfpv61mhFJSO6gA2.js |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 90690 |
| Entropy (8bit): | 5.331029016047939 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | D390AA6A6D257834D807D8E7DDC90968 |
| SHA1: | 6A6EFD105DBBEB099D25998A38875808D83AF5C8 |
| SHA-256: | D755D7CE744425DEE51A3BD8CBA9B2A789D96C584C9958082B557FEB70F226D9 |
| SHA-512: | 9629ED6071CFED4EFF34C163F36482336F0D402FD95951FC792A5F125C1BE1CA3C6918E61A4A79815B15AB5CDD6BCEF30D4FE0090C283C02590B62879D960818 |
| Malicious: | false |
| Reputation: | unknown |
| URL: | https://logincdn.msftauth.net/shared/5/chunks/oneds-analytics-js_54b1724af1b05e2ba3db_en.js |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 170222 |
| Entropy (8bit): | 5.043706734923043 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | 501A61540F1AD706F32DC3B22FFA92C3 |
| SHA1: | 6E8283877B215FEF5232F42C2AA6CDFDC0B7A8D6 |
| SHA-256: | F5E98E2373C741C7A3D6F1C3A4B114E3F0F022C41E24EE6BA022DE985EAC773B |
| SHA-512: | 3F08136147A867E43576136A2F5D82CD16AD65DC9CA77122B104151698451F2C702F14E63F35476F7CC461CDE33E28E552A7D46C6BA6B6B6AFF515E396E1DD04 |
| Malicious: | false |
| Reputation: | unknown |
| URL: | https://www.microsoft.com/onerfstatics/marketingsites-eus-prod/west-european/shell/_scrf/css/themes=default.device=uplevel_web_pc/79-4cdd0a/33-ae3d41/a5-4bf7a2/13-8e1ceb/81-32f0c0/5c-b7b685/bd-97baf6/ef-a24652?ver=2.0&_cf=20210618 |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 7886 |
| Entropy (8bit): | 3.973130033666625 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | 9425D8E9313A692BB3F022E8055FAB82 |
| SHA1: | EDDCF3EA767D4C3042D01AC88594D7E795D8615C |
| SHA-256: | F2A1ABCF12EBD0F329E5B66B811B0BD76C8E954CB283CE3B61E72FBF459EF6F1 |
| SHA-512: | 93B3EB3C4CE385D80D4A8F6902355BBD156AC1AA20B8869AF05C8E714E90E74C5630BB8DE34D5B8FC9F876AC44BE314F3A2A08B3163295ADADBC6DD7B8D23561 |
| Malicious: | false |
| Reputation: | unknown |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 16 |
| Entropy (8bit): | 3.875 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | D6B82198AF25D0139723AF9E44D3D23A |
| SHA1: | D60DEEF1847EEEF1889803E9D3ADC7EDA220F544 |
| SHA-256: | A5C8CC49FA6649BE393EF22C2B31F1C46B671F8D763F783ED6D7B4E33669BDA3 |
| SHA-512: | B21BEE2EEC588308A9DC3C3C2405377704B39B08AA20CBA40BA6E6834E67CF6F2C086E0701F5B05AEE27E2677E9C5C24FF137318275ACA00DD063DF3DCC07D4D |
| Malicious: | false |
| Reputation: | unknown |
| URL: | https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISEAkURW043JHwYRIFDVd69_0=?alt=proto |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 7914 |
| Entropy (8bit): | 4.4735908000780045 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | 56F9CD8A07135E776326431C8560F8F2 |
| SHA1: | FCFF27C475A9FB014661B045B59C8BB4799A0392 |
| SHA-256: | 0E1D105D6EE902B7279AEFD9E8AF21AB3E5D0CF058332A2A0E53A351524C75E6 |
| SHA-512: | E75E2B65828CDE51CA880AEE30A74A3EE04B25B0FC0D2AF5B4BB675B62B592CF12D284771A0CE0A8174295F93C4D9007DA5C407C65229456EC0F1A18A6C8EE28 |
| Malicious: | false |
| Reputation: | unknown |
| URL: | https://forms.office.com/offline.aspx |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 15701 |
| Entropy (8bit): | 5.4651251774189475 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | 859C7881B914BD13781C0446EEB497C7 |
| SHA1: | 5357563CDF1AACBE7447814A5DA4EA4DC3388CCF |
| SHA-256: | C91A80A096CEE5D241FB8A8B6A5B7F23909AB258B08B43FA1B3F8F90B399E469 |
| SHA-512: | 47C6E715A99E44EFB2CDB441A8C6D90694AAD8A545FB15CCA2868CD30A40CF683DD690AAF9D9642507250261CAF83D50AF832356BD9E38AF70F6C3B1D862B6C0 |
| Malicious: | false |
| Reputation: | unknown |
| URL: | https://cdn.forms.office.net/forms/scripts/dists/light-response-page.chunk.lrp_post.boot.f2af163.js |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 20390 |
| Entropy (8bit): | 7.9794389214686126 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | 5EDF83D03EA7B67BD2F35472E435D17E |
| SHA1: | 737BF84D2931906E6700439FD90CE6147633B0D0 |
| SHA-256: | 6524138B61AAF24DEADDA7C64AF577789C350C1ED90C48B6482011323C455513 |
| SHA-512: | DE3F83D1C11E1498C2D83DD72374755385DE76F870F54A2698D22DC7CE2F85B685690C93128A9A68D43DB94B7CCE1C45072521A5912E97F4FCACD341F162FA45 |
| Malicious: | false |
| Reputation: | unknown |
| URL: | https://aadcdn.msauth.net/ests/2.1/content/cdnbundles/converged.v2.login.min_mc5ac6ol0l4d2iaqspstyg2.css |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 548 |
| Entropy (8bit): | 4.688532577858027 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | 370E16C3B7DBA286CFF055F93B9A94D8 |
| SHA1: | 65F3537C3C798F7DA146C55AEF536F7B5D0CB943 |
| SHA-256: | D465172175D35D493FB1633E237700022BD849FA123164790B168B8318ACB090 |
| SHA-512: | 75CD6A0AC7D6081D35140ABBEA018D1A2608DD936E2E21F61BF69E063F6FA16DD31C62392F5703D7A7C828EE3D4ECC838E73BFF029A98CED8986ACB5C8364966 |
| Malicious: | false |
| Reputation: | unknown |
| URL: | https://assets-eur.mkt.dynamics.com/bundles/styles/signedout-oneui?v=fxWDPSdgdYVZRC_ceRR_L6he1M_EOZx8zyPNGpHAdOs1 |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 1779 |
| Entropy (8bit): | 7.589819392147309 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | 4150A5D4F2B0284A9E62D247929DD2AA |
| SHA1: | 97CA2D9ECE8F0855B2A93E6BFDFC4883685C51CB |
| SHA-256: | F058653DCBA7E8B00D4BDB9409E06817F098AB18125CE5A5821520F04030D176 |
| SHA-512: | D034378E76D58A899047B4639115102CC8F89AEF3F300DDAF0C0B3EAE40C8381040D1656109632E9095ED3F399218F196087D070C099FD89B9605DFBC34FB585 |
| Malicious: | false |
| Reputation: | unknown |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 1151 |
| Entropy (8bit): | 5.369908043108395 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | 436A7BC82156A644ED0206BFBC3A67BD |
| SHA1: | 189C49265A47CBD4DDA7D86E785C9E9970C41F7E |
| SHA-256: | 5E18809EF5C2DFEB8B35CB5CD230ED8C64CD04A564090761F24E5FB8F628C6CA |
| SHA-512: | CA54A7B2D60FC04D4E6D44287A1B5051DB9E843A10514142E1C79BA1091A9CB0DD1BBCCDFDEB5DF7BC845C648A5C0B798313D44A76ED48135BC64B0E1C0DEF35 |
| Malicious: | false |
| Reputation: | unknown |
| URL: | https://cdn.forms.office.net/forms/scripts/dists/light-response-page.chunk.sw.a6ac500.js |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 1864 |
| Entropy (8bit): | 5.222032823730197 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | BC3D32A696895F78C19DF6C717586A5D |
| SHA1: | 9191CB156A30A3ED79C44C0A16C95159E8FF689D |
| SHA-256: | 0E88B6FCBB8591EDFD28184FA70A04B6DD3AF8A14367C628EDD7CABA32E58C68 |
| SHA-512: | 8D4F38907F3423A86D90575772B292680F7970527D2090FC005F9B096CC81D3F279D59AD76EAFCA30C3D4BBAF2276BBAA753E2A46A149424CF6F1C319DED5A64 |
| Malicious: | false |
| Reputation: | unknown |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 36826 |
| Entropy (8bit): | 4.784953255851495 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | 83C5167228BD89135F9397462EB03D3F |
| SHA1: | B86A808A28F0EB68D3B32B7372C21588D3703AF1 |
| SHA-256: | AC23890CF57171832DDE373895120A6141AC209931C2125F2B5DB7A32344D1F8 |
| SHA-512: | DA5D56881ECD009DA56CAB73E52CC2F8AA95A6E9133FE5BB41A2B783D5A7EFA5AF0705C5773096FE2F9FA2A83FD82799C1C83215901EFC81F6EC8319B39189C1 |
| Malicious: | false |
| Reputation: | unknown |
| URL: | https://cdn.forms.office.net/forms/scripts/dists/ls-response.en-us.8baacbebd.js |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 110678 |
| Entropy (8bit): | 5.425859733908257 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | 07B98765F2550D83EEAEF5CB36A2E6A1 |
| SHA1: | 4F5CB9D05789079FA605E58546015C8A6969FFA6 |
| SHA-256: | E86B0BF07871186DD32B20C7B4FD8E8729C717EABE73763847BE9CB091D348F7 |
| SHA-512: | BBB2F8EFC7C12DF1B01DE74DF607B4E86CD6A5BF6FA6EC90C5D824D0D76E675616613040B578FE099AF5BE6FE728B919F014CAEE0DFA0E47714558DFD7AEFDE2 |
| Malicious: | false |
| Reputation: | unknown |
| URL: | https://cdn.forms.office.net/forms/scripts/dists/light-response-page.chunk.1ds.a8079b3.js |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 1282 |
| Entropy (8bit): | 4.695064346385326 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | 8D30025E69BC896ACC2064D1791F5A88 |
| SHA1: | 1F14560FD3D30F0A2C291CE503CCB490C94E0C3E |
| SHA-256: | 769442A29597F6DB303853931D749780EF46D2855412843431DAC07A9D72CCB0 |
| SHA-512: | 7363382D59DF760A37A8C48F6D7037EF9C57CE97EFA0AFDDD19FE133952EE825B9043C84227F4E0B6D4AED310E9DF0053294BF6EB991CC3FBE7338C853C51888 |
| Malicious: | false |
| Reputation: | unknown |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 491 |
| Entropy (8bit): | 5.058319039482085 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | B8853C5CB492B4374675A6EEE35F3E13 |
| SHA1: | 723BEB5FE213DDE8A9AA5849D2F5857B4E03BB1E |
| SHA-256: | 9F8A8A20DBCB4123D3380DF2EE65FEE14DB070948A40034DA6C24A386446B98D |
| SHA-512: | EEBF0D7A0F9682870E9EAE27AC9A014569BC6E4CF29A2D8D70E734E8CDCC1EB5FEA54B931C5DDBB51EE6353F03331A22C9255BC41115F5349245324A50B5D9A0 |
| Malicious: | false |
| Reputation: | unknown |
| URL: | https://assets-eur.mkt.dynamics.com/21f9f50d-1320-ef11-8406-000d3adc9e50/digitalassets/standaloneforms/b957aef6-0232-ef11-8409-6045bddd5e05?=outlook.office.com/mail/inbox/id/xMwAQAP%2FO5QhSWQBJt%2Bdd51R9eCU%3D?actSwt=true |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 742296 |
| Entropy (8bit): | 5.442960982190392 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | 545A1BBC31581E3D1B1EB383DD3E9B98 |
| SHA1: | 09249350A3B3EA2665724E0A789096BBA27E0E16 |
| SHA-256: | C3D9901D45BE8548749013D46A5FD17A564495A52DF6E265668E0D2401915165 |
| SHA-512: | BE38C2CEBFFFEEE6F6EFD6071F65C8C047D79133119C60409E89480762F3B4677407E452BE702851E5BFB33B8E8DE8077159038049D86B7C85FDB03F64046133 |
| Malicious: | false |
| Reputation: | unknown |
| URL: | https://cxppusa1formui01cdnsa01-endpoint.azureedge.net/eur/FormLoader/FormLoader.bundle.js |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 998130 |
| Entropy (8bit): | 5.576589911673417 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | BDD50587EA7EDA5BCB74B767590C5B93 |
| SHA1: | 3DA343D6351DED8E125B3A5DABB6F12F8311EBBC |
| SHA-256: | 3C0E8698A860D8D8205B4F88BBEAC02E52E1B427FBB4E7A77793D1E6E53FCA3E |
| SHA-512: | B305989CFE2FE3A2ACD175D8BE120EFB96FBE97D31FD45D51ED2991235247BE8E91FC89F2C2318C4EAFE288D574B3986CDE106C28347C737B75D74BA855B190D |
| Malicious: | false |
| Reputation: | unknown |
| URL: | https://cdn.forms.office.net/forms/scripts/dists/light-response-page.chunk.officebrowserfeedback.bd03d92.js |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 4613 |
| Entropy (8bit): | 5.404641833275565 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | 36F27B960C9F790F49FB76B120E17A17 |
| SHA1: | 2BACA86C15A245DD64199BDD2D33DE3B3BE5D005 |
| SHA-256: | E2B7D115BE4E3A08D9B119E09CAD08A893E499D2C54AF6BC1280582142281518 |
| SHA-512: | 3F51A717F613D993C3D5D80463D7707CD493774CC72C54FB6434037387458879122AD541B469CE709C3AE5C4EAA323E8FACDC1F3EA5BF0E1452B5CCBCBC63D7B |
| Malicious: | false |
| Reputation: | unknown |
| URL: | https://cdn.forms.office.net/forms/scripts/dists/light-response-page.chunk.lrp_groupnote.a8081b2.js |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 621 |
| Entropy (8bit): | 7.673946009263606 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | 4761405717E938D7E7400BB15715DB1E |
| SHA1: | 76FED7C229D353A27DB3257F5927C1EAF0AB8DE9 |
| SHA-256: | F7ED91A1DAB5BB2802A7A3B3890DF4777588CCBE04903260FBA83E6E64C90DDF |
| SHA-512: | E8DAC6F81EB4EBA2722E9F34DAF9B99548E5C40CCA93791FBEDA3DEBD8D6E401975FC1A75986C0E7262AFA1B9D1475E1008A89B92C8A7BEC84D8A917F221B4A2 |
| Malicious: | false |
| Reputation: | unknown |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 3620 |
| Entropy (8bit): | 6.867828878374734 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | B540A8E518037192E32C4FE58BF2DBAB |
| SHA1: | 3047C1DB97B86F6981E0AD2F96AF40CDF43511AF |
| SHA-256: | 8737D721808655F37B333F08A90185699E7E8B9BDAAA15CDB63C8448B426F95D |
| SHA-512: | E3612D9E6809EC192F6E2D035290B730871C269A267115E4A5515CADB7E6E14E3DD4290A35ABAA8D14CF1FA3924DC76E11926AC341E0F6F372E9FC5434B546E5 |
| Malicious: | false |
| Reputation: | unknown |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 43797 |
| Entropy (8bit): | 5.3330082676730814 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | 72BC74DBD7E2D7EC8098628569C7C8D1 |
| SHA1: | CF83D74066EF9F807DB72B7985522E44A9DBE68E |
| SHA-256: | 6DD99733E4AF8728ABF32904C57D8B884D75D3424011EC2C9AA255D942A8BFF6 |
| SHA-512: | CA933824BE7CB9863946B247B79CCDAF8168A7C9982336DB25A5A2FE8376DA69F1C9B88E8D8A770AD6049BA388579704D49383B7190325518906908BF3F68BF2 |
| Malicious: | false |
| Reputation: | unknown |
| URL: | https://forms.office.com/sw.js?ring=Business |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 17174 |
| Entropy (8bit): | 2.9129715116732746 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | 12E3DAC858061D088023B2BD48E2FA96 |
| SHA1: | E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5 |
| SHA-256: | 90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21 |
| SHA-512: | C5030C55A855E7A9E20E22F4C70BF1E0F3C558A9B7D501CFAB6992AC2656AE5E41B050CCAC541EFA55F9603E0D349B247EB4912EE169D44044271789C719CD01 |
| Malicious: | false |
| Reputation: | unknown |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 340501 |
| Entropy (8bit): | 7.881878211626162 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | E83BC964DFCA2B34B1F2BE36CA1C9BCB |
| SHA1: | 7A4E9C94C5A13CF3DA0F2D3D7B660EC91FE51C82 |
| SHA-256: | 578D99B041999BCE58A52E74121AA1BFCCB7B5194207D1D5FDF7A275C72753FA |
| SHA-512: | 82DDF44483653AE9FA82C84B63B2719834F25076A5FC8EA161A7DDF4778574FA9C0E830890EB31924CE86083FD92BEFEDD8372D51FF815F74CBD41003704CB1D |
| Malicious: | false |
| Reputation: | unknown |
| URL: | https://lists.office.com/Images/2d4d4e83-7a83-45a5-b049-46926117014c/126fa5f5-c7b4-4f2a-87b3-dd54700e4a11/T91SNW06S7A66KF3ZKQMW2CTOH/85a251d6-8880-4632-8ea1-b8b4caa7ef08 |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 72 |
| Entropy (8bit): | 4.241202481433726 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | 9E576E34B18E986347909C29AE6A82C6 |
| SHA1: | 532C767978DC2B55854B3CA2D2DF5B4DB221C934 |
| SHA-256: | 88BDF5AF090328963973990DE427779F9C4DF3B8E1F5BADC3D972BAC3087006D |
| SHA-512: | 5EF6DCFFD93434D45760888BF4B95FF134D53F34DA9DC904AD3C5EBEDC58409073483F531FEA4233869ED3EC75F38B022A70B2E179A5D3A13BDB10AB5C46B124 |
| Malicious: | false |
| Reputation: | unknown |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 2672 |
| Entropy (8bit): | 6.640973516071413 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | 166DE53471265253AB3A456DEFE6DA23 |
| SHA1: | 17C6DF4D7CCF1FA2C9EFD716FBAE0FC2C71C8D6D |
| SHA-256: | A46201581A7C7C667FD42787CD1E9ADF2F6BF809EFB7596E61A03E8DBA9ADA13 |
| SHA-512: | 80978C1D262BC225A8BA1758DF546E27B5BE8D84CBCF7E6044910E5E05E04AFFEFEC3C0DA0818145EB8A917E1A8D90F4BAC833B64A1F6DE97AD3D5FC80A02308 |
| Malicious: | false |
| Reputation: | unknown |
| URL: | https://aadcdn.msauth.net/shared/1.0/content/images/marching_ants_white_8257b0707cbe1d0bd2661b80068676fe.gif |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 3651 |
| Entropy (8bit): | 4.094801914706141 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | EE5C8D9FB6248C938FD0DC19370E90BD |
| SHA1: | D01A22720918B781338B5BBF9202B241A5F99EE4 |
| SHA-256: | 04D29248EE3A13A074518C93A18D6EFC491BF1F298F9B87FC989A6AE4B9FAD7A |
| SHA-512: | C77215B729D0E60C97F075998E88775CD0F813B4D094DC2FDD13E5711D16F4E5993D4521D0FBD5BF7150B0DBE253D88B1B1FF60901F053113C5D7C1919852D58 |
| Malicious: | false |
| Reputation: | unknown |
| URL: | https://logincdn.msftauth.net/shared/5/images/microsoft_logo_ee5c8d9fb6248c938fd0.svg |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 5895 |
| Entropy (8bit): | 7.720248605671278 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | 311274C8C9C66E894F5AFA51FACD72CD |
| SHA1: | 386D1FA0B2924DF2C21545CF2FF1DDE2CD985D33 |
| SHA-256: | BC3C029408DAB6B5CB676B990B2E21BDD474E4B2E45DAF87E70210539390BF49 |
| SHA-512: | 2117BC16AC878BCC307CEA0DEFA0638800715330E83E9C8C1CAD7398BBF207E9432391B851E004308FB75C20C2D6F587D015FA3FB13F8630FE3E0C7E194979FC |
| Malicious: | false |
| Reputation: | unknown |
| URL: | https://cdn.forms.office.net/forms/images/microsoft365logo_v1.png |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 36099 |
| Entropy (8bit): | 5.314563534826003 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | 2F7CCD8B357434E3FA86E690C0D9EED8 |
| SHA1: | 8D96BF3F6EA364AD00A39144D63F6262272C0661 |
| SHA-256: | 97FEDEC7AE01B311398DF5BBB3D625C7797587DC89AAE0B9EF1F3A864EB73728 |
| SHA-512: | 0FD4A54C5A28703DE4B907442A40DA926E1121EBC33203C0CBA50C070F006E08F8E8B2C4DE966A18AD41DADD69F8EF88DA3D190810E6FD9FB6A42B8FFEFBE313 |
| Malicious: | false |
| Reputation: | unknown |
| URL: | https://cdn.forms.office.net/forms/scripts/dists/light-response-page.chunk.utel.a33ffb6.js |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 15942 |
| Entropy (8bit): | 7.985848663515711 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | D8413A82C3ACAD792A58247EE86F13E3 |
| SHA1: | A0E7094EC02457E0FFFAF3C35B2FB62740BC3BBA |
| SHA-256: | 8D37EC047A496B43579F8B4C83432905C482D67E0672A32FF8C9BC4155C718CC |
| SHA-512: | FBDC7B9087518D334295F912113B310E4FA3EFE36B202C62B4E459380DB2EA8D434710A896D1ECADC6304CC9C5BAFBA84438EA9355D869ED4A89B86D581EFEAD |
| Malicious: | false |
| Reputation: | unknown |
| URL: | https://aadcdn.msauth.net/ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_fo8rkc18qnhjh4wnzabsdg2.js |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 49796 |
| Entropy (8bit): | 4.696858330625097 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | 36C1943617E01085CE1FF9FCD054A05B |
| SHA1: | 6840BA63B42F0BDCA901B560D9D08C5616D1F768 |
| SHA-256: | C04E5EF32EBA9D8E2AE0C16665FED499372E9C641A9376447D34E10132C50637 |
| SHA-512: | 13626D86F4532A40EECE1F99C2513EDB5D03A214CDBE9AFA9BB2216862E0A848F30E5E281E586A1C338B424231BC61588C7A2810374B16CEADCA82843D9C0CD3 |
| Malicious: | false |
| Reputation: | unknown |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 11401 |
| Entropy (8bit): | 4.914475659803146 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | 550F480BD63DBC8D5B04FAFDA2696C24 |
| SHA1: | 5A15E9F6516B6D838E73085DDA4EBCCBAFBB878D |
| SHA-256: | F5181C7776E0F5540DC52C3405E22FE678F906F27DFE5B009FE9C66A0403B488 |
| SHA-512: | 97E67960A841EA1E6F797FEBCE2E2F450FDFF12076CFB59477D221187F09D78919A0D49148A4655A25537012AB48464DB14CFBEC9A981911292F80EEE2B0696C |
| Malicious: | false |
| Reputation: | unknown |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 49696 |
| Entropy (8bit): | 7.995313044786981 |
| Encrypted: | true |
| SSDEEP: | |
| MD5: | 3D5FBC4186EF45B04DE8BF8BA6861967 |
| SHA1: | EFB2759A486E84730182091A9710DCE3EDCD8F6F |
| SHA-256: | 099E7356BAE6752C1A7052BC9DE4AD113187EDA6A1385794E12955F7AE636D25 |
| SHA-512: | 949516390D8CEA5A1057647B2487634CFCFBD2510D9571965DC714954723EA9FA1FA79C240671888613964D8D43C921DCA8BAE3802E15C98F127B82092E51126 |
| Malicious: | false |
| Reputation: | unknown |
| URL: | https://aadcdn.msauth.net/shared/1.0/content/js/BssoInterrupt_Core_sw-M8KkV3_nBot-G1ImRcw2.js |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 54318 |
| Entropy (8bit): | 7.995006031600911 |
| Encrypted: | true |
| SSDEEP: | |
| MD5: | 3F98A175D5232F665BEFFC23352D7176 |
| SHA1: | 8413FCCF22CEBAAED144736F5415F09EFD45CE48 |
| SHA-256: | C6D80B97A3828280862163C72A94F5902F10D927FA1F6BDEAB5479B94F04F5AC |
| SHA-512: | 93D0C9BBB7B204AE18A2392F137DC02B71A9E5352EC24267C2CEBAE5C286EEB68BCABF73F3F4B6DA1DF1D49E3998F6190D843144CD1ACDD5B4AA707CDF7CC24D |
| Malicious: | false |
| Reputation: | unknown |
| URL: | https://aadcdn.msauth.net/shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_8e14dcf0e3ff5580d170.js |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 673 |
| Entropy (8bit): | 7.6596900876595075 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | 0E176276362B94279A4492511BFCBD98 |
| SHA1: | 389FE6B51F62254BB98939896B8C89EBEFFE2A02 |
| SHA-256: | 9A2C174AE45CAC057822844211156A5ED293E65C5F69E1D211A7206472C5C80C |
| SHA-512: | 8D61C9E464C8F3C77BF1729E32F92BBB1B426A19907E418862EFE117DBD1F0A26FCC3A6FE1D1B22B836853D43C964F6B6D25E414649767FBEA7FE10D2048D7A1 |
| Malicious: | false |
| Reputation: | unknown |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 402685 |
| Entropy (8bit): | 5.611514974167333 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | D952E75B9440113C469361B3BBDE72DC |
| SHA1: | 54B8FF95D654C61F866E2566C7426FEDD091A183 |
| SHA-256: | B3E34B03A6DCD9B495FFF75F5780B954174ABD5468A4A54A847BE30057D57EE2 |
| SHA-512: | 7A6E1ABD75A9B65AF5FABC7E41B01409F581BEA0958A41173933357FC562AD79DB427F03770453E8613E906B4B3B16E11FAC763B88C48149807A1F3C3AF27B4C |
| Malicious: | false |
| Reputation: | unknown |
| URL: | https://cdn.forms.office.net/forms/scripts/dists/light-response-page.chunk.lrp_ext.15c75c9.js |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 38124 |
| Entropy (8bit): | 5.310312368406633 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | F85DF0DB3B351E61F18DD9CA98A3C999 |
| SHA1: | 055AB43C220151E0C8B521A39D40DC54C50F988D |
| SHA-256: | 5BEA34A1B8999FB53F5B3B8541BE6A2C6F8C75A8932BCB7A05E3FD5B91D78608 |
| SHA-512: | 1FB8F1989F9DD1F6C0C327F5B4808465F679793697EC486A7B18F2345DCF8DECDDCCFEEC65CC586B0F51E62BDD9C2EB035CE9C6CC23165F791181F4E0EB0DF0C |
| Malicious: | false |
| Reputation: | unknown |
| URL: | https://cdn.forms.office.net/forms/scripts/dists/dll-dompurify.min.bcf1a85.js |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 530 |
| Entropy (8bit): | 4.860983185588505 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | 4D945878F36DCBBF35C41B5BB6E5513E |
| SHA1: | 786EDE7740452B1C38B1FFA47C28F4E70140EC5F |
| SHA-256: | 19DADB739E9886DBDDC79E9E916B753AC53A2C8C1A9560EF14AF28B400C234E0 |
| SHA-512: | 37E16ACE0F5DF65065C150FB05E7968A5B3AA828F66EFDEF29DD78EF4C2D4B29D0C4F81502CDA069F1EFB0B0329FA69BC309579D74A447E2B7FE9E27AC9CCD99 |
| Malicious: | false |
| Reputation: | unknown |
| URL: | https://forms.office.com/pwa/en-us/app.webmanifest |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 35807 |
| Entropy (8bit): | 7.994448207898337 |
| Encrypted: | true |
| SSDEEP: | |
| MD5: | FCF71472EFC9E614B10DFD499805F729 |
| SHA1: | CF1FA991F9F08068F8F5F4D188D741BF5C2B7722 |
| SHA-256: | 23FF9B1A108B620EB12123003F37200042B120F3A554D3772B55F6366BDD4652 |
| SHA-512: | B01F793C888C512F4BD1252EBA17A30C16BE3EC5E5A48BBBDD8F724EDCAEB2FD810439050A3097C27DAFDD1DE9235B39B7CF45D5341CC43A942F3F529891F379 |
| Malicious: | false |
| Reputation: | unknown |
| URL: | https://aadcdn.msauth.net/shared/1.0/content/js/asyncchunk/convergedlogin_pstringcustomizationhelper_ea3e62a2bdfb2b2ee8c8.js |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 28 |
| Entropy (8bit): | 4.307354922057605 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | 9F9FA94F28FE0DE82BC8FD039A7BDB24 |
| SHA1: | 6FE91F82974BD5B101782941064BCB2AFDEB17D8 |
| SHA-256: | 9A37FDC0DBA8B23EB7D3AA9473D59A45B3547CF060D68B4D52253EE0DA1AF92E |
| SHA-512: | 34946EF12CE635F3445ED7B945CF2C272EF7DD9482DA6B1A49C9D09A6C9E111B19B130A3EEBE5AC0CCD394C523B54DD7EB9BF052168979A9E37E7DB174433F64 |
| Malicious: | false |
| Reputation: | unknown |
| URL: | https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISFwlI5QkAMeIp4hIFDdFbUVISBQ1Xevf9?alt=proto |
| Preview: |
⊘No static file info
Key Decision
Richest Path
Thread / callback creation
Lower opacity -> Library Node