Edit tour
Windows
Analysis Report
CARDFACTORYAccess Program, Tuesday, October 29, 2024.eml
Overview
General Information
| Sample name: | CARDFACTORYAccess Program, Tuesday, October 29, 2024.eml |
| Analysis ID: | 1544520 |
| MD5: | d7181a0f9dc46fd04abda1ad40f56ec8 |
| SHA1: | abfbe61b41e28d4588b3307b4b1a594f29a27e2c |
| SHA256: | f86596bef7648a336af62194a9720e60acf5149915a8af54712d65da7c4b3152 |
| Infos: |  |
 | |
Detection
HTMLPhisher
| Score: | 72 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
AI detected phishing page
Yara detected HtmlPhish54
AI detected landing page (webpage, office document or email)
AI detected potential phishing Email
AI detected suspicious URL
Suspicious MSG / EML detected (based on various text indicators)
Detected hidden input values containing email addresses (often used in phishing pages)
Detected non-DNS traffic on DNS port
HTML body contains low number of good links
HTML page contains hidden javascript code
HTML page contains obfuscated script src
Queries the volume information (name, serial number etc) of a device
Sigma detected: Office Autorun Keys Modification
Stores files to the Windows start menu directory
Stores large binary data to the registry
Classification
- System is w10x64_ra
OUTLOOK.EXE (PID: 6232 cmdline: "C:\Progra m Files (x 86)\Micros oft Office \Root\Offi ce16\OUTLO OK.EXE" /e ml "C:\Use rs\user\De sktop\CARD FACTORYAcc ess Progra m, Tuesday , October 29, 2024.e ml" MD5: 91A5292942864110ED734005B7E005C0) 
ai.exe (PID: 6936 cmdline: "C:\Progra m Files (x 86)\Micros oft Office \root\vfs\ ProgramFil esCommonX6 4\Microsof t Shared\O ffice16\ai .exe" "DA4 52C15-9AA4 -4595-B00D -2FDB55D92 BF1" "54ED 896D-0900- 4799-9D4A- 72ADFC60F6 A8" "6232" "C:\Progr am Files ( x86)\Micro soft Offic e\Root\Off ice16\OUTL OOK.EXE" " WordCombin edFloatieL reOnline.o nnx" MD5: EC652BEDD90E089D9406AFED89A8A8BD) 
chrome.exe (PID: 6900 cmdline: "C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" --st art-maximi zed --sing le-argumen t https:// eu-west-1. protection .sophos.co m/?d=googl e.fr&u=aHR 0cHM6Ly93d 3cuZ29vZ2x lLmZyL3Vyb D9xPTM4cFF 2dnE2eFJ5a jdZMDB4RGp ubHg5a0lIT 1NvenVyTU9 pYUFrSW1Qd VFKbk9JV3R KanFKTGk2c 3RqdER6M3l oJnJjdD10V FBTck1PaWF Ba0ltUHVRS m5PSVd0Smp xSkxpNnN0a nRGWDA4cFF 2dnE2eFJ5a jdZMDB4RGp ubHg5a0lqd XN1Y1Qmc2E 9dCZ1cmw9Y W1wJTJGJTc 1JTczJTY1J TY0JTcyJTY 5JTY0JTY1J TJFJTYzJTZ GJTZEJTJGJ Tc3JTY5JTZ FJTZFJTY1J TcyJTczJTJ GJTJGcyUyR mFXNW5ZUzV yYjNaaGJHV nVhMjlBWTJ GeVpHWmhZM 1J2Y25rdVk yOHVkV3M9& p=m&i=NTky NmUxYTRhOT hjZDUxMDgx NWIxNTk0&t =Qk8wa0o5e TNyQTlnWGR wckJIcmdWe UUxclBHQlp wZGh0ZEEwV jlpenlQWT0 =&h=8b88c2 8b523442e5 87fad60044 dcaa9e&s=A VNPUEhUT0N FTkNSWVBUS VYchBOFqol 47RBhuJZL- B5xL-ytAmI EQQmg-Sfvk JeMh3wacrl DO6DO7l84i eZpYk7qmt- Oebhv_TAYN 6o878B50OO gdyI35nmiD uYTNH3pXIC rn_ttcsB_d ONae7A_CxE MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4) - chrome.exe (PID: 4780 cmdline:
"C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" --ty pe=utility --utility -sub-type= network.mo jom.Networ kService - -lang=en-U S --servic e-sandbox- type=none --mojo-pla tform-chan nel-handle =2180 --fi eld-trial- handle=199 2,i,951403 8010907118 811,180379 5703621005 8772,26214 4 --disabl e-features =Optimizat ionGuideMo delDownloa ding,Optim izationHin ts,Optimiz ationHints Fetching,O ptimizatio nTargetPre diction /p refetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
- cleanup
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| JoeSecurity_HtmlPhish_54 | Yara detected HtmlPhish_54 | Joe Security | ||
| JoeSecurity_HtmlPhish_54 | Yara detected HtmlPhish_54 | Joe Security | ||
| JoeSecurity_HtmlPhish_54 | Yara detected HtmlPhish_54 | Joe Security | ||
| JoeSecurity_HtmlPhish_54 | Yara detected HtmlPhish_54 | Joe Security |
| Source: | Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): | ||
⊘No Suricata rule has matched
Click to jump to signature section
Show All Signature Results
Phishing |   |
|---|
| Source: | LLM: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | OCR Text: | ||
| Source: | HTTP Parser: | ||
| Source: | HTTP Parser: | ||
| Source: | HTTP Parser: | ||
| Source: | HTTP Parser: | ||
| Source: | HTTP Parser: | ||
| Source: | HTTP Parser: | ||
| Source: | HTTP Parser: | ||
| Source: | HTTP Parser: | ||
| Source: | HTTP Parser: | ||
| Source: | HTTP Parser: | ||
| Source: | HTTP Parser: | ||
| Source: | HTTP Parser: | ||
| Source: | HTTP Parser: | ||
| Source: | HTTP Parser: | ||
| Source: | HTTP Parser: | ||
| Source: | HTTP Parser: | ||
| Source: | HTTP Parser: | ||
| Source: | HTTP Parser: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | Classification label: | ||
| Source: | File created: | ||
| Source: | File created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Section loaded: | ||
| Source: | Section loaded: | ||
| Source: | Section loaded: | ||
| Source: | Section loaded: | ||
| Source: | Section loaded: | ||
| Source: | Section loaded: | ||
| Source: | Section loaded: | ||
| Source: | Section loaded: | ||
| Source: | Section loaded: | ||
| Source: | Key value queried: | ||
| Source: | Window found: | ||
| Source: | Window detected: | ||
| Source: | Key opened: | ||
Persistence and Installation Behavior | |
|---|
| Source: | LLM: | ||
| Source: | LLM: | ||
| Source: | LLM: | ||
| Source: | JoeBoxAI: | ||
| Source: | JoeBoxAI: | ||
| Source: | JoeBoxAI: | ||
| Source: | JoeBoxAI: | ||
| Source: | JoeBoxAI: | ||
| Source: | File created: | ||
| Source: | File created: | ||
| Source: | File created: | ||
| Source: | File created: | ||
| Source: | File created: | ||
| Source: | File created: | ||
| Source: | File created: | ||
| Source: | Key value created or modified: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | File Volume queried: | ||
| Source: | Process information queried: | ||
| Source: | Queries volume information: | ||
| Source: | Key value queried: | ||
| Reconnaissance | Resource Development | Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Command and Control | Exfiltration | Impact |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Gather Victim Identity Information | Acquire Infrastructure | 1 Drive-by Compromise | Windows Management Instrumentation | 3 Browser Extensions | 1 Process Injection | 1 Masquerading | OS Credential Dumping | 1 Process Discovery | Remote Services | Data from Local System | 2 Encrypted Channel | Exfiltration Over Other Network Medium | Abuse Accessibility Features |
| Credentials | Domains | Default Accounts | Scheduled Task/Job | 1 Registry Run Keys / Startup Folder | 1 Registry Run Keys / Startup Folder | 1 Modify Registry | LSASS Memory | 13 System Information Discovery | Remote Desktop Protocol | Data from Removable Media | 3 Ingress Tool Transfer | Exfiltration Over Bluetooth | Network Denial of Service |
| Email Addresses | DNS Server | Domain Accounts | At | 1 DLL Side-Loading | 1 DLL Side-Loading | 1 Process Injection | Security Account Manager | Query Registry | SMB/Windows Admin Shares | Data from Network Shared Drive | 3 Non-Application Layer Protocol | Automated Exfiltration | Data Encrypted for Impact |
| Employee Names | Virtual Private Server | Local Accounts | Cron | Login Hook | Login Hook | 1 DLL Side-Loading | NTDS | System Network Configuration Discovery | Distributed Component Object Model | Input Capture | 4 Application Layer Protocol | Traffic Duplication | Data Destruction |
This section contains all screenshots as thumbnails, including those not shown in the slideshow.
⊘No Antivirus matches
⊘No Antivirus matches
⊘No Antivirus matches
⊘No Antivirus matches
⊘No Antivirus matches
| Name | IP | Active | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|---|---|
| bg.microsoft.map.fastly.net | 199.232.214.172 | true | false | unknown | |
| d35tlz0p71apkp.cloudfront.net | 18.173.205.68 | true | false | unknown | |
| hyperworldfr.com | 87.120.113.115 | true | false | unknown | |
| www.google.fr | 142.250.186.163 | true | false | unknown | |
| challenges.cloudflare.com | 104.18.95.41 | true | false | unknown | |
| usedride.com | 103.83.194.55 | true | true | unknown | |
| pandat.live | 87.120.113.115 | true | true | unknown | |
| sni1gl.wpc.omegacdn.net | 152.199.21.175 | true | false | unknown | |
| s-part-0017.t-0009.fb-t-msedge.net | 13.107.253.45 | true | false | unknown | |
| s-part-0017.t-0009.t-msedge.net | 13.107.246.45 | true | false | unknown | |
| www.google.com | 142.250.74.196 | true | false | unknown | |
| HHN-efz.ms-acdc.office.com | 40.99.150.34 | true | false | unknown | |
| eu-west-1.protection.sophos.com | unknown | unknown | false | unknown | |
| r4.res.office365.com | unknown | unknown | false | unknown | |
| aadcdn.msftauth.net | unknown | unknown | false | unknown | |
| outlook.office365.com | unknown | unknown | false | unknown | |
| aadcdn.msftauthimages.net | unknown | unknown | false | unknown |
| Name | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|
| false | unknown | ||
| false | unknown | ||
| true | unknown |
- No. of IPs < 25%
- 25% < No. of IPs < 50%
- 50% < No. of IPs < 75%
- 75% < No. of IPs
| IP | Domain | Country | Flag | ASN | ASN Name | Malicious |
|---|---|---|---|---|---|---|
| 13.107.246.45 | s-part-0017.t-0009.t-msedge.net | United States | 8068 | MICROSOFT-CORP-MSN-AS-BLOCKUS | false | |
| 104.18.94.41 | unknown | United States | 13335 | CLOUDFLARENETUS | false | |
| 74.125.206.84 | unknown | United States | 15169 | GOOGLEUS | false | |
| 52.109.68.129 | unknown | United States | 8075 | MICROSOFT-CORP-MSN-AS-BLOCKUS | false | |
| 20.190.160.14 | unknown | United States | 8075 | MICROSOFT-CORP-MSN-AS-BLOCKUS | false | |
| 18.173.205.68 | d35tlz0p71apkp.cloudfront.net | United States | 3 | MIT-GATEWAYSUS | false | |
| 2.19.126.160 | unknown | European Union | 16625 | AKAMAI-ASUS | false | |
| 199.232.214.172 | bg.microsoft.map.fastly.net | United States | 54113 | FASTLYUS | false | |
| 20.42.73.26 | unknown | United States | 8075 | MICROSOFT-CORP-MSN-AS-BLOCKUS | false | |
| 40.99.150.34 | HHN-efz.ms-acdc.office.com | United States | 8075 | MICROSOFT-CORP-MSN-AS-BLOCKUS | false | |
| 172.217.18.10 | unknown | United States | 15169 | GOOGLEUS | false | |
| 87.120.113.115 | hyperworldfr.com | Bulgaria | 25206 | UNACS-AS-BG8000BurgasBG | true | |
| 142.250.74.196 | www.google.com | United States | 15169 | GOOGLEUS | false | |
| 52.113.194.132 | unknown | United States | 8068 | MICROSOFT-CORP-MSN-AS-BLOCKUS | false | |
| 23.38.98.84 | unknown | United States | 16625 | AKAMAI-ASUS | false | |
| 1.1.1.1 | unknown | Australia | 13335 | CLOUDFLARENETUS | false | |
| 34.104.35.123 | unknown | United States | 15169 | GOOGLEUS | false | |
| 142.250.186.163 | www.google.fr | United States | 15169 | GOOGLEUS | false | |
| 103.83.194.55 | usedride.com | United States | 132335 | NETWORK-LEAPSWITCH-INLeapSwitchNetworksPvtLtdIN | true | |
| 142.250.185.110 | unknown | United States | 15169 | GOOGLEUS | false | |
| 104.18.95.41 | challenges.cloudflare.com | United States | 13335 | CLOUDFLARENETUS | false | |
| 239.255.255.250 | unknown | Reserved | unknown | unknown | false | |
| 142.250.185.195 | unknown | United States | 15169 | GOOGLEUS | false | |
| 152.199.21.175 | sni1gl.wpc.omegacdn.net | United States | 15133 | EDGECASTUS | false | |
| 172.217.16.195 | unknown | United States | 15169 | GOOGLEUS | false |
| IP |
|---|
| 192.168.2.16 |
| Joe Sandbox version: | 41.0.0 Charoite |
| Analysis ID: | 1544520 |
| Start date and time: | 2024-10-29 14:36:33 +01:00 |
| Joe Sandbox product: | CloudBasic |
| Overall analysis duration: | |
| Hypervisor based Inspection enabled: | false |
| Report type: | full |
| Cookbook file name: | defaultwindowsinteractivecookbook.jbs |
| Analysis system description: | Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01 |
| Number of analysed new started processes analysed: | 16 |
| Number of new started drivers analysed: | 0 |
| Number of existing processes analysed: | 0 |
| Number of existing drivers analysed: | 0 |
| Number of injected processes analysed: | 0 |
| Technologies: |
|
| Analysis Mode: | stream |
| Analysis stop reason: | Timeout |
| Sample name: | CARDFACTORYAccess Program, Tuesday, October 29, 2024.eml |
| Detection: | MAL |
| Classification: | mal72.phis.winEML@28/36@30/216 |
| Cookbook Comments: |
|
- Exclude process from analysis (whitelisted): dllhost.exe, svchost.exe
- Excluded IPs from analysis (whitelisted): 52.113.194.132, 52.109.68.129, 2.19.126.160, 2.19.126.151, 199.232.214.172, 20.190.159.4, 40.126.31.73, 20.190.159.68, 40.126.31.69, 20.190.159.75, 20.190.159.73, 40.126.31.67, 20.190.159.71
- Excluded domains from analysis (whitelisted): ecs.office.com, omex.cdn.office.net, prdv4a.aadg.msidentity.com, ctldl.windowsupdate.com.delivery.microsoft.com, www.tm.v4.a.prd.aadg.akadns.net, osiprod-frc-buff-azsc-000.francecentral.cloudapp.azure.com, ctldl.windowsupdate.com, prod.roaming1.live.com.akadns.net, s-0005-office.config.skype.com, eur.roaming1.live.com.akadns.net, login.msa.msidentity.com, ecs-office.s-0005.s-msedge.net, roaming.officeapps.live.com, s-0005.s-msedge.net, login.live.com, frc-azsc-000.roaming.officeapps.live.com, ecs.office.trafficmanager.net, omex.cdn.office.net.akamaized.net, wu-b-net.trafficmanager.net, a1864.dscd.akamai.net, www.tm.lg.prod.aadmsa.trafficmanager.net
- Not all processes where analyzed, report is missing behavior information
- Report size getting too big, too many NtQueryAttributesFile calls found.
- Report size getting too big, too many NtQueryValueKey calls found.
- VT rate limit hit for: CARDFACTORYAccess Program, Tuesday, October 29, 2024.eml
| Input | Output |
|---|---|
| URL: Model: claude-3-5-sonnet-latest | {
"explanation": [
"The sender domain 'mycarsrepair.com' is suspicious and doesn't match the claimed service (CARDFACTORY/ShareFile)",
"The URL contains multiple redirects and encoding to obscure the final destination",
"The email creates urgency about a 'completed document' while providing a suspicious external link"
],
"phishing": true,
"confidence": 9
} |
{
"date": "Tue, 29 Oct 2024 13:21:56 +0000",
"subject": "CARDFACTORY:Access Program, Tuesday, October 29, 2024",
"communications": [
"CAUTION: This email originated from outside of the organisation. If in doubt please use the report message button to Security.\n\n\nThe CARDFACTORY document has been completed.\n\n\n\nVIEW COMPLETED DOCUMENT https://eu-west-1.protection.sophos.com?d=google.fr&u=aHR0cHM6Ly93d3cuZ29vZ2xlLmZyL3VybD9xPTM4cFF2dnE2eFJ5ajdZMDB4RGpubHg5a0lIT1NvenVyTU9pYUFrSW1QdVFKbk9JV3RKanFKTGk2c3RqdER6M3loJnJjdD10VFBTck1PaWFBa0ltUHVRSm5PSVd0SmpxSkxpNnN0anRGWDA4cFF2dnE2eFJ5ajdZMDB4RGpubHg5a0lqdXN1Y1Qmc2E9dCZ1cmw9YW1wJTJGJTc1JTczJTY1JTY0JTcyJTY5JTY0JTY1JTJFJTYzJTZGJTZEJTJGJTc3JTY5JTZFJTZFJTY1JTcyJTczJTJGJTJGcyUyRmFXNW5ZUzVyYjNaaGJHVnVhMjlBWTJGeVpHWmhZM1J2Y25rdVkyOHVkV3M9&p=m&i=NTkyNmUxYTRhOThjZDUxMDgxNWIxNTk0&t=Qk8wa0o5eTNyQTlnWGRwckJIcmdWeUUxclBHQlpwZGh0ZEEwVjlpenlQWT0=&h=8b88c28b523442e587fad60044dcaa9e&s=AVNPUEhUT0NFTkNSWVBUSVYchBOFqol47RBhuJZL-B5xL-ytAmIEQQmg-SfvkJeMh3wacrlDO6DO7l84ieZpYk7qmt-Oebhv_TAYN6o878B50OOgdyI35nmiDuYTNH3pXICrn_ttcsB_dONae7A_CxE\n\n\n\n\n\nLogoa\nCONFIDENTIALITY NOTICE: The information contained in and accompanying this communication may be privileged or confidential and is intended solely for the use of the intended recipient (s). If you are not the intended recipient of this communication please delete and destroy all copies immediately.\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n----------------------------------------------------------------------------\n-- Disclaimer: The content of this e-mail is the view of the sender or stated author and does not necessarily reflect the view of Brisbane Catholic Education. The content, including attachments, is a confidential communication between the sender or stated author and the intended recipient. If you are not the intended recipient, any use, interference with, disclosure or copying of this e-mail, including attachments, is unauthorised and expressly prohibited. If you have received this e-mail in error please contact the sender immediately and delete the e-mail and any attachments from your system. Brisbane Catholic Education does not warrant or represent that this email is free from viruses, malicious software or defects .----------------------------------------------------------------------------\n"
],
"from": "ShareFile Portal <info@mycarsrepair.com>",
"to": "inga.kovalenko@cardfactory.co.uk",
"attachements": []
} | |
| URL: Email Model: claude-3-haiku-20240307 | ```json
{
"contains_trigger_text": true,
"trigger_text": "The CARDFACTORY document has been completed.",
"prominent_button_name": "VIEW COMPLETED DOCUMENT",
"text_input_field_labels": "unknown",
"pdf_icon_visible": false,
"has_visible_captcha": false,
"has_urgent_text": false,
"has_visible_qrcode": false
} |
 | |
| URL: Email Model: claude-3-haiku-20240307 | ```json
{
"brands": [
"CARDFACTORY"
]
} |
| |
| URL: Model: claude-3-5-sonnet-latest | {
"typosquatting": false,
"unusual_query_string": true,
"suspicious_tld": false,
"ip_in_url": false,
"long_subdomain": false,
"malicious_keywords": true,
"encoded_characters": true,
"redirection": false,
"contains_email_address": false,
"known_domain": false,
"brand_spoofing_attempt": false,
"third_party_hosting": true
} |
URL: URL: http://usedride.com/winners//s/aW5nYS5rb3ZhbGVua29AY2FyZGZhY3RvcnkuY28udWs= | |
| URL: https://hyperworldfr.com/?exhoyuqr=42d42470aa2a0c60e307c3c230ff507aff5e5c662e754210d7f40576d703a57dbb1ff5f84aadf18fe302166bbba2d3a81671f84339f523b320bdf9a3e35be315&email=inga.kovalenko%40cardfactory.co.uk Model: claude-3-haiku-20240307 | ```json
{
"contains_trigger_text": true,
"trigger_text": "Please stand by, while we are checking if the site connection is secure",
"prominent_button_name": "unknown",
"text_input_field_labels": "unknown",
"pdf_icon_visible": false,
"has_visible_captcha": false,
"has_urgent_text": true,
"has_visible_qrcode": false
} |
 | |
| URL: https://hyperworldfr.com/?exhoyuqr=42d42470aa2a0c60e307c3c230ff507aff5e5c662e754210d7f40576d703a57dbb1ff5f84aadf18fe302166bbba2d3a81671f84339f523b320bdf9a3e35be315&email=inga.kovalenko%40cardfactory.co.uk Model: claude-3-haiku-20240307 | ```json
{
"brands": [
"Performance & Security"
]
} |
| |
| URL: https://hyperworldfr.com/?exhoyuqr=42d42470aa2a0c60e307c3c230ff507aff5e5c662e754210d7f40576d703a57dbb1ff5f84aadf18fe302166bbba2d3a81671f84339f523b320bdf9a3e35be315&email=inga.kovalenko%40cardfactory.co.uk Model: claude-3-haiku-20240307 | ```json
{
"contains_trigger_text": true,
"trigger_text": "Please stand by, while we are checking if the site connection is secure",
"prominent_button_name": "unknown",
"text_input_field_labels": "unknown",
"pdf_icon_visible": false,
"has_visible_captcha": false,
"has_urgent_text": false,
"has_visible_qrcode": false
} |
 | |
| URL: https://hyperworldfr.com/?exhoyuqr=42d42470aa2a0c60e307c3c230ff507aff5e5c662e754210d7f40576d703a57dbb1ff5f84aadf18fe302166bbba2d3a81671f84339f523b320bdf9a3e35be315&email=inga.kovalenko%40cardfactory.co.uk Model: claude-3-haiku-20240307 | ```json
{
"brands": [
"Cloudflare"
]
} |
| |
| URL: Model: claude-3-5-sonnet-latest | {
"typosquatting": false,
"unusual_query_string": true,
"suspicious_tld": true,
"ip_in_url": false,
"long_subdomain": false,
"malicious_keywords": false,
"encoded_characters": true,
"redirection": true,
"contains_email_address": true,
"known_domain": false,
"brand_spoofing_attempt": true,
"third_party_hosting": true
} |
URL: URL: https://pandat.live/?azax4pfo2=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD1pbmdhLmtvdmFsZW5rbyU0MGNhcmRmYWN0b3J5LmNvLnVrJmNsaWVudC1yZXF1ZXN0LWlkPTMzMTUzOWE4LWU0N2ItODYzYS0zY2MzLWFkMzM0MGQ2ZTBkMyZwcm90ZWN0ZWR0b2tlbj10cnVlJmNsYWltcz0lN2IlMjJpZF90b2tlbiUyMiUzYSU3YiUyMnhtc19jYyUyMiUzYSU3YiUyMnZhbHVlcyUyMiUzYSU1YiUyMkNQMSUyMiU1ZCU3ZCU3ZCU3ZCZub25jZT02Mzg2NTgwNTg3MDA3ODUzNzguM2YwMDRkMGYtZDVmZi00NTFiLTkyNzctYjZmYzhjNGQ5MmJjJnN0YXRlPURjdE5Ec0lnRUVCaDBMTzRoSTdsWi1qQ2VCUURnMU1KRFNSTjFYaDdXWHh2OTZRUTRqeWNCZ2tqQXIwSjNnVndBUUV3T0lOQkd3YXdHVmhseDZ5c3V5YTF6SWdxZWFaQU5pOXpJamxlTV9Wdm5PNWJYMHQ3dkVvN2JxV3RVZGYtaWR1ejFYNnhRSEhQSE9uby0wOVQxLV82Qnc= | |
| URL: Model: claude-3-5-sonnet-latest | {
"typosquatting": false,
"unusual_query_string": true,
"suspicious_tld": true,
"ip_in_url": false,
"long_subdomain": false,
"malicious_keywords": false,
"encoded_characters": true,
"redirection": true,
"contains_email_address": true,
"known_domain": false,
"brand_spoofing_attempt": true,
"third_party_hosting": true
} |
URL: URL: https://pandat.live/?azax4pfo2=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD1pbmdhLmtvdmFsZW5rbyU0MGNhcmRmYWN0b3J5LmNvLnVrJmNsaWVudC1yZXF1ZXN0LWlkPTMzMTUzOWE4LWU0N2ItODYzYS0zY2MzLWFkMzM0MGQ2ZTBkMyZwcm90ZWN0ZWR0b2tlbj10cnVlJmNsYWltcz0lN2IlMjJpZF90b2tlbiUyMiUzYSU3YiUyMnhtc19jYyUyMiUzYSU3YiUyMnZhbHVlcyUyMiUzYSU1YiUyMkNQMSUyMiU1ZCU3ZCU3ZCU3ZCZub25jZT02Mzg2NTgwNTg3MDA3ODUzNzguM2YwMDRkMGYtZDVmZi00NTFiLTkyNzctYjZmYzhjNGQ5MmJjJnN0YXRlPURjdE5Ec0lnRUVCaDBMTzRoSTdsWi1qQ2VCUURnMU1KRFNSTjFYaDdXWHh2OTZRUTRqeWNCZ2tqQXIwSjNnVndBUUV3T0lOQkd3YXdHVmhseDZ5c3V5YTF6SWdxZWFaQU5pOXpJamxlTV9Wdm5PNWJYMHQ3dkVvN2JxV3RVZGYtaWR1ejFYNnhRSEhQSE9uby0wOVQxLV82Qnc=&sso_reload=true | |
| URL: https://pandat.live/?azax4pfo2=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNl Model: claude-3-haiku-20240307 | ```json
{
"contains_trigger_text": true,
"trigger_text": "Enter password",
"prominent_button_name": "Sign in",
"text_input_field_labels": [
"Password"
],
"pdf_icon_visible": false,
"has_visible_captcha": false,
"has_urgent_text": false,
"has_visible_qrcode": false
} |
 | |
| URL: https://pandat.live/?azax4pfo2=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNl Model: claude-3-haiku-20240307 | ```json
{
"contains_trigger_text": true,
"trigger_text": "Enter password",
"prominent_button_name": "Sign in",
"text_input_field_labels": [
"Password"
],
"pdf_icon_visible": false,
"has_visible_captcha": false,
"has_urgent_text": false,
"has_visible_qrcode": false
} |
 | |
| URL: https://pandat.live/?azax4pfo2=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNl Model: claude-3-haiku-20240307 | ```json
{
"contains_trigger_text": true,
"trigger_text": "Enter password",
"prominent_button_name": "Sign in",
"text_input_field_labels": [
"Password"
],
"pdf_icon_visible": false,
"has_visible_captcha": false,
"has_urgent_text": false,
"has_visible_qrcode": false
} |
 | |
| URL: https://pandat.live/?azax4pfo2=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNl Model: claude-3-haiku-20240307 | ```json
{
"brands": [
"cardfactory"
]
} |
| |
| URL: https://pandat.live/?azax4pfo2=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNl Model: claude-3-haiku-20240307 | ```json
{
"brands": [
"Cardfactory"
]
} |
| |
| URL: https://pandat.live/?azax4pfo2=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNl Model: claude-3-haiku-20240307 | ```json
{
"brands": [
"cardfactory"
]
} |
| |
| URL: https://pandat.live/?azax4pfo2=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNl Model: gpt-4o | ```json{ "legit_domain": "cardfactory.co.uk", "classification": "known", "reasons": [ "The brand 'cardfactory' is a known brand associated with greeting cards and gifts.", "The legitimate domain for Card Factory is 'cardfactory.co.uk'.", "The URL 'pandat.live' does not match the legitimate domain for Card Factory.", "The domain 'pandat.live' is unrelated to the brand 'cardfactory' and does not contain any recognizable elements of the brand name.", "The use of a generic domain extension '.live' is unusual for a known brand like Card Factory.", "Presence of a password input field on an unrelated domain raises suspicion." ], "riskscore": 9}
Google indexed: False |
URL: pandat.live
Brands: cardfactory
Input Fields: Password | |
| URL: Model: claude-3-5-sonnet-latest | {
"typosquatting": false,
"unusual_query_string": false,
"suspicious_tld": false,
"ip_in_url": false,
"long_subdomain": false,
"malicious_keywords": false,
"encoded_characters": false,
"redirection": false,
"contains_email_address": false,
"known_domain": false,
"brand_spoofing_attempt": false,
"third_party_hosting": false
} |
URL: URL: https://hyperworldfr.com |
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
Download File
| Process: | C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 338 |
| Entropy (8bit): | 3.4701888843967716 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | 4DDE8DBAC626AD7912D3857817E9E26B |
| SHA1: | 90C863D2B8B1B289A9576956BCB910A7848D7243 |
| SHA-256: | 879FC7BE862DC03D21ADD363FFF92450F8C2FFFE522C1F7137920F708DAE0D7B |
| SHA-512: | 8AA36101DB68A49019B02726F313B5D2CBA44E3EF19BE0A38EF3CB0ABE5207FA3B98C0A9CB440DE6D27FE75A908EE335677A00B62B7ED998ED90A4FCB7FE0078 |
| Malicious: | false |
| Reputation: | unknown |
| Preview: |
| Process: | C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 231348 |
| Entropy (8bit): | 4.394895570765673 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | 701A043DE436DE445BFDEF9568784BE5 |
| SHA1: | E3A8584EA7666AB51B54452AEE1DE087A28E1171 |
| SHA-256: | C811B1F1825E947BD5C65579EFCA1E6DB40A14419398FCEE13C000D93E1F7462 |
| SHA-512: | 99EE55C935E251EE9FDE51D0263D2E8EF365E69F4142F1AB43843F17E486260D1D2274E10500E50AD60237E78A333B61575D65CA2E27E8D36BDC8D3C00707B99 |
| Malicious: | false |
| Reputation: | unknown |
| Preview: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntities.bin
Download File
| Process: | C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 322260 |
| Entropy (8bit): | 4.000299760592446 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | CC90D669144261B198DEAD45AA266572 |
| SHA1: | EF164048A8BC8BD3A015CF63E78BDAC720071305 |
| SHA-256: | 89C701EEFF939A44F28921FD85365ECD87041935DCD0FE0BAF04957DA12C9899 |
| SHA-512: | 16F8A8A6DCBAEAEFB88C7CFF910BCCC71B76A723CF808B810F500E28E543112C2FAE2491D4D209569BD810490EDFF564A2B084709B02963BCAF6FDF1AEEC59AC |
| Malicious: | false |
| Reputation: | unknown |
| Preview: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntitiesUpdated.bin
Download File
| Process: | C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 10 |
| Entropy (8bit): | 2.4464393446710155 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | D67443D8B161E8B39BDC1AA3B823002F |
| SHA1: | F21EE6FE17274E2F0008B3710FC5133298DA81DD |
| SHA-256: | EF75827754B4C290025AFD25C217807B718188BBA9F750D832A84227D8EC4567 |
| SHA-512: | 0F82F7DB379DD5115876E67F2A40BB8FE2A7F303CD11A81A35BB7AD9E37ED863AD817FBCE95D512374BBBB9CF483ACC00C678FA76498FE4324C13C0DA0BB469A |
| Malicious: | false |
| Reputation: | unknown |
| Preview: |
| Process: | C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 4616 |
| Entropy (8bit): | 0.13760166725504608 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | 09B9E7EABE178AFF34D19C956D6C52F0 |
| SHA1: | D3DEA12D33502D0946038314B11EE1265507C775 |
| SHA-256: | DBE1F7E46983083F33375BF170866846CED29E57B106F6D3A441C377CD223500 |
| SHA-512: | 8815BE91BF825983DE9503C8086E3E032AAB13F854407E01DA107951561557235BA23D35A3C4E0F4E1152F3333DE74DA2813A79891DC4AF581E29CCD7F42A598 |
| Malicious: | false |
| Reputation: | unknown |
| Preview: |
| Process: | C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 30 |
| Entropy (8bit): | 1.2389205950315936 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | 5BA67B3F1D65A335DD9F04C950553FEC |
| SHA1: | 4C69130711BE6D5A5FC634A4D96107FF532E2AD9 |
| SHA-256: | 35CF13F30C8D732F5F98BD79902EE3A28BFA013EC658BC11EB2158A458017DE5 |
| SHA-512: | C5218A25B5A47F861C995E02D5CB62B818A8A9214D2F3270526893C09E1B48D2064ADD5A1537DD7432DF572B69AC0F4088E3B6A2A463619A9BDEEB204972BDB4 |
| Malicious: | false |
| Reputation: | unknown |
| Preview: |
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk
Download File
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 2673 |
| Entropy (8bit): | 3.987859272110716 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | F69B2A41B81D32E69960DA7DF6B594AA |
| SHA1: | EA44AA59536B2B65D77C04A1AFF85FD80A8FF688 |
| SHA-256: | 7885F05DF9481D0B780BA639112E9F22E32C682EF6AB63437E83627882E254AA |
| SHA-512: | 4ADA63AB5FDC4ACA13308C3169C78C6C78BF4BDC0E07988D6F49474FCDA07E0FE32E85A8E50D4BADBE53612449B45DC4AF59AA120E77C03E46DE6ED20FB6A68D |
| Malicious: | false |
| Reputation: | unknown |
| Preview: |
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Download File
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 2675 |
| Entropy (8bit): | 4.002479263226723 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | 45A76D985224FCF9FC2E9FD1993BE1BF |
| SHA1: | 2DB5D8AC9A49230FA929F84C9FBA109D738C78D1 |
| SHA-256: | DB37704095FDEAAF2357890047D3A77202520D2938D49E5374E7972E5D7E3EC5 |
| SHA-512: | 85CD40E038C5EC737C545FF17FB09AE891CDF8953C8C7ED445AAF7924E07EA26D838B5E81A803FEA3A045315F67B588F67056D83DA73EB3FE011775E8CC4BF07 |
| Malicious: | false |
| Reputation: | unknown |
| Preview: |
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Download File
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 2689 |
| Entropy (8bit): | 4.01082002980115 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | 435FDEB6911E10D0021DEA05DC72BDB2 |
| SHA1: | 5CA0B8A63D39A2EB55A7C371EFE042FE7D636609 |
| SHA-256: | 193C16711367D1670A40BEA3405BE24566DD7FBAD7B8667D87623BF4DB265851 |
| SHA-512: | F3D6BA3245231DA70DDD70F74E9DEBB30635CEC6A560258EB26BFD96E2956F4D1E044F15D0FDD863B97F970957A142DB7B3DDAFF72DA71A19BDB6C46FB455675 |
| Malicious: | false |
| Reputation: | unknown |
| Preview: |
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Download File
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 2677 |
| Entropy (8bit): | 4.000850242469945 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | ACDC3A543DA2E2C86A9E0CA481C50990 |
| SHA1: | 5E2771E5B716ED7A356EDFD65506218A8DB87184 |
| SHA-256: | 3A5D8EC2C23F78345D59308C6E7570AD35E8C02E451B31CCC2C29C1A751DA83C |
| SHA-512: | A5D7656FDD9D9817004F44D3F94608512B11F7B42FD211A4D82A598D7802068D1D9FB982B856BF9847292520ACC64A28517202AB71F0E324336BDE11B5A13FFD |
| Malicious: | false |
| Reputation: | unknown |
| Preview: |
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Download File
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 2677 |
| Entropy (8bit): | 3.988220784425954 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | 7DC9AFB6ECD11C338D6E2108FE75FE56 |
| SHA1: | CC6537E0EBF867EAA730B7E5D868332DAF8844D6 |
| SHA-256: | 9FF9503BF0D3435C22C43EBE3909FD2B86F00931FB0B0253538D80A545F37158 |
| SHA-512: | F26CFB9CD744EB786956BAC2F1B0B0ACE903770CA8C7D0AF08D99A2C8F1C87B7932557EE813E26CAC5C791C3373106845FD9D1030AF6244AA8F95ED1861F1C2E |
| Malicious: | false |
| Reputation: | unknown |
| Preview: |
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Download File
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 2679 |
| Entropy (8bit): | 3.9990656647601597 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | 7E01C883545130292DC52DE030176702 |
| SHA1: | 3A0B127F3FCB250490B5D09DB2E8E0CF2B9DF81B |
| SHA-256: | 1BACDBB1F7B1E8B29A6DC39E81FD89A9265CE12F4668C6105DC292596C82C947 |
| SHA-512: | D1814962419CDC393D5AB609AD10AC84D54900D8E23CE259F87C16385DCFC3C1B4B2A8DA9D4D21E1717A2995F7766F65C54A0052465473E9393E121EEADA96E5 |
| Malicious: | false |
| Reputation: | unknown |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 8683 |
| Entropy (8bit): | 7.96994309950595 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | 6D9E55C9D67DBC47494E021ED41B1F52 |
| SHA1: | 28D47D348610D5B18D5876DF6CEA3482F793724C |
| SHA-256: | 8E64B0A4243BC298FEEA1BC3C8E68A710BBA74823CC3BCA083B14AA8F16D7428 |
| SHA-512: | FF9DB8DB6E6AE5C70A702B6152803C3BE9B358492B0E2C811D41B7A954EBA4275EA0420DCC6D56D2ABB47AFC933E155B74CC39D82959B87E57A58EE9BC255CD3 |
| Malicious: | false |
| Reputation: | unknown |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 24207 |
| Entropy (8bit): | 5.2347649587378795 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | 6026206DA394ABD5252E0A5C87DD3B00 |
| SHA1: | 3F542F42FD19862662C56CB29EB4BDD68A0622D9 |
| SHA-256: | 08D2BCF4ED2AE7BC7C9A84831B73FB511B904A3232A5C9C9E1915AF000583A81 |
| SHA-512: | 38A363B5FA541C9796604CD05201486BFAE63CD6461EF8B7AF5CAAD13556441D67CC39156842296070C014B30E4343A767B5B73C8DD4EC81511F8D0C5FEAA2C0 |
| Malicious: | false |
| Reputation: | unknown |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 109863 |
| Entropy (8bit): | 5.310477442235456 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | 46C21D0ACECBD2212374B27C7D1B078A |
| SHA1: | 5861965E506ACAAA7D10E5B9C31E99D254B85560 |
| SHA-256: | 5F5FBEE72883732799D75F6C08679ED8A6E769AE4F3AFDCD3721103A481AFA80 |
| SHA-512: | B7E4980A66F15A8B918C2325CDC5FC41BADD0DEF7A43B2A2A93C593D05FC2ED4793448115DCC28B551F73623D876DB2B4672D64C3EE064369181FB74919FFC51 |
| Malicious: | false |
| Reputation: | unknown |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 994 |
| Entropy (8bit): | 4.934955158256183 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | E2110B813F02736A4726197271108119 |
| SHA1: | D7AC10CC425A7B67BF16DDA0AAEF1FEB00A79857 |
| SHA-256: | 6D1BE7ED96DD494447F348986317FAF64728CCF788BE551F2A621B31DDC929AC |
| SHA-512: | E79CF6DB777D62690DB9C975B5494085C82E771936DB614AF9C75DB7CE4B6CA0A224B7DFB858437EF1E33C6026D772BE9DBBB064828DB382A4703CB34ECEF1CF |
| Malicious: | false |
| Reputation: | unknown |
| URL: | https://r4.res.office365.com/owa/prem/15.20.8114.20/resources/images/0/sprite1.mouse.css |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 232394 |
| Entropy (8bit): | 5.54543362321178 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | AF8D946B64D139A380CF3A1C27BDBEB0 |
| SHA1: | C76845B6FFEAF14450795C550260EB618ABD60AB |
| SHA-256: | 37619B16288166CC76403F0B7DF6586349B2D5628DE00D5850C815D019B17904 |
| SHA-512: | C5CFB514F993310676E834C8A5477576BD57C82A8665387F9909BA0D4C3C2DE693E738ACAA74E7B4CA20894EA2FEEA5CF9A2428767D03FE1DE9C84538FDC3EE9 |
| Malicious: | false |
| Reputation: | unknown |
| URL: | https://r4.res.office365.com/owa/prem/15.20.8114.20/resources/styles/0/boot.worldwide.mouse.css |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 663451 |
| Entropy (8bit): | 5.3635307555313165 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | 761CE9E68C8D14F49B8BF1A0257B69D6 |
| SHA1: | 8CF5D714D35EFFA54F3686065CB62CCE028E2C77 |
| SHA-256: | BEAA65AD34340E61E9E701458E2CCFF8F9073FDEBBC3593A2C7EC8AFEACB69C1 |
| SHA-512: | CEC948666FBA0F56D3DA27A931033C3A581C9C00FEC4D3DDCF41324525B5B5321AE3AB89581ECC7F497DE85EF684AB277C8A2DB393D526416CEB76C91A1B9263 |
| Malicious: | false |
| Reputation: | unknown |
| URL: | https://r4.res.office365.com/owa/prem/15.20.8114.20/scripts/boot.worldwide.0.mouse.js |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 28 |
| Entropy (8bit): | 4.164497779200461 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | 17C4BD96DCB397D1D62D24921BC4FEBA |
| SHA1: | 2C0F2AFF858069D582A97867B183EBD5DC8A9FCB |
| SHA-256: | 3549DBC06BDD994A38C9A29AECD7E8F9577E2150D15F8D6B0533B4D250666514 |
| SHA-512: | 9659C4D5B7EF0C852428D3AE8A8EE816438E268E4537FFA70823C9CB2C240252E6D9E863B2AE95F39397172EEFAAA73541123DC9255C9B37FC9437C655F55A78 |
| Malicious: | false |
| Reputation: | unknown |
| URL: | https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISFwltQFtUwG9JZRIFDU9-u70SBQ1Xevf9?alt=proto |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 142367 |
| Entropy (8bit): | 5.430503459492507 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | 630494AE1E47076305B742370B01FCD3 |
| SHA1: | 776222EE24C51B0E0576C12BEB236B16F320C145 |
| SHA-256: | 410E629B005385784F6F184E69A26FF7702BA63F46686DF9D46C44D7C4A55A67 |
| SHA-512: | 8089A26C5969F3D903D196AEB34986514890B13A11AC85DBB17DCC83F4FCF24D35F129DE9E3BF07D1F795D33E56B8FF530D8C8136C564F165B66FF9006024820 |
| Malicious: | false |
| Reputation: | unknown |
| URL: | https://pandat.live/aadcdn.msftauth.net/~/shared/1.0/content/js/BssoInterrupt_Core_zKox_QMcTIVut7mG_Z9Eew2.js |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 2672 |
| Entropy (8bit): | 6.640973516071413 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | 166DE53471265253AB3A456DEFE6DA23 |
| SHA1: | 17C6DF4D7CCF1FA2C9EFD716FBAE0FC2C71C8D6D |
| SHA-256: | A46201581A7C7C667FD42787CD1E9ADF2F6BF809EFB7596E61A03E8DBA9ADA13 |
| SHA-512: | 80978C1D262BC225A8BA1758DF546E27B5BE8D84CBCF7E6044910E5E05E04AFFEFEC3C0DA0818145EB8A917E1A8D90F4BAC833B64A1F6DE97AD3D5FC80A02308 |
| Malicious: | false |
| Reputation: | unknown |
| URL: | https://pandat.live/aadcdn.msftauth.net/~/shared/1.0/content/images/marching_ants_white_166de53471265253ab3a456defe6da23.gif |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 3452 |
| Entropy (8bit): | 5.117912766689607 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | CB06E9A552B197D5C0EA600B431A3407 |
| SHA1: | 04E167433F2F1038C78F387F8A166BB6542C2008 |
| SHA-256: | 1F4EDBD2416E15BD82E61BA1A8E5558D44C4E914536B1B07712181BF57934021 |
| SHA-512: | 1B4A3919E442EE4D2F30AE29B1C70DF7274E5428BCB6B3EDD84DCB92D60A0D6BDD9FA6D9DDE8EAB341FF4C12DE00A50858BF1FC5B6135B71E9E177F5A9ED34B9 |
| Malicious: | false |
| Reputation: | unknown |
| URL: | https://login.live.com/Me.htm?v=3 |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 22 |
| Entropy (8bit): | 3.6978458230844122 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | 6AAB5444A217195068E4B25509BC0C50 |
| SHA1: | 7B22EAF7EAA9B7E1F664A0632D3894D406FE7933 |
| SHA-256: | FC5525D427BFA27792D3A87411BE241C047D07F07C18E2FC36BF00B1C2E33D07 |
| SHA-512: | AA5F66638B142B5E6D1D008F2934530C7AAD2F7F19128CA24609825D0DACFFD25A77591BFD7FB1D225BE2FA77CABCE837E0741326C1AC622C244D51E6FAFB303 |
| Malicious: | false |
| Reputation: | unknown |
| URL: | https://hyperworldfr.com/favicon.ico |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 132 |
| Entropy (8bit): | 4.945787382366693 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | 3EDA15637AFEAC6078F56C9DCC9BBDB8 |
| SHA1: | 97B900884183CB8CF99BA069EEDC280C599C1B74 |
| SHA-256: | 68C66D144855BA2BC8B8BEE88BB266047367708C1E281A21B9D729B1FBD23429 |
| SHA-512: | 06B21827589FCAF63B085DB2D662737B24A39A697FF9138BDF188408647C3E90784B355F2B8390160CA487992C033CE735599271EE35873E1941812AB6C34B52 |
| Malicious: | false |
| Reputation: | unknown |
| URL: | https://r4.res.office365.com/owa/prem/15.20.8114.20/resources/images/0/sprite1.mouse.png |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 660449 |
| Entropy (8bit): | 5.4121922690110535 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | D9E3D2CE0228D2A5079478AAE5759698 |
| SHA1: | 412F45951C6AEDA5F3DF2C52533171FC7BDD5961 |
| SHA-256: | 7041D585609800051E4F451792AEC2B8BD06A4F2D29ED6F5AD8841AAE5107502 |
| SHA-512: | 06700C65BEF4002EBFBFF9D856C12E8D71F408BACA2D2103DDE1C28319B6BD3859FA9D289D8AEB6DD484E802040F6EE537F31F97B4B60A6B120A6882C992207A |
| Malicious: | false |
| Reputation: | unknown |
| URL: | https://r4.res.office365.com/owa/prem/15.20.8114.20/scripts/boot.worldwide.3.mouse.js |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 3620 |
| Entropy (8bit): | 6.867828878374734 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | B540A8E518037192E32C4FE58BF2DBAB |
| SHA1: | 3047C1DB97B86F6981E0AD2F96AF40CDF43511AF |
| SHA-256: | 8737D721808655F37B333F08A90185699E7E8B9BDAAA15CDB63C8448B426F95D |
| SHA-512: | E3612D9E6809EC192F6E2D035290B730871C269A267115E4A5515CADB7E6E14E3DD4290A35ABAA8D14CF1FA3924DC76E11926AC341E0F6F372E9FC5434B546E5 |
| Malicious: | false |
| Reputation: | unknown |
| URL: | https://pandat.live/aadcdn.msftauth.net/~/shared/1.0/content/images/marching_ants_b540a8e518037192e32c4fe58bf2dbab.gif |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 61 |
| Entropy (8bit): | 4.035372245524404 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | 992F9850603D1F9EB470320B9EB0B174 |
| SHA1: | 1B42373E6B0AEDBA515031D255AB74AE917D0051 |
| SHA-256: | 0455AD3FBBC240087EC77C1A2B42931B4EEC4F5448ECE5585C5B1352337FE9B2 |
| SHA-512: | 4C5E061CF93818F6F0EB8EDDC1D141CA14ABDBFECE126330566473DCBCCDA61447FE37E3B23FC5EA4C3D04EEEDA600D9A5E83B01E7E67A3116D7913F9E299C3E |
| Malicious: | false |
| Reputation: | unknown |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 689017 |
| Entropy (8bit): | 4.210697599646938 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | 3E89AE909C6A8D8C56396830471F3373 |
| SHA1: | 2632F95A5BE7E4C589402BF76E800A8151CD036B |
| SHA-256: | 6665CA6A09F770C6679556EB86CF4234C8BDB0271049620E03199B34B4A16099 |
| SHA-512: | E7DBE4E95D58F48A0C8E3ED1F489DCF8FBF39C3DB27889813B43EE95454DECA2816AC1E195E61A844CC9351E04F97AFA271B37CAB3FC522809CE2BE85CC1B8F0 |
| Malicious: | false |
| Reputation: | unknown |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 662286 |
| Entropy (8bit): | 5.315860951951661 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | 12204899D75FC019689A92ED57559B94 |
| SHA1: | CCF6271C6565495B18C1CED2F7273D5875DBFB1F |
| SHA-256: | 39DAFD5ACA286717D9515F24CF9BE0C594DFD1DDF746E6973B1CE5DE8B2DD21B |
| SHA-512: | AA397E6ABD4C54538E42CCEDA8E3AA64ACE76E50B231499C20E88CF09270AECD704565BC9BD3B27D90429965A0233F99F27697F66829734FF02511BD096CF030 |
| Malicious: | false |
| Reputation: | unknown |
| URL: | https://r4.res.office365.com/owa/prem/15.20.8114.20/scripts/boot.worldwide.2.mouse.js |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 659798 |
| Entropy (8bit): | 5.352921769071548 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | 9786D38346567E5E93C7D03B06E3EA2D |
| SHA1: | 23EF8C59C5C9AA5290865933B29C9C56AB62E3B0 |
| SHA-256: | 263307E3FE285C85CB77CF5BA69092531CE07B7641BF316EF496DCB5733AF76C |
| SHA-512: | 4962CDF483281AB39D339A7DA105A88ADDB9C210C9E36EA5E36611D7135D19FEC8B3C9DBA3E97ABB36D580F194F1860813071FD6CBEDE85D3E88952D099D6805 |
| Malicious: | false |
| Reputation: | unknown |
| URL: | https://r4.res.office365.com/owa/prem/15.20.8114.20/scripts/boot.worldwide.1.mouse.js |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 47532 |
| Entropy (8bit): | 5.399631966931825 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | 808A57CAE0B6FEE71F46EFDDED44B348 |
| SHA1: | DD570A24C8BDA1B391AA1DDEA6004125818E579A |
| SHA-256: | 5B75AC6F98994352699841DFFA6E562725EBBD0005C539946AD3625EC550EB0F |
| SHA-512: | 3F06DFBFDEDE9BB4270EB1BBBE29FFBDB6E19DC0AA8234E1A2B92D84F0737555031231965151EFC386510193343985BCEC63062484BBD8EC0540A94A0109B765 |
| Malicious: | false |
| Reputation: | unknown |
| URL: | https://challenges.cloudflare.com/turnstile/v0/g/f2bbd6738e15/api.js |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 612 |
| Entropy (8bit): | 7.428596420812553 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | 1EA9E193A701BFF80DA3746A4F16662A |
| SHA1: | F8ED447D6A84D66C2DA4A5E3EEE6BFB726863C5B |
| SHA-256: | 55CBAAAA9B09FFAB5CC72B279476FF91637DAB69F5105DAF3405C662526D5EC0 |
| SHA-512: | 3862EF6F9C0C53E9D726E873B274B0B6A50595902CFC791BF1F730909594FD8570584ED3CB9741DEEDC29F7C3497119FBD0646F65AD948AF0F7A7AC5F082FC33 |
| Malicious: | false |
| Reputation: | unknown |
| URL: | https://aadcdn.msftauthimages.net/c1c6b6c8-4efq5pwmtp9yu-t0ajds-1-ocvmulwdrjbskyohxvu/logintenantbranding/0/favicon?ts=638464536409307562 |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 57443 |
| Entropy (8bit): | 5.372940573746363 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | D580777BB3A28B94F6F1D18EE17AEDA3 |
| SHA1: | E78833A2DB1AA97DA3F4A1994E6AF1F0D74D7CC7 |
| SHA-256: | 81188E8A76162C79DB4A5C10AC933C9E874C5B9EAE10E47956AD9DF704E01B28 |
| SHA-512: | E3F5FFE3E7E54A7D640DF3BC06D336C9F936635D2594159B3EA5EDAEFBA6D6774060A532E0CBE0664FDC65806BD53E9BFC19C11F7946A5E157A9EC935C564378 |
| Malicious: | false |
| Reputation: | unknown |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 315 |
| Entropy (8bit): | 5.0572271090563765 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | A34AC19F4AFAE63ADC5D2F7BC970C07F |
| SHA1: | A82190FC530C265AA40A045C21770D967F4767B8 |
| SHA-256: | D5A89E26BEAE0BC03AD18A0B0D1D3D75F87C32047879D25DA11970CB5C4662A3 |
| SHA-512: | 42E53D96E5961E95B7A984D9C9778A1D3BD8EE0C87B8B3B515FA31F67C2D073C8565AFC2F4B962C43668C4EFA1E478DA9BB0ECFFA79479C7E880731BC4C55765 |
| Malicious: | false |
| Reputation: | unknown |
| URL: | http://usedride.com/favicon.ico |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 113378 |
| Entropy (8bit): | 5.285066693137765 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | 9C837C2B6C9C441656C3C64BE6FC6401 |
| SHA1: | D44AA83093C4109DDD8FFAEA60755F05D1BFE7D3 |
| SHA-256: | 68C2994E21A564345EB3B4091DD2334C9CBDDB0AECDA45EE963C6DE2E1629B93 |
| SHA-512: | AF04835BCC621FE1793C4661FDB03EDEA16219BAA77F1198AA419F771B6B3DCDAC3DA92676568C207022251483AB79C75AB6DF2CE94924748FF9CEBF64AFF5A2 |
| Malicious: | false |
| Reputation: | unknown |
| URL: | https://pandat.live/aadcdn.msftauth.net/~/ests/2.1/content/cdnbundles/converged.v2.login.min_nin8k2ycrbzww8zl5vxkaq2.css |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 61 |
| Entropy (8bit): | 3.990210155325004 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | 9246CCA8FC3C00F50035F28E9F6B7F7D |
| SHA1: | 3AA538440F70873B574F40CD793060F53EC17A5D |
| SHA-256: | C07D7D29E3C20FA6CA4C5D20663688D52BAD13E129AD82CE06B80EB187D9DC84 |
| SHA-512: | A2098304D541DF4C71CDE98E4C4A8FB1746D7EB9677CEBA4B19FF522EFDD981E484224479FD882809196B854DBC5B129962DBA76198D34AAECF7318BD3736C6B |
| Malicious: | false |
| Reputation: | unknown |
| Preview: |
| File type: | |
| Entropy (8bit): | 6.006544988692188 |
| TrID: |
|
| File name: | CARDFACTORYAccess Program, Tuesday, October 29, 2024.eml |
| File size: | 28'549 bytes |
| MD5: | d7181a0f9dc46fd04abda1ad40f56ec8 |
| SHA1: | abfbe61b41e28d4588b3307b4b1a594f29a27e2c |
| SHA256: | f86596bef7648a336af62194a9720e60acf5149915a8af54712d65da7c4b3152 |
| SHA512: | 51a4c237ca2ce521f906e02ae6a7d179958a8a8f798a34f45c05a2989849317d266d7369f2296fd5e8bfa83c88328038cc8e23c6c001a511b7e6044cb0025f93 |
| SSDEEP: | 768:AO/2YR6eB8QkakvJCCCmU81tOaicxa758V:AO+IPeVvshmUCtRicxk8V |
| TLSH: | 9DD2F791CFA91021F566D5E81F007D0EE6503A6FABFBDED035E950664F9B0A28B1F309 |
| File Content Preview: | Received: from GV2PR03MB8680.eurprd03.prod.outlook.com (2603:10a6:150:78::6).. by DBBPR03MB6921.eurprd03.prod.outlook.com with HTTPS; Tue, 29 Oct 2024.. 13:22:10 +0000..Received: from AS9PR01CA0048.eurprd01.prod.exchangelabs.com.. (2603:10a6:20b:542::22) |
| Subject: | CARDFACTORY:Access Program, Tuesday, October 29, 2024 |
| From: | ShareFile Portal <info@mycarsrepair.com> |
| To: | inga.kovalenko@cardfactory.co.uk |
| Cc: | |
| BCC: | |
| Date: | Tue, 29 Oct 2024 13:21:56 +0000 |
| Communications: |
|
| Attachments: |
| Key | Value |
|---|---|
| Received | from d218-52.smtp-out.eu-west-2.amazonses.com (23.249.218.52) by DB1PEPF00039232.mail.protection.outlook.com (10.167.8.105) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.20.8093.14 via Frontend Transport; Tue, 29 Oct 2024 13:21:56 +0000 |
| Authentication-Results | spf=fail (sender IP is 198.154.180.197) smtp.mailfrom=eu-west-2.amazonses.com; dkim=fail (body hash did not verify) header.d=mycarsrepair.com;dkim=fail (body hash did not verify) header.d=amazonses.com;dmarc=none action=none header.from=mycarsrepair.com;compauth=fail reason=001 |
| Received-SPF | Pass (protection.outlook.com: domain of eu-west-2.amazonses.com designates 23.249.218.52 as permitted sender) receiver=protection.outlook.com; client-ip=23.249.218.52; helo=d218-52.smtp-out.eu-west-2.amazonses.com; pr=C |
| X-Sophos-Product-Type | Mailflow |
| X-Sophos-Email-ID | 8b88c28b523442e587fad60044dcaa9e |
| Authentication-Results-Original | spf=pass (sender IP is 23.249.218.52) smtp.mailfrom=eu-west-2.amazonses.com; dkim=pass (signature was verified) header.d=mycarsrepair.com;dkim=pass (signature was verified) header.d=amazonses.com;dmarc=none action=none header.from=mycarsrepair.com;compauth=pass reason=101 |
| DKIM-Signature | v=1; a=rsa-sha256; q=dns/txt; c=relaxed/simple; s=pgxy5mtxzx6eoyytua4nvvg26jbuf6lj; d=amazonses.com; t=1730208116; h=From:Subject:To:Content-Type:MIME-Version:Date:Message-Id:Feedback-ID; bh=h6hEJnIiWFhTGVkHn4c2W8Jjazoysp/2DHgz/GQuUj4=; b=KN189szkNwQYTF0H0eZYjueC7lAfCl79kKKb0NkEwsexXB4fIvuVESCMmjl2SLNj srNlxg2r3rrVd4vuBxVcCXJkaxdLSr4h2ACBHAamzgmsRRyU/qBiSLSs7fajSOgdG39 Mjtheo8eR5rT3s0+TBPNgkJZc0uXWu5LUAUvZzr4= |
| From | ShareFile Portal <info@mycarsrepair.com> |
| Subject | CARDFACTORY:Access Program, Tuesday, October 29, 2024 |
| To | inga.kovalenko@cardfactory.co.uk |
| Content-Type | multipart/alternative; boundary="SYXho6Lx8382Xy2M9uKCBwpbpLJL2LK3=_" |
| Date | Tue, 29 Oct 2024 13:21:56 +0000 |
| Message-ID | <010b0192d870ad42-3a1e441c-2ff9-4b23-ba94-305cdcf8f399-000000@eu-west-2.amazonses.com> |
| Feedback-ID | ::1.eu-west-2.wtypgKaK5ZHQXRPQhJwoiTQytsjORP2EcwrgwrlOJs8=:AmazonSES |
| X-SES-Outgoing | 2024.10.29-23.249.218.52 |
| X-EOPAttributedMessage | 1 |
| X-EOPTenantAttributedMessage | 7956b84e-0c99-46b5-81c6-28689cfa7221:1 |
| X-MS-TrafficTypeDiagnostic | DB1PEPF00039232:EE_|VI2PR03MB10934:EE_|AM4PEPF00027A65:EE_|GV2PR03MB8680:EE_|DBBPR03MB6921:EE_ |
| X-MS-Office365-Filtering-Correlation-Id | 9f77b5c7-39f8-4b0d-f0b9-08dcf81caeb3 |
| X-Forefront-Antispam-Report-Untrusted | CIP:23.249.218.52; CTRY:US; LANG:en; SCL:5; SRV:; IPV:NLI; SFV:SPM; H:d218-52.smtp-out.eu-west-2.amazonses.com; PTR:d218-52.smtp-out.eu-west-2.amazonses.com; CAT:PHISH; SFS:(13230040)(5073199012)(32142699015)(35012699015)(4076899003)(8096899003); DIR:INB; |
| X-Microsoft-Antispam-Untrusted | BCL:0; ARA:13230040|5073199012|32142699015|35012699015|4076899003|8096899003; |
| X-Microsoft-Antispam-Message-Info-Original | +/s8nflfwlff0RVuRmOIJZMK7Urga0ecXm2wFSVjF66jGBCrEl0OxHe7FYaeVe4P7+8f3glGEL1Jsryogr2ekAC9n0ByXueScLxYP49sqAxIooB4IW3CqTaEcFr9Xwkxa8QgdRVILC/15fGlyt6hSkxtkl8MsfxEnxl9XQhhY5n0VRknHMp82lumwL0Ewy3QZHxdFD45qBqeWIKrb7zkiVHem0rQYKZQ3j2pZa8ah/lYpP9bx8Dh58PX65lqvl21NqL4sc1vRW+aUEkr7VufDmkC0VsrDa3tx6WrISOLkfZW/g6Do4dybaAOPHvST0dm4WSv9CFujN0rjuEMWxQCPJmjRsn8EI+ldRZRKudIMXsEZjtQAVrOxMnLqCGSq/X0AcOz7JV4m8OY+XEqxK+gY38DLFA5dtRFRmeImeUVW1xG/UpNgPT48ueXcVf0OlEwRrAblpFDh8nF3ej+KZCL+7LrtRL7/ooyOfqM4hd+YjuDJsvbueuzHPe/lTDcPtxJZM2YJo9gSqpO/tTx7wEeshUI5X5n8qpYD89nURaAN/105kgiSVG/x9L3lp7QsIgXRb+RrXgPq2/0aSKcn4U4H0vSHDafY+a4KwRT4NbAZAOqnwFaqzyuRmz/bO955fDE+aPPnpeFQvYjZ4+1GZNCFe4pBr1Wk+UM6A0mTzcMABpVwFmRrNjYpdgSgFblxnWevv2ytNYFb+1Ym7mTugKkosCC677z+5IW3oAYekEL4dHSrG5j1PcOQ4ej9dylDC6qfy8CkWopDFdS3c886/ozbyOjKexxPm17o6JD9VgKwtxiLoc5zSQc/YWI4HSuxu7ZOVq27gDdsxCQyf8KfxqRWl5v3WiMtAWnhIOFJtZGI0DKnIgD52eEDl5YkXNwet/VaOWnk+WKAgmkgtZ99xDAf6P45PF73sXACCqOCIs+3nr+wKJyxbb6swAOKcJdxobtM5bArxT5Ln/7wpJW5iQbVOaW8WGXdtdNkG53yDlLZwh/l7t5TKDjIwCdOv0uurVNqGryvLlBPt5mvAi/a/RFJzQRAIehOfNKvn5IxvmGD+UIpWUe+t/8JWGu59qb/moboB7/9eFAkE+M4JvCeABtEhx1ukpkZgNDzh8qYEXGU3fU0wCrB4nn/gm6HgNAUk90Fw2jBSKqb1T+zAvmrHypmsA/kAXmsoK5aJ7zGlNEhx+1mIvD2n0M5XLnoe0qZdlkwMvGzE05dkofjkFT31hUDcMHcQVeW5U1hEfgLMm2PPGm6oOv/WjhYmBlQ6Rg3/OBjkxli7msnZq1WQ0hlYVYDOr0/2j3zbSdk9SW2CY2fWcG68aGx22n28yE6/NVblz+NL2XqrIsiB5RMEQHOP+RpJyqfzMbvXjkj4pnV7sR3B/dI6x7VDiTUFlWCQP7EFCHBroDAIFouX9zmSaEm3Mz95ErYhTkoefO85rO7MoqBLYrM0Dd7vLXLS1s/63HDPV6UopII9xlmI4rXxj3p8eyyNXwEqRL0x/HFgNcHjwTHNXI0rOV3jMbfTr/GASV/MlCoXnUiNNvOaI6VKdJ1jfIdAr7Ted18yJJxpdOWpoyN4KR01e5OTEVuNEkDTEL6Q+TYGAic5WfpDkjtgkJ4ym4HNHLwKArTgeSYLBw7dEKXzi7V4FMXEfMNEwlt8NvWGstbUJLSRu6uus5UnXLp6sj5T8Qb1KyXU9h8zJe9gzL+D5aKUCKn6lmF2lsJAdDxmu5ww8rmnFXvVFxumwY2+/0lm7ztlPl2v1YdZF9pA3y3s7VlE3Vivcqdzc4QT1tSMsXVWd46woWy+LuXcsrUK5/ut0WMHte4BJVCf2k+iUdtbz0V2h1vq6qqBgign0LB2bYMDjj8WKB9RIUsl3iuCFh+M/R4WkRYetq4w9yZLNmekIc7J4itcV0qWyijHak+aEQEYI/JLTN+wAq4zc7lnSs0GN9mqMnFeSJPuYr/nPXAr4J2Xpt1B17jhmlhQ2zy5O9sto0/SgLv2OsvoVwYyyD0fezIt//5/P+fZfG4e0Nyqm0FmGq4PKftyqXX9+9TwCuo/T9kYavaO98QWBkmD04/rZNIyLRyg2Ovk0W5V5YzRdZfCBONAZ3sfsVmrCjzRl5Rfeal7A6zENnIvaDTqshAPHjV99+LeIY5PHD6vacNWMafE/Fx/D8MtPySWJmJsIHlesjNTVHPy4iGkpcdDSSOdyli1ygiL0MLB+4I9qgxBfphrOAzAQyuiu7JsM5t5HR4KKdbQiqd7viztUmkiQmF/l4+hzrJE5dx20B23fcou9whRv1lau4CHWJZ/A/Ly9isLJIBdONPTSg8kNApfI0yfFm9uyZXZ65EaPkKo+Mv/VHD1A+4ICMyqgMm5CpZfRC9+NOt8xOkWIh8kWZtbMC9KVQrfgAs6Y59oFratvEG3cZoXTRgOlB1IghOfk6iPAjG+YlLzC1s/IQ68Dz7bu+LCbrG4mEmWRbBF6Q3yiaVUhN3ZLyZD3sYV9Z56vm5kzLM+tWLljKeSQNsFpPcQCZgEoFEwCzck38R82yvTCVVD0FBhrV9i2Avqd8bL/YwZ6f3l8XvV78o3nAZ200r6TSwMOECA/dw0hlfjcmtRA7SyVGh5VW6Qv2fKygCQQjXRZP |
| X-MS-Exchange-Transport-CrossTenantHeadersStamped | GV2PR03MB8680 |
| Content-Transfer-Encoding | 8bit |
| X-Sophos-Email-Scan-Details | 27140d181540510e43465059144752097e74 |
| X-Sophos-Email | [eu-west-1] Antispam-Engine: 6.0.0, AntispamData: 2024.10.29.123916 |
| X-Sophos-SenderHistory | ip=23.249.218.52, fs=138604160, fso=146021013, da=223666730, mc=396868, sc=277, hc=396591, sp=0, re=25, sd=0, hd=30 |
| X-Sophos-DomainHistory | d=amazonses.com, fs=48123, fso=79170020, da=84409554, mc=102691, sc=155, hc=102536, sp=0, re=916, sd=0, hd=30 |
| X-LASED-From-ReplyTo-Diff | From:<cardfactory.co.uk>:12 |
| X-LASED-SpamProbability | 0.245085 |
| X-LASED-Hits | BODYTEXTH_SIZE_10000_LESS 0.000000, BODYTEXTP_SIZE_3000_LESS 0.000000, BODY_SIZE_4000_4999 0.000000, BODY_SIZE_5000_LESS 0.000000, BODY_SIZE_7000_LESS 0.000000, DKIM_ALIGNS 0.000000, DKIM_SIGNATURE 0.000000, DQ_S_H 0.000000, GOOGLE_REDIR 0.000000, HREF_LABEL_TEXT_NO_URI 0.000000, HREF_LABEL_TEXT_ONLY 0.000000, HTML_FONT_INVISIBLE 0.100000, IMP_FROM_NOTSELF 0.000000, INBOUND_SOPHOS 0.000000, INBOUND_SOPHOS_TOP_REGIONS 0.000000, KNOWN_MTA_TFX 0.000000, NO_FUR_HEADER 0.000000, OBFU_SAME_STRING_X10 0.500000, OUTLOOK_VERDICT_SPAM 2.000000, RCVD_FROM_IP_DATE 0.100000, SINGLE_HREF_LABEL_PHISH_MED 0.000000, SINGLE_HREF_URI_IN_BODY 0.000000, SINGLE_URI_IN_BODY 0.000000, SUPERLONG_LINE 0.050000, SXL_IP_TFX_WM 0.000000, URI_WITH_PATH_ONLY 0.000000, __AMAZON_DKIM 0.000000, __AMAZON_MSGID 0.000000, __ANY_URI 0.000000, __ATTACH_CTE_QUOTED_PRINTABLE 0.000000, __AUTH_RES_DKIM_PASS 0.000000, __AUTH_RES_PASS 0.000000, __AUTH_R_DKIM_P_AMAZON 0.000000, __BODY_NO_MAILTO 0.000000, __BODY_TEXT_X4 0.000000, __CP_URI_IN_BODY 0.000000, __CT 0.000000, __CTYPE_HAS_BOUNDARY 0.000000, __CTYPE_MULTIPART 0.000000, __CTYPE_MULTIPART_ALT 0.000000, __DKIM_ALIGNS_1 0.000000, __DKIM_ALIGNS_2 0.000000, __DQ_D_H 0.000000, __DQ_IP_FSO_LARGE 0.000000, __DQ_S_DOMAIN_100K 0.000000, __DQ_S_DOMAIN_HD_10_P 0.000000, __DQ_S_DOMAIN_HD_1_P 0.000000, __DQ_S_DOMAIN_HD_20_P 0.000000, __DQ_S_DOMAIN_HD_30 0.000000, __DQ_S_DOMAIN_HD_5_P 0.000000, __DQ_S_DOMAIN_HIST_1 0.000000, __DQ_S_DOMAIN_MC_100_P 0.000000, __DQ_S_DOMAIN_MC_10_P 0.000000, __DQ_S_DOMAIN_MC_1K_P 0.000000, __DQ_S_DOMAIN_MC_1_P 0.000000, __DQ_S_DOMAIN_MC_50_P 0.000000, __DQ_S_DOMAIN_MC_5_P 0.000000, __DQ_S_DOMAIN_RE_100_P 0.000000, __DQ_S_DOMAIN_SC_100_P 0.000000, __DQ_S_DOMAIN_SC_10_P 0.000000, __DQ_S_DOMAIN_SC_1_P 0.000000, __DQ_S_DOMAIN_SC_5_P 0.000000, __DQ_S_DOMAIN_SP_0_P 0.000000, __DQ_S_HIST_1 0.000000, __DQ_S_HIST_2 0.000000, __DQ_S_IP_HD_10_P 0.000000, __DQ_S_IP_MC_100_P 0.000000, __DQ_S_IP_MC_10_P 0.000000, __DQ_S_IP_MC_1K_P 0.000000, __DQ_S_IP_MC_1_P 0.000000, __DQ_S_IP_MC_5_P 0.000000, __DQ_S_IP_RE_49_L 0.000000, __DQ_S_IP_RE_99_L 0.000000, __DQ_S_IP_SC_100_P 0.000000, __DQ_S_IP_SC_10_P 0.000000, __DQ_S_IP_SC_1_P 0.000000, __DQ_S_IP_SC_5_P 0.000000, __DQ_S_IP_SP_0_P 0.000000, __EXTORTION_MALWARE 0.000000, __FILESHARE_PHRASE 0.000000, __FOOTER_DISCLAIMER 0.000000, __FRAUD_URGENCY 0.000000, __FROM_DOMAIN_NOT_IN_BODY 0.000000, __FROM_NAME_NOT_IN_ADDR 0.000000, __FROM_NAME_NOT_IN_BODY 0.000000, __HAS_FROM 0.000000, __HAS_HTML 0.000000, __HAS_MSGID 0.000000, __HAS_X_FF_ASR 0.000000, __HAS_X_FF_ASR_CAT 0.000000, __HAS_X_FF_ASR_SFV 0.000000, __HREF_LABEL_PHISH 0.000000, __HREF_LABEL_TEXT 0.000000, __HTML_AHREF_TAG 0.000000, __HTML_BAD_START 0.000000, __HTML_BASE_HREF 0.000000, __HTML_ENTITIES_X4 0.000000, __HTML_TAG_CENTER 0.000000, __HTML_TAG_DIV 0.000000, __HTML_TAG_TABLE 0.000000, __HTTPS_URI 0.000000, __IMG_THEN_TEXT 0.000000, __IMP_FROM_NOTSELF 0.000000, __INBOUND_SOPHOS_EU_WEST_1 0.000000, __JSON_HAS_MODELS 0.000000, __JSON_HAS_SCHEMA_VERSION 0.000000, __JSON_HAS_SENDER_AUTH 0.000000, __JSON_HAS_TENANT_DOMAINS 0.000000, __JSON_HAS_TENANT_ID 0.000000, __JSON_HAS_TENANT_SCHEMA_VERSION 0.000000, __JSON_HAS_TENANT_VIPS 0.000000, __JSON_HAS_TRACKING_ID 0.000000, __LINES_OF_YELLING 0.000000, __MIME_HTML 0.000000, __MIME_TEXT_H 0.000000, __MIME_TEXT_H1 0.000000, __MIME_TEXT_H2 0.000000, __MIME_TEXT_P 0.000000, __MIME_TEXT_P1 0.000000, __MIME_TEXT_P2 0.000000, __MIME_VERSION 0.000000, __MTHREAT_0 0.000000, __MTL_0 0.000000, __MULTIPLE_URI_TEXT 0.000000, __PHISH_PHRASE10_C 0.000000, __RCVD_PASS 0.000000, __SANE_MSGID 0.000000, __SCAN_DETAILS 0.000000, __SCAN_DETAILS_SANE 0.000000, __SCAN_DETAILS_TH_SPAM 0.000000, __SCAN_DETAILS_TL_6 0.000000, __SINGLE_URI_MPART_BOTH 0.000000, __SPEAR_FROM_NAME 0.000000, __STOCK_CRUFT 0.000000, __STOCK_PHRASE_7 0.000000, __SUBJ_ENDS_IN_DATE 0.000000, __TO_MALFORMED_2 0.000000, __TO_NO_NAME 0.000000, __URI_CTA_NOT_DOCUSIGN2 0.000000, __URI_IN_BODY 0.000000, __URI_NOT_IMG 0.000000, __URI_NO_MAILTO 0.000000, __URI_NS 0.000000, __URI_WITH_PATH 0.000000, __X_FF_ASR_SCL_SPM 0.000000, __X_FF_ASR_SFV_SPM 0.000000 |
| X-LASED-Impersonation | False |
| X-LASED-Spam | NonSpam |
| X-Sophos-MH-Mail-Info-Key | NFhkOXM4NmhUM3pDcWpmLTE3Mi4xOS4yLjE0Ng== |
| Return-Path | 010b0192d870ad42-3a1e441c-2ff9-4b23-ba94-305cdcf8f399-000000@eu-west-2.amazonses.com |
| X-MS-Exchange-Organization-ExpirationStartTime | 29 Oct 2024 13:22:05.3568 (UTC) |
| X-MS-Exchange-Organization-ExpirationStartTimeReason | OriginalSubmit |
| X-MS-Exchange-Organization-ExpirationInterval | 1:00:00:00.0000000 |
| X-MS-Exchange-Organization-ExpirationIntervalReason | OriginalSubmit |
| X-MS-Exchange-Organization-Network-Message-Id | 9f77b5c7-39f8-4b0d-f0b9-08dcf81caeb3 |
| X-MS-Exchange-Organization-MessageDirectionality | Incoming |
| X-MS-Exchange-Transport-CrossTenantHeadersStripped | AM4PEPF00027A65.eurprd04.prod.outlook.com |
| X-MS-PublicTrafficType | |
| X-MS-Exchange-Organization-AuthSource | AM4PEPF00027A65.eurprd04.prod.outlook.com |
| X-MS-Exchange-Organization-AuthAs | Anonymous |
| X-MS-Office365-Filtering-Correlation-Id-Prvs | 6564920f-cdea-4764-7533-08dcf81ca96a |
| X-MS-Exchange-Organization-SCL | -1 |
| X-Microsoft-Antispam | BCL:0;ARA:13230040|5073199012|35042699022|32142699015|8096899003|4076899003|35012699015; |
| X-Forefront-Antispam-Report | CIP:198.154.180.197;CTRY:US;LANG:en;SCL:-1;SRV:;IPV:NLI;SFV:SKN;H:mfid-euw1.prod.hydra.sophos.com;PTR:mfid-euw1.prod.hydra.sophos.com;CAT:NONE;SFS:(13230040)(5073199012)(35042699022)(32142699015)(8096899003)(4076899003)(35012699015);DIR:INB; |
| X-MS-Exchange-CrossTenant-OriginalArrivalTime | 29 Oct 2024 13:22:05.2631 (UTC) |
| X-MS-Exchange-CrossTenant-Network-Message-Id | 9f77b5c7-39f8-4b0d-f0b9-08dcf81caeb3 |
| X-MS-Exchange-CrossTenant-Id | 7956b84e-0c99-46b5-81c6-28689cfa7221 |
| X-MS-Exchange-CrossTenant-AuthSource | AM4PEPF00027A65.eurprd04.prod.outlook.com |
| X-MS-Exchange-CrossTenant-AuthAs | Anonymous |
| X-MS-Exchange-CrossTenant-FromEntityHeader | Internet |
| X-MS-Exchange-Transport-EndToEndLatency | 00:00:05.0832413 |
| X-MS-Exchange-Processed-By-BccFoldering | 15.20.8093.023 |
| X-Microsoft-Antispam-Mailbox-Delivery | ucf:0;jmr:0;auth:0;dest:I;ENG:(910001)(944506478)(944626604)(920097)(930097)(140003); |
| X-Microsoft-Antispam-Message-Info | PiC+yenE8xwYjTmunfxzOunUfGkp+O/v7VKUFcimIzOWdr3Rv7kJqEaaamavzPnNmdi7vclOxtzZU6xyBoxslAU4vQsu9sSZwVEDIiUZmoeOFonM75cQT0pixjJtYtF+/3Sxt9s8ObEaiyH5MmfNgjZ1NOV+IjXcnJ4//nDg7yBuIxKWV/DcbZsWFrL+G1ug70XDUYQYB8Jmx9FTQ9MP1aOgphtnUUOXO/tz7DsBk3jnaKKAkqsjo5FtK9/twXJxNlCQkDFvTZwR2YZKoqz8YJTHA6/DPPRa6SWi5Qnyz7t+PvGcGYqfkOSNwsdZkqCucnW/gOmROZ9oiZPqiB70HMmUueIIfQg4f3lQ55le2EszCopppeO/vi6qGGuERBkYR4MNiMOVz/HNtMls8f2S8LKydKgDwJ6Tv+ap5Fw383kaAwhCutrxQ5UtzA3CiTBletZ88CuHQjkyxPPaJOkKZNvasrOBPyh3+xWzGg7Q/7OkCwgN0H4H7A0vUbjc5YIwcr1qAGF2mN6G6IU/QTjr1wV5Ha0a79QGrlSSv6Juq0c3LfkTtHSMyWgGXIG+F6yEuHN+Z9FHrsDYqT9FqYjFTvrZG7tKVDH89fFmbiWmEvTAMjmdP6wCK5+75MQTjEOZwLHxvhl4oGLwO+3NTTa2SG0GKEMz3pMtmOFxfDfBzvz+4InnT+6y0OI5VWLO7a3ujxQTM/mNAzXT7nET/FwO8zIdTwjS106EjZRH39+wP5KB06VX30NQDRTmvufj66qQjht0AwIISAKyH9KDWhs958e3RZsZWUvUyusCFkvn9IDu5nC2wQvyDjWMn0ncxx5thylcvZ5QaY5tjbOMPm7W5AlYndoXIxawGxG6N2VCrPMTiBWpwNepvETQaUMCYTgL8vocyj2ic5bvr+2KzJk2vjPiBmX9/x+Fz9wz8XbNnPWZtgn4Gw7yo0620w9OxmxU1ENV1bQeTp+VZsS60jMMIefj9ij4Q1IaGbXnoDvVFUJau9HrqIm+zUzWir+5iKDM8bnFbvQD8p95Rjd45eLqq95TvRYrcY2aXpyYDm707CHfYyBgAYrRUUxfjXtfnkiCcvwEmg5o0MqMHNOmvfj5nTG9C5uOTJQfg/W1J3nFuxIdbAGP0EC+uWu2ZgsvetYL6WcUOo4i0LkigkjkHAomq0txdLlWIFJ76Caib+Iw3XSStlLXi12EAQcm7BNSyWozCnJCFdMUKRiMBOQBGnGYZ/MYLOF+rDAhc2RLqk+8O1Nk4AWmBKdbq0oIS6eVn0OMRgkAA/FtzqdGqYBlyLmkXXVOaXmJIjclKdWYVurj1r21EfZ+DjzS7eYpJzArT7zq0Be/ZivM6aNP2857qEXaxjLahlcJg535DWLl3aJ9JkKyc4UzlTtZIzExPGIDLD21dzmOqI+OGhUrDRBGpwq7RrrtDDK5aE60SOeVeFakW4edbPYZMPZE0VWOW1c+0jXWiD2Ctm2bDsgWH4BnzNYn1Pr4Gh1NdDNIh4CkdfnAi8s9IQjkf7wjkheotzN8ogpLnUi7fryoevE2mhT4YSip1lrMES/DGNeLO9nVjtzslNiLKjTbVh1dZ8nteNR2UVCmZ3XLWDIgSZ9T3tlhhdN/f1kXskpiyxpwuQkX96Hjndw7p9d1vaCPYjy2mJjPNbP8bLpL79y0D5KS1A8ohB42xJ8lTADsP4gkiypaiCwLTBAW5L5aqjdqEYov61+spu+iJaI/9IU4mWrPS0QIdsRBBr0zikwKYDjXl7c3BitFD/obtRR/iXNiiUbow+YCa6vP7YvWo8YFcg/B8IC5w2nFINhwTDR/FtE4RAMN/xR1G02XWB0eRYge/rlCEjQKCF3q0reV+0CuE76I78gSZsuM21GqSiZ3jVPOi7MM3S6HCTJ/cpkj7ZaBZJNZEz0lcj/nbFPbj6QhI6U3BXTe3SDy+8t4o2XY+VyujMwb0z+6JOCHu4te/t2Jty7qET5qpu3njkjppJShxf4cM0SUetgPxSikxflJwLX1LNMvKeOfwY/pvufpFa0vm8JsI8Xkzj5t2UqSSNrZE3JgKTD5r3AD+4TnAGBQEiyusq9iQcJ7lh1sUpHO3FJszBAIKf7FVFjx2A2AMMo15+bmgUUuUOzDMzVxOLxigSUlmh+J/1O9oPcIg1UlQ86xB7ZGlPjST+2e1Nqo12VjhcVnSgwLSw/nYJbjcF7FdLlX+6BrxIz2GY8nDfjwj9DgC9Vb0/PEVwFH+KoVv9miP2HYvBSfbSfPK9LcX0ZVYoOPRQ671jzu9S+BugzJBI7VrzlY0foOpcRDT+Hb4Fu8bS6kIH/AXX4SdcKjI2ZjAJmc17BiscO2itxskgdBGcHrdpMyyY0k32B9NN4F3BsQBKvxPRxy0D0vrvdc0O33BEyFQ7Ngx/ztWuBk/0cIVz+3Md4maqAVsUMFkg5N4HOvz+ulzzsDYb5URoNEJt89CRK9bq1jMq+tVRej25zyzynY2iBLKOgsmPcaU1/pG2Xpv1ZDsA0GXoy0LjHScSL4FiLhlatg86ab8Ea6BrpLWv9w28fVGELIWYGsZnsaI6vp9h5FztKlF2E//WDGKsA7/ZSf0GsWo8DGc+WfuvwOp3F38sA1QVQTcADk0iwdsznPDTOVv1Sb7ItFiVq8fAcyi2MRooq9hpByve8zpX8zQ6zLhS4XRQYb0jdA+3bLZ9TH31SFgigQqI2TWR3NhqwtEWw3avQry/hprPWkYuEG8XwuSC6LaAr23VviEgZ2wX9vYdVp6bfeyetPtnjClQL2yUKzoxKvuN5MSXtoH4jlCJ5s7a8uzNYbuC11WjPnjpPQMRPIg3oXFC3Lul2zcQbORh3J3SSje+QdjBL8R8SO0itB+oKHJLmBm/beuqHUaH52EuFcP6H9dNGhgSdL986C0jthWWcLtW00hO9iKpOAlTZh4MB1OAUZlSt34koi1RwFEUYXlsHGFiz+1YDLzhCDIDZt6gFuwnIrf4zVmiPg2I8LH6kGxI9ZDpm0oQOsjf+CCf7A6ggEA3lEUmwIIe81yZ77oChkPoj5sg3orZDrOckO4tehD9G/pQOc |
| MIME-Version | 1.0 |
 | |
| Icon Hash: | 46070c0a8e0c67d6 |
Key Decision
Richest Path
Thread / callback creation
Lower opacity -> Library Node