Edit tour

Windows Analysis Report
(No subject) - 2024-10-31T090531.704.eml

Overview

General Information

Sample name:	(No subject) - 2024-10-31T090531.704.eml
Analysis ID:	1546260
MD5:	970633fc2ac75fdf0d4dce1d003186f4
SHA1:	6205eacd288c674abfd0097a250cbb735f267f20
SHA256:	5c4aea1d1371875afb976f58def88de89763eb0f122321c801313743603b9378
Infos:

Detection

Score:	52
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

AI detected landing page (webpage, office document or email)

AI detected potential phishing Email

Suspicious MSG / EML detected (based on various text indicators)

Detected suspicious crossdomain redirect

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

Queries the volume information (name, serial number etc) of a device

Sigma detected: Office Autorun Keys Modification

Stores files to the Windows start menu directory

Suricata IDS alerts with low severity for network traffic

Classification

Process Tree

System is w10x64_ra

OUTLOOK.EXE (PID: 6644 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\user\Desktop\(No subject) - 2024-10-31T090531.704.eml" MD5: 91A5292942864110ED734005B7E005C0)

ai.exe (PID: 6212 cmdline: "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "A3EA6518-C531-4DE7-BC7D-22EC5B6727F8" "C28E0983-BCA6-49DB-A7D6-E768A78B37F2" "6644" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx" MD5: EC652BEDD90E089D9406AFED89A8A8BD)

chrome.exe (PID: 5748 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fna4.docusign.net%2FSigning%2FEmailStart.aspx%3Fa%3Da6f8f68f-e076-4337-aac3-c42f41ebf6cc%26etti%3D24%26acct%3D7e9e0095-f41c-42f4-b219-3be2b992a461%26er%3D449d3c4f-dbee-4c6e-a043-8f2682f3079d&data=05%7C02%7Ckhickey%40santaclaraca.gov%7Cac1bfe3680ab4b4bc88008dcf9c3a7ca%7C28ea354810694e81aa0b6e4b3271a5cb%7C0%7C0%7C638659866425908855%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C20000%7C%7C%7C&sdata=hiibBlRjS07Ot%2Fn9qwgC1lvq2U9kAt%2BMFXtGA%2BOSu5U%3D&reserved=0 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 1836 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1588 --field-trial-handle=2024,i,12387921056704305798,15199288670711883833,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Sigma Signatures

Sigma detected: Office Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 , EventID: 13, EventType: SetValue, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE, ProcessId: 6644, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Addins\OneNote.OutlookAddin\1

Suricata Signatures

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-31T17:09:43.943592+0100	2022930	1	A Network Trojan was detected	20.109.210.53	443	192.168.2.16	49712	TCP
2024-10-31T17:10:22.833613+0100	2022930	1	A Network Trojan was detected	20.12.23.50	443	192.168.2.16	49748	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Phishing

Suspicious MSG / EML detected (based on various text indicators)

Source: MSG / EML

OCR Text: You don't often get email from dse_na4@docusign.net. Learn why this is important @docusign Caitlin Tharp (Gilmore) sent you a document to review and sign. REVIEW DOCUMENT Caitlin Tharp (Gilmore) zskeiemm3@consultant.com Thanks! got em. Caitlin Tharp (Gilmore), PE I Vice President Schaaf and Wheeler Consulting Civil Engineers 10232 Donner Pass Road #4, Truckee, CA 96161 Do Not Share This Email This email contains a secure link to Docusign. Please do not share this email, link, or access code with others. Alternate Signing Method Visit Docusign.com, click 'Access Documents', and enter the security code: A6F8F68FE0764337AAC3C42F41 EBF6CC7 About Docusign Sign documents electronically in just minutes. It's safe, secure, and legally binding. Whether you're in an office, at home, on-the-go -- or even across the globe -- Docusign provides a professional trusted solution for Digital Transaction ManagementTM. Questions about the Document? If you need to modify the document or have questions about the details in the document, please reach out to the sender by emailing them directly. Stop receiving this email Report this email or read more about Declining to sign and Managing notifications. If you have trouble signing, visit "How to Sign a Document" on our Docusign Support Center, or browse our Docusign Community for more information.

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.16:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.16:49748 version: TLS 1.2

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

HTTP traffic: Redirect from: gcc02.safelinks.protection.outlook.com to https://na4.docusign.net/signing/emailstart.aspx?a=a6f8f68f-e076-4337-aac3-c42f41ebf6cc&etti=24&acct=7e9e0095-f41c-42f4-b219-3be2b992a461&er=449d3c4f-dbee-4c6e-a043-8f2682f3079d

Source: Joe Sandbox View	IP Address: 239.255.255.250 239.255.255.250
Source: Joe Sandbox View	IP Address: 104.47.64.28 104.47.64.28

Source: Joe Sandbox View

JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4

Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 20.12.23.50:443 -> 192.168.2.16:49748
Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 20.109.210.53:443 -> 192.168.2.16:49712

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.14
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.14
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.14
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.14
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.14
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.14
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.14
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50

Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=fGLw7rl8KtPeAcX&MD=AeeMNrPN HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /?url=https%3A%2F%2Fna4.docusign.net%2FSigning%2FEmailStart.aspx%3Fa%3Da6f8f68f-e076-4337-aac3-c42f41ebf6cc%26etti%3D24%26acct%3D7e9e0095-f41c-42f4-b219-3be2b992a461%26er%3D449d3c4f-dbee-4c6e-a043-8f2682f3079d&data=05%7C02%7Ckhickey%40santaclaraca.gov%7Cac1bfe3680ab4b4bc88008dcf9c3a7ca%7C28ea354810694e81aa0b6e4b3271a5cb%7C0%7C0%7C638659866425908855%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C20000%7C%7C%7C&sdata=hiibBlRjS07Ot%2Fn9qwgC1lvq2U9kAt%2BMFXtGA%2BOSu5U%3D&reserved=0 HTTP/1.1Host: gcc02.safelinks.protection.outlook.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /track/?data=eyJldmVudCI6ICJtcF9wYWdlX3ZpZXciLCJwcm9wZXJ0aWVzIjogeyIkb3MiOiAiV2luZG93cyIsIiRicm93c2VyIjogIkNocm9tZSIsIiRyZWZlcnJpbmdfZG9tYWluIjogIm5hNC5kb2N1c2lnbi5uZXQiLCIkc2NyZWVuX2hlaWdodCI6IDEwMjQsIiRzY3JlZW5fd2lkdGgiOiAxMjgwLCJtcF9saWIiOiAid2ViIiwiZGlzdGluY3RfaWQiOiAiNTM4QzA5Mzc0QTEyM0I4RjZCOERBOEZEMDk4QTlDOTk4MTQwRjdEMiIsIiRpbml0aWFsX3JlZmVycmluZ19kb21haW4iOiAibmE0LmRvY3VzaWduLm5ldCIsIm1wX3BhZ2UiOiAibmE0LmRvY3VzaWduLm5ldCIsIm1wX3JlZmVycmVyIjogIm5hNC5kb2N1c2lnbi5uZXQiLCJtcF9icm93c2VyIjogIkNocm9tZSIsIm1wX3BsYXRmb3JtIjogIldpbmRvd3MiLCJ0b2tlbiI6ICIzMDRjY2JkZTI0ZDNiMTVmZmUyZDVkZTMwYzEwZGFiMiJ9fQ%3D%3D&ip=1&_=1730390993043 HTTP/1.1Host: api.mixpanel.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://na4.docusign.netSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://na4.docusign.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /track/?data=eyJldmVudCI6ICJtcF9wYWdlX3ZpZXciLCJwcm9wZXJ0aWVzIjogeyIkb3MiOiAiV2luZG93cyIsIiRicm93c2VyIjogIkNocm9tZSIsIiRyZWZlcnJpbmdfZG9tYWluIjogIm5hNC5kb2N1c2lnbi5uZXQiLCIkc2NyZWVuX2hlaWdodCI6IDEwMjQsIiRzY3JlZW5fd2lkdGgiOiAxMjgwLCJtcF9saWIiOiAid2ViIiwiZGlzdGluY3RfaWQiOiAiNTM4QzA5Mzc0QTEyM0I4RjZCOERBOEZEMDk4QTlDOTk4MTQwRjdEMiIsIiRpbml0aWFsX3JlZmVycmluZ19kb21haW4iOiAibmE0LmRvY3VzaWduLm5ldCIsIm1wX3BhZ2UiOiAibmE0LmRvY3VzaWduLm5ldCIsIm1wX3JlZmVycmVyIjogIm5hNC5kb2N1c2lnbi5uZXQiLCJtcF9icm93c2VyIjogIkNocm9tZSIsIm1wX3BsYXRmb3JtIjogIldpbmRvd3MiLCJ0b2tlbiI6ICIzMDRjY2JkZTI0ZDNiMTVmZmUyZDVkZTMwYzEwZGFiMiJ9fQ%3D%3D&ip=1&_=1730390993043 HTTP/1.1Host: api.mixpanel.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=fGLw7rl8KtPeAcX&MD=AeeMNrPN HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com

Source: global traffic	DNS traffic detected: DNS query: gcc02.safelinks.protection.outlook.com
Source: global traffic	DNS traffic detected: DNS query: na4.docusign.net
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: docucdn-a.akamaihd.net
Source: global traffic	DNS traffic detected: DNS query: api.mixpanel.com

Source: chromecache_72.11.dr	String found in binary or memory: http://blog.55minutes.com/2012/04/iphone-text-resizing/
Source: chromecache_68.11.dr, chromecache_70.11.dr	String found in binary or memory: http://dbj.org/dbj/?p=286
Source: chromecache_68.11.dr, chromecache_70.11.dr	String found in binary or memory: http://dean.edwards.name/weblog/2005/10/add-event/
Source: chromecache_68.11.dr, chromecache_70.11.dr	String found in binary or memory: http://documentcloud.github.com/underscore/
Source: chromecache_68.11.dr, chromecache_70.11.dr	String found in binary or memory: http://hacks.mozilla.org/2009/07/cross-site-xmlhttprequest-with-cors/
Source: chromecache_68.11.dr, chromecache_70.11.dr	String found in binary or memory: http://mixpanel.com/
Source: (No subject) - 2024-10-31T090531.704.eml	String found in binary or memory: http://schema.org/Creat=
Source: (No subject) - 2024-10-31T090531.704.eml	String found in binary or memory: http://schema.org/EmailMessage
Source: chromecache_68.11.dr, chromecache_70.11.dr	String found in binary or memory: http://www.ecma-international.org/ecma-262/5.1/#sec-12.4
Source: (No subject) - 2024-10-31T090531.704.eml	String found in binary or memory: https://NA4.docusign.net/member/Imag=
Source: ~WRS{0A6D8DF3-6320-4094-AAF6-4C38E47FCA82}.tmp.0.dr	String found in binary or memory: https://NA4.docusign.net/member/Images/email/docInvite-white.png
Source: (No subject) - 2024-10-31T090531.704.eml, ~WRS{0A6D8DF3-6320-4094-AAF6-4C38E47FCA82}.tmp.0.dr	String found in binary or memory: https://aka.ms/LearnAboutSenderIdentification
Source: (No subject) - 2024-10-31T090531.704.eml	String found in binary or memory: https://community.docusign.com/esignature-111?utm_campaign=3DGBL_=
Source: chromecache_68.11.dr, chromecache_70.11.dr	String found in binary or memory: https://developer.mozilla.org/en-US/docs/DOM/XMLHttpRequest#withCredentials
Source: (No subject) - 2024-10-31T090531.704.eml	String found in binary or memory: https://docucdn-a.akamaihd.net/olive/images/2.62.0/glob=
Source: (No subject) - 2024-10-31T090531.704.eml	String found in binary or memory: https://docucdn-a.akamaihd.net/olive/images/2.62.0/global-assets/ema=
Source: (No subject) - 2024-10-31T090531.704.eml	String found in binary or memory: https://docucdn-a.akamaihd.net/olive/images/2.62.0/global-assets/email-tem=
Source: ~WRS{0A6D8DF3-6320-4094-AAF6-4C38E47FCA82}.tmp.0.dr	String found in binary or memory: https://docucdn-a.akamaihd.net/olive/images/2.62.0/global-assets/email-templates/email-logo.png
Source: (No subject) - 2024-10-31T090531.704.eml	String found in binary or memory: https://gcc02.safelin=
Source: (No subject) - 2024-10-31T090531.704.eml	String found in binary or memory: https://gcc02.safelinks.pro=
Source: (No subject) - 2024-10-31T090531.704.eml	String found in binary or memory: https://gcc02.safelinks.prote=
Source: (No subject) - 2024-10-31T090531.704.eml	String found in binary or memory: https://gcc02.safelinks.protection.out=
Source: (No subject) - 2024-10-31T090531.704.eml	String found in binary or memory: https://gcc02.safelinks.protection.outlook.com/?url=3Dhttps%3A%2=
Source: ~WRS{0A6D8DF3-6320-4094-AAF6-4C38E47FCA82}.tmp.0.dr	String found in binary or memory: https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fcommunity.docusign.com%2Fesignatur
Source: ~WRS{0A6D8DF3-6320-4094-AAF6-4C38E47FCA82}.tmp.0.dr	String found in binary or memory: https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fna4.docusign.net%2FSigning%2FEmail
Source: ~WRS{0A6D8DF3-6320-4094-AAF6-4C38E47FCA82}.tmp.0.dr	String found in binary or memory: https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fprotect.docusign.net%2Freport-abus
Source: ~WRS{0A6D8DF3-6320-4094-AAF6-4C38E47FCA82}.tmp.0.dr	String found in binary or memory: https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fsupport.docusign.com%2F&data=05%7C
Source: ~WRS{0A6D8DF3-6320-4094-AAF6-4C38E47FCA82}.tmp.0.dr	String found in binary or memory: https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fsupport.docusign.com%2Fen%2Farticl
Source: ~WRS{0A6D8DF3-6320-4094-AAF6-4C38E47FCA82}.tmp.0.dr	String found in binary or memory: https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fsupport.docusign.com%2Fen%2Fguides
Source: ~WRS{0A6D8DF3-6320-4094-AAF6-4C38E47FCA82}.tmp.0.dr	String found in binary or memory: https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fsupport.docusign.com%2Fs%2Farticle
Source: ~WRS{0A6D8DF3-6320-4094-AAF6-4C38E47FCA82}.tmp.0.dr	String found in binary or memory: https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.docusign.com%2Ffeatures-and-be
Source: (No subject) - 2024-10-31T090531.704.eml	String found in binary or memory: https://gcc02.safelinks=
Source: chromecache_68.11.dr, chromecache_70.11.dr	String found in binary or memory: https://gist.github.com/1930440
Source: chromecache_68.11.dr, chromecache_70.11.dr	String found in binary or memory: https://github.com/douglascrockford/JSON-js/blob/master/json_parse.js
Source: (No subject) - 2024-10-31T090531.704.eml	String found in binary or memory: https://na4.docusign.net/Signing/EmailSta=
Source: (No subject) - 2024-10-31T090531.704.eml	String found in binary or memory: https://na4.docusign.net/Signing/EmailStart.aspx?a=3D=
Source: (No subject) - 2024-10-31T090531.704.eml	String found in binary or memory: https://na4.docusign.net/Signing/EmailStart.aspx?a=3Da6f8f=
Source: (No subject) - 2024-10-31T090531.704.eml	String found in binary or memory: https://protect.docusign.net/report-abus=
Source: (No subject) - 2024-10-31T090531.704.eml	String found in binary or memory: https://protect.docusign.net/report-abuse?e=3DAUtomjpFak9=
Source: (No subject) - 2024-10-31T090531.704.eml	String found in binary or memory: https://support.=
Source: (No subject) - 2024-10-31T090531.704.eml	String found in binary or memory: https://support.docusign.com/
Source: (No subject) - 2024-10-31T090531.704.eml	String found in binary or memory: https://support.docusign.com/en/articles/How-do-I-manage-my-email-no=
Source: (No subject) - 2024-10-31T090531.704.eml	String found in binary or memory: https://support.docusign.com/en/guide=
Source: (No subject) - 2024-10-31T090531.704.eml	String found in binary or memory: https://support.docusign.com/en/guides/Declining-to-sign-DocuS=
Source: (No subject) - 2024-10-31T090531.704.eml	String found in binary or memory: https://support.docusign.com/s/articles/How-do-I-sign-a-DocuSi=

Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49695 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49693 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49695
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49693
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.16:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.16:49748 version: TLS 1.2

Source: classification engine

Classification label: mal52.phis.winEML@18/48@16/7

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

File created: C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

File created: C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20241031T1209330586-6644.etl

Jump to behavior

Source: unknown	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\user\Desktop\(No subject) - 2024-10-31T090531.704.eml"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "A3EA6518-C531-4DE7-BC7D-22EC5B6727F8" "C28E0983-BCA6-49DB-A7D6-E768A78B37F2" "6644" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fna4.docusign.net%2FSigning%2FEmailStart.aspx%3Fa%3Da6f8f68f-e076-4337-aac3-c42f41ebf6cc%26etti%3D24%26acct%3D7e9e0095-f41c-42f4-b219-3be2b992a461%26er%3D449d3c4f-dbee-4c6e-a043-8f2682f3079d&data=05%7C02%7Ckhickey%40santaclaraca.gov%7Cac1bfe3680ab4b4bc88008dcf9c3a7ca%7C28ea354810694e81aa0b6e4b3271a5cb%7C0%7C0%7C638659866425908855%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C20000%7C%7C%7C&sdata=hiibBlRjS07Ot%2Fn9qwgC1lvq2U9kAt%2BMFXtGA%2BOSu5U%3D&reserved=0
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1588 --field-trial-handle=2024,i,12387921056704305798,15199288670711883833,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "A3EA6518-C531-4DE7-BC7D-22EC5B6727F8" "C28E0983-BCA6-49DB-A7D6-E768A78B37F2" "6644" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fna4.docusign.net%2FSigning%2FEmailStart.aspx%3Fa%3Da6f8f68f-e076-4337-aac3-c42f41ebf6cc%26etti%3D24%26acct%3D7e9e0095-f41c-42f4-b219-3be2b992a461%26er%3D449d3c4f-dbee-4c6e-a043-8f2682f3079d&data=05%7C02%7Ckhickey%40santaclaraca.gov%7Cac1bfe3680ab4b4bc88008dcf9c3a7ca%7C28ea354810694e81aa0b6e4b3271a5cb%7C0%7C0%7C638659866425908855%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C20000%7C%7C%7C&sdata=hiibBlRjS07Ot%2Fn9qwgC1lvq2U9kAt%2BMFXtGA%2BOSu5U%3D&reserved=0	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1588 --field-trial-handle=2024,i,12387921056704305798,15199288670711883833,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: c2r64.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: gpapi.dll	Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{F959DBBB-3867-41F2-8E5F-3B8BEFAA81B3}\InprocServer32

Jump to behavior

Source: Google Drive.lnk.10.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.10.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.10.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.10.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.10.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.10.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Window found: window name: SysTabControl32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Common

Jump to behavior

Persistence and Installation Behavior

AI detected landing page (webpage, office document or email)

Source: Email	LLM: Page contains button: 'REVIEW DOCUMENT' Source: 'Email'
Source: Email	LLM: Email contains prominent button: 'review document'

AI detected potential phishing Email

Source: Email

LLM: Detected potential phishing email: The sender email 'zskeiemm3@consultant.com' is suspicious and doesn't match the legitimate DocuSign domain

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

File Volume queried: C:\Windows\SysWOW64 FullSizeInformation

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe

Queries volume information: C:\Program Files (x86)\Microsoft Office\root\Office16\AI\WordCombinedFloatieLreOnline.onnx VolumeInformation

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	2 Browser Extensions	1 Process Injection	1 Masquerading	OS Credential Dumping	1 Process Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	1 DLL Side-Loading	1 Process Injection	LSASS Memory	13 System Information Discovery	Remote Desktop Protocol	Data from Removable Media	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 Registry Run Keys / Startup Folder	1 Registry Run Keys / Startup Folder	1 DLL Side-Loading	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
https://aka.ms/LearnAboutSenderIdentification	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
gcc02.safelinks.eop-tm2.outlook.com	104.47.64.28	true	false	unknown
www.google.com	142.250.186.132	true	false	unknown
api.mixpanel.com	130.211.34.183	true	false	unknown
na4.docusign.net	unknown	unknown	false	unknown
docucdn-a.akamaihd.net	unknown	unknown	false	unknown
gcc02.safelinks.protection.outlook.com	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://na4.docusign.net/Signing/Error.aspx?e=ec8e592e-79f3-440a-9824-0fb2d21626e9&scope=05ac77a9-331f-4027-8c9d-22e8dfb23b8f	false		unknown
https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fna4.docusign.net%2FSigning%2FEmailStart.aspx%3Fa%3Da6f8f68f-e076-4337-aac3-c42f41ebf6cc%26etti%3D24%26acct%3D7e9e0095-f41c-42f4-b219-3be2b992a461%26er%3D449d3c4f-dbee-4c6e-a043-8f2682f3079d&data=05%7C02%7Ckhickey%40santaclaraca.gov%7Cac1bfe3680ab4b4bc88008dcf9c3a7ca%7C28ea354810694e81aa0b6e4b3271a5cb%7C0%7C0%7C638659866425908855%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C20000%7C%7C%7C&sdata=hiibBlRjS07Ot%2Fn9qwgC1lvq2U9kAt%2BMFXtGA%2BOSu5U%3D&reserved=0	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://docucdn-a.akamaihd.net/olive/images/2.62.0/global-assets/email-templates/email-logo.png	~WRS{0A6D8DF3-6320-4094-AAF6-4C38E47FCA82}.tmp.0.dr	false		unknown
https://gcc02.safelin=	(No subject) - 2024-10-31T090531.704.eml	false		unknown
https://developer.mozilla.org/en-US/docs/DOM/XMLHttpRequest#withCredentials	chromecache_68.11.dr, chromecache_70.11.dr	false		unknown
https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fsupport.docusign.com%2Fen%2Farticl	~WRS{0A6D8DF3-6320-4094-AAF6-4C38E47FCA82}.tmp.0.dr	false		unknown
https://support.docusign.com/en/guide=	(No subject) - 2024-10-31T090531.704.eml	false		unknown
https://github.com/douglascrockford/JSON-js/blob/master/json_parse.js	chromecache_68.11.dr, chromecache_70.11.dr	false		unknown
https://support.docusign.com/	(No subject) - 2024-10-31T090531.704.eml	false		unknown
https://NA4.docusign.net/member/Imag=	(No subject) - 2024-10-31T090531.704.eml	false		unknown
https://gcc02.safelinks=	(No subject) - 2024-10-31T090531.704.eml	false		unknown
https://na4.docusign.net/Signing/EmailStart.aspx?a=3Da6f8f=	(No subject) - 2024-10-31T090531.704.eml	true		unknown
https://gist.github.com/1930440	chromecache_68.11.dr, chromecache_70.11.dr	false		unknown
https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fna4.docusign.net%2FSigning%2FEmail	~WRS{0A6D8DF3-6320-4094-AAF6-4C38E47FCA82}.tmp.0.dr	true		unknown
https://gcc02.safelinks.protection.outlook.com/?url=3Dhttps%3A%2=	(No subject) - 2024-10-31T090531.704.eml	false		unknown
https://gcc02.safelinks.prote=	(No subject) - 2024-10-31T090531.704.eml	false		unknown
https://gcc02.safelinks.protection.out=	(No subject) - 2024-10-31T090531.704.eml	false		unknown
https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fprotect.docusign.net%2Freport-abus	~WRS{0A6D8DF3-6320-4094-AAF6-4C38E47FCA82}.tmp.0.dr	false		unknown
http://schema.org/EmailMessage	(No subject) - 2024-10-31T090531.704.eml	true		unknown
https://protect.docusign.net/report-abus=	(No subject) - 2024-10-31T090531.704.eml	false		unknown
https://support.=	(No subject) - 2024-10-31T090531.704.eml	false		unknown
https://docucdn-a.akamaihd.net/olive/images/2.62.0/global-assets/email-tem=	(No subject) - 2024-10-31T090531.704.eml	false		unknown
https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.docusign.com%2Ffeatures-and-be	~WRS{0A6D8DF3-6320-4094-AAF6-4C38E47FCA82}.tmp.0.dr	false		unknown
http://dean.edwards.name/weblog/2005/10/add-event/	chromecache_68.11.dr, chromecache_70.11.dr	false		unknown
https://aka.ms/LearnAboutSenderIdentification	(No subject) - 2024-10-31T090531.704.eml, ~WRS{0A6D8DF3-6320-4094-AAF6-4C38E47FCA82}.tmp.0.dr	false	URL Reputation: safe	unknown
https://docucdn-a.akamaihd.net/olive/images/2.62.0/global-assets/ema=	(No subject) - 2024-10-31T090531.704.eml	false		unknown
https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fsupport.docusign.com%2F&data=05%7C	~WRS{0A6D8DF3-6320-4094-AAF6-4C38E47FCA82}.tmp.0.dr	false		unknown
http://documentcloud.github.com/underscore/	chromecache_68.11.dr, chromecache_70.11.dr	false		unknown
https://community.docusign.com/esignature-111?utm_campaign=3DGBL_=	(No subject) - 2024-10-31T090531.704.eml	false		unknown
http://www.ecma-international.org/ecma-262/5.1/#sec-12.4	chromecache_68.11.dr, chromecache_70.11.dr	false		unknown
https://support.docusign.com/en/guides/Declining-to-sign-DocuS=	(No subject) - 2024-10-31T090531.704.eml	false		unknown
https://support.docusign.com/s/articles/How-do-I-sign-a-DocuSi=	(No subject) - 2024-10-31T090531.704.eml	false		unknown
https://na4.docusign.net/Signing/EmailStart.aspx?a=3D=	(No subject) - 2024-10-31T090531.704.eml	true		unknown
http://blog.55minutes.com/2012/04/iphone-text-resizing/	chromecache_72.11.dr	false		unknown
https://support.docusign.com/en/articles/How-do-I-manage-my-email-no=	(No subject) - 2024-10-31T090531.704.eml	false		unknown
https://protect.docusign.net/report-abuse?e=3DAUtomjpFak9=	(No subject) - 2024-10-31T090531.704.eml	false		unknown
https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fsupport.docusign.com%2Fs%2Farticle	~WRS{0A6D8DF3-6320-4094-AAF6-4C38E47FCA82}.tmp.0.dr	false		unknown
https://na4.docusign.net/Signing/EmailSta=	(No subject) - 2024-10-31T090531.704.eml	true		unknown
https://gcc02.safelinks.pro=	(No subject) - 2024-10-31T090531.704.eml	false		unknown
http://dbj.org/dbj/?p=286	chromecache_68.11.dr, chromecache_70.11.dr	false		unknown
http://hacks.mozilla.org/2009/07/cross-site-xmlhttprequest-with-cors/	chromecache_68.11.dr, chromecache_70.11.dr	false		unknown
https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fcommunity.docusign.com%2Fesignatur	~WRS{0A6D8DF3-6320-4094-AAF6-4C38E47FCA82}.tmp.0.dr	false		unknown
https://docucdn-a.akamaihd.net/olive/images/2.62.0/glob=	(No subject) - 2024-10-31T090531.704.eml	false		unknown
http://schema.org/Creat=	(No subject) - 2024-10-31T090531.704.eml	false		unknown
https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fsupport.docusign.com%2Fen%2Fguides	~WRS{0A6D8DF3-6320-4094-AAF6-4C38E47FCA82}.tmp.0.dr	false		unknown
https://NA4.docusign.net/member/Images/email/docInvite-white.png	~WRS{0A6D8DF3-6320-4094-AAF6-4C38E47FCA82}.tmp.0.dr	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
35.186.241.51	unknown	United States	15169	GOOGLEUS	false
130.211.34.183	api.mixpanel.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
104.47.64.28	gcc02.safelinks.eop-tm2.outlook.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.250.186.132	www.google.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.16
192.168.2.22

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1546260
Start date and time:	2024-10-31 17:09:02 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 12s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	(No subject) - 2024-10-31T090531.704.eml
Detection:	MAL
Classification:	mal52.phis.winEML@18/48@16/7
Cookbook Comments:	Found application associated with file extension: .eml

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 52.113.194.132, 142.250.181.227, 74.125.133.84, 142.250.186.46, 20.42.73.28, 34.104.35.123, 162.248.184.187, 95.101.54.217, 2.19.126.227, 2.19.126.218, 162.248.184.189, 20.189.173.12, 13.69.109.131, 142.250.185.227, 142.250.186.174
Excluded domains from analysis (whitelisted): clients1.google.com, ecs.office.com, na4-se.docusign.net.akadns.net, fs.microsoft.com, accounts.google.com, onedscolprdwus11.westus.cloudapp.azure.com, slscr.update.microsoft.com, clientservices.googleapis.com, onedscolprdweu03.westeurope.cloudapp.azure.com, s-0005-office.config.skype.com, na4.docusign.net.akadns.net, docucdn-a.akamaihd.net.edgesuite.net, mobile.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com, ecs-office.s-0005.s-msedge.net, a1737.b.akamai.net, clients2.google.com, edgedl.me.gvt1.com, s-0005.s-msedge.net, update.googleapis.com, onedscolprdeus15.eastus.cloudapp.azure.com, ecs.office.trafficmanager.net, clients.l.google.com, mobile.events.data.trafficmanager.net
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
VT rate limit hit for: (No subject) - 2024-10-31T090531.704.eml

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
239.255.255.250	Fw Message from Kevin - Update on Coles Supply Chain Modernisation 31-10-24.eml	Get hash	malicious	Unknown	Browse
	https://t.ly/4Nq2x	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse
	Metro Plastics Technologies.pdf	Get hash	malicious	Unknown	Browse
	https://concursolutions.us.com/a25kQvF4zrkinsa51n0h3rdanW1d07r9s0h3nW1	Get hash	malicious	Unknown	Browse
	SilverSEAL Corporation -RFQ_RFP_FSR Proposal.pdf	Get hash	malicious	Phisher	Browse
	https://my.toruftuiov.com/a43a39c3-796e-468c-aae4-b83c862e0918	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	https://hidrive.ionos.com/lnk/FamigcCEF	Get hash	malicious	Unknown	Browse
	https://growph.me/?gad_source=1&gclid=EAIaIQobChMI4cSUu72diQMVqGFIAB2rcRJoEAMYAiAAEgJQO_D_BwE	Get hash	malicious	HTMLPhisher	Browse
	http://djaahaf.r.af.d.sendibt2.com	Get hash	malicious	Unknown	Browse
104.47.64.28	Access Audits -System #6878.msg	Get hash	malicious	HTMLPhisher	Browse
	(No subject) (100).eml	Get hash	malicious	Tycoon2FA	Browse
	(No subject) (93).eml	Get hash	malicious	HTMLPhisher	Browse
	(No subject) (92).eml	Get hash	malicious	Unknown	Browse
	(No subject) (89).eml	Get hash	malicious	HTMLPhisher	Browse
	(No subject) (87).eml	Get hash	malicious	HTMLPhisher	Browse
	https://memakers-my.sharepoint.com/:f:/p/saeed/EuiMdoZoPpVNthIaEwKAedkBDFKyUdriWNhHe2RDzQxMdQ?e=5hQMeB&xsdata=MDV8MDJ8cGhlcm1hbkBidXJiYW5rY2EuZ292fDU4NDFjYjVhMjQzNDQ2YjU2ODZmMDhkY2Q3ZjZlNzZlfDY0OGRhZTMxMTgyYjRkYTI5OWVmMjU4MWFiOGU4YmVhfDB8MHw2Mzg2MjI3MDI2NDY5MTMzMDB8VW5rbm93bnxUV0ZwYkdac2IzZDhleUpXSWpvaU1DNHdMakF3TURBaUxDSlFJam9pVjJsdU16SWlMQ0pCVGlJNklrMWhhV3dpTENKWFZDSTZNbjA9fDQwMDAwfHx8&sdata=STFxSjJFWXZ2WnFoSWJsSml1L3V4emhPdHNVTmE5OWJmbjZsSDRKcjlyND0%3d	Get hash	malicious	HTMLPhisher	Browse
	(No subject) (82).eml	Get hash	malicious	Unknown	Browse
	[VM]_ New message in mailbox 2145 from _WATERBOARDS_ ..eml	Get hash	malicious	Unknown	Browse
	https://memakers-my.sharepoint.com/:f:/p/saeed/EuiMdoZoPpVNthIaEwKAedkBDFKyUdriWNhHe2RDzQxMdQ?e=5hQMeB&xsdata=MDV8MDJ8Y3RyYWJlckBidXJiYW5rY2EuZ292fDU4NDFjYjVhMjQzNDQ2YjU2ODZmMDhkY2Q3ZjZlNzZlfDY0OGRhZTMxMTgyYjRkYTI5OWVmMjU4MWFiOGU4YmVhfDB8MHw2Mzg2MjI3MDI2NTAzODc0MDJ8VW5rbm93bnxUV0ZwYkdac2IzZDhleUpXSWpvaU1DNHdMakF3TURBaUxDSlFJam9pVjJsdU16SWlMQ0pCVGlJNklrMWhhV3dpTENKWFZDSTZNbjA9fDQwMDAwfHx8&sdata=NENKTUZZU2szc0xpaVZyRHEzeVdOaE9HYnhiQ0dDZTdmRWF3QkpLU0tkaz0=	Get hash	malicious	HTMLPhisher	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
gcc02.safelinks.eop-tm2.outlook.com	Access Audits -System #6878.msg	Get hash	malicious	HTMLPhisher	Browse	104.47.64.28
	(No subject) (100).eml	Get hash	malicious	Tycoon2FA	Browse	104.47.64.28
	(No subject) (93).eml	Get hash	malicious	HTMLPhisher	Browse	104.47.64.28
	(No subject) (92).eml	Get hash	malicious	Unknown	Browse	104.47.64.28
	(No subject) (90).eml	Get hash	malicious	Unknown	Browse	104.47.65.28
	(No subject) (89).eml	Get hash	malicious	HTMLPhisher	Browse	104.47.65.28
	(No subject) (87).eml	Get hash	malicious	HTMLPhisher	Browse	104.47.64.28
	https://memakers-my.sharepoint.com/:f:/p/saeed/EuiMdoZoPpVNthIaEwKAedkBDFKyUdriWNhHe2RDzQxMdQ?e=5hQMeB&xsdata=MDV8MDJ8cGhlcm1hbkBidXJiYW5rY2EuZ292fDU4NDFjYjVhMjQzNDQ2YjU2ODZmMDhkY2Q3ZjZlNzZlfDY0OGRhZTMxMTgyYjRkYTI5OWVmMjU4MWFiOGU4YmVhfDB8MHw2Mzg2MjI3MDI2NDY5MTMzMDB8VW5rbm93bnxUV0ZwYkdac2IzZDhleUpXSWpvaU1DNHdMakF3TURBaUxDSlFJam9pVjJsdU16SWlMQ0pCVGlJNklrMWhhV3dpTENKWFZDSTZNbjA9fDQwMDAwfHx8&sdata=STFxSjJFWXZ2WnFoSWJsSml1L3V4emhPdHNVTmE5OWJmbjZsSDRKcjlyND0%3d	Get hash	malicious	HTMLPhisher	Browse	104.47.64.28
	(No subject) (82).eml	Get hash	malicious	Unknown	Browse	104.47.64.28
	[VM]_ New message in mailbox 2145 from _WATERBOARDS_ ..eml	Get hash	malicious	Unknown	Browse	104.47.64.28

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
MICROSOFT-CORP-MSN-AS-BLOCKUS	Fw Message from Kevin - Update on Coles Supply Chain Modernisation 31-10-24.eml	Get hash	malicious	Unknown	Browse	52.113.194.132
	https://t.ly/4Nq2x	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	13.107.253.44
	Update-KB4890-x86.exe	Get hash	malicious	Unknown	Browse	52.101.73.31
	http://djaahaf.r.af.d.sendibt2.com	Get hash	malicious	Unknown	Browse	150.171.28.10
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	20.96.153.111
	http://3d1.gmobb.jp/dcm299ccyag4e/gov/	Get hash	malicious	Phisher	Browse	20.33.55.12
	https://dzentec-my.sharepoint.com/:u:/g/personal/i_lahmer_entec-dz_com/EdYp5IxQ-uxJivnPAqSzv40BZiCX7sphz7Kj8JDyRBKqpQ?e=wqutC4	Get hash	malicious	Unknown	Browse	52.108.11.12
	https://onedrive.live.com/view.aspx?resid=8656653D19C3C7C0!s599af221dbfd41b9a607812ebc66d2cf&migratedtospo=true&redeem=aHR0cHM6Ly8xZHJ2Lm1zL28vYy84NjU2NjUzZDE5YzNjN2MwL0VpSHltbG45MjdsQnBnZUJMcnhtMHM4QjRNbHFPTTJWd0ZlQTFNLWNhZ0lnRkE_ZT1aak8wczY&wd=target%28Sezione%20senza%20titolo.one%7C99ad2a4b-5ecc-495f-9ce8-040ac62eb8f2%2F%5BExternal%5D%20-%20Invoice%20%27s%208808-%7C9e6e973e-3cda-429a-a28f-c51dc242e5b1%2F%29&wdorigin=NavigationUrl	Get hash	malicious	Unknown	Browse	52.108.11.12
	Orden de compra.xla.xlsx	Get hash	malicious	Unknown	Browse	13.107.246.45
	Orden de compra.xla.xlsx	Get hash	malicious	Unknown	Browse	13.107.253.45

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	https://t.ly/4Nq2x	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	20.109.210.53 184.28.90.27 20.12.23.50
	Metro Plastics Technologies.pdf	Get hash	malicious	Unknown	Browse	20.109.210.53 184.28.90.27 20.12.23.50
	https://concursolutions.us.com/a25kQvF4zrkinsa51n0h3rdanW1d07r9s0h3nW1	Get hash	malicious	Unknown	Browse	20.109.210.53 184.28.90.27 20.12.23.50
	SilverSEAL Corporation -RFQ_RFP_FSR Proposal.pdf	Get hash	malicious	Phisher	Browse	20.109.210.53 184.28.90.27 20.12.23.50
	https://my.toruftuiov.com/a43a39c3-796e-468c-aae4-b83c862e0918	Get hash	malicious	Unknown	Browse	20.109.210.53 184.28.90.27 20.12.23.50
	QUOTATION#09678.exe	Get hash	malicious	RedLine	Browse	20.109.210.53 184.28.90.27 20.12.23.50
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	20.109.210.53 184.28.90.27 20.12.23.50
	https://hidrive.ionos.com/lnk/FamigcCEF	Get hash	malicious	Unknown	Browse	20.109.210.53 184.28.90.27 20.12.23.50
	http://djaahaf.r.af.d.sendibt2.com	Get hash	malicious	Unknown	Browse	20.109.210.53 184.28.90.27 20.12.23.50
	http://www.kristinsacademy.com/?wptouch_switch=desktop&redirect=http://lagunaua.com	Get hash	malicious	HTMLPhisher	Browse	20.109.210.53 184.28.90.27 20.12.23.50

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	231348
Entropy (8bit):	4.397088498119976
Encrypted:	false
SSDEEP:	1536:j5YL41gsNa3Fore3KgsK8NcAz79ysQqt2gHUmqoQd2rcm0FvWHayGCSprAqlvemI:iqgxgDgYmiGu2OqoQIrt0FvgCeYNkB1
MD5:	76328A98D1A79B8558E77EE12BB5035C
SHA1:	381D4DF2C1A5707E8096BAB946082E0F3DBC4440
SHA-256:	4F87650E03F3FEAA058C0E7BEE5F22202AC55D9F49B1C1577632ED477F8FBF6D
SHA-512:	EACB4666B28887A4CA718C54F2A58001DA5D8D3D8FD06CE8D772D1F5DF44101294F8FC2CD58A9B18DD5DCD300037545E2FCB3884364197660C0E5C50EEBAAE4F
Malicious:	false
Reputation:	low
Preview:	TH02...... ..tW;.+......SM01X...,.....I;.+..........IPM.Activity...........h...............h............H..h4........G.....h............H..h\cal ...pDat...h ...0..........h.@.............h........_`Pk...hzC..@...I.lw...h....H...8.Uk...0....T...............d.........2h...............k..............!h.............. hO.W...........#h....8.........$h........8....."h.~.......}....'h..y...........1h.@..<.........0h....4....Uk../h....h.....UkH..h0...p...4.....-h ............+h>A......(................... ..............F7..............FIPM.Activity....Form....Standard....Journal Entry...IPM.Microsoft.FolderDesign.FormsDescription................F.k..........1122110020000000.GwwMicrosoft...This form is used to create journal entries.........kf...... ..........&...........(.......(... ...@.....................................................................................................................fffffffff........wwwwwwww.p....pp..............p...............pw..............pw..DDDDO..

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-shm

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.04591939678467531
Encrypted:	false
SSDEEP:	3:Gtlxtjl9tbml3vottlxtjl9tbml33/lljR9//8l1lvlll1lllwlvlllglbelDblx:GtTsottT0tX9X01PH4l942wU
MD5:	2B53A9D3DD59CDE42DBFD2CCB27D1418
SHA1:	E0194B04E44D465FACBFE7C6E793034DF9834BDA
SHA-256:	82EC2268A1EEE74B2153B7800464C5C57BDFE07681668421C1235E0468D993E9
SHA-512:	CD9512D8111F14EF44C5F6B991726A192E0618DAC5C0E2337A1EF02B5924191EA9A57F05426D5336EE5326DFFF713D508623D96FE58DD7546DD4B00D0A9D3EE4
Malicious:	false
Reputation:	low
Preview:	..-......................\.`......`...w3..O.^...-......................\.`......`...w3..O.^.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-wal

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	modified
Size (bytes):	49472
Entropy (8bit):	0.4841145634759912
Encrypted:	false
SSDEEP:	48:qJp8gQ1IMUll7DYMOcR+qzO8VFDYMN1BO8VFDYML:Opci/ll4HcQ6jVGOjVGC
MD5:	528A7EF019C80D80B60899FEBD445581
SHA1:	20656A0DA85C12E242438C805EB4F0719257AFDD
SHA-256:	88B3531DEA49AD7FBE374E4E5280C2E30ED12A1F870267B5A63950960B9DB583
SHA-512:	7978E0AAB896F36B2533C2A6A953A9CB935AC236DEAAA1EF36E8E42D4ACA0BE5DACF2BEBFFB239ED34894971B2E25D8C6C8CC0220B3108C882B4BAB81B909F7C
Malicious:	false
Reputation:	low
Preview:	7....-.............`...w5x..eE............`...w...H..4SQLite format 3......@ .......................................................................... .............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{0A6D8DF3-6320-4094-AAF6-4C38E47FCA82}.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	20176
Entropy (8bit):	3.882125367458284
Encrypted:	false
SSDEEP:	192:F6Y++QQhx8HZoooor0llQdmBcI5BVqn+pOw/mukHmNmj7LM2fm6UmdQAm5Cem:kY++QQhx85oooorN0J7uwHkBM2ai
MD5:	D786BE21923BB2616771D3C6721D36AD
SHA1:	21F6AE29F8504E6302F250D1C8ED58749C6755B6
SHA-256:	18279A933A53323A5A90F6BA464C203B33536D84F57283813EE7FD89A5AA98F8
SHA-512:	8A9747E7533BFA24F99DC44FFD7616D46CDA5163C01C9E60EDE2985BE769BFE2CAC4B0082C98271D09E5BCC0125B9883FC2888EE27F72A6FE73485A262E8FE68
Malicious:	false
Reputation:	low
Preview:	......Y.o.u. .d.o.n.'.t. .o.f.t.e.n. .g.e.t. .e.m.a.i.l. .f.r.o.m. .d.s.e._.n.a.4.@.d.o.c.u.s.i.g.n...n.e.t... .H.Y.P.E.R.L.I.N.K. .".h.t.t.p.s.:././.a.k.a...m.s./.L.e.a.r.n.A.b.o.u.t.S.e.n.d.e.r.I.d.e.n.t.i.f.i.c.a.t.i.o.n."...........................................................................................................................................................................................................................................................................................................................................2........................................................................................................................................................................................................................................................................................................................................................................................$.a$.*...$..$.If........!v..h.#v....:V.......t.....6......5.......4

C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1730390973785818400_2843F15A-A046-4E40-8493-39B4179C9EF6.log

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	ASCII text, with very long lines (28769), with CRLF line terminators
Category:	dropped
Size (bytes):	20971520
Entropy (8bit):	0.17661159256570175
Encrypted:	false
SSDEEP:	1536:Xzhf2dKITcZhk4HuS8Ch7MqSX1yo5MjkHogYK9bsTduBBV17diA1Pj/ykpq6XU9D:odd8hkdIanJiVV
MD5:	C3176F0875A29E9B365E4FA19065C3B6
SHA1:	C213DF53B12AF48A82D94B7085A6201B005ACBFA
SHA-256:	D8175FD85F368982F9D3F3DE0B086BAA9B0CC72A792BCA7D6285476B2B5B728D
SHA-512:	EBE37F09C7E17CBA50508AA78AC85EC4285695DF377875FFF930B355B52615AE4421B3A329CD00F4A1C9CF4FD3ED5633381B9550DCB77E85F6DAB3B79EC52FBE
Malicious:	false
Reputation:	low
Preview:	Timestamp.Process.TID.Area.Category.EventID.Level.Message.Correlation..10/31/2024 16:09:33.826.OUTLOOK (0x19F4).0x19F0.Microsoft Outlook.Telemetry Event.b7vzq.Medium.SendEvent {"EventName":"Office.Text.GDIAssistant.HandleCallback","Flags":30962256044949761,"InternalSequenceNumber":26,"Time":"2024-10-31T16:09:33.826Z","Contract":"Office.System.Activity","Activity.CV":"WvFDKEagQE6Ekzm0F5ye9g.4.11","Activity.Duration":12,"Activity.Count":1,"Activity.AggMode":0,"Activity.Success":true,"Data.GdiFamilyName":"","Data.CloudFontStatus":6,"Data.CloudFontTypes":256}...10/31/2024 16:09:33.842.OUTLOOK (0x19F4).0x19F0.Microsoft Outlook.Telemetry Event.b7vzq.Medium.SendEvent {"EventName":"Office.Text.ResourceClient.Deserialize","Flags":30962256044949761,"InternalSequenceNumber":28,"Time":"2024-10-31T16:09:33.842Z","Contract":"Office.System.Activity","Activity.CV":"WvFDKEagQE6Ekzm0F5ye9g.4.12","Activity.Duration":9800,"Activity.Count":1,"Activity.AggMode":0,"Activity.Success":true,"Data.JsonFileMajorV

C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1730390973786560500_2843F15A-A046-4E40-8493-39B4179C9EF6.log

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	20971520
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	8F4E33F3DC3E414FF94E5FB6905CBA8C
SHA1:	9674344C90C2F0646F0B78026E127C9B86E3AD77
SHA-256:	CD52D81E25F372E6FA4DB2C0DFCEB59862C1969CAB17096DA352B34950C973CC
SHA-512:	7FB91E868F3923BBD043725818EF3A5D8D08EBF1059A18AC0FE07040D32EEBA517DA11515E6A4AFAEB29BCC5E0F1543BA2C595B0FE8E6167DDC5E6793EDEF5BB
Malicious:	false
Reputation:	high, very likely benign file
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20241031T1209330586-6644.etl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	102400
Entropy (8bit):	4.4863701116198325
Encrypted:	false
SSDEEP:	768:1KQd1yjDoIMDEnrEQ+41g6lh9fIhK2YIZLXC+jbM6d9:kFQ4eo9fIhDVXt1
MD5:	3F158A237527FF0C9849C0BCA2AB3585
SHA1:	1726C156F62BA24E6E7B492918A62F235159BF92
SHA-256:	9F558C3C5A7E080A86367726937FA2BCEAF44A2272E5269102C47BC31241DEA4
SHA-512:	592C6BF15DE93A182E32095EC4D09633B88A94FDBBA61ED1694A2B0D45885CCC75D0F352CE35AC58D4945CB9F5B61BC85A864B0804F5321B6399D139748C1893
Malicious:	false
Preview:	............................................................................`...........].FF.+..................eJ..............Zb..2...................................,...@.t.z.r.e.s...d.l.l.,.-.1.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.1.1.1...........................................................@...Y..........].FF.+..........v.2._.O.U.T.L.O.O.K.:.1.9.f.4.:.5.e.2.d.1.4.3.9.f.f.0.f.4.4.2.5.8.5.5.3.f.4.4.2.c.0.1.6.9.2.6.4...C.:.\.U.s.e.r.s.\.c.a.l.i.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.O.u.t.l.o.o.k. .L.o.g.g.i.n.g.\.O.U.T.L.O.O.K._.1.6._.0._.1.6.8.2.7._.2.0.1.3.0.-.2.0.2.4.1.0.3.1.T.1.2.0.9.3.3.0.5.8.6.-.6.6.4.4...e.t.l.......P.P...........IF.+..........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Office\MSO3072.acl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	30
Entropy (8bit):	1.2389205950315936
Encrypted:	false
SSDEEP:	3:i57v:il
MD5:	811126A730B2F975DA08BCDA25233CC0
SHA1:	FADA3E80880C0146DB5280D76B1B7A9E6D66E934
SHA-256:	7C5078B0DDC6316DED95F9B8B4C3791F409444261663E6B41A2CF51925B98FC5
SHA-512:	852D3E2D3C253E9AD12B8E86E2D2B6A936BEF886F43497B7B0E26E740CF53F0E133E7616917C0A4C1E80C5E3BB317DBDF43B1E3553D2A5006929D32601D42CBF
Malicious:	false
Preview:	..............................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 31 15:09:46 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2673
Entropy (8bit):	3.9858211379868584
Encrypted:	false
SSDEEP:	48:8Ud8TAERHgidAKZdA1FehwiZUklqeh2y+3:8Ln4By
MD5:	6A78238E79D7BDFAFF469DCA455CCE26
SHA1:	1FB75856D80EC74237D8B16630E836D39FBE2F34
SHA-256:	8E4952676945716DB703A87D2766FD0DCAEB59FD77A1B44EF49D00A29AC46896
SHA-512:	74AA61CA8C1C732C1CCACE7FB4B764ABBABEF35B4B0F3A812BBE64955A217AA8CBB6535EF9BF12BA95D785367BDBFF4BD0FE7701D2C6CA3356A4E8F6BE14440B
Malicious:	false
Preview:	L..................F.@.. ...$+.,....l..M.+..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I_Y'.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V_Y6.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V_Y6.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V_Y6............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V_Y7............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........^\|......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 31 15:09:45 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2675
Entropy (8bit):	4.001247253471289
Encrypted:	false
SSDEEP:	48:8wd8TAERHgidAKZdA1seh/iZUkAQkqehxy+2:83nO9QEy
MD5:	24089AC5823B21C5AD03E5945AB53C19
SHA1:	68DC3830C391C8F9D92DFD45FE914F7917D20792
SHA-256:	4B756A858C2945F329AD482D9BEB93C74BAC371684AB353C881F02363F549CED
SHA-512:	513629361674D44211ECE155590BC0600A7D3579D777727E7BBAA856CCC1B5BB0E2C0787A820C17B8A3CC67FB38FF79498DD4ECCB170CA93F5E06FD9028B10F3
Malicious:	false
Preview:	L..................F.@.. ...$+.,.....=.M.+..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I_Y'.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V_Y6.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V_Y6.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V_Y6............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V_Y7............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........^\|......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2689
Entropy (8bit):	4.009603990279436
Encrypted:	false
SSDEEP:	48:84d8TAEAHgidAKZdA14meh7sFiZUkmgqeh7sny+BX:8PnVndy
MD5:	E12A54D6E70282EEE2B526C570350D8B
SHA1:	7AF8E42AC3ACC2124C377E3B13A09E1D3AEC6343
SHA-256:	ED980B2556DFE8168D2E7D598668EE7157355C11B1904759544767D5427E795D
SHA-512:	FE5C2C3285303967A50E2FA279DE3FAEFCADABB00396916DA23870B75472A959CC6096C63CD362F1CBDC60B6BF091FF78C382F6FA2331D8CFC9ABB4D8D8590D8
Malicious:	false
Preview:	L..................F.@.. ...$+.,.....Y.04...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I_Y'.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V_Y6.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V_Y6.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V_Y6............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VFW.E...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........^\|......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 31 15:09:45 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	4.000340188600224
Encrypted:	false
SSDEEP:	48:8jd8TAERHgidAKZdA1TehDiZUkwqehFy+R:8Knlvy
MD5:	113FC2A10773A102CDA45AA51F18C45D
SHA1:	CCD1BB4433B6E607C82FE1E169BA3BAD2B89D136
SHA-256:	3A7E66384F709EE4E0BE2F9B12E2ECF9C2AD07C2A1F81A0ACE5CC5AC666CBE0D
SHA-512:	F0FC37BBBBF9A7D1BC3721BCDBE6DC4CE9B3B1EF0D7668F18B36ED410801F68EB77E03DDEACDAFE739D76BA94D6F163597A9F159B3F0D748C537F6C0FA6E219B
Malicious:	false
Preview:	L..................F.@.. ...$+.,.....&.M.+..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I_Y'.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V_Y6.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V_Y6.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V_Y6............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V_Y7............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........^\|......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 31 15:09:46 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9877214936584746
Encrypted:	false
SSDEEP:	48:8wd8TAERHgidAKZdA1dehBiZUk1W1qehTy+C:83nV9zy
MD5:	6CE603EBB11B863FBA94F9D045EB34DE
SHA1:	6F18563CC79425F27A15FE9368F6E712494A7661
SHA-256:	580368B33FA839317516BA56455413806B1100D590C793A5AFB2582C9F9F9064
SHA-512:	600119B04501C8E71734279034429667F6405A6FA8975B0730110550A113BA0F890D0F1427312BF6ABC8BFA3F98F27E0ABB9F9BB9F90D6859E4DFBB29F7F8DAE
Malicious:	false
Preview:	L..................F.@.. ...$+.,....y,.M.+..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I_Y'.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V_Y6.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V_Y6.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V_Y6............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V_Y7............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........^\|......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 31 15:09:45 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.996238373992111
Encrypted:	false
SSDEEP:	48:80d8TAERHgidAKZdA1duTeehOuTbbiZUk5OjqehOuTbdy+yT+:8rndTfTbxWOvTbdy7T
MD5:	FDDB6621DC5ECFE68DAB9A3F8279E641
SHA1:	99086E246E298AE2DCDCD77194C89F1358D66FD9
SHA-256:	6324EBBFA94569485598F47DF0C6B0E2378D964C98925C67CDFD97859DF7FE10
SHA-512:	DB336CDB41BF35694509772322BB8168C26F571884D0D576F05262B0E793E515EC279E565D5A5C3C9E5C7D00BC6225D72DE90FC9B16485DF5055335F9D040464
Malicious:	false
Preview:	L..................F.@.. ...$+.,....UP.M.+..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I_Y'.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V_Y6.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V_Y6.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V_Y6............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V_Y7............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........^\|......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\Documents\Outlook Files\Outlook Data File - NoEmail.pst

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	Microsoft Outlook email folder (>=2003)
Category:	dropped
Size (bytes):	271360
Entropy (8bit):	3.3026928990304394
Encrypted:	false
SSDEEP:	6144:/LBdUnCEkNCEkrCEkaCEk/CEkTCEkqXCEk8pdd6LA:TBenCEkNCEkrCEkaCEk/CEkTCEkqXCEZ
MD5:	3C47833C859C1266707E524585F84EEF
SHA1:	E5075948D85D17D4C4E78FB4BA834997B52F7868
SHA-256:	C66F3EE1B0ADDCC879E434845FC17D755E48DF5CD9B0D3C97E9426FDF101504C
SHA-512:	1F15483BBFA9557B83EF4B3220E9AD639A6B813EC02DFEFCEE3D363F7F2B646E0DC3A9C363A323A48B3078EFDF9C040ED771F5A5462E7A2CEFC45C24A052651D
Malicious:	true
Preview:	!BDN.x..SM......\........O..............Y................@...........@...@...................................@...........................................................................$.......D..................................................................................................................................................................................................................................................................................................................................h.......^f.b.\A.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	4.621530442134387
Encrypted:	false
SSDEEP:	3072:rh3CEkNCEkrCEkaCEk/CEkyCEkqXCEk/V+bdnp9scQ0:rh3CEkNCEkrCEkaCEk/CEkyCEkqXCEk2
MD5:	B017B0341670F04FB02BC923EE3C0868
SHA1:	39B4C8E21EA1C52CF76A811E4A9AE8E411B235BE
SHA-256:	0E128135C87C410CC7F6BFED9D891E60F1A454924BA002A37B84E218326E2249
SHA-512:	24EAED2BAFD8053A4022523557BF59C23DA9BD93B1EE51E3125F725313F5F525E1BC70C1A5F046BC57A98E3058E2C9A24A32C963F088AB0731FCADA6D849414B
Malicious:	true
Preview:	YK9.0...y...........Xq%F.+.......D............#...........o..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................9.w.D......=P..0...z...........Xq%F.+.......B............#.........................................................................................................................................................................................................................................................................................................................................................................................................

Chrome Cache Entry: 66

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (13479), with CRLF line terminators
Category:	downloaded
Size (bytes):	13579
Entropy (8bit):	5.27337657330958
Encrypted:	false
SSDEEP:	192:5mprDN+sag6ifKIUpQI99P1tLm9kdgyq1+J3aCJQ+h4MPLORd:5mprxaefKI0LP19m4q1WW+h4Mjg
MD5:	2779F5D2F1F22353C726240E530016CC
SHA1:	2B3F380F212C8C64E79DB1F47FA25C114AFE6FBB
SHA-256:	16496529F57AC8915F194E00479B04AF942C33D7897BCFD9A55DD072BBEC1411
SHA-512:	14F4E6DB8D21EFA0A01DFE6AC5C6941807B3DA8875864D736476D480167A9C7B02E60E8BE19CC2F9526B3027684661F5B11D36D3A9D44096DF86B120AF8904E6
Malicious:	false
URL:	https://na4.docusign.net/Signing/client_scripts/jQuery/jquery-migrate-3.4.1.min.js
Preview:	/! jQuery Migrate v3.4.1 \| (c) OpenJS Foundation and other contributors \| jquery.org/license /.."undefined"==typeof jQuery.migrateMute&&(jQuery.migrateMute=!0),function(t){"use strict";"function"==typeof define&&define.amd?define(["jquery"],function(e){return t(e,window)}):"object"==typeof module&&module.exports?module.exports=t(require("jquery"),window):t(jQuery,window)}(function(s,n){"use strict";function e(e){return 0<=function(e,t){for(var r=/^(\d+)\.(\d+)\.(\d+)/,n=r.exec(e)\|\|[],o=r.exec(t)\|\|[],a=1;a<=3;a++){if(+o[a]<+n[a])return 1;if(+n[a]<+o[a])return-1}return 0}(s.fn.jquery,e)}s.migrateVersion="3.4.1";var t=Object.create(null);s.migrateDisablePatches=function(){for(var e=0;e<arguments.length;e++)t[arguments[e]]=!0},s.migrateEnablePatches=function(){for(var e=0;e<arguments.length;e++)delete t[arguments[e]]},s.migrateIsPatchEnabled=function(e){return!t[e]},n.console&&n.console.log&&(s&&e("3.0.0")&&!e("5.0.0")\|\|n.console.log("JQMIGRATE: jQuery 3.x-4.x REQUIRED"),s.migrateWarning

Chrome Cache Entry: 67

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	3896
Entropy (8bit):	4.786686051422741
Encrypted:	false
SSDEEP:	96:JvfEcgJcu5leSCSvraBYw9o01tedRnCKEpyWgoY:5EcgJ0SDvraBc0EEp+
MD5:	855476199961A10981ADCA7432CEC048
SHA1:	7995725A0CAC73EB6A2A1B5A8D5B162DBF47988E
SHA-256:	6DD60FAA0E35F2DFE342C452ED414A084D384D11793BD0F0EB03C2B1C6F1405C
SHA-512:	A9E61582FA18BCC1DD57DE8A7C194BAB0D6F733897F541A6E13B94906ADC115D65004F5A2649919FA8B8545F0C67C9313A14EAEAF42C34F630DA13CD38E17994
Malicious:	false
URL:	https://docucdn-a.akamaihd.net/olive/images/2.63.0/global-assets/ds-logo-inverse.svg
Preview:	<?xml version="1.0" encoding="utf-8"?>. Generator: Adobe Illustrator 28.1.0, SVG Export Plug-In . SVG Version: 6.00 Build 0) -->.<svg version="1.1" id="Layer_1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px".. viewBox="0 0 1200 241.4" style="enable-background:new 0 0 1200 241.4;" xml:space="preserve">.<style type="text/css">...st0{fill:#FFFFFF;}...st1{fill:#4C00FF;}...st2{fill:#FF5252;}.</style>.<g>..<g>...<g>....<path class="st0" d="M1169.2,109.7v78.7h-28.9v-73.5c0-17.9-7.7-27.9-22.7-27.9s-24.9,10.5-27.7,28.1c-0.8,4.2-1,10.7-1,24.4.....v48.8H1060v-125h25.6c0.1,1.1,0.7,12.3,0.7,13c0,0.9,1.1,1.4,1.8,0.8c10.6-8.4,22.3-16.2,38.6-16.2.....C1153.5,60.9,1169.2,79,1169.2,109.7z"/>....<path class="st0" d="M1013.4,63.4l-0.9,14.3c-0.1,0.9-1.2,1.4-1.8,0.8c-3.5-3.3-16.4-17.5-38.3-17.5c-31.4,0-54.5,27.1-54.5,63.9.....l0,0c0,37.3,22.9,64.5,54.5,64.5c21.1,0,34-13.7,36.4-16.7c0.7-0.8,2-0.3,2,0.7c-0.3,3.8-0.8,13.3-4,21.4.....c-4,10.2-13,19.7-31.1,19.7

Chrome Cache Entry: 68

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	119869
Entropy (8bit):	4.18401975910281
Encrypted:	false
SSDEEP:	1536:h5nLZxjaZ8x2R3Ud4FqBW92ZgyFqBW9sLBHdyoXwIWc1GO9GwIw6CTq14e7pnvaM:h5LZxjml1GO9xqB7pnva38
MD5:	ECE7A224F69AB2205D90900589AE1D05
SHA1:	3D861B816A5DA892C8A88D5755A5537C036239DE
SHA-256:	FFA8C6A4CE199BFD9E32B05E0E4DECE330C6A577FB3A0E8518291619C658C486
SHA-512:	EEF4BDD54AF95BE42224FFE605BB627293DAEA0C58A50B328ACC8B56040C81FDCB5EC8406F56856FC617A552E4D6DD28BB892467666889D27F03EE8BFCD16D7B
Malicious:	false
Preview:	/. DocuSign modified version of Mixpanel JS Library v2.2.1. * $initial_referer and $referer have been removed, as not to send any senstive information. * $initial_referring_domain and referring_domain have been retained.. . Mixpanel JS Library v2.2.1. . . * Copyright 2012, Mixpanel, Inc. All Rights Reserved. * http://mixpanel.com/. . Includes portions of Underscore.js. * http://documentcloud.github.com/underscore/. * (c) 2011 Jeremy Ashkenas, DocumentCloud Inc.. * Released under the MIT License.. /..// ==ClosureCompiler==.// @compilation_level ADVANCED_OPTIMIZATIONS.// @output_file_name mixpanel-2.2.min.js.// ==/ClosureCompiler==../.Will export window.mixpanel./../.SIMPLE STYLE GUIDE:..this.x == public function.this._x == internal - only use within this file.this.__x == private - only use within the class..Globals should be all caps./.(function(mixpanel) {. /. * Saved references to long variable names, so that closure compiler can. * minimize file size.. */. var

Chrome Cache Entry: 69

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	3896
Entropy (8bit):	4.786686051422741
Encrypted:	false
SSDEEP:	96:JvfEcgJcu5leSCSvraBYw9o01tedRnCKEpyWgoY:5EcgJ0SDvraBc0EEp+
MD5:	855476199961A10981ADCA7432CEC048
SHA1:	7995725A0CAC73EB6A2A1B5A8D5B162DBF47988E
SHA-256:	6DD60FAA0E35F2DFE342C452ED414A084D384D11793BD0F0EB03C2B1C6F1405C
SHA-512:	A9E61582FA18BCC1DD57DE8A7C194BAB0D6F733897F541A6E13B94906ADC115D65004F5A2649919FA8B8545F0C67C9313A14EAEAF42C34F630DA13CD38E17994
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>. Generator: Adobe Illustrator 28.1.0, SVG Export Plug-In . SVG Version: 6.00 Build 0) -->.<svg version="1.1" id="Layer_1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px".. viewBox="0 0 1200 241.4" style="enable-background:new 0 0 1200 241.4;" xml:space="preserve">.<style type="text/css">...st0{fill:#FFFFFF;}...st1{fill:#4C00FF;}...st2{fill:#FF5252;}.</style>.<g>..<g>...<g>....<path class="st0" d="M1169.2,109.7v78.7h-28.9v-73.5c0-17.9-7.7-27.9-22.7-27.9s-24.9,10.5-27.7,28.1c-0.8,4.2-1,10.7-1,24.4.....v48.8H1060v-125h25.6c0.1,1.1,0.7,12.3,0.7,13c0,0.9,1.1,1.4,1.8,0.8c10.6-8.4,22.3-16.2,38.6-16.2.....C1153.5,60.9,1169.2,79,1169.2,109.7z"/>....<path class="st0" d="M1013.4,63.4l-0.9,14.3c-0.1,0.9-1.2,1.4-1.8,0.8c-3.5-3.3-16.4-17.5-38.3-17.5c-31.4,0-54.5,27.1-54.5,63.9.....l0,0c0,37.3,22.9,64.5,54.5,64.5c21.1,0,34-13.7,36.4-16.7c0.7-0.8,2-0.3,2,0.7c-0.3,3.8-0.8,13.3-4,21.4.....c-4,10.2-13,19.7-31.1,19.7

Chrome Cache Entry: 70

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	119869
Entropy (8bit):	4.18401975910281
Encrypted:	false
SSDEEP:	1536:h5nLZxjaZ8x2R3Ud4FqBW92ZgyFqBW9sLBHdyoXwIWc1GO9GwIw6CTq14e7pnvaM:h5LZxjml1GO9xqB7pnva38
MD5:	ECE7A224F69AB2205D90900589AE1D05
SHA1:	3D861B816A5DA892C8A88D5755A5537C036239DE
SHA-256:	FFA8C6A4CE199BFD9E32B05E0E4DECE330C6A577FB3A0E8518291619C658C486
SHA-512:	EEF4BDD54AF95BE42224FFE605BB627293DAEA0C58A50B328ACC8B56040C81FDCB5EC8406F56856FC617A552E4D6DD28BB892467666889D27F03EE8BFCD16D7B
Malicious:	false
URL:	https://docucdn-a.akamaihd.net/v/static/mixpanel-2-2-1b.js
Preview:	/. DocuSign modified version of Mixpanel JS Library v2.2.1. * $initial_referer and $referer have been removed, as not to send any senstive information. * $initial_referring_domain and referring_domain have been retained.. . Mixpanel JS Library v2.2.1. . . * Copyright 2012, Mixpanel, Inc. All Rights Reserved. * http://mixpanel.com/. . Includes portions of Underscore.js. * http://documentcloud.github.com/underscore/. * (c) 2011 Jeremy Ashkenas, DocumentCloud Inc.. * Released under the MIT License.. /..// ==ClosureCompiler==.// @compilation_level ADVANCED_OPTIMIZATIONS.// @output_file_name mixpanel-2.2.min.js.// ==/ClosureCompiler==../.Will export window.mixpanel./../.SIMPLE STYLE GUIDE:..this.x == public function.this._x == internal - only use within this file.this.__x == private - only use within the class..Globals should be all caps./.(function(mixpanel) {. /. * Saved references to long variable names, so that closure compiler can. * minimize file size.. */. var

Chrome Cache Entry: 71

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format, CFF, length 33752, version 0.0
Category:	downloaded
Size (bytes):	33752
Entropy (8bit):	7.984139047245452
Encrypted:	false
SSDEEP:	768:8VyJ64rZFHKtB7wvkAKE0/40pQeOSHKOfITzE1SRSgyTAIW4l8:mbeZJOSvkFB/40p/HKOfI8gyTAcC
MD5:	4DE7535F6F5DF8D5437C21C068DDB0EC
SHA1:	3553204B4624CA41CF1C4F3BD9B37D8C968CBA23
SHA-256:	8F6A520A392FF62149E5FC5AA87BFAB9B3816CD6010D4D4FCA194E8683CA498B
SHA-512:	E2A9B45F69BD1CBCF0D5F3710BECFACF6A28AF0A9FD034262F6AF4803628DADCE4C2FCC385758F88130AB68D362F3694ED786D0971CF7FD7E8FAF6CD1C2860DE
Malicious:	false
URL:	https://docucdn-a.akamaihd.net/production/1ds/widgets/@ds/signing/24.10.26-8/fonts/maven-pro/MavenPro-Bold.woff
Preview:	wOFFOTTO...........x........................CFF ......Om......FFTM...h........Z...GDEF..T........ ....GPOS..TH..-....DiP}7GSUB..T(... ... l.t.OS/2.......H...`...Ccmap.......\|....#G..head...0...3...6....hhea...d... ...$.U.>hmtx.......Q...X.Xl7maxp..............P.name.......4....N...post........... .j.fx.c`d```d8...l<..W.n...8..2.F.../..)...:..&.(..v...x.c`d``../........g.2.EP.5.......P.....x.c`b.......u..1...<.f........p...).,fP`P...._....N.u05..X.@r.L.GP..x.m.1O.A.....(...XL...K....+.[...-..@.A....6..K...e#.x..\|.......^.p..PzV...s...=7q.O..z..+.xn.R=Q.....m.Y.......s..><........6n..c.lq@..klPC.....!".,AJ.`N.e.&.L....F..7g..&..w<.J...P..M-..@.Q.Kz.yn.)dRg...B..J...v:....gR.vFC..N.2....PF0..=.)V.,..{..LY.g"...;9..]p..2n!f....IW67..a.%.mO..-......iXax.c```f.`..F..8..1..,..........P..a)........L..(.(H).)().)X).QTz..........@....1.AU.+H(.UZBU2.................n...}.`...V=X.`.I...Q8.z....#..A.L.,.l...\.<.\|...B.".b...R.2.r...J..j...Z.:.z...F.&.f...V.6.v...N...n...

Chrome Cache Entry: 72

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with CRLF line terminators
Category:	downloaded
Size (bytes):	4739
Entropy (8bit):	4.736490039075709
Encrypted:	false
SSDEEP:	96:mbr63wlBqhA2/EB9CkxgfFLFA31vlKn4aXtYly:mQwlBqh8PaF5A3ZlKn4CtYly
MD5:	4B86605C4B80FA75342703878E7DFF13
SHA1:	6EF59F904C58E88B3E143BA3DA464AFE63FDC188
SHA-256:	2F186CDFA13B6CA51F69D44BAC8A7D5B69E1D5409A68D21F5768A87C6DFDB3A1
SHA-512:	B493241426AB5A1B75D1455720E84AB27A2B7E176FDF782ECB14B26004F5553FD306DCAE14C17CE788891FDBCAE9A32A5E22CB187C6BCE66486B89A0E5028AD9
Malicious:	false
URL:	https://na4.docusign.net/Signing/StyleSheets/Framework.css
Preview:	/-----------------------/..../* needs brackets to swallow error on dev /..{..}..../ This file contains the styles needed for the 2014 rebrand /..html {.. / Prevent font suserng in landscape while allowing user zoom /.. / Use 100% here, NEVER none. See http://blog.55minutes.com/2012/04/iphone-text-resizing/ /.. -webkit-text-size-adjust: 100%;..}..body {.. margin: 0;.. background-image: none;.. background-color: #EAEAEA;.. font-family: "Helvetica Neue", Arial, sans-serif !important;..}...Header {.. display: none;..}...scroll-area {.. position: absolute;.. overflow: auto;.. overflow-x: hidden;.. top: 0;.. left: 0;.. right: 0;.. bottom: 0;.. min-width: 1024px;..}...scroll-area, .Border.scroll-area {.. overflow-x: auto;..}...scroll-container {.. border-bottom: none;.. position: static;..}...clear {.. clear: both;..}..../ site content - centered w/ max-width and padding */...site-content {.. margin: 0 auto;.. max-wid

Chrome Cache Entry: 73

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65446), with CRLF line terminators
Category:	dropped
Size (bytes):	89797
Entropy (8bit):	5.291128696884303
Encrypted:	false
SSDEEP:	1536:VjjxXUHunxDjoXEZxkMV4PYDt0zxxf6gP3f8cApoEGOzZTBqUsuy8WnKdXwhLQvv:VeeIygP3fulzhsz8jlvaDioQ47GKK
MD5:	954F70F07F05742168ADCEBA796DDA72
SHA1:	EDF8A6A066F201B1FFAD32C585BD79C9982D4433
SHA-256:	4DA87C258ECA460D39CDB0F6158CBF69AF539D05A1D14F1BC011518511D02228
SHA-512:	66EE57172810E0002C308C1FD5FC008C1C64573602627CA0313D97742D830C72BB7D26DD3B069E1835C5E3D6F8721F856809EB9CCEF18CE8934FF7758F645717
Malicious:	false
Preview:	/! jQuery v3.6.4 \| (c) OpenJS Foundation and other contributors \| jquery.org/license /..!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery requires a window with a document");return t(e)}:t(e)}("undefined"!=typeof window?window:this,function(C,e){"use strict";var t=[],r=Object.getPrototypeOf,s=t.slice,g=t.flat?function(e){return t.flat.call(e)}:function(e){return t.concat.apply([],e)},u=t.push,i=t.indexOf,n={},o=n.toString,y=n.hasOwnProperty,a=y.toString,l=a.call(Object),v={},m=function(e){return"function"==typeof e&&"number"!=typeof e.nodeType&&"function"!=typeof e.item},x=function(e){return null!=e&&e===e.window},E=C.document,c={type:!0,src:!0,nonce:!0,noModule:!0};function b(e,t,n){var r,i,o=(n=n\|\|E).createElement("script");if(o.text=e,t)for(r in c)(i=t[r]\|\|t.getAttribute&&t.getAttribute(r))&&o.setAttribute(r,i);n.head.appendChild(o).parentNode.removeChild(o)}func

Chrome Cache Entry: 74

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 10 x 10, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2961
Entropy (8bit):	7.876188909726169
Encrypted:	false
SSDEEP:	48:VvVe5e5QkDntvY2jl4qHftvx1qtZQ9J7kxzahysneTDLfZJDsbOWeKO4x:VvyWDtvYQtHfxKc7OnseTDLfZJDsR
MD5:	C863DB426897325CB4805B2C20F51F30
SHA1:	A426FE43F0CE1A489CE091CC27768CDCC2991210
SHA-256:	2A5179B8851C8E3DFC77D7DCB33B3963AFA037608336D6AE412ACAA38AD59D22
SHA-512:	90DA76303CDE0B81F183709D94DC96B5C3EA7B7766948AF5B81E1EBE4B887012FC611F6A0CFC50873E80AF7B73077F7CB8BD5F254A4F4848C632A68733522A68
Malicious:	false
Preview:	.PNG........IHDR..............2.....gAMA....\|.Q.... cHRM...........R...@..}y.....<.....s<.w...9iCCPPhotoshop ICC profile..H..wTT....wz..0..z..0... ..Q.f......Ml..@D...E......H..b!(.`.H.Pb0...dF.J\|yy.......g.s..{....$O../... .'..z8.W.G....x....0Y.A..@$/7.z........H..e..O...O.T...._..lN:K.."N.....3"..$..F../JP.rb.[.}..Q..d.[..S..l1..x{..#b.G...\N..o.X3I....[ql2.....$..8.x.......t..r.p../8...p...C...f.q....K.njm.{r2.8...?......).L^6..g.,.qm."[.Z[Z....~Q....7%.."....3......R..`.j...[.~.:.. w....!.$E}k...yh.y...Rm..333..........:..}.=#.v.....e...tq.X)I)B>==......<..8..X....9<QD.h..8Q.yl....sy....0.OZ.k.(...5..H....>.....yP..........:.8......p.........Lg....k.k...$.......t.!0.V..8.7....`.........2A....@.....JP..A#h.'@.8.....:....`....`......a!2D..!UH.2.. .d..A>P ..ECq...B.......Z....:.]..B..=h...~....L...2...........5p.......N..........:\|......@...QC.....!.H,.G6 .H9R.. ]H/r..A..w(......Q.(OT...JCm@..QGQ...-.(j...MF+...6h/.t.:.]..G7....w...7......Xa<1..

Chrome Cache Entry: 75

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	downloaded
Size (bytes):	2048
Entropy (8bit):	4.886793296383126
Encrypted:	false
SSDEEP:	48:e6m7eDwLO/T/6kok/TF/c4kb30m3ZP0ZopAa:JmSq8Nok/TF/Tkb30m3ZP0Na
MD5:	3165AF715E6BA5CA2B00F9AB5277CC8C
SHA1:	99697540AAC85B979624E1A09483418A4C30BD11
SHA-256:	08034C30A67418DD7BFF599A0EA4ECB87315D485ADB3BD1774AFC36B33705317
SHA-512:	9B62C145664DA8EE0C6B8C719B7468848F1E1F87CBD9DAFBBF878FCCE9F72E5569A7FCA13C01FC408ADB6B8C5B4F2393BBB93B5077BA02CA816C2DE7937EFA5E
Malicious:	false
URL:	https://na4.docusign.net/Signing/StyleSheetsDev/ErrorExpired.css
Preview:	..btn {.. background: #111;.. border: 1px solid #111;.. border-radius: 2px;.. cursor: pointer;.. color: #fff;.. display: inline-block;.. font-family: "Maven Pro","Helvetica Neue",HelveticaNeue,Helvetica,Arial,sans-serif;.. font-size: 12px;.. letter-spacing: .6px;.. line-height: 1;.. min-width: 55px;.. margin: 0;.. padding: 7px 14px;.. position: relative;.. text-align: center;.. text-decoration: none!important;.. text-transform: uppercase;.. font-weight: bold;..}.....btn-main, .btn-main.disabled:hover, .btn-main[disabled]:hover {.. background: #ffc820;.. border-color: #ffc820;.. color: #333;..}.....btn-lg {.. font-size: 14px;.. padding: 9px 18px;..}.....expireActionDiv {.. float: left;.. width:50%;..}.....expireActionDiv .newLink {.. margin-left: 50px;..}.....expireActionAccountless{.. text-align: center;..}.....expireActionAccountless .newLink{..}.....freshLink {.. margin-top: 10px;..}.....expireActio

Chrome Cache Entry: 76

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (13479), with CRLF line terminators
Category:	dropped
Size (bytes):	13579
Entropy (8bit):	5.27337657330958
Encrypted:	false
SSDEEP:	192:5mprDN+sag6ifKIUpQI99P1tLm9kdgyq1+J3aCJQ+h4MPLORd:5mprxaefKI0LP19m4q1WW+h4Mjg
MD5:	2779F5D2F1F22353C726240E530016CC
SHA1:	2B3F380F212C8C64E79DB1F47FA25C114AFE6FBB
SHA-256:	16496529F57AC8915F194E00479B04AF942C33D7897BCFD9A55DD072BBEC1411
SHA-512:	14F4E6DB8D21EFA0A01DFE6AC5C6941807B3DA8875864D736476D480167A9C7B02E60E8BE19CC2F9526B3027684661F5B11D36D3A9D44096DF86B120AF8904E6
Malicious:	false
Preview:	/! jQuery Migrate v3.4.1 \| (c) OpenJS Foundation and other contributors \| jquery.org/license /.."undefined"==typeof jQuery.migrateMute&&(jQuery.migrateMute=!0),function(t){"use strict";"function"==typeof define&&define.amd?define(["jquery"],function(e){return t(e,window)}):"object"==typeof module&&module.exports?module.exports=t(require("jquery"),window):t(jQuery,window)}(function(s,n){"use strict";function e(e){return 0<=function(e,t){for(var r=/^(\d+)\.(\d+)\.(\d+)/,n=r.exec(e)\|\|[],o=r.exec(t)\|\|[],a=1;a<=3;a++){if(+o[a]<+n[a])return 1;if(+n[a]<+o[a])return-1}return 0}(s.fn.jquery,e)}s.migrateVersion="3.4.1";var t=Object.create(null);s.migrateDisablePatches=function(){for(var e=0;e<arguments.length;e++)t[arguments[e]]=!0},s.migrateEnablePatches=function(){for(var e=0;e<arguments.length;e++)delete t[arguments[e]]},s.migrateIsPatchEnabled=function(e){return!t[e]},n.console&&n.console.log&&(s&&e("3.0.0")&&!e("5.0.0")\|\|n.console.log("JQMIGRATE: jQuery 3.x-4.x REQUIRED"),s.migrateWarning

Chrome Cache Entry: 77

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 643 x 261, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	13702
Entropy (8bit):	7.8986608011417285
Encrypted:	false
SSDEEP:	384:HSmSjs2UiEATeIi1u4k01h3LnnkTmw4Pl7VFLo9C8KwtD:ymWEi+h1Q0f7nnkTmtRVFL0djt
MD5:	5CC1977B21BF780731B87028942FFD6D
SHA1:	80D7113EF2323BC839FC79BF43FD37C4D7E03993
SHA-256:	CDFA2C94A06FA985649F2853A1D1BC2C64CD1B487B5EB6EBB2DCFAAEA5DE2FB9
SHA-512:	601E493D5ED694D50897B17E37BE93C37A63FC4DB15E07ACE8CE1F693EDC44370061729D0C5671D5D96D6A9D7205FA7237FE00BC8E7CB50AB0BDBFB132D48962
Malicious:	false
Preview:	.PNG........IHDR...............z.....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.paint.net 4.0.6..c...4.IDATx^....\U..q...O.......#v...~PZD..Z..RV...PQA.T.@E....b.[..kh...t.-]i-.{..i.f.d&3...%....4L'..{g.9....q.J'...9'..;...DDDT>,1..Q9..DDD........KLDDTN,1..Q9..DDD........KLDDTN,1..Q9..DDD........KLDDTN,1..Q9..DDD........KLDDTN,1..Q9..DDD........KLDDTN.....K.'"..KL..\.DD.`......,1Q.r....%&.C.{""{..Dy.uODd...(........!.=..=Xb.<.'"..KL..\.DD.`......,1Q.r....%&.C.{""{..Dy.uODd...(.........zzz".H4...b.x<.L.t.t.u...8..3.[...v\..J^(..KL..\.De.......Ot./......q.."\..b...(...J%...h.].Q.Le.....l..,..KL..\.D6C.b.X..1T.6.....JVS......-.Fmmmr..K.{"......'.H..)......._b.....p.....F....Yr..I.{"...~g..?.d. .G."...8 nll..O.#W...={N.<)'..'*..S(...."f...?..S..D....0...F8&f....@$.Q.1`..G...{...J.c...s.....q.`..7.+.....A.....Xb.&..P(..G.....wY.....Xb. /78..Q(;............y..d/..<"..`?&.C.....a..^,1yA$.....pC...8..g.....g....~....g.P..;.6.....5.

Chrome Cache Entry: 78

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 10 x 10, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	2961
Entropy (8bit):	7.876188909726169
Encrypted:	false
SSDEEP:	48:VvVe5e5QkDntvY2jl4qHftvx1qtZQ9J7kxzahysneTDLfZJDsbOWeKO4x:VvyWDtvYQtHfxKc7OnseTDLfZJDsR
MD5:	C863DB426897325CB4805B2C20F51F30
SHA1:	A426FE43F0CE1A489CE091CC27768CDCC2991210
SHA-256:	2A5179B8851C8E3DFC77D7DCB33B3963AFA037608336D6AE412ACAA38AD59D22
SHA-512:	90DA76303CDE0B81F183709D94DC96B5C3EA7B7766948AF5B81E1EBE4B887012FC611F6A0CFC50873E80AF7B73077F7CB8BD5F254A4F4848C632A68733522A68
Malicious:	false
URL:	https://na4.docusign.net/Signing/Images/controls/btn_arrow_u.png
Preview:	.PNG........IHDR..............2.....gAMA....\|.Q.... cHRM...........R...@..}y.....<.....s<.w...9iCCPPhotoshop ICC profile..H..wTT....wz..0..z..0... ..Q.f......Ml..@D...E......H..b!(.`.H.Pb0...dF.J\|yy.......g.s..{....$O../... .'..z8.W.G....x....0Y.A..@$/7.z........H..e..O...O.T...._..lN:K.."N.....3"..$..F../JP.rb.[.}..Q..d.[..S..l1..x{..#b.G...\N..o.X3I....[ql2.....$..8.x.......t..r.p../8...p...C...f.q....K.njm.{r2.8...?......).L^6..g.,.qm."[.Z[Z....~Q....7%.."....3......R..`.j...[.~.:.. w....!.$E}k...yh.y...Rm..333..........:..}.=#.v.....e...tq.X)I)B>==......<..8..X....9<QD.h..8Q.yl....sy....0.OZ.k.(...5..H....>.....yP..........:.8......p.........Lg....k.k...$.......t.!0.V..8.7....`.........2A....@.....JP..A#h.'@.8.....:....`....`......a!2D..!UH.2.. .d..A>P ..ECq...B.......Z....:.]..B..=h...~....L...2...........5p.......N..........:\|......@...QC.....!.H,.G6 .H9R.. ]H/r..A..w(......Q.(OT...JCm@..QGQ...-.(j...MF+...6h/.t.:.]..G7....w...7......Xa<1..

Chrome Cache Entry: 79

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	326
Entropy (8bit):	6.860674885804344
Encrypted:	false
SSDEEP:	6:6v/lhPe/6TsR/rnMXvFGVAkFjqYCm8BQ5XIYDg/jruT0l8pgVy6EybrNcVp:6v/7m/6Ts/rnAF4nFWF5BQWdae82yXys
MD5:	AFE00DB89CE086B91A541C227EDBF136
SHA1:	961B2EE6FB39C4D515BDC49EC1BA688B0916F104
SHA-256:	E11827C678AF8519E702F364E525AC34509CAD49F8D839677E089949EDDA060E
SHA-512:	85F265A917E83BA92FEDB2152FBFADA273FCFF2937A85B080641307FD2E61D0138493162883E016796C9F68062A01D79DA60F546EFC2CB1FB4078760EB3451F0
Malicious:	false
Preview:	.PNG........IHDR................a....pHYs.................sRGB.........gAMA......a.....IDATx.....0...Uq...UP.\|..v.K.>.O`.$.[.B....'pvJ}..B..P.h...I.!.rs.%.$....O"r!.I.m....J..........U.. ..F[.....j4<...6.b6.T!x..Y..]..;._.,..........K.F..b.~.$..M.......M....,...i....*.z...x8."C.r.{.2~.~........x...B.G.6.....IEND.B`.

Chrome Cache Entry: 80

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65446), with CRLF line terminators
Category:	downloaded
Size (bytes):	89797
Entropy (8bit):	5.291128696884303
Encrypted:	false
SSDEEP:	1536:VjjxXUHunxDjoXEZxkMV4PYDt0zxxf6gP3f8cApoEGOzZTBqUsuy8WnKdXwhLQvv:VeeIygP3fulzhsz8jlvaDioQ47GKK
MD5:	954F70F07F05742168ADCEBA796DDA72
SHA1:	EDF8A6A066F201B1FFAD32C585BD79C9982D4433
SHA-256:	4DA87C258ECA460D39CDB0F6158CBF69AF539D05A1D14F1BC011518511D02228
SHA-512:	66EE57172810E0002C308C1FD5FC008C1C64573602627CA0313D97742D830C72BB7D26DD3B069E1835C5E3D6F8721F856809EB9CCEF18CE8934FF7758F645717
Malicious:	false
URL:	https://na4.docusign.net/Signing/client_scripts/jQuery/jquery-3.6.4.min.js
Preview:	/! jQuery v3.6.4 \| (c) OpenJS Foundation and other contributors \| jquery.org/license /..!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery requires a window with a document");return t(e)}:t(e)}("undefined"!=typeof window?window:this,function(C,e){"use strict";var t=[],r=Object.getPrototypeOf,s=t.slice,g=t.flat?function(e){return t.flat.call(e)}:function(e){return t.concat.apply([],e)},u=t.push,i=t.indexOf,n={},o=n.toString,y=n.hasOwnProperty,a=y.toString,l=a.call(Object),v={},m=function(e){return"function"==typeof e&&"number"!=typeof e.nodeType&&"function"!=typeof e.item},x=function(e){return null!=e&&e===e.window},E=C.document,c={type:!0,src:!0,nonce:!0,noModule:!0};function b(e,t,n){var r,i,o=(n=n\|\|E).createElement("script");if(o.text=e,t)for(r in c)(i=t[r]\|\|t.getAttribute&&t.getAttribute(r))&&o.setAttribute(r,i);n.head.appendChild(o).parentNode.removeChild(o)}func

Chrome Cache Entry: 81

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 643 x 261, 8-bit/color RGB, non-interlaced
Category:	downloaded
Size (bytes):	13702
Entropy (8bit):	7.8986608011417285
Encrypted:	false
SSDEEP:	384:HSmSjs2UiEATeIi1u4k01h3LnnkTmw4Pl7VFLo9C8KwtD:ymWEi+h1Q0f7nnkTmtRVFL0djt
MD5:	5CC1977B21BF780731B87028942FFD6D
SHA1:	80D7113EF2323BC839FC79BF43FD37C4D7E03993
SHA-256:	CDFA2C94A06FA985649F2853A1D1BC2C64CD1B487B5EB6EBB2DCFAAEA5DE2FB9
SHA-512:	601E493D5ED694D50897B17E37BE93C37A63FC4DB15E07ACE8CE1F693EDC44370061729D0C5671D5D96D6A9D7205FA7237FE00BC8E7CB50AB0BDBFB132D48962
Malicious:	false
URL:	https://na4.docusign.net/Signing/Images/linkExpired/linkExpired.png
Preview:	.PNG........IHDR...............z.....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.paint.net 4.0.6..c...4.IDATx^....\U..q...O.......#v...~PZD..Z..RV...PQA.T.@E....b.[..kh...t.-]i-.{..i.f.d&3...%....4L'..{g.9....q.J'...9'..;...DDDT>,1..Q9..DDD........KLDDTN,1..Q9..DDD........KLDDTN,1..Q9..DDD........KLDDTN,1..Q9..DDD........KLDDTN,1..Q9..DDD........KLDDTN.....K.'"..KL..\.DD.`......,1Q.r....%&.C.{""{..Dy.uODd...(........!.=..=Xb.<.'"..KL..\.DD.`......,1Q.r....%&.C.{""{..Dy.uODd...(.........zzz".H4...b.x<.L.t.t.u...8..3.[...v\..J^(..KL..\.De.......Ot./......q.."\..b...(...J%...h.].Q.Le.....l..,..KL..\.D6C.b.X..1T.6.....JVS......-.Fmmmr..K.{"......'.H..)......._b.....p.....F....Yr..I.{"...~g..?.d. .G."...8 nll..O.#W...={N.<)'..'*..S(...."f...?..S..D....0...F8&f....@$.Q.1`..G...{...J.c...s.....q.`..7.+.....A.....Xb.&..P(..G.....wY.....Xb. /78..Q(;............y..d/..<"..`?&.C.....a..^,1yA$.....pC...8..g.....g....~....g.P..;.6.....5.

Chrome Cache Entry: 82

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	3728
Entropy (8bit):	4.718277261919778
Encrypted:	false
SSDEEP:	96:JvfEcg0UqvMcOAvXa4zwjo0HtedznCOpKpFWgot:5Ecg04cXvXa4f0Y4p0
MD5:	EC396047518A7FEF11D53D1B4F6BE65B
SHA1:	E3BEC4CDAF5567641517A23019ADBFA2328B0A7F
SHA-256:	8F77CFC832517C619BC1B8D82A6A478EE18D97442B4C78B006B0286CEC91E1A8
SHA-512:	34AD62B5CC5EE5C950F340D65800102AE1CD06D34D24A611E7AC2CB9F23308AC96AC669D3B226C258DC6F862D985030EC3D5BB29609ECFEDF34E14F8F48529EB
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>. Generator: Adobe Illustrator 28.1.0, SVG Export Plug-In . SVG Version: 6.00 Build 0) -->.<svg version="1.1" id="Layer_1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px".. viewBox="0 0 1200 241.4" style="enable-background:new 0 0 1200 241.4;" xml:space="preserve">.<style type="text/css">...st0{fill:#4C00FF;}...st1{fill:#FF5252;}.</style>.<g>..<g>...<g>....<path d="M1169.2,109.7v78.7h-28.9v-73.5c0-17.9-7.7-27.9-22.7-27.9s-24.9,10.5-27.7,28.1c-0.8,4.2-1,10.7-1,24.4v48.8H1060v-125.....h25.6c0.1,1.1,0.7,12.3,0.7,13c0,0.9,1.1,1.4,1.8,0.8c10.6-8.4,22.3-16.2,38.6-16.2C1153.5,60.9,1169.2,79,1169.2,109.7z"/>....<path d="M1013.4,63.4l-0.9,14.3c-0.1,0.9-1.2,1.4-1.8,0.8c-3.5-3.3-16.4-17.5-38.3-17.5c-31.4,0-54.5,27.1-54.5,63.9l0,0.....c0,37.3,22.9,64.5,54.5,64.5c21.1,0,34-13.7,36.4-16.7c0.7-0.8,2-0.3,2,0.7c-0.3,3.8-0.8,13.3-4,21.4c-4,10.2-13,19.7-31.1,19.7.....c-14.9,0-28.1-5.7-40.6-17.9L920,217.3c13.7,15.5,35

Chrome Cache Entry: 83

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	326
Entropy (8bit):	6.860674885804344
Encrypted:	false
SSDEEP:	6:6v/lhPe/6TsR/rnMXvFGVAkFjqYCm8BQ5XIYDg/jruT0l8pgVy6EybrNcVp:6v/7m/6Ts/rnAF4nFWF5BQWdae82yXys
MD5:	AFE00DB89CE086B91A541C227EDBF136
SHA1:	961B2EE6FB39C4D515BDC49EC1BA688B0916F104
SHA-256:	E11827C678AF8519E702F364E525AC34509CAD49F8D839677E089949EDDA060E
SHA-512:	85F265A917E83BA92FEDB2152FBFADA273FCFF2937A85B080641307FD2E61D0138493162883E016796C9F68062A01D79DA60F546EFC2CB1FB4078760EB3451F0
Malicious:	false
URL:	https://docucdn-a.akamaihd.net/olive/images/2.63.0/global-assets/ds-icons-favicon-default-16x16.png
Preview:	.PNG........IHDR................a....pHYs.................sRGB.........gAMA......a.....IDATx.....0...Uq...UP.\|..v.K.>.O`.$.[.B....'pvJ}..B..P.h...I.!.rs.%.$....O"r!.I.m....J..........U.. ..F[.....j4<...6.b6.T!x..Y..]..;._.,..........K.F..b.~.$..M.......M....,...i....*.z...x8."C.r.{.2~.~........x...B.G.6.....IEND.B`.

Chrome Cache Entry: 84

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	788
Entropy (8bit):	4.9019698351522845
Encrypted:	false
SSDEEP:	24:LrOb6MnezMoVTAN/jYme6MfzMVVTJ2jYy4:LrOG1jV0Njrr6AVMj74
MD5:	CB4FD3AF4DEEBD7277FCD75A576BF633
SHA1:	71A7BC5DE0F92581F2A9F8DCED86578E01B4856C
SHA-256:	F6C29AE65E37D866FEFB836DB488C4D044414798EC995B2B69CD067949938DD9
SHA-512:	1507C60248859484296F0CF5D1D0AB73BA4B2522A8D05C37773E45AE57C381BFC1FBFC1E38C2F1EE4DB626C1E4AF8C973B38FAD6C5FD74A4423FD78CFEE47E85
Malicious:	false
URL:	https://docucdn-a.akamaihd.net/production/1ds/widgets/@ds/signing/24.10.26-8/css/font-faces.css?cs=7aa34814
Preview:	/ mix ins /..list-no-style {. list-style: none;. padding-left: 0;.}.@font-face {. font-family: 'Maven Pro';. src: url('../fonts/maven-pro/MavenPro-Regular.eot');. src: url('../fonts/maven-pro/MavenPro-Regular.eot?#iefix') format('embedded-opentype'), url('../fonts/maven-pro/MavenPro-Regular.woff') format('woff'), url('../fonts/maven-pro/MavenPro-Regular.ttf') format('truetype');. font-weight: normal;. font-style: normal;.}.@font-face {. font-family: 'Maven Pro';. src: url('../fonts/maven-pro/MavenPro-Bold.eot');. src: url('../fonts/maven-pro/MavenPro-Bold.eot?#iefix') format('embedded-opentype'), url('../fonts/maven-pro/MavenPro-Bold.woff') format('woff'), url('../fonts/maven-pro/MavenPro-Bold.ttf') format('truetype');. font-weight: bold;. font-style: normal;.}.

Chrome Cache Entry: 85

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	3728
Entropy (8bit):	4.718277261919778
Encrypted:	false
SSDEEP:	96:JvfEcg0UqvMcOAvXa4zwjo0HtedznCOpKpFWgot:5Ecg04cXvXa4f0Y4p0
MD5:	EC396047518A7FEF11D53D1B4F6BE65B
SHA1:	E3BEC4CDAF5567641517A23019ADBFA2328B0A7F
SHA-256:	8F77CFC832517C619BC1B8D82A6A478EE18D97442B4C78B006B0286CEC91E1A8
SHA-512:	34AD62B5CC5EE5C950F340D65800102AE1CD06D34D24A611E7AC2CB9F23308AC96AC669D3B226C258DC6F862D985030EC3D5BB29609ECFEDF34E14F8F48529EB
Malicious:	false
URL:	https://docucdn-a.akamaihd.net/olive/images/2.63.0/global-assets/ds-logo-default.svg
Preview:	<?xml version="1.0" encoding="utf-8"?>. Generator: Adobe Illustrator 28.1.0, SVG Export Plug-In . SVG Version: 6.00 Build 0) -->.<svg version="1.1" id="Layer_1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px".. viewBox="0 0 1200 241.4" style="enable-background:new 0 0 1200 241.4;" xml:space="preserve">.<style type="text/css">...st0{fill:#4C00FF;}...st1{fill:#FF5252;}.</style>.<g>..<g>...<g>....<path d="M1169.2,109.7v78.7h-28.9v-73.5c0-17.9-7.7-27.9-22.7-27.9s-24.9,10.5-27.7,28.1c-0.8,4.2-1,10.7-1,24.4v48.8H1060v-125.....h25.6c0.1,1.1,0.7,12.3,0.7,13c0,0.9,1.1,1.4,1.8,0.8c10.6-8.4,22.3-16.2,38.6-16.2C1153.5,60.9,1169.2,79,1169.2,109.7z"/>....<path d="M1013.4,63.4l-0.9,14.3c-0.1,0.9-1.2,1.4-1.8,0.8c-3.5-3.3-16.4-17.5-38.3-17.5c-31.4,0-54.5,27.1-54.5,63.9l0,0.....c0,37.3,22.9,64.5,54.5,64.5c21.1,0,34-13.7,36.4-16.7c0.7-0.8,2-0.3,2,0.7c-0.3,3.8-0.8,13.3-4,21.4c-4,10.2-13,19.7-31.1,19.7.....c-14.9,0-28.1-5.7-40.6-17.9L920,217.3c13.7,15.5,35

Static File Info

General

File type:	RFC 822 mail, ASCII text, with very long lines (395), with CRLF line terminators
Entropy (8bit):	5.746540070832795
TrID:	E-Mail message (Var. 5) (54515/1) 100.00%
File name:	(No subject) - 2024-10-31T090531.704.eml
File size:	40'666 bytes
MD5:	970633fc2ac75fdf0d4dce1d003186f4
SHA1:	6205eacd288c674abfd0097a250cbb735f267f20
SHA256:	5c4aea1d1371875afb976f58def88de89763eb0f122321c801313743603b9378
SHA512:	3fcab92d5ca30f3e8eb8127dae936b688328fb822806300ee181cb8ede31e1af616d509316af49151bfd97dafcba67110367e3141658bf846439457fd30475ec
SSDEEP:	768:A/tLvD8W3B0sz61To/7yKJuwW/T9WYx1eT:kx8Wx7z61To/7yK2T9WaeT
TLSH:	FD034E57E3D01C569EAB086070037B7D7B3548CB5F7249B064DB7B3E5B0EC93968A28A
File Content Preview:	Received: from SJ0PR09MB9698.namprd09.prod.outlook.com (2603:10b6:a03:444::20).. by SA1PR09MB8669.namprd09.prod.outlook.com with HTTPS; Thu, 31 Oct 2024.. 15:50:42 +0000..Received: from CYXPR09CA0019.namprd09.prod.outlook.com (2603:10b6:930:d4::11).. by S

Static Mail

General

Subject:	Complete with Docusign: New Contact and submittal fromSchaaf and Wheeler Consulting Civil Engineers.
From:	"Caitlin Tharp (Gilmore) via Docusign" <dse_NA4@docusign.net>
To:	"khickey@santaclaraca.gov" <khickey@santaclaraca.gov>
Cc:
BCC:
Date:	Thu, 31 Oct 2024 08:49:48 -0700
Communications:	You don't often get email from dse_na4@docusign.net. Learn why this is important<https://aka.ms/LearnAboutSenderIdentification> [DocuSign] [https://NA4.docusign.net/member/Images/email/docInvite-white.png] Caitlin Tharp (Gilmore) sent you a document to review and sign. REVIEW DOCUMENT <https://na4.docusign.net/Signing/EmailStart.aspx?a=a6f8f68f-e076-4337-aac3-c42f41ebf6cc&etti=24&acct=7e9e0095-f41c-42f4-b219-3be2b992a461&er=449d3c4f-dbee-4c6e-a043-8f2682f3079d> Caitlin Tharp (Gilmore) zskeiemm3@consultant.com Thanks! got em. Caitlin Tharp (Gilmore), PE I Vice President QSD/QSP,CPSWQ,CFM,LEED AP Schaaf and Wheeler Consulting Civil Engineers 10232 Donner Pass Road #4, Truckee, CA 96161 Do Not Share This Email This email contains a secure link to Docusign. Please do not share this email, link, or access code with others. Alternate Signing Method Visit Docusign.com, click 'Access Documents', and enter the security code: A6F8F68FE0764337AAC3C42F41EBF6CC7 About Docusign Sign documents electronically in just minutes. It's safe, secure, and legally binding. Whether you're in an office, at home, on-the-go -- or even across the globe -- Docusign provides a professional trusted solution for Digital Transaction Management. Questions about the Document? If you need to modify the document or have questions about the details in the document, please reach out to the sender by emailing them directly. Stop receiving this email Report this email<https://protect.docusign.net/report-abuse?e=AUtomjpFak9GlbPL0zFFi1194xjxm1rAAhKJ7ThozECjwb5gx8pmVifNVGDawaqGdGYUuysJm6hxjtOSW8_6MvUf5XbY-zVOYv-6ryueL7YPrmYx6zFBlclM4-n7dFvqjLlSKNC2n9QMLgybZ6-BKKAqL5pR4EzXwn0igu_AA-Au_b1jLfokNIemcaNPKyz3nNw0Z5bROO-SPM4f2OhVpaYHl1XTZXmSTrMBRPCeLCamL4B-XfQpB2kZwqFXfMldbpP4Xv5_uSxJYnWPRC6Xn-caagn5mPHDa9OMu2RsHJSH3yYqWt6hOOAkmrmJytV2rnT7dAPXdbn_rE5zpcDNkS6RUlyVqdCSXbLD35FX5VAAvVp0j6ZuqZzV6c4LG8ceHX_cFYaLOynMiFGwtNL6upmlis04Y3i6TL4P5ZF1eHb8LsspOh2yf_I5HbM9giJm7A&lang=en> or read more about Declining to sign<https://support.docusign.com/en/guides/Declining-to-sign-DocuSign-Signer-Guide> and Managing notifications<https://support.docusign.com/en/articles/How-do-I-manage-my-email-notifications>. If you have trouble signing, visit "How to Sign a Document<https://support.docusign.com/s/articles/How-do-I-sign-a-DocuSign-document-Basic-Signing?language=en_US&utm_campaign=GBL_XX_DBU_UPS_2211_SignNotificationEmailFooter&utm_medium=product&utm_source=postsend>" on our Docusign Support Center<https://support.docusign.com/>, or browse our Docusign Community<https://community.docusign.com/esignature-111?utm_campaign=GBL_US_PRD_AWA_2405_CommunityCTA&utm_medium=email&utm_source=postsend> for more information. [https://docucdn-a.akamaihd.net/olive/images/2.62.0/global-assets/email-templates/icon-download-app.png]Download the Docusign App <https://www.docusign.com/features-and-benefits/mobile?utm_campaign=GBL_XX_DBU_UPS_2211_SignNotificationEmailFooter&utm_medium=product&utm_source=postsend> This message was sent to you by Caitlin Tharp (Gilmore) who is using the Docusign Electronic Signature Service. If you would rather not receive email from this sender you may contact the sender with your request.
Attachments:

Headers

Key	Value
Received	from docusign.net ([127.0.0.1]) by SE101FE56.corp.docusign.net with Microsoft SMTPSVC(10.0.17763.1697); Thu, 31 Oct 2024 08:49:48 -0700
Authentication-Results	spf=pass (sender IP is 64.207.219.136) smtp.mailfrom=docusign.net; dkim=pass (signature was verified) header.d=docusign.net;dmarc=pass action=none header.from=docusign.net;compauth=pass reason=100
Received-SPF	Pass (protection.outlook.com: domain of docusign.net designates 64.207.219.136 as permitted sender) receiver=protection.outlook.com; client-ip=64.207.219.136; helo=mailda.docusign.net; pr=C
DKIM-Signature	v=1; a=rsa-sha256; c=relaxed/simple; d=docusign.net; s=mail1; t=1730389789; bh=uI91cMNYp4Kx902sKwl1NshxOnOjUI17dkPJMU5B6eE=; h=From; b=V9rl7ESRZoARALeJ5rc8RHNB+B7rAXvEGZTC/QzbChIWH8PP3ItiJrP91+/eFU7Dg RYNYFfefIR/519f3FpudmZDyvRPgpYF8zhCfSxgXhhlHU0RgbasEvMPob1JTL/gN+u kvuCpYYQI//ltvFQfmRVFRy4rKgH7yJ3vN1c1kr5gb1lssGFz/zi2RDA/+UmgS7DAM l5QVuwXOAlFc7FFAKgqvyiPRemJLyJwadvm+/wHXzltqW1dB5taTurf2sEi5VvQhpN BRbKcrgMahhFQkkegBbuHdhraCk+1qaQh/4brYnzX4FF5+01Fcr4lhuWS4UueerIsB isqtu22eha4Zw==
Sender	DocuSign NA4 System <dse_NA4@docusign.net>
Reply-To	"Caitlin Tharp (Gilmore)" <zskeiemm3@consultant.com>
Recipient-Id	449d3c4f-dbee-4c6e-a043-8f2682f3079d
X-Debug	False
X-Email-Rejection-Mode	LearningMode
X-Api-Host	na4.docusign.net
Site-Id	7
X-BounceEmailVersion	1
From	"Caitlin Tharp (Gilmore) via Docusign" <dse_NA4@docusign.net>
To	"khickey@santaclaraca.gov" <khickey@santaclaraca.gov>
Message-ID	<b840061673da40fcaa950dbff10277b7@docusign.net>
Date	Thu, 31 Oct 2024 08:49:48 -0700
Subject	Complete with Docusign: New Contact and submittal fromSchaaf and Wheeler Consulting Civil Engineers.
Content-Type	multipart/alternative; boundary="----=_NextPart_90A53530_FE1D_400A_BBFA_03A8738BBFA3"
X-OriginalArrivalTime	31 Oct 2024 15:49:48.0694 (UTC) FILETIME=[84065B60:01DB2BAC]
Return-Path	dse_NA4@docusign.net
X-MS-Exchange-Organization-ExpirationStartTime	31 Oct 2024 15:49:50.8791 (UTC)
X-MS-Exchange-Organization-ExpirationStartTimeReason	OriginalSubmit
X-MS-Exchange-Organization-ExpirationInterval	1:00:00:00.0000000
X-MS-Exchange-Organization-ExpirationIntervalReason	OriginalSubmit
X-MS-Exchange-Organization-Network-Message-Id	ac1bfe36-80ab-4b4b-c880-08dcf9c3a7ca
X-EOPAttributedMessage	0
X-EOPTenantAttributedMessage	28ea3548-1069-4e81-aa0b-6e4b3271a5cb:0
X-MS-Exchange-Organization-MessageDirectionality	Incoming
X-MS-PublicTrafficType	Email
X-MS-TrafficTypeDiagnostic	BL02EPF0001B419:EE_\|SJ0PR09MB9698:EE_\|SA1PR09MB8669:EE_
X-MS-Exchange-Organization-AuthSource	BL02EPF0001B419.namprd09.prod.outlook.com
X-MS-Exchange-Organization-AuthAs	Anonymous
X-MS-Office365-Filtering-Correlation-Id	ac1bfe36-80ab-4b4b-c880-08dcf9c3a7ca
X-MS-Exchange-AtpMessageProperties	SA\|SL
X-MS-Exchange-Organization-SCL	-1
X-Microsoft-Antispam	BCL:0;ARA:13230040\|69100299015\|1032899013\|12012899012\|13102899012\|4092899012\|5082899009\|13012899012\|3092899012\|6062899009\|3072899012\|5062899012\|2092899012\|5063199012\|35002699018\|5073199012\|4123199012\|2066899003\|8096899003\|4076899003;
X-Forefront-Antispam-Report	CIP:64.207.219.136;CTRY:US;LANG:en;SCL:-1;SRV:;IPV:NLI;SFV:SKA;H:mailda.docusign.net;PTR:mailda.docusign.net;CAT:NONE;SFTY:9.25;SFS:(13230040)(69100299015)(1032899013)(12012899012)(13102899012)(4092899012)(5082899009)(13012899012)(3092899012)(6062899009)(3072899012)(5062899012)(2092899012)(5063199012)(35002699018)(5073199012)(4123199012)(2066899003)(8096899003)(4076899003);DIR:INB;SFTY:9.25;
X-MS-Exchange-CrossTenant-OriginalArrivalTime	31 Oct 2024 15:49:50.6760 (UTC)
X-MS-Exchange-CrossTenant-Network-Message-Id	ac1bfe36-80ab-4b4b-c880-08dcf9c3a7ca
X-MS-Exchange-CrossTenant-Id	28ea3548-1069-4e81-aa0b-6e4b3271a5cb
X-MS-Exchange-CrossTenant-AuthSource	BL02EPF0001B419.namprd09.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs	Anonymous
X-MS-Exchange-CrossTenant-FromEntityHeader	Internet
X-MS-Exchange-Transport-CrossTenantHeadersStamped	SJ0PR09MB9698
X-MS-Exchange-Transport-EndToEndLatency	00:00:51.8282108
X-MS-Exchange-Processed-By-BccFoldering	15.20.8114.023
X-Microsoft-Antispam-Mailbox-Delivery	ucf:0;jmr:0;auth:0;dest:I;ENG:(910001)(944506478)(944626604)(920097)(930097)(140003)(1420198);
X-Microsoft-Antispam-Message-Info	khSu8c/8AesR0JpPD4GjuUnlcbOwpMZfm+BhHnXCqnbqcSw3GeBKd1pAeG1daBNwkXyQkqAkhw69UUNNcOXFv61IX2AKjc8CSl5jhAs8F+sSLo+IL+BWORtuu52EWMb8mAtn0GXUMYxfIfOmDtCmnIvDhZ8kRPeMkJ92VXLnYp06k2e2OornPEaKtRPkoHobp9E2Mq69ynivOsCbmBEsrAc9sps+dWV0l8jr+wu/retGs7Gfdem/SphkFVjwS3XNuSaitVokzxyKyVVBHlhldY7oUVfJ4xuNT53o5sk5jIUNkZ9vDvmpIY6hdTudyrO/k+iPhHFjkwJfBi7omOpDaWhjPZr4iIdStou+XpqctmKzR7FrdOtA83rZZ4Vol4oZ9Rq0RsPT235ePCZRKGi2besuOTDeOwq4ybUc9iS1liLy1gw1PBgY0wu/Dvil8XDKGrp2d786xoGE2Sli2YK8NMrYUoHtHqOw3mZzfFiYNIMA4X2JeCP+wOAHFWjfNOQcJn8CQ3TCC+esMgwcHIp+zlFjK1dGC19gR6mEfvWy1igf5bXc+a/rERL/mUsdSch1O25n2DJn7VqNT+HC0s3R2lGREmMkd+psACcrywzUS4ok/DI/RA/I0P48ugQtkFpH8O7nJB/whXxTQQTITUWgzg+b1qdx9zwUl1gNXLCGKujxmFXiqZSMCOBFBPmc5FVhQxVvxHZlIBVE0p9VKL9OMo0iZiRXRc+ro2eBYAh8J/SNlsyTzHKkXTPqAixtPYlzmUNQ0CXEY6Rew3iCC4iOekTGjgrw5wsWE2L+WA0ej6nwjoRtCxRBH9rP5vqtb9HK0LzDaY7Q45wHkU+PqRDPwXwfNqDMGIPBvsmsz+I/KvRCFkz331KnNP1uNY3FNic/regmukjfTTWt1Kv3abiz5T91HWiItHcELb8xMfacduGE/NdWknT6MDDbEmQzSAX0I5nBgc9HpsJSxAYd3lNq/L4OP0iFCqsSDYEcHxAkPlW8n4IP2vsz2PugXL9izt1brrtNEhFPzXMSpoyn/y3O5eIXUGI6787B/hJ3jzatF1uKsjyzBhy7HQfWaUv+9l+o8epuJc14kUPnOkm7sTOvVY8R1+fJd2unhaVHmLMLEoaLz/zfWPzfH4sfGzbyT8sAPBfrVTV94xFdylJuN4vnF7DCyC95VFh0DspP4hPvM9fC2YT2kRAu8Bneu827w1LxCqvV7zi4yjj6xtAjydmQCbEV47pSrXNzOiIUYZNU9GCfvHK1twI2yO7suqMXsHzMnXybGrIwlalON/tnBheG5cplN8e+BEwl3G1pyiqZm/MvKzSbnUwVGIstCAb0r9sDTHvy5hoyuqjc2SDCPy+nfbS9CC8VI+QbaWjs8Nl18+2gQq6kkFl8igwycdOoOScS3ssPxnO/A4gNaxsRU1bRv0kcbW/Rhhi1dOOmwyrp7w3EDdcRyLMFes8pTZZ1QDe23LwywaSEtuzvz8KU2r3vuwjZr8y86muM8olzD3tch0L/HTZuDp6Rks7qSY+3ZV50Fv9Fh3piZ+7GFBHFq3hz2H8+Gmww5kKV1C3pEmAJ7x8EwvI1VwVlXQdYheJDQyuDFO7zuFFr19eZ5MYOcykHm5ZqQSB71qwMlEUxNdFQ2LG7rn7QuHayeNX1zJCYfZsuoKOXVG+21eRHoQbvVW8etPDZhS8LKbqnb7kfGF1tGZ4zdKWm+DxdL32SV9E4yMpHn2/HgIXYrC/AU43x0SPGvfuZjcMECfy1lW5ULe2F27w92nZCx7R3yqApA0Wll2hKS9NgwX3tV2qeYnrFiuW3tuiGc5fZvRm+lDSZcd3ED1UUnndMWxRbOgBnL6k98t+i9brsawtHF3v6XKcoyx1uVaMyhqZDMa1/40EZW880xqY2qUOskDWaLX8gDH2Ea9ha/1rQDvjuMnT6nrKmnXuLpfLnvTtu7Zvsi7LuDw8AQtV0iBPcygNLxTrRA2h6yiLe0XAKuiXD2kwKobcgQBszOsU5tmOupqKc2vNhVIYlcTaR8nIg4YGrz9B1W66Sje2Jdm0A5ZJiqrnXj2oFT8X4dR7XP1kFiGOXVmduiaq9vHNJNZpgcrcX9cH65RSOQ6DwctKz9HYh7LgnEbBiKqjt35fAKLFu4IK0gSs3+Dcqkeh60IHeQKQ92ar4Ci4JqfTVAvbsv1vmRtawyF4cuR2HlPw3GYOSklgYicch09yCY/gMDK6nQRx0S8l8G2+fasHY/CW29V8N+kTPnaLanVyo4vM8Gsl0e2+NkD17ooc4WRumubS+N457u84FMqO+iCwIM+cvTK0aKKSxC0PuV0LpFQ==
MIME-Version	1.0

File Icon


Icon Hash:	46070c0a8e0c67d6

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-31T17:09:43.943592+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	20.109.210.53	443	192.168.2.16	49712	TCP
2024-10-31T17:10:22.833613+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	20.12.23.50	443	192.168.2.16	49748	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 31, 2024 17:09:34.223359108 CET	49673	443	192.168.2.16	204.79.197.203
Oct 31, 2024 17:09:34.526990891 CET	49673	443	192.168.2.16	204.79.197.203
Oct 31, 2024 17:09:35.134881020 CET	49673	443	192.168.2.16	204.79.197.203
Oct 31, 2024 17:09:36.350029945 CET	49673	443	192.168.2.16	204.79.197.203
Oct 31, 2024 17:09:37.404890060 CET	49689	80	192.168.2.16	192.229.211.108
Oct 31, 2024 17:09:38.757019043 CET	49673	443	192.168.2.16	204.79.197.203
Oct 31, 2024 17:09:39.759495974 CET	49703	443	192.168.2.16	20.190.160.14
Oct 31, 2024 17:09:39.759548903 CET	49703	443	192.168.2.16	20.190.160.14
Oct 31, 2024 17:09:39.764830112 CET	443	49703	20.190.160.14	192.168.2.16
Oct 31, 2024 17:09:39.764869928 CET	443	49703	20.190.160.14	192.168.2.16
Oct 31, 2024 17:09:39.764904022 CET	443	49703	20.190.160.14	192.168.2.16
Oct 31, 2024 17:09:39.764933109 CET	443	49703	20.190.160.14	192.168.2.16
Oct 31, 2024 17:09:39.764961004 CET	443	49703	20.190.160.14	192.168.2.16
Oct 31, 2024 17:09:40.151107073 CET	443	49703	20.190.160.14	192.168.2.16
Oct 31, 2024 17:09:40.151190996 CET	443	49703	20.190.160.14	192.168.2.16
Oct 31, 2024 17:09:40.151231050 CET	443	49703	20.190.160.14	192.168.2.16
Oct 31, 2024 17:09:40.151269913 CET	49703	443	192.168.2.16	20.190.160.14
Oct 31, 2024 17:09:40.151571035 CET	443	49703	20.190.160.14	192.168.2.16
Oct 31, 2024 17:09:40.151626110 CET	49703	443	192.168.2.16	20.190.160.14
Oct 31, 2024 17:09:40.151895046 CET	443	49703	20.190.160.14	192.168.2.16
Oct 31, 2024 17:09:40.151942968 CET	443	49703	20.190.160.14	192.168.2.16
Oct 31, 2024 17:09:40.151995897 CET	49703	443	192.168.2.16	20.190.160.14
Oct 31, 2024 17:09:40.152513027 CET	443	49703	20.190.160.14	192.168.2.16
Oct 31, 2024 17:09:40.152549028 CET	443	49703	20.190.160.14	192.168.2.16
Oct 31, 2024 17:09:40.152605057 CET	49703	443	192.168.2.16	20.190.160.14
Oct 31, 2024 17:09:40.153103113 CET	443	49703	20.190.160.14	192.168.2.16
Oct 31, 2024 17:09:40.153139114 CET	443	49703	20.190.160.14	192.168.2.16
Oct 31, 2024 17:09:40.153202057 CET	49703	443	192.168.2.16	20.190.160.14
Oct 31, 2024 17:09:40.740705013 CET	49710	443	192.168.2.16	184.28.90.27
Oct 31, 2024 17:09:40.740818024 CET	443	49710	184.28.90.27	192.168.2.16
Oct 31, 2024 17:09:40.740926981 CET	49710	443	192.168.2.16	184.28.90.27
Oct 31, 2024 17:09:40.742533922 CET	49710	443	192.168.2.16	184.28.90.27
Oct 31, 2024 17:09:40.742568970 CET	443	49710	184.28.90.27	192.168.2.16
Oct 31, 2024 17:09:41.619404078 CET	443	49710	184.28.90.27	192.168.2.16
Oct 31, 2024 17:09:41.619488001 CET	49710	443	192.168.2.16	184.28.90.27
Oct 31, 2024 17:09:41.622215986 CET	49710	443	192.168.2.16	184.28.90.27
Oct 31, 2024 17:09:41.622231960 CET	443	49710	184.28.90.27	192.168.2.16
Oct 31, 2024 17:09:41.622464895 CET	443	49710	184.28.90.27	192.168.2.16
Oct 31, 2024 17:09:41.661864042 CET	49710	443	192.168.2.16	184.28.90.27
Oct 31, 2024 17:09:41.707339048 CET	443	49710	184.28.90.27	192.168.2.16
Oct 31, 2024 17:09:41.909995079 CET	443	49710	184.28.90.27	192.168.2.16
Oct 31, 2024 17:09:41.911185026 CET	49710	443	192.168.2.16	184.28.90.27
Oct 31, 2024 17:09:41.911207914 CET	443	49710	184.28.90.27	192.168.2.16
Oct 31, 2024 17:09:41.911220074 CET	49710	443	192.168.2.16	184.28.90.27
Oct 31, 2024 17:09:41.911403894 CET	443	49710	184.28.90.27	192.168.2.16
Oct 31, 2024 17:09:41.911433935 CET	443	49710	184.28.90.27	192.168.2.16
Oct 31, 2024 17:09:41.911468983 CET	49710	443	192.168.2.16	184.28.90.27
Oct 31, 2024 17:09:41.975704908 CET	49711	443	192.168.2.16	184.28.90.27
Oct 31, 2024 17:09:41.975759029 CET	443	49711	184.28.90.27	192.168.2.16
Oct 31, 2024 17:09:41.975830078 CET	49711	443	192.168.2.16	184.28.90.27
Oct 31, 2024 17:09:41.976082087 CET	49711	443	192.168.2.16	184.28.90.27
Oct 31, 2024 17:09:41.976093054 CET	443	49711	184.28.90.27	192.168.2.16
Oct 31, 2024 17:09:42.382253885 CET	49678	443	192.168.2.16	20.189.173.10
Oct 31, 2024 17:09:42.590547085 CET	49712	443	192.168.2.16	20.109.210.53
Oct 31, 2024 17:09:42.590580940 CET	443	49712	20.109.210.53	192.168.2.16
Oct 31, 2024 17:09:42.592684031 CET	49712	443	192.168.2.16	20.109.210.53
Oct 31, 2024 17:09:42.593727112 CET	49712	443	192.168.2.16	20.109.210.53
Oct 31, 2024 17:09:42.593739986 CET	443	49712	20.109.210.53	192.168.2.16
Oct 31, 2024 17:09:42.701004028 CET	49678	443	192.168.2.16	20.189.173.10
Oct 31, 2024 17:09:42.829566956 CET	443	49711	184.28.90.27	192.168.2.16
Oct 31, 2024 17:09:42.829643011 CET	49711	443	192.168.2.16	184.28.90.27
Oct 31, 2024 17:09:42.830784082 CET	49711	443	192.168.2.16	184.28.90.27
Oct 31, 2024 17:09:42.830805063 CET	443	49711	184.28.90.27	192.168.2.16
Oct 31, 2024 17:09:42.831029892 CET	443	49711	184.28.90.27	192.168.2.16
Oct 31, 2024 17:09:42.832165956 CET	49711	443	192.168.2.16	184.28.90.27
Oct 31, 2024 17:09:42.879323006 CET	443	49711	184.28.90.27	192.168.2.16
Oct 31, 2024 17:09:43.076857090 CET	443	49711	184.28.90.27	192.168.2.16
Oct 31, 2024 17:09:43.076942921 CET	443	49711	184.28.90.27	192.168.2.16
Oct 31, 2024 17:09:43.077059984 CET	49711	443	192.168.2.16	184.28.90.27
Oct 31, 2024 17:09:43.077742100 CET	49711	443	192.168.2.16	184.28.90.27
Oct 31, 2024 17:09:43.077768087 CET	443	49711	184.28.90.27	192.168.2.16
Oct 31, 2024 17:09:43.077780008 CET	49711	443	192.168.2.16	184.28.90.27
Oct 31, 2024 17:09:43.077785969 CET	443	49711	184.28.90.27	192.168.2.16
Oct 31, 2024 17:09:43.308163881 CET	49678	443	192.168.2.16	20.189.173.10
Oct 31, 2024 17:09:43.564023972 CET	49673	443	192.168.2.16	204.79.197.203
Oct 31, 2024 17:09:43.625525951 CET	443	49712	20.109.210.53	192.168.2.16
Oct 31, 2024 17:09:43.625603914 CET	49712	443	192.168.2.16	20.109.210.53
Oct 31, 2024 17:09:43.627331018 CET	49712	443	192.168.2.16	20.109.210.53
Oct 31, 2024 17:09:43.627343893 CET	443	49712	20.109.210.53	192.168.2.16
Oct 31, 2024 17:09:43.627724886 CET	443	49712	20.109.210.53	192.168.2.16
Oct 31, 2024 17:09:43.676023006 CET	49712	443	192.168.2.16	20.109.210.53
Oct 31, 2024 17:09:43.685460091 CET	49712	443	192.168.2.16	20.109.210.53
Oct 31, 2024 17:09:43.731338024 CET	443	49712	20.109.210.53	192.168.2.16
Oct 31, 2024 17:09:43.941371918 CET	443	49712	20.109.210.53	192.168.2.16
Oct 31, 2024 17:09:43.941416025 CET	443	49712	20.109.210.53	192.168.2.16
Oct 31, 2024 17:09:43.941426039 CET	443	49712	20.109.210.53	192.168.2.16
Oct 31, 2024 17:09:43.941443920 CET	443	49712	20.109.210.53	192.168.2.16
Oct 31, 2024 17:09:43.941453934 CET	443	49712	20.109.210.53	192.168.2.16
Oct 31, 2024 17:09:43.941463947 CET	443	49712	20.109.210.53	192.168.2.16
Oct 31, 2024 17:09:43.941467047 CET	49712	443	192.168.2.16	20.109.210.53
Oct 31, 2024 17:09:43.941502094 CET	443	49712	20.109.210.53	192.168.2.16
Oct 31, 2024 17:09:43.941518068 CET	49712	443	192.168.2.16	20.109.210.53
Oct 31, 2024 17:09:43.941564083 CET	49712	443	192.168.2.16	20.109.210.53
Oct 31, 2024 17:09:43.943360090 CET	443	49712	20.109.210.53	192.168.2.16
Oct 31, 2024 17:09:43.943423033 CET	49712	443	192.168.2.16	20.109.210.53
Oct 31, 2024 17:09:43.943432093 CET	443	49712	20.109.210.53	192.168.2.16
Oct 31, 2024 17:09:43.943475962 CET	443	49712	20.109.210.53	192.168.2.16
Oct 31, 2024 17:09:43.943519115 CET	49712	443	192.168.2.16	20.109.210.53
Oct 31, 2024 17:09:44.126440048 CET	49712	443	192.168.2.16	20.109.210.53
Oct 31, 2024 17:09:44.126491070 CET	443	49712	20.109.210.53	192.168.2.16
Oct 31, 2024 17:09:44.126507044 CET	49712	443	192.168.2.16	20.109.210.53
Oct 31, 2024 17:09:44.126514912 CET	443	49712	20.109.210.53	192.168.2.16
Oct 31, 2024 17:09:44.518996000 CET	49678	443	192.168.2.16	20.189.173.10
Oct 31, 2024 17:09:44.749543905 CET	49714	443	192.168.2.16	104.47.64.28
Oct 31, 2024 17:09:44.749610901 CET	443	49714	104.47.64.28	192.168.2.16
Oct 31, 2024 17:09:44.749667883 CET	49714	443	192.168.2.16	104.47.64.28
Oct 31, 2024 17:09:44.750277996 CET	49714	443	192.168.2.16	104.47.64.28
Oct 31, 2024 17:09:44.750303030 CET	443	49714	104.47.64.28	192.168.2.16
Oct 31, 2024 17:09:45.651895046 CET	443	49714	104.47.64.28	192.168.2.16
Oct 31, 2024 17:09:45.652481079 CET	49714	443	192.168.2.16	104.47.64.28
Oct 31, 2024 17:09:45.652510881 CET	443	49714	104.47.64.28	192.168.2.16
Oct 31, 2024 17:09:45.653723955 CET	443	49714	104.47.64.28	192.168.2.16
Oct 31, 2024 17:09:45.653836966 CET	49714	443	192.168.2.16	104.47.64.28
Oct 31, 2024 17:09:45.654803038 CET	49714	443	192.168.2.16	104.47.64.28
Oct 31, 2024 17:09:45.654874086 CET	443	49714	104.47.64.28	192.168.2.16
Oct 31, 2024 17:09:45.654989004 CET	49714	443	192.168.2.16	104.47.64.28
Oct 31, 2024 17:09:45.695328951 CET	443	49714	104.47.64.28	192.168.2.16
Oct 31, 2024 17:09:45.698029995 CET	49714	443	192.168.2.16	104.47.64.28
Oct 31, 2024 17:09:45.698050022 CET	443	49714	104.47.64.28	192.168.2.16
Oct 31, 2024 17:09:45.746031046 CET	49714	443	192.168.2.16	104.47.64.28
Oct 31, 2024 17:09:46.797229052 CET	443	49714	104.47.64.28	192.168.2.16
Oct 31, 2024 17:09:46.797816992 CET	49714	443	192.168.2.16	104.47.64.28
Oct 31, 2024 17:09:46.797853947 CET	443	49714	104.47.64.28	192.168.2.16
Oct 31, 2024 17:09:46.798108101 CET	443	49714	104.47.64.28	192.168.2.16
Oct 31, 2024 17:09:46.798118114 CET	49714	443	192.168.2.16	104.47.64.28
Oct 31, 2024 17:09:46.798158884 CET	49714	443	192.168.2.16	104.47.64.28
Oct 31, 2024 17:09:46.846601009 CET	49680	80	192.168.2.16	192.229.211.108
Oct 31, 2024 17:09:46.926318884 CET	49678	443	192.168.2.16	20.189.173.10
Oct 31, 2024 17:09:47.150551081 CET	49680	80	192.168.2.16	192.229.211.108
Oct 31, 2024 17:09:47.754067898 CET	49680	80	192.168.2.16	192.229.211.108
Oct 31, 2024 17:09:48.958062887 CET	49680	80	192.168.2.16	192.229.211.108
Oct 31, 2024 17:09:49.383519888 CET	49724	443	192.168.2.16	142.250.186.132
Oct 31, 2024 17:09:49.383544922 CET	443	49724	142.250.186.132	192.168.2.16
Oct 31, 2024 17:09:49.383790970 CET	49724	443	192.168.2.16	142.250.186.132
Oct 31, 2024 17:09:49.384078979 CET	49724	443	192.168.2.16	142.250.186.132
Oct 31, 2024 17:09:49.384092093 CET	443	49724	142.250.186.132	192.168.2.16
Oct 31, 2024 17:09:50.261007071 CET	443	49724	142.250.186.132	192.168.2.16
Oct 31, 2024 17:09:50.261476040 CET	49724	443	192.168.2.16	142.250.186.132
Oct 31, 2024 17:09:50.261499882 CET	443	49724	142.250.186.132	192.168.2.16
Oct 31, 2024 17:09:50.262671947 CET	443	49724	142.250.186.132	192.168.2.16
Oct 31, 2024 17:09:50.262747049 CET	49724	443	192.168.2.16	142.250.186.132
Oct 31, 2024 17:09:50.264094114 CET	49724	443	192.168.2.16	142.250.186.132
Oct 31, 2024 17:09:50.264156103 CET	443	49724	142.250.186.132	192.168.2.16
Oct 31, 2024 17:09:50.316051960 CET	49724	443	192.168.2.16	142.250.186.132
Oct 31, 2024 17:09:50.316081047 CET	443	49724	142.250.186.132	192.168.2.16
Oct 31, 2024 17:09:50.364056110 CET	49724	443	192.168.2.16	142.250.186.132
Oct 31, 2024 17:09:51.365078926 CET	49680	80	192.168.2.16	192.229.211.108
Oct 31, 2024 17:09:51.733418941 CET	49678	443	192.168.2.16	20.189.173.10
Oct 31, 2024 17:09:53.179060936 CET	49673	443	192.168.2.16	204.79.197.203
Oct 31, 2024 17:09:54.314555883 CET	49745	443	192.168.2.16	130.211.34.183
Oct 31, 2024 17:09:54.314591885 CET	443	49745	130.211.34.183	192.168.2.16
Oct 31, 2024 17:09:54.314651966 CET	49745	443	192.168.2.16	130.211.34.183
Oct 31, 2024 17:09:54.314837933 CET	49745	443	192.168.2.16	130.211.34.183
Oct 31, 2024 17:09:54.314851999 CET	443	49745	130.211.34.183	192.168.2.16
Oct 31, 2024 17:09:54.961827993 CET	443	49745	130.211.34.183	192.168.2.16
Oct 31, 2024 17:09:54.962147951 CET	49745	443	192.168.2.16	130.211.34.183
Oct 31, 2024 17:09:54.962194920 CET	443	49745	130.211.34.183	192.168.2.16
Oct 31, 2024 17:09:54.963110924 CET	443	49745	130.211.34.183	192.168.2.16
Oct 31, 2024 17:09:54.963212013 CET	49745	443	192.168.2.16	130.211.34.183
Oct 31, 2024 17:09:54.964256048 CET	49745	443	192.168.2.16	130.211.34.183
Oct 31, 2024 17:09:54.964320898 CET	443	49745	130.211.34.183	192.168.2.16
Oct 31, 2024 17:09:54.964426041 CET	49745	443	192.168.2.16	130.211.34.183
Oct 31, 2024 17:09:54.964442968 CET	443	49745	130.211.34.183	192.168.2.16
Oct 31, 2024 17:09:55.006103039 CET	49745	443	192.168.2.16	130.211.34.183
Oct 31, 2024 17:09:55.145625114 CET	443	49745	130.211.34.183	192.168.2.16
Oct 31, 2024 17:09:55.152728081 CET	443	49745	130.211.34.183	192.168.2.16
Oct 31, 2024 17:09:55.152796030 CET	49745	443	192.168.2.16	130.211.34.183
Oct 31, 2024 17:09:55.152966022 CET	49745	443	192.168.2.16	130.211.34.183
Oct 31, 2024 17:09:55.153023005 CET	443	49745	130.211.34.183	192.168.2.16
Oct 31, 2024 17:09:55.169981003 CET	49746	443	192.168.2.16	35.186.241.51
Oct 31, 2024 17:09:55.170013905 CET	443	49746	35.186.241.51	192.168.2.16
Oct 31, 2024 17:09:55.170084953 CET	49746	443	192.168.2.16	35.186.241.51
Oct 31, 2024 17:09:55.170264959 CET	49746	443	192.168.2.16	35.186.241.51
Oct 31, 2024 17:09:55.170274019 CET	443	49746	35.186.241.51	192.168.2.16
Oct 31, 2024 17:09:55.790100098 CET	443	49746	35.186.241.51	192.168.2.16
Oct 31, 2024 17:09:55.790384054 CET	49746	443	192.168.2.16	35.186.241.51
Oct 31, 2024 17:09:55.790396929 CET	443	49746	35.186.241.51	192.168.2.16
Oct 31, 2024 17:09:55.791277885 CET	443	49746	35.186.241.51	192.168.2.16
Oct 31, 2024 17:09:55.791374922 CET	49746	443	192.168.2.16	35.186.241.51
Oct 31, 2024 17:09:55.791644096 CET	49746	443	192.168.2.16	35.186.241.51
Oct 31, 2024 17:09:55.791696072 CET	443	49746	35.186.241.51	192.168.2.16
Oct 31, 2024 17:09:55.791799068 CET	49746	443	192.168.2.16	35.186.241.51
Oct 31, 2024 17:09:55.791809082 CET	443	49746	35.186.241.51	192.168.2.16
Oct 31, 2024 17:09:55.834064007 CET	49746	443	192.168.2.16	35.186.241.51
Oct 31, 2024 17:09:55.939961910 CET	443	49746	35.186.241.51	192.168.2.16
Oct 31, 2024 17:09:55.941622019 CET	443	49746	35.186.241.51	192.168.2.16
Oct 31, 2024 17:09:55.941680908 CET	49746	443	192.168.2.16	35.186.241.51
Oct 31, 2024 17:09:55.941826105 CET	49746	443	192.168.2.16	35.186.241.51
Oct 31, 2024 17:09:55.941840887 CET	443	49746	35.186.241.51	192.168.2.16
Oct 31, 2024 17:09:56.167088032 CET	49680	80	192.168.2.16	192.229.211.108
Oct 31, 2024 17:10:00.249783039 CET	443	49724	142.250.186.132	192.168.2.16
Oct 31, 2024 17:10:00.249844074 CET	443	49724	142.250.186.132	192.168.2.16
Oct 31, 2024 17:10:00.250097990 CET	49724	443	192.168.2.16	142.250.186.132
Oct 31, 2024 17:10:00.972734928 CET	49724	443	192.168.2.16	142.250.186.132
Oct 31, 2024 17:10:00.972779036 CET	443	49724	142.250.186.132	192.168.2.16
Oct 31, 2024 17:10:01.339227915 CET	49678	443	192.168.2.16	20.189.173.10
Oct 31, 2024 17:10:05.778135061 CET	49680	80	192.168.2.16	192.229.211.108
Oct 31, 2024 17:10:21.498758078 CET	49748	443	192.168.2.16	20.12.23.50
Oct 31, 2024 17:10:21.498794079 CET	443	49748	20.12.23.50	192.168.2.16
Oct 31, 2024 17:10:21.498879910 CET	49748	443	192.168.2.16	20.12.23.50
Oct 31, 2024 17:10:21.499300003 CET	49748	443	192.168.2.16	20.12.23.50
Oct 31, 2024 17:10:21.499306917 CET	443	49748	20.12.23.50	192.168.2.16
Oct 31, 2024 17:10:21.569392920 CET	49701	80	192.168.2.16	199.232.214.172
Oct 31, 2024 17:10:21.569708109 CET	49702	80	192.168.2.16	199.232.214.172
Oct 31, 2024 17:10:21.597383976 CET	80	49701	199.232.214.172	192.168.2.16
Oct 31, 2024 17:10:21.597608089 CET	49701	80	192.168.2.16	199.232.214.172
Oct 31, 2024 17:10:21.598203897 CET	80	49702	199.232.214.172	192.168.2.16
Oct 31, 2024 17:10:21.598270893 CET	49702	80	192.168.2.16	199.232.214.172
Oct 31, 2024 17:10:22.401050091 CET	443	49748	20.12.23.50	192.168.2.16
Oct 31, 2024 17:10:22.401153088 CET	49748	443	192.168.2.16	20.12.23.50
Oct 31, 2024 17:10:22.403012037 CET	49748	443	192.168.2.16	20.12.23.50
Oct 31, 2024 17:10:22.403028011 CET	443	49748	20.12.23.50	192.168.2.16
Oct 31, 2024 17:10:22.403243065 CET	443	49748	20.12.23.50	192.168.2.16
Oct 31, 2024 17:10:22.404901981 CET	49748	443	192.168.2.16	20.12.23.50
Oct 31, 2024 17:10:22.451324940 CET	443	49748	20.12.23.50	192.168.2.16
Oct 31, 2024 17:10:22.709249020 CET	443	49748	20.12.23.50	192.168.2.16
Oct 31, 2024 17:10:22.709276915 CET	443	49748	20.12.23.50	192.168.2.16
Oct 31, 2024 17:10:22.709294081 CET	443	49748	20.12.23.50	192.168.2.16
Oct 31, 2024 17:10:22.709402084 CET	49748	443	192.168.2.16	20.12.23.50
Oct 31, 2024 17:10:22.709434032 CET	443	49748	20.12.23.50	192.168.2.16
Oct 31, 2024 17:10:22.709460974 CET	49748	443	192.168.2.16	20.12.23.50
Oct 31, 2024 17:10:22.709491014 CET	49748	443	192.168.2.16	20.12.23.50
Oct 31, 2024 17:10:22.833194971 CET	443	49748	20.12.23.50	192.168.2.16
Oct 31, 2024 17:10:22.833250046 CET	443	49748	20.12.23.50	192.168.2.16
Oct 31, 2024 17:10:22.833307028 CET	49748	443	192.168.2.16	20.12.23.50
Oct 31, 2024 17:10:22.833323002 CET	443	49748	20.12.23.50	192.168.2.16
Oct 31, 2024 17:10:22.833375931 CET	49748	443	192.168.2.16	20.12.23.50
Oct 31, 2024 17:10:22.833462000 CET	49748	443	192.168.2.16	20.12.23.50
Oct 31, 2024 17:10:22.833473921 CET	443	49748	20.12.23.50	192.168.2.16
Oct 31, 2024 17:10:22.833483934 CET	443	49748	20.12.23.50	192.168.2.16
Oct 31, 2024 17:10:22.833492994 CET	49748	443	192.168.2.16	20.12.23.50
Oct 31, 2024 17:10:22.833528996 CET	443	49748	20.12.23.50	192.168.2.16
Oct 31, 2024 17:10:49.428523064 CET	49750	443	192.168.2.16	142.250.186.132
Oct 31, 2024 17:10:49.428582907 CET	443	49750	142.250.186.132	192.168.2.16
Oct 31, 2024 17:10:49.428679943 CET	49750	443	192.168.2.16	142.250.186.132
Oct 31, 2024 17:10:49.428931952 CET	49750	443	192.168.2.16	142.250.186.132
Oct 31, 2024 17:10:49.428945065 CET	443	49750	142.250.186.132	192.168.2.16
Oct 31, 2024 17:10:50.305732012 CET	443	49750	142.250.186.132	192.168.2.16
Oct 31, 2024 17:10:50.306186914 CET	49750	443	192.168.2.16	142.250.186.132
Oct 31, 2024 17:10:50.306209087 CET	443	49750	142.250.186.132	192.168.2.16
Oct 31, 2024 17:10:50.306555033 CET	443	49750	142.250.186.132	192.168.2.16
Oct 31, 2024 17:10:50.306987047 CET	49750	443	192.168.2.16	142.250.186.132
Oct 31, 2024 17:10:50.307049990 CET	443	49750	142.250.186.132	192.168.2.16
Oct 31, 2024 17:10:50.353374004 CET	49750	443	192.168.2.16	142.250.186.132
Oct 31, 2024 17:10:57.604357004 CET	49693	443	192.168.2.16	2.19.126.135
Oct 31, 2024 17:10:57.604573011 CET	49695	443	192.168.2.16	2.19.126.135
Oct 31, 2024 17:10:57.610313892 CET	443	49693	2.19.126.135	192.168.2.16
Oct 31, 2024 17:10:57.610372066 CET	443	49695	2.19.126.135	192.168.2.16
Oct 31, 2024 17:10:57.610460997 CET	49693	443	192.168.2.16	2.19.126.135
Oct 31, 2024 17:10:57.610534906 CET	49695	443	192.168.2.16	2.19.126.135
Oct 31, 2024 17:11:00.301589012 CET	443	49750	142.250.186.132	192.168.2.16
Oct 31, 2024 17:11:00.301660061 CET	443	49750	142.250.186.132	192.168.2.16
Oct 31, 2024 17:11:00.301918030 CET	49750	443	192.168.2.16	142.250.186.132
Oct 31, 2024 17:11:00.975522995 CET	49750	443	192.168.2.16	142.250.186.132
Oct 31, 2024 17:11:00.975558996 CET	443	49750	142.250.186.132	192.168.2.16
Oct 31, 2024 17:11:11.129656076 CET	49703	443	192.168.2.16	20.190.160.14
Oct 31, 2024 17:11:11.129707098 CET	49704	80	192.168.2.16	192.229.221.95
Oct 31, 2024 17:11:11.136420012 CET	443	49703	20.190.160.14	192.168.2.16
Oct 31, 2024 17:11:11.136445045 CET	80	49704	192.229.221.95	192.168.2.16
Oct 31, 2024 17:11:11.136528015 CET	49703	443	192.168.2.16	20.190.160.14
Oct 31, 2024 17:11:11.136558056 CET	49704	80	192.168.2.16	192.229.221.95
Oct 31, 2024 17:11:13.874548912 CET	49705	443	192.168.2.16	20.190.160.14
Oct 31, 2024 17:11:13.881454945 CET	443	49705	20.190.160.14	192.168.2.16
Oct 31, 2024 17:11:13.881580114 CET	49705	443	192.168.2.16	20.190.160.14

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 31, 2024 17:09:44.726483107 CET	52427	53	192.168.2.16	1.1.1.1
Oct 31, 2024 17:09:44.726722956 CET	55577	53	192.168.2.16	1.1.1.1
Oct 31, 2024 17:09:44.732505083 CET	53	63589	1.1.1.1	192.168.2.16
Oct 31, 2024 17:09:44.743298054 CET	53	52427	1.1.1.1	192.168.2.16
Oct 31, 2024 17:09:44.749062061 CET	53	55577	1.1.1.1	192.168.2.16
Oct 31, 2024 17:09:44.751626015 CET	53	54693	1.1.1.1	192.168.2.16
Oct 31, 2024 17:09:46.024398088 CET	53	61626	1.1.1.1	192.168.2.16
Oct 31, 2024 17:09:46.800648928 CET	63743	53	192.168.2.16	1.1.1.1
Oct 31, 2024 17:09:46.801058054 CET	64313	53	192.168.2.16	1.1.1.1
Oct 31, 2024 17:09:49.370423079 CET	50931	53	192.168.2.16	1.1.1.1
Oct 31, 2024 17:09:49.370616913 CET	59864	53	192.168.2.16	1.1.1.1
Oct 31, 2024 17:09:49.379980087 CET	53	50931	1.1.1.1	192.168.2.16
Oct 31, 2024 17:09:49.380458117 CET	53	59864	1.1.1.1	192.168.2.16
Oct 31, 2024 17:09:50.172055006 CET	65370	53	192.168.2.16	1.1.1.1
Oct 31, 2024 17:09:50.172362089 CET	62196	53	192.168.2.16	1.1.1.1
Oct 31, 2024 17:09:51.645468950 CET	55076	53	192.168.2.16	1.1.1.1
Oct 31, 2024 17:09:51.645821095 CET	59743	53	192.168.2.16	1.1.1.1
Oct 31, 2024 17:09:52.082221031 CET	55831	53	192.168.2.16	1.1.1.1
Oct 31, 2024 17:09:52.082221985 CET	51469	53	192.168.2.16	1.1.1.1
Oct 31, 2024 17:09:54.304528952 CET	52212	53	192.168.2.16	1.1.1.1
Oct 31, 2024 17:09:54.305617094 CET	56931	53	192.168.2.16	1.1.1.1
Oct 31, 2024 17:09:54.311352015 CET	53	52212	1.1.1.1	192.168.2.16
Oct 31, 2024 17:09:54.314055920 CET	53	56931	1.1.1.1	192.168.2.16
Oct 31, 2024 17:09:55.155360937 CET	56208	53	192.168.2.16	1.1.1.1
Oct 31, 2024 17:09:55.155504942 CET	52541	53	192.168.2.16	1.1.1.1
Oct 31, 2024 17:09:55.169308901 CET	53	56208	1.1.1.1	192.168.2.16
Oct 31, 2024 17:09:55.169626951 CET	53	52541	1.1.1.1	192.168.2.16
Oct 31, 2024 17:10:02.990923882 CET	53	52169	1.1.1.1	192.168.2.16
Oct 31, 2024 17:10:21.706809044 CET	53	56345	1.1.1.1	192.168.2.16
Oct 31, 2024 17:10:38.561199903 CET	138	138	192.168.2.16	192.168.2.255
Oct 31, 2024 17:10:44.569214106 CET	53	59399	1.1.1.1	192.168.2.16
Oct 31, 2024 17:10:44.658257008 CET	53	65451	1.1.1.1	192.168.2.16
Oct 31, 2024 17:11:13.500355959 CET	53	56192	1.1.1.1	192.168.2.16

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Oct 31, 2024 17:09:46.836114883 CET	192.168.2.16	1.1.1.1	c26f	(Port unreachable)	Destination Unreachable
Oct 31, 2024 17:09:50.193181992 CET	192.168.2.16	1.1.1.1	c281	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 31, 2024 17:09:44.726483107 CET	192.168.2.16	1.1.1.1	0xab5c	Standard query (0)	gcc02.safelinks.protection.outlook.com	A (IP address)	IN (0x0001)	false
Oct 31, 2024 17:09:44.726722956 CET	192.168.2.16	1.1.1.1	0x106c	Standard query (0)	gcc02.safelinks.protection.outlook.com	65	IN (0x0001)	false
Oct 31, 2024 17:09:46.800648928 CET	192.168.2.16	1.1.1.1	0xbd6	Standard query (0)	na4.docusign.net	A (IP address)	IN (0x0001)	false
Oct 31, 2024 17:09:46.801058054 CET	192.168.2.16	1.1.1.1	0xe83c	Standard query (0)	na4.docusign.net	65	IN (0x0001)	false
Oct 31, 2024 17:09:49.370423079 CET	192.168.2.16	1.1.1.1	0x7930	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Oct 31, 2024 17:09:49.370616913 CET	192.168.2.16	1.1.1.1	0x4996	Standard query (0)	www.google.com	65	IN (0x0001)	false
Oct 31, 2024 17:09:50.172055006 CET	192.168.2.16	1.1.1.1	0xcb9b	Standard query (0)	docucdn-a.akamaihd.net	A (IP address)	IN (0x0001)	false
Oct 31, 2024 17:09:50.172362089 CET	192.168.2.16	1.1.1.1	0x5b78	Standard query (0)	docucdn-a.akamaihd.net	65	IN (0x0001)	false
Oct 31, 2024 17:09:51.645468950 CET	192.168.2.16	1.1.1.1	0xfe4f	Standard query (0)	docucdn-a.akamaihd.net	A (IP address)	IN (0x0001)	false
Oct 31, 2024 17:09:51.645821095 CET	192.168.2.16	1.1.1.1	0x5e59	Standard query (0)	docucdn-a.akamaihd.net	65	IN (0x0001)	false
Oct 31, 2024 17:09:52.082221031 CET	192.168.2.16	1.1.1.1	0xa4a0	Standard query (0)	na4.docusign.net	A (IP address)	IN (0x0001)	false
Oct 31, 2024 17:09:52.082221985 CET	192.168.2.16	1.1.1.1	0xa79b	Standard query (0)	na4.docusign.net	65	IN (0x0001)	false
Oct 31, 2024 17:09:54.304528952 CET	192.168.2.16	1.1.1.1	0x663e	Standard query (0)	api.mixpanel.com	A (IP address)	IN (0x0001)	false
Oct 31, 2024 17:09:54.305617094 CET	192.168.2.16	1.1.1.1	0xcd7d	Standard query (0)	api.mixpanel.com	65	IN (0x0001)	false
Oct 31, 2024 17:09:55.155360937 CET	192.168.2.16	1.1.1.1	0xaf84	Standard query (0)	api.mixpanel.com	A (IP address)	IN (0x0001)	false
Oct 31, 2024 17:09:55.155504942 CET	192.168.2.16	1.1.1.1	0xe5b6	Standard query (0)	api.mixpanel.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 31, 2024 17:09:44.743298054 CET	1.1.1.1	192.168.2.16	0xab5c	No error (0)	gcc02.safelinks.protection.outlook.com	gcc02.safelinks.eop-tm2.outlook.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 31, 2024 17:09:44.743298054 CET	1.1.1.1	192.168.2.16	0xab5c	No error (0)	gcc02.safelinks.eop-tm2.outlook.com		104.47.64.28	A (IP address)	IN (0x0001)	false
Oct 31, 2024 17:09:44.743298054 CET	1.1.1.1	192.168.2.16	0xab5c	No error (0)	gcc02.safelinks.eop-tm2.outlook.com		104.47.65.28	A (IP address)	IN (0x0001)	false
Oct 31, 2024 17:09:44.749062061 CET	1.1.1.1	192.168.2.16	0x106c	No error (0)	gcc02.safelinks.protection.outlook.com	gcc02.safelinks.eop-tm2.outlook.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 31, 2024 17:09:46.807740927 CET	1.1.1.1	192.168.2.16	0xbd6	No error (0)	na4.docusign.net	na4.docusign.net.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 31, 2024 17:09:46.835544109 CET	1.1.1.1	192.168.2.16	0xe83c	No error (0)	na4.docusign.net	na4.docusign.net.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 31, 2024 17:09:49.379980087 CET	1.1.1.1	192.168.2.16	0x7930	No error (0)	www.google.com		142.250.186.132	A (IP address)	IN (0x0001)	false
Oct 31, 2024 17:09:49.380458117 CET	1.1.1.1	192.168.2.16	0x4996	No error (0)	www.google.com			65	IN (0x0001)	false
Oct 31, 2024 17:09:50.181350946 CET	1.1.1.1	192.168.2.16	0xcb9b	No error (0)	docucdn-a.akamaihd.net	docucdn-a.akamaihd.net.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 31, 2024 17:09:50.193075895 CET	1.1.1.1	192.168.2.16	0x5b78	No error (0)	docucdn-a.akamaihd.net	docucdn-a.akamaihd.net.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 31, 2024 17:09:51.654952049 CET	1.1.1.1	192.168.2.16	0x5e59	No error (0)	docucdn-a.akamaihd.net	docucdn-a.akamaihd.net.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 31, 2024 17:09:51.655096054 CET	1.1.1.1	192.168.2.16	0xfe4f	No error (0)	docucdn-a.akamaihd.net	docucdn-a.akamaihd.net.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 31, 2024 17:09:52.091181993 CET	1.1.1.1	192.168.2.16	0xa4a0	No error (0)	na4.docusign.net	na4.docusign.net.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 31, 2024 17:09:52.111305952 CET	1.1.1.1	192.168.2.16	0xa79b	No error (0)	na4.docusign.net	na4.docusign.net.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 31, 2024 17:09:54.311352015 CET	1.1.1.1	192.168.2.16	0x663e	No error (0)	api.mixpanel.com		130.211.34.183	A (IP address)	IN (0x0001)	false
Oct 31, 2024 17:09:54.311352015 CET	1.1.1.1	192.168.2.16	0x663e	No error (0)	api.mixpanel.com		35.190.25.25	A (IP address)	IN (0x0001)	false
Oct 31, 2024 17:09:54.311352015 CET	1.1.1.1	192.168.2.16	0x663e	No error (0)	api.mixpanel.com		35.186.241.51	A (IP address)	IN (0x0001)	false
Oct 31, 2024 17:09:54.311352015 CET	1.1.1.1	192.168.2.16	0x663e	No error (0)	api.mixpanel.com		107.178.240.159	A (IP address)	IN (0x0001)	false
Oct 31, 2024 17:09:55.169308901 CET	1.1.1.1	192.168.2.16	0xaf84	No error (0)	api.mixpanel.com		35.186.241.51	A (IP address)	IN (0x0001)	false
Oct 31, 2024 17:09:55.169308901 CET	1.1.1.1	192.168.2.16	0xaf84	No error (0)	api.mixpanel.com		35.190.25.25	A (IP address)	IN (0x0001)	false
Oct 31, 2024 17:09:55.169308901 CET	1.1.1.1	192.168.2.16	0xaf84	No error (0)	api.mixpanel.com		107.178.240.159	A (IP address)	IN (0x0001)	false
Oct 31, 2024 17:09:55.169308901 CET	1.1.1.1	192.168.2.16	0xaf84	No error (0)	api.mixpanel.com		130.211.34.183	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

fs.microsoft.com

slscr.update.microsoft.com

gcc02.safelinks.protection.outlook.com

https:

api.mixpanel.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.16	49710	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 16:09:41 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-10-31 16:09:41 UTC	467	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF70) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-neu-z1 Cache-Control: public, max-age=174961 Date: Thu, 31 Oct 2024 16:09:41 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.16	49711	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 16:09:42 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-10-31 16:09:43 UTC	515	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=175017 Date: Thu, 31 Oct 2024 16:09:42 GMT Content-Length: 55 Connection: close X-CID: 2
2024-10-31 16:09:43 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.16	49712	20.109.210.53	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 16:09:43 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=fGLw7rl8KtPeAcX&MD=AeeMNrPN HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-10-31 16:09:43 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 8e3a5e01-8fe5-48a2-b1c9-567a31953449 MS-RequestId: 21acc6c8-e043-434f-b68d-1652d742ee70 MS-CV: 6sC7ABoUckuS8rlx.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Thu, 31 Oct 2024 16:09:43 GMT Connection: close Content-Length: 24490
2024-10-31 16:09:43 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-10-31 16:09:43 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.16	49714	104.47.64.28	443	1836	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 16:09:45 UTC	1208	OUT	GET /?url=https%3A%2F%2Fna4.docusign.net%2FSigning%2FEmailStart.aspx%3Fa%3Da6f8f68f-e076-4337-aac3-c42f41ebf6cc%26etti%3D24%26acct%3D7e9e0095-f41c-42f4-b219-3be2b992a461%26er%3D449d3c4f-dbee-4c6e-a043-8f2682f3079d&data=05%7C02%7Ckhickey%40santaclaraca.gov%7Cac1bfe3680ab4b4bc88008dcf9c3a7ca%7C28ea354810694e81aa0b6e4b3271a5cb%7C0%7C0%7C638659866425908855%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C20000%7C%7C%7C&sdata=hiibBlRjS07Ot%2Fn9qwgC1lvq2U9kAt%2BMFXtGA%2BOSu5U%3D&reserved=0 HTTP/1.1 Host: gcc02.safelinks.protection.outlook.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-31 16:09:46 UTC	730	IN	HTTP/1.1 302 Found Cache-Control: private Content-Type: text/html; charset=utf-8 Location: https://na4.docusign.net/Signing/EmailStart.aspx?a=a6f8f68f-e076-4337-aac3-c42f41ebf6cc&etti=24&acct=7e9e0095-f41c-42f4-b219-3be2b992a461&er=449d3c4f-dbee-4c6e-a043-8f2682f3079d Server: Microsoft-IIS/10.0 X-AspNetMvc-Version: 4.0 X-SL-GetUrlReputation-Verdict: Good X-Robots-Tag: noindex, nofollow X-AspNet-Version: 4.0.30319 X-ServerName: BL0GCC02WS013 X-ServerVersion: 15.20.8114.020 X-ServerLat: 969 X-SafeLinks-Tracking-Id: 15bd19b8-4bfc-41c3-f8b2-08dcf9c66ffc X-Powered-By: ASP.NET X-Content-Type-Options: nosniff X-UA-Compatible: IE=Edge Date: Thu, 31 Oct 2024 16:09:46 GMT Connection: close Content-Length: 306
2024-10-31 16:09:46 UTC	306	IN	Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 4f 62 6a 65 63 74 20 6d 6f 76 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 32 3e 4f 62 6a 65 63 74 20 6d 6f 76 65 64 20 74 6f 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 6e 61 34 2e 64 6f 63 75 73 69 67 6e 2e 6e 65 74 2f 53 69 67 6e 69 6e 67 2f 45 6d 61 69 6c 53 74 61 72 74 2e 61 73 70 78 3f 61 3d 61 36 66 38 66 36 38 66 2d 65 30 37 36 2d 34 33 33 37 2d 61 61 63 33 2d 63 34 32 66 34 31 65 62 66 36 63 63 26 61 6d 70 3b 65 74 74 69 3d 32 34 26 61 6d 70 3b 61 63 63 74 3d 37 65 39 65 30 30 39 35 2d 66 34 31 63 2d 34 32 66 34 2d 62 32 31 39 2d 33 62 65 32 62 39 39 32 61 34 36 31 26 61 6d 70 3b 65 72 3d 34 34 39 64 33 63 34 66 2d 64 62 65 65 2d 34 63 36 65 2d Data Ascii: <html><head><title>Object moved</title></head><body><h2>Object moved to <a href="https://na4.docusign.net/Signing/EmailStart.aspx?a=a6f8f68f-e076-4337-aac3-c42f41ebf6cc&etti=24&acct=7e9e0095-f41c-42f4-b219-3be2b992a461&er=449d3c4f-dbee-4c6e-

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.16	49745	130.211.34.183	443	1836	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 16:09:54 UTC	1175	OUT	GET /track/?data=eyJldmVudCI6ICJtcF9wYWdlX3ZpZXciLCJwcm9wZXJ0aWVzIjogeyIkb3MiOiAiV2luZG93cyIsIiRicm93c2VyIjogIkNocm9tZSIsIiRyZWZlcnJpbmdfZG9tYWluIjogIm5hNC5kb2N1c2lnbi5uZXQiLCIkc2NyZWVuX2hlaWdodCI6IDEwMjQsIiRzY3JlZW5fd2lkdGgiOiAxMjgwLCJtcF9saWIiOiAid2ViIiwiZGlzdGluY3RfaWQiOiAiNTM4QzA5Mzc0QTEyM0I4RjZCOERBOEZEMDk4QTlDOTk4MTQwRjdEMiIsIiRpbml0aWFsX3JlZmVycmluZ19kb21haW4iOiAibmE0LmRvY3VzaWduLm5ldCIsIm1wX3BhZ2UiOiAibmE0LmRvY3VzaWduLm5ldCIsIm1wX3JlZmVycmVyIjogIm5hNC5kb2N1c2lnbi5uZXQiLCJtcF9icm93c2VyIjogIkNocm9tZSIsIm1wX3BsYXRmb3JtIjogIldpbmRvd3MiLCJ0b2tlbiI6ICIzMDRjY2JkZTI0ZDNiMTVmZmUyZDVkZTMwYzEwZGFiMiJ9fQ%3D%3D&ip=1&_=1730390993043 HTTP/1.1 Host: api.mixpanel.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://na4.docusign.net Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://na4.docusign.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-31 16:09:55 UTC	530	IN	HTTP/1.1 200 OK Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Requested-With Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Origin: https://na4.docusign.net Access-Control-Expose-Headers: X-MP-CE-Backoff Access-Control-Max-Age: 1728000 Cache-Control: no-cache, no-store Content-Type: application/json Strict-Transport-Security: max-age=604800; includeSubDomains Date: Thu, 31 Oct 2024 16:09:55 GMT Content-Length: 1 Via: 1.1 google Alt-Svc: clear Connection: close
2024-10-31 16:09:55 UTC	1	IN	Data Raw: 31 Data Ascii: 1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.16	49746	35.186.241.51	443	1836	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 16:09:55 UTC	969	OUT	GET /track/?data=eyJldmVudCI6ICJtcF9wYWdlX3ZpZXciLCJwcm9wZXJ0aWVzIjogeyIkb3MiOiAiV2luZG93cyIsIiRicm93c2VyIjogIkNocm9tZSIsIiRyZWZlcnJpbmdfZG9tYWluIjogIm5hNC5kb2N1c2lnbi5uZXQiLCIkc2NyZWVuX2hlaWdodCI6IDEwMjQsIiRzY3JlZW5fd2lkdGgiOiAxMjgwLCJtcF9saWIiOiAid2ViIiwiZGlzdGluY3RfaWQiOiAiNTM4QzA5Mzc0QTEyM0I4RjZCOERBOEZEMDk4QTlDOTk4MTQwRjdEMiIsIiRpbml0aWFsX3JlZmVycmluZ19kb21haW4iOiAibmE0LmRvY3VzaWduLm5ldCIsIm1wX3BhZ2UiOiAibmE0LmRvY3VzaWduLm5ldCIsIm1wX3JlZmVycmVyIjogIm5hNC5kb2N1c2lnbi5uZXQiLCJtcF9icm93c2VyIjogIkNocm9tZSIsIm1wX3BsYXRmb3JtIjogIldpbmRvd3MiLCJ0b2tlbiI6ICIzMDRjY2JkZTI0ZDNiMTVmZmUyZDVkZTMwYzEwZGFiMiJ9fQ%3D%3D&ip=1&_=1730390993043 HTTP/1.1 Host: api.mixpanel.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-31 16:09:55 UTC	507	IN	HTTP/1.1 200 OK Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Requested-With Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Origin: * Access-Control-Expose-Headers: X-MP-CE-Backoff Access-Control-Max-Age: 1728000 Cache-Control: no-cache, no-store Content-Type: application/json Strict-Transport-Security: max-age=604800; includeSubDomains Date: Thu, 31 Oct 2024 16:09:55 GMT Content-Length: 1 Via: 1.1 google Alt-Svc: clear Connection: close
2024-10-31 16:09:55 UTC	1	IN	Data Raw: 31 Data Ascii: 1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.16	49748	20.12.23.50	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 16:10:22 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=fGLw7rl8KtPeAcX&MD=AeeMNrPN HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-10-31 16:10:22 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "vic+p1MiJJ+/WMnK08jaWnCBGDfvkGRzPk9f8ZadQHg=_1440" MS-CorrelationId: 3a05b729-c84e-4bf5-9750-1d832db5c827 MS-RequestId: ab7fdf43-1d50-4c35-b890-2c26605e4a56 MS-CV: PhJ1oZszYEO40pcH.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Thu, 31 Oct 2024 16:10:21 GMT Connection: close Content-Length: 30005
2024-10-31 16:10:22 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 8d 2b 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 5b 49 00 00 14 00 00 00 00 00 10 00 8d 2b 00 00 a8 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 72 4d 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 fe f6 51 be 21 2b 72 4d 43 4b ed 7c 05 58 54 eb da f6 14 43 49 37 0a 02 d2 b9 86 0e 41 52 a4 1b 24 a5 bb 43 24 44 18 94 90 92 52 41 3a 05 09 95 ee 54 b0 00 91 2e e9 12 10 04 11 c9 6f 10 b7 a2 67 9f bd cf 3e ff b7 ff b3 bf 73 ed e1 9a 99 f5 c6 7a d7 bb de f5 3e cf fd 3c f7 dc 17 4a 1a 52 e7 41 a8 97 1e 14 f4 e5 25 7d f4 05 82 82 c1 20 30 08 06 ba c3 05 02 11 7f a9 c1 ff d2 87 5c 1e f4 ed 65 8e 7a 1f f6 0a 40 03 1d 7b f9 83 2c 1c 2f db b8 3a 39 3a 58 38 ba 73 5e Data Ascii: MSCF+D[I+IdrMenvironment.cabQ!+rMCK\|XTCI7AR$C$DRA:T.og>sz><JRA%} 0\ez@{,/:9:X8s^
2024-10-31 16:10:22 UTC	14181	IN	Data Raw: 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 20 50 43 41 20 32 30 31 30 30 1e 17 0d 32 33 31 30 31 32 31 39 30 37 32 35 5a 17 0d 32 35 30 31 31 30 31 39 30 37 32 35 5a 30 81 d2 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 2d 30 2b 06 03 55 04 0b 13 24 4d 69 63 72 6f Data Ascii: UUS10UWashington10URedmond10UMicrosoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100231012190725Z250110190725Z010UUS10UWashington10URedmond10UMicrosoft Corporation1-0+U$Micro

Target ID:	0
Start time:	12:09:33
Start date:	31/10/2024
Path:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\user\Desktop\(No subject) - 2024-10-31T090531.704.eml"
Imagebase:	0x7a0000
File size:	34'446'744 bytes
MD5 hash:	91A5292942864110ED734005B7E005C0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	12:09:34
Start date:	31/10/2024
Path:	C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "A3EA6518-C531-4DE7-BC7D-22EC5B6727F8" "C28E0983-BCA6-49DB-A7D6-E768A78B37F2" "6644" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
Imagebase:	0x7ff705590000
File size:	710'048 bytes
MD5 hash:	EC652BEDD90E089D9406AFED89A8A8BD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	12:09:42
Start date:	31/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fna4.docusign.net%2FSigning%2FEmailStart.aspx%3Fa%3Da6f8f68f-e076-4337-aac3-c42f41ebf6cc%26etti%3D24%26acct%3D7e9e0095-f41c-42f4-b219-3be2b992a461%26er%3D449d3c4f-dbee-4c6e-a043-8f2682f3079d&data=05%7C02%7Ckhickey%40santaclaraca.gov%7Cac1bfe3680ab4b4bc88008dcf9c3a7ca%7C28ea354810694e81aa0b6e4b3271a5cb%7C0%7C0%7C638659866425908855%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C20000%7C%7C%7C&sdata=hiibBlRjS07Ot%2Fn9qwgC1lvq2U9kAt%2BMFXtGA%2BOSu5U%3D&reserved=0
Imagebase:	0x7ff7f9810000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	12:09:43
Start date:	31/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1588 --field-trial-handle=2024,i,12387921056704305798,15199288670711883833,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff7f9810000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may abuse Internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality and customize aspects of Internet browsers. They can be installed directly or through a browser's app store and generally have access and permissions to everything that the browser can access.
Tactics:	Persistence
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Process: Process Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report (No subject) - 2024-10-31T090531.704.eml

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\FORMS\FRMCACHE.DAT

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-shm

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-wal

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{0A6D8DF3-6320-4094-AAF6-4C38E47FCA82}.tmp

C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1730390973785818400_2843F15A-A046-4E40-8493-39B4179C9EF6.log

C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1730390973786560500_2843F15A-A046-4E40-8493-39B4179C9EF6.log

C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20241031T1209330586-6644.etl

C:\Users\user\AppData\Roaming\Microsoft\Office\MSO3072.acl

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

C:\Users\user\Documents\Outlook Files\Outlook Data File - NoEmail.pst

C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp

Chrome Cache Entry: 66

Chrome Cache Entry: 67

Chrome Cache Entry: 68

Chrome Cache Entry: 69

Chrome Cache Entry: 70

Chrome Cache Entry: 71

Windows Analysis Report
(No subject) - 2024-10-31T090531.704.eml