Edit tour

Windows Analysis Report
FW Important Exploit Has Been Identified In Your Account Steps to Resolve.msg

Overview

General Information

Sample name:	FW Important Exploit Has Been Identified In Your Account Steps to Resolve.msg
Analysis ID:	1555123
MD5:	22e77deb8baeb67268d991959f158e72
SHA1:	0a407b68cbeed426c55927eef8af0c4aaf921b97
SHA256:	60720452c31b7d192c93fe968f7b8bed1f27cc5c733bd778402affa91bf1cae6
Infos:

Detection

Score:	60
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

AI detected phishing page

AI detected landing page (webpage, office document or email)

AI detected potential phishing Email

Phishing site detected (based on favicon image match)

HTML body with high number of embedded images detected

HTML page contains hidden javascript code

Queries the volume information (name, serial number etc) of a device

Sigma detected: Office Autorun Keys Modification

Stores files to the Windows start menu directory

Stores large binary data to the registry

Classification

Process Tree

System is w10x64_ra

OUTLOOK.EXE (PID: 6820 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /f "C:\Users\user\Desktop\FW Important Exploit Has Been Identified In Your Account Steps to Resolve.msg" MD5: 91A5292942864110ED734005B7E005C0)

ai.exe (PID: 7132 cmdline: "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "8C562E3F-F48F-464C-8BAF-90F194864796" "65EFBF38-C141-4B59-8CC6-A3B0A1E22398" "6820" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx" MD5: EC652BEDD90E089D9406AFED89A8A8BD)

chrome.exe (PID: 6936 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://eu-west-1.protection.sophos.com/?d=salesforce-sites.com&u=aHR0cHM6Ly9zYWFzLWFnaWxpdHktMTMyNC5teS5zYWxlc2ZvcmNlLXNpdGVzLmNvbS9zdXBwb3J0&p=m&i=NWY4Y2M5MDRiZjMzNDkwZTA5YjI2NjRl&t=UGw4bitJbmtBTmZjbVE2eWZVRW9xTzFvempXNk9IREsrRERPRmVuNkNzST0=&h=cfaba86bf26f4cab8d057b35fbb98b3b&s=AVNPUEhUT0NFTkNSWVBUSVZeg5PtcYAYZSdiS2wrkwnZbIZ-RJoxZeHPGn_HACYMjg MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 544 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 --field-trial-handle=1748,i,11569380789177123916,14124452111115969553,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Sigma Signatures

Sigma detected: Office Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 , EventID: 13, EventType: SetValue, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE, ProcessId: 6820, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Addins\OneNote.OutlookAddin\1

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Phishing

AI detected phishing page

Source: https://account.metaforsystemcheck.com/?__cf_chl_tk=Zga._v9oP0gZJuIuU3XMmQUGpDRKwAoU9PZ8pGqixdw-1731497986-1.0.1.1-wPgjYkAm4vVTpZWJ_lFIHqYQzT6gg4UBsONgzeRgQPE	LLM: Score: 9 Reasons: The brand 'Meta' is well-known and associated with the legitimate domain 'meta.com'., The URL 'account.metaforsystemcheck.com' does not match the legitimate domain 'meta.com'., The domain 'metaforsystemcheck.com' includes 'meta' as a substring, which is a common tactic in phishing to create confusion., The presence of 'account' as a subdomain is often used in phishing attempts to mimic login or account management pages., The URL structure suggests a potential phishing attempt due to the inclusion of 'meta' in a non-legitimate domain. DOM: 2.7.pages.csv
Source: https://account.metaforsystemcheck.com/?__cf_chl_tk=Zga._v9oP0gZJuIuU3XMmQUGpDRKwAoU9PZ8pGqixdw-1731497986-1.0.1.1-wPgjYkAm4vVTpZWJ_lFIHqYQzT6gg4UBsONgzeRgQPE	LLM: Score: 9 Reasons: The brand 'Meta' is well-known and is associated with the legitimate domain 'meta.com'., The URL 'account.metaforsystemcheck.com' does not match the legitimate domain 'meta.com'., The domain 'metaforsystemcheck.com' includes the word 'meta', which could be an attempt to mimic the legitimate brand., The presence of additional words in the domain name, such as 'forsystemcheck', is a common tactic used in phishing to create a sense of legitimacy., The URL structure and domain do not align with any known legitimate subdomains or services provided by Meta. DOM: 2.6.pages.csv

Phishing site detected (based on favicon image match)

Source: https://account.metaforsystemcheck.com/?__cf_chl_tk=Zga._v9oP0gZJuIuU3XMmQUGpDRKwAoU9PZ8pGqixdw-1731497986-1.0.1.1-wPgjYkAm4vVTpZWJ_lFIHqYQzT6gg4UBsONgzeRgQPE	Matcher: Template: facebook matched with high similarity
Source: https://salesforce-sites.com	Matcher: Template: salesforce matched with high similarity

Source: https://account.metaforsystemcheck.com/?__cf_chl_tk=Zga._v9oP0gZJuIuU3XMmQUGpDRKwAoU9PZ8pGqixdw-1731497986-1.0.1.1-wPgjYkAm4vVTpZWJ_lFIHqYQzT6gg4UBsONgzeRgQPE

HTTP Parser: Total embedded image size: 232127

Source: https://account.metaforsystemcheck.com/?__cf_chl_tk=Zga._v9oP0gZJuIuU3XMmQUGpDRKwAoU9PZ8pGqixdw-1731497986-1.0.1.1-wPgjYkAm4vVTpZWJ_lFIHqYQzT6gg4UBsONgzeRgQPE

HTTP Parser: Base64 decoded: <svg xmlns="http://www.w3.org/2000/svg" width="32" height="32" fill="none"><path fill="#B20F03" d="M16 3a13 13 0 1 0 13 13A13.015 13.015 0 0 0 16 3m0 24a11 11 0 1 1 11-11 11.01 11.01 0 0 1-11 11"/><path fill="#B20F03" d="M17.038 18.615H14.87L14.563 9.5h2....

Source: https://saas-agility-1324.my.salesforce-sites.com/support	HTTP Parser: No favicon
Source: https://account.metaforsystemcheck.com/?__cf_chl_tk=Zga._v9oP0gZJuIuU3XMmQUGpDRKwAoU9PZ8pGqixdw-1731497986-1.0.1.1-wPgjYkAm4vVTpZWJ_lFIHqYQzT6gg4UBsONgzeRgQPE	HTTP Parser: No favicon
Source: https://account.metaforsystemcheck.com/?__cf_chl_tk=Zga._v9oP0gZJuIuU3XMmQUGpDRKwAoU9PZ8pGqixdw-1731497986-1.0.1.1-wPgjYkAm4vVTpZWJ_lFIHqYQzT6gg4UBsONgzeRgQPE	HTTP Parser: No favicon
Source: https://account.metaforsystemcheck.com/?__cf_chl_tk=Zga._v9oP0gZJuIuU3XMmQUGpDRKwAoU9PZ8pGqixdw-1731497986-1.0.1.1-wPgjYkAm4vVTpZWJ_lFIHqYQzT6gg4UBsONgzeRgQPE	HTTP Parser: No favicon

Source: unknown	TCP traffic detected without corresponding DNS query: 93.184.221.240
Source: unknown	TCP traffic detected without corresponding DNS query: 2.22.50.144
Source: unknown	TCP traffic detected without corresponding DNS query: 93.184.221.240
Source: unknown	TCP traffic detected without corresponding DNS query: 2.22.50.144
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: eu-west-1.protection.sophos.com
Source: global traffic	DNS traffic detected: DNS query: saas-agility-1324.my.salesforce-sites.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: account.metaforsystemcheck.com
Source: global traffic	DNS traffic detected: DNS query: a.nel.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: challenges.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: cdnjs.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: cdn.jsdelivr.net
Source: global traffic	DNS traffic detected: DNS query: i.imgur.com
Source: global traffic	DNS traffic detected: DNS query: cdn.gtranslate.net

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: classification engine

Classification label: mal60.phis.winMSG@23/45@36/184

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

File created: C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

File created: C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20241113T0737410745-6820.etl

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

File read: C:\Users\desktop.ini

Source: unknown	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /f "C:\Users\user\Desktop\FW Important Exploit Has Been Identified In Your Account Steps to Resolve.msg"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "8C562E3F-F48F-464C-8BAF-90F194864796" "65EFBF38-C141-4B59-8CC6-A3B0A1E22398" "6820" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "8C562E3F-F48F-464C-8BAF-90F194864796" "65EFBF38-C141-4B59-8CC6-A3B0A1E22398" "6820" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://eu-west-1.protection.sophos.com/?d=salesforce-sites.com&u=aHR0cHM6Ly9zYWFzLWFnaWxpdHktMTMyNC5teS5zYWxlc2ZvcmNlLXNpdGVzLmNvbS9zdXBwb3J0&p=m&i=NWY4Y2M5MDRiZjMzNDkwZTA5YjI2NjRl&t=UGw4bitJbmtBTmZjbVE2eWZVRW9xTzFvempXNk9IREsrRERPRmVuNkNzST0=&h=cfaba86bf26f4cab8d057b35fbb98b3b&s=AVNPUEhUT0NFTkNSWVBUSVZeg5PtcYAYZSdiS2wrkwnZbIZ-RJoxZeHPGn_HACYMjg
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 --field-trial-handle=1748,i,11569380789177123916,14124452111115969553,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://eu-west-1.protection.sophos.com/?d=salesforce-sites.com&u=aHR0cHM6Ly9zYWFzLWFnaWxpdHktMTMyNC5teS5zYWxlc2ZvcmNlLXNpdGVzLmNvbS9zdXBwb3J0&p=m&i=NWY4Y2M5MDRiZjMzNDkwZTA5YjI2NjRl&t=UGw4bitJbmtBTmZjbVE2eWZVRW9xTzFvempXNk9IREsrRERPRmVuNkNzST0=&h=cfaba86bf26f4cab8d057b35fbb98b3b&s=AVNPUEhUT0NFTkNSWVBUSVZeg5PtcYAYZSdiS2wrkwnZbIZ-RJoxZeHPGn_HACYMjg
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 --field-trial-handle=1748,i,11569380789177123916,14124452111115969553,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: apphelp.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: c2r64.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: userenv.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: msasn1.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: cryptsp.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: rsaenh.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: gpapi.dll

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A6FF50C0-56C0-71CA-5732-BED303A59628}\InProcServer32

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Window found: window name: SysTabControl32

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Common

Persistence and Installation Behavior

AI detected landing page (webpage, office document or email)

Source: Email	LLM: Page contains button: 'Submit an appeal' Source: 'Email'
Source: Email	LLM: Email contains prominent button: 'submit an appeal'

AI detected potential phishing Email

Source: Email

LLM: Detected potential phishing email: The email claims to be from Salesforce/Meta but uses urgency and threats of permanent restrictions to create pressure

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\outlook\ConfigContextData 1

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

File Volume queried: C:\Windows\SysWOW64 FullSizeInformation

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Process information queried: ProcessInformation

Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe

Queries volume information: C:\Program Files (x86)\Microsoft Office\root\Office16\AI\WordCombinedFloatieLreOnline.onnx VolumeInformation

Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	2 Browser Extensions	1 Process Injection	1 Masquerading	OS Credential Dumping	1 Process Discovery	Remote Services	Data from Local System	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	1 DLL Side-Loading	1 Modify Registry	LSASS Memory	1 File and Directory Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 Registry Run Keys / Startup Folder	1 Registry Run Keys / Startup Folder	1 Process Injection	Security Account Manager	13 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction

Name	IP	Active	Malicious	Reputation
jsdelivr.map.fastly.net	151.101.65.229	true	false	high
a.nel.cloudflare.com	35.190.80.1	true	false	high
d35tlz0p71apkp.cloudfront.net	18.173.205.68	true	false	unknown
account.metaforsystemcheck.com	104.26.7.129	true	true	unknown
cdnjs.cloudflare.com	104.17.24.14	true	false	high
challenges.cloudflare.com	104.18.94.41	true	false	high
www.google.com	142.250.184.228	true	false	high
cdn.gtranslate.net	104.26.13.42	true	false	high
na235-ia7.ia7.r.salesforce.com	136.146.32.120	true	false	unknown
ipv4.imgur.map.fastly.net	199.232.196.193	true	false	high
eu-west-1.protection.sophos.com	unknown	unknown	false	high
cdn.jsdelivr.net	unknown	unknown	false	high
saas-agility-1324.my.salesforce-sites.com	unknown	unknown	false	unknown
i.imgur.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://account.metaforsystemcheck.com/?__cf_chl_tk=Zga._v9oP0gZJuIuU3XMmQUGpDRKwAoU9PZ8pGqixdw-1731497986-1.0.1.1-wPgjYkAm4vVTpZWJ_lFIHqYQzT6gg4UBsONgzeRgQPE	true		unknown
https://saas-agility-1324.my.salesforce-sites.com/support	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
104.18.94.41	challenges.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
199.232.196.193	ipv4.imgur.map.fastly.net	United States	54113	FASTLYUS	false
20.189.173.12	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
104.26.7.129	account.metaforsystemcheck.com	United States	13335	CLOUDFLARENETUS	true
52.111.231.26	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
18.173.205.68	d35tlz0p71apkp.cloudfront.net	United States	3	MIT-GATEWAYSUS	false
104.26.13.42	cdn.gtranslate.net	United States	13335	CLOUDFLARENETUS	false
136.146.32.120	na235-ia7.ia7.r.salesforce.com	United States	14340	SALESFORCEUS	false
35.190.80.1	a.nel.cloudflare.com	United States	15169	GOOGLEUS	false
142.250.184.228	www.google.com	United States	15169	GOOGLEUS	false
52.113.194.132	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
104.17.24.14	cdnjs.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
1.1.1.1	unknown	Australia	13335	CLOUDFLARENETUS	false
104.18.186.31	unknown	United States	13335	CLOUDFLARENETUS	false
74.125.71.84	unknown	United States	15169	GOOGLEUS	false
151.101.65.229	jsdelivr.map.fastly.net	United States	54113	FASTLYUS	false
104.18.95.41	unknown	United States	13335	CLOUDFLARENETUS	false
2.19.126.151	unknown	European Union	16625	AKAMAI-ASUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
52.109.28.47	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
172.217.18.106	unknown	United States	15169	GOOGLEUS	false
52.109.28.46	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.250.186.142	unknown	United States	15169	GOOGLEUS	false
184.28.90.27	unknown	United States	16625	AKAMAI-ASUS	false
172.217.16.195	unknown	United States	15169	GOOGLEUS	false
104.17.25.14	unknown	United States	13335	CLOUDFLARENETUS	false

Private

IP
192.168.2.16

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1555123
Start date and time:	2024-11-13 13:37:04 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled
Analysis Mode:	stream
Analysis stop reason:	Timeout
Sample name:	FW Important Exploit Has Been Identified In Your Account Steps to Resolve.msg
Detection:	MAL
Classification:	mal60.phis.winMSG@23/45@36/184
Cookbook Comments:	Found application associated with file extension: .msg

Warnings

Exclude process from analysis (whitelisted): dllhost.exe
Excluded IPs from analysis (whitelisted): 52.109.28.46
Excluded domains from analysis (whitelisted): config.officeapps.live.com, prod.configsvc1.live.com.akadns.net, ctldl.windowsupdate.com, officeclient.microsoft.com, europe.configsvc1.live.com.akadns.net, uks-azsc-config.officeapps.live.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: FW Important Exploit Has Been Identified In Your Account Steps to Resolve.msg

LLM Input / Output

Input	Output
URL: Model: claude-3-5-sonnet-latest	{ "explanation": [ "The email claims to be from Salesforce/Meta but uses urgency and threats of permanent restrictions to create pressure", "The links in the email are obscured and redirect through suspicious domains (salesforce-sites.com) rather than official Meta domains", "There are inconsistencies in branding - mixing Salesforce, Meta and 'facelo ook' in suspicious ways" ], "phishing": true, "confidence": 9 }
{ "date": "Wed, 13 Nov 2024 13:19:15 +0100", "subject": "FW: Important: Exploit Has Been Identified In Your Account Steps to Resolve", "communications": [ " \n\n \n\n", "From: Business Suite <noreply@salesforce.com> \nSent: 13 November 2024 11:58\nTo: Emily Edwards <Emily.Edwards@cardfactory.co.uk>\nSubject: Important: Exploit Has Been Identified In Your Account Steps to Resolve\n\n \n\nWe wanted to inform you about some recent activity on your account that may not fully adhere to our guidelines. It appears an exploit has been identified that might be impacting specific functions wit \n\nCAUTION: This email originated from outside of the organisation. If in doubt please use the report message button to Security.\n\nsophospsmartbannerend \n\n\t \t\n We wanted to inform you about some recent activity on your account that may not fully adhere to our guidelines. It appears an exploit has been identified that might be impacting specific functions within the Meta Business Suite. As a result, temporary limitations have been placed on your account. \n\n \n\n\t\n \n\nfacelo ook \n\n\t\n\t\n\t\n \n\n \n\n\t\n \n\n\t\n\t\nTicket ID: FB-42P-378-KLM-TRQ\n\nDear Emily Edwards,,\n\nWe wanted to inform you about some recent activity on your account that may not fully adhere to our guidelines. It appears an exploit has been identified that might be impacting specific functions within the Meta Business Suite. As a result, temporary limitations have been placed on your account. \n\nNext Steps: \n\n\tInitiate the System Check: Please submit an appeal to start a system check, allowing us to investigate and potentially lift the restrictions on your account.\n\tLive Chat Assistance: Our team is available via live chat to guide you through the review process and answer any questions.\n\nPlease be aware that appeals should be submitted by November 13, 2024. After this date, the restrictions may become permanent, and further appeals may not be accepted.\n\n\t\nSubmit an appeal <https://eu-west-1.protection.sophos.com?d=salesforce-sites.com&u=aHR0cHM6Ly9zYWFzLWFnaWxpdHktMTMyNC5teS5zYWxlc2ZvcmNlLXNpdGVzLmNvbS9zdXBwb3J0&p=m&i=NWY4Y2M5MDRiZjMzNDkwZTA5YjI2NjRl&t=UGw4bitJbmtBTmZjbVE2eWZVRW9xTzFvempXNk9IREsrRERPRmVuNkNzST0=&h=cfaba86bf26f4cab8d057b35fbb98b3b&s=AVNPUEhUT0NFTkNSWVBUSVZeg5PtcYAYZSdiS2wrkwnZbIZ-RJoxZeHPGn_HACYMjg> \n\n\t\nIf you need further assistance, please don't hesitate to contact our support team <https://eu-west-1.protection.sophos.com?d=salesforce-sites.com&u=aHR0cHM6Ly9zYWFzLWFnaWxpdHktMTMyNC5teS5zYWxlc2ZvcmNlLXNpdGVzLmNvbS9zdXBwb3J0&p=m&i=NWY4Y2M5MDRiZjMzNDkwZTA5YjI2NjRl&t=UGw4bitJbmtBTmZjbVE2eWZVRW9xTzFvempXNk9IREsrRERPRmVuNkNzST0=&h=cfaba86bf26f4cab8d057b35fbb98b3b&s=AVNPUEhUT0NFTkNSWVBUSVZeg5PtcYAYZSdiS2wrkwnZbIZ-RJoxZeHPGn_HACYMjg> .\n\n\t\n\t\n\t\n\t\n\t\t\t\n \n\n\t\t\n \n\n \t\n \n\n \n\n\t\n \n\nCopyright 2024 Meta Ltd. All rights reserved. We are located at 1601 Willow Road, Menlo Park, CA 94025 .\n\n\t\n\t\n\t\n\t\t\n\n\n\n \n\n" ], "from": "Emily Edwards <Emily.Edwards@cardfactory.co.uk>", "to": "Gaganpreet Gandhi <Gaganpreet.Gandhi@cardfactory.co.uk>", "attachements": [ "~WRD0001.jpg" ] }
URL: Email Model: claude-3-haiku-20240307	```json { "contains_trigger_text": true, "trigger_text": "Initiate the System Check: Please submit an appeal to start a system check, allowing us to investigate and potentially lift the restrictions on your account.", "prominent_button_name": "Submit an appeal", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": true, "has_visible_qrcode": false }

URL: Email Model: claude-3-haiku-20240307	```json { "brands": [ "facebook" ] }
	```json { "brands": [ "facebook" ] }
URL: https://account.metaforsystemcheck.com/?__cf_chl_tk=Zga._v9oP0gZJuIuU3XMmQUGpDRKwAoU9PZ8pGqixdw-1731497986-1.0.1.1-wPgjYkAm4vVTpZWJ_lFIHqYQzT6gg4UBsONgzeRgQPE Model: claude-3-haiku-20240307	```json { "contains_trigger_text": true, "trigger_text": "Verifying you are human. This may take a few seconds.", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": true, "has_urgent_text": false, "has_visible_qrcode": false }

URL: Model: claude-3-5-sonnet-latest	{ "typosquatting": false, "unusual_query_string": false, "suspicious_tld": false, "ip_in_url": false, "long_subdomain": true, "malicious_keywords": false, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": true, "brand_spoofing_attempt": false, "third_party_hosting": true }
URL: https://saas-agility-1324.my.salesforce-sites.com
URL: https://account.metaforsystemcheck.com/?__cf_chl_tk=Zga._v9oP0gZJuIuU3XMmQUGpDRKwAoU9PZ8pGqixdw-1731497986-1.0.1.1-wPgjYkAm4vVTpZWJ_lFIHqYQzT6gg4UBsONgzeRgQPE Model: claude-3-haiku-20240307	```json { "brands": [ "Cloudflare" ] }
	```json { "brands": [ "Cloudflare" ] }
URL: https://account.metaforsystemcheck.com/?__cf_chl_tk=Zga._v9oP0gZJuIuU3XMmQUGpDRKwAoU9PZ8pGqixdw-1731497986-1.0.1.1-wPgjYkAm4vVTpZWJ_lFIHqYQzT6gg4UBsONgzeRgQPE Model: claude-3-haiku-20240307	```json { "contains_trigger_text": true, "trigger_text": "Verifying you are human. This may take a few seconds.", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": true, "has_urgent_text": false, "has_visible_qrcode": false }

URL: https://account.metaforsystemcheck.com/?__cf_chl_tk=Zga._v9oP0gZJuIuU3XMmQUGpDRKwAoU9PZ8pGqixdw-1731497986-1.0.1.1-wPgjYkAm4vVTpZWJ_lFIHqYQzT6gg4UBsONgzeRgQPE Model: claude-3-haiku-20240307	```json { "contains_trigger_text": true, "trigger_text": "Verify you are human by completing the action below.", "prominent_button_name": "Verify you are human", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": true, "has_urgent_text": false, "has_visible_qrcode": false }

URL: https://account.metaforsystemcheck.com/?__cf_chl_tk=Zga._v9oP0gZJuIuU3XMmQUGpDRKwAoU9PZ8pGqixdw-1731497986-1.0.1.1-wPgjYkAm4vVTpZWJ_lFIHqYQzT6gg4UBsONgzeRgQPE Model: claude-3-haiku-20240307	```json { "brands": [ "Cloudflare" ] }
	```json { "brands": [ "Cloudflare" ] }
URL: https://account.metaforsystemcheck.com/?__cf_chl_tk=Zga._v9oP0gZJuIuU3XMmQUGpDRKwAoU9PZ8pGqixdw-1731497986-1.0.1.1-wPgjYkAm4vVTpZWJ_lFIHqYQzT6gg4UBsONgzeRgQPE Model: claude-3-haiku-20240307	```json { "brands": [ "Cloudflare" ] }
	```json { "brands": [ "Cloudflare" ] }
URL: https://account.metaforsystemcheck.com/?__cf_chl_tk=Zga._v9oP0gZJuIuU3XMmQUGpDRKwAoU9PZ8pGqixdw-1731497986-1.0.1.1-wPgjYkAm4vVTpZWJ_lFIHqYQzT6gg4UBsONgzeRgQPE Model: claude-3-haiku-20240307	```json { "contains_trigger_text": true, "trigger_text": "Enter the ticket ID you've received in the email.", "prominent_button_name": "Create Ticket", "text_input_field_labels": [ "First name", "Last name", "Business email", "Ticket ID" ], "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false }

URL: https://account.metaforsystemcheck.com/?__cf_chl_tk=Zga._v9oP0gZJuIuU3XMmQUGpDRKwAoU9PZ8pGqixdw-1731497986-1.0.1.1-wPgjYkAm4vVTpZWJ_lFIHqYQzT6gg4UBsONgzeRgQPE Model: claude-3-haiku-20240307	```json { "contains_trigger_text": true, "trigger_text": "Enter the ticket ID you've received in the email.", "prominent_button_name": "Continue", "text_input_field_labels": [ "Business email", "Ticket ID" ], "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false }

URL: https://account.metaforsystemcheck.com/?__cf_chl_tk=Zga._v9oP0gZJuIuU3XMmQUGpDRKwAoU9PZ8pGqixdw-1731497986-1.0.1.1-wPgjYkAm4vVTpZWJ_lFIHqYQzT6gg4UBsONgzeRgQPE Model: claude-3-haiku-20240307	```json { "brands": [ "Meta" ] }
	```json { "brands": [ "Meta" ] }
URL: https://account.metaforsystemcheck.com/?__cf_chl_tk=Zga._v9oP0gZJuIuU3XMmQUGpDRKwAoU9PZ8pGqixdw-1731497986-1.0.1.1-wPgjYkAm4vVTpZWJ_lFIHqYQzT6gg4UBsONgzeRgQPE Model: claude-3-haiku-20240307	```json { "brands": [ "Meta" ] }
	```json { "brands": [ "Meta" ] }
URL: https://account.metaforsystemcheck.com/?__cf_chl_tk=Zga._v9oP0gZJuIuU3XMmQUGpDRKwAoU9PZ8pGqixdw-1731497986-1.0.1.1-wPgjYkAm4vVTpZWJ_lFIHqYQzT6gg4UBsONgzeRgQPE Model: gpt-4o	```json{ "legit_domain": "meta.com", "classification": "wellknown", "reasons": [ "The brand 'Meta' is well-known and associated with the legitimate domain 'meta.com'.", "The URL 'account.metaforsystemcheck.com' does not match the legitimate domain 'meta.com'.", "The domain 'metaforsystemcheck.com' includes 'meta' as a substring, which is a common tactic in phishing to create confusion.", "The presence of 'account' as a subdomain is often used in phishing attempts to mimic login or account management pages.", "The URL structure suggests a potential phishing attempt due to the inclusion of 'meta' in a non-legitimate domain." ], "riskscore": 9} Google indexed: False
URL: account.metaforsystemcheck.com Brands: Meta Input Fields: Business email, Ticket ID
URL: https://account.metaforsystemcheck.com/?__cf_chl_tk=Zga._v9oP0gZJuIuU3XMmQUGpDRKwAoU9PZ8pGqixdw-1731497986-1.0.1.1-wPgjYkAm4vVTpZWJ_lFIHqYQzT6gg4UBsONgzeRgQPE Model: gpt-4o	```json{ "legit_domain": "meta.com", "classification": "wellknown", "reasons": [ "The brand 'Meta' is well-known and is associated with the legitimate domain 'meta.com'.", "The URL 'account.metaforsystemcheck.com' does not match the legitimate domain 'meta.com'.", "The domain 'metaforsystemcheck.com' includes the word 'meta', which could be an attempt to mimic the legitimate brand.", "The presence of additional words in the domain name, such as 'forsystemcheck', is a common tactic used in phishing to create a sense of legitimacy.", "The URL structure and domain do not align with any known legitimate subdomains or services provided by Meta." ], "riskscore": 9} Google indexed: False
URL: account.metaforsystemcheck.com Brands: Meta Input Fields: First name, Last name, Business email, Ticket ID
URL: Model: claude-3-5-sonnet-latest	{ "typosquatting": false, "unusual_query_string": false, "suspicious_tld": false, "ip_in_url": false, "long_subdomain": false, "malicious_keywords": false, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": true, "brand_spoofing_attempt": false, "third_party_hosting": false }
URL: https://salesforce-sites.com

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\FORMS\FRMCACHE.DAT

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	modified
Size (bytes):	231348
Entropy (8bit):	4.396653951615408
Encrypted:	false
SSDEEP:
MD5:	AC95C80FC2E3284877384711ABC32ACC
SHA1:	CFD79966823A38534969DDC64DCA97E3AB951A90
SHA-256:	3A3B03B5B0925F91DD05FFE16A5E3DAC888FC052094BB80A8B0A1ED7DF2279D7
SHA-512:	D691701DA81A55CECFC09B9535CC4398622735A8AE335AC5690DAFAC025F5BD0B59CE17E00606C44931B5607F082EA368743A763C4CF3312FD3B1ADF77BC31A2
Malicious:	false
Reputation:	unknown
Preview:	TH02...... ......5......SM01X...,........5..........IPM.Activity...........h...............h............H..hd.\|......o)....h........H...H..h\cal ...pDat...hHd..0.....\|....h.v............h........_`Rk...h.i.@...I.lw...h....H...8.Wk...0....T...............d.........2h...............k5.;.....4.2...!h.............. h..R*.....\|...#h....8.........$hH.......8....."h.{.......\|....'h..............1h.v.<.........0h....4....Wk../h....h.....WkH..hp...p...d.\|...-h .........\|...+hYw....X.\|................. ..............F7..............FIPM.Activity....Form....Standard....Journal Entry...IPM.Microsoft.FolderDesign.FormsDescription................F.k..........1122110020000000.GwwMicrosoft...This form is used to create journal entries.........kf...... ..........&...........(.......(... ...@.....................................................................................................................fffffffff........wwwwwwww.p....pp..............p...............pw..............pw..DDDDO..

C:\Users\user\AppData\Local\Microsoft\FontCache\4\CatalogCacheMetaData.xml

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	XML 1.0 document, ASCII text, with very long lines (1869), with no line terminators
Category:	dropped
Size (bytes):	1869
Entropy (8bit):	5.089607518789864
Encrypted:	false
SSDEEP:
MD5:	F4924344564BF8A5BD3C6F17F57BE14F
SHA1:	C683A22D23F8CF043760EB6D1BA3C33ED512A59C
SHA-256:	613EF019F69C114F7315454680AA680EABB17690F757B925A3CCA061AC03FE27
SHA-512:	A022114E40D87D993D07538DC731F0D14BC558870E030F9687F3CD47077FB7B6F247B10F81940C337183273FB7ABB55676D3EB91AE367D2FD7874406D7C2F60D
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?><root><version>1</version><Count>12</Count><Resource><Id>Aptos_26215680</Id><LAT>2024-11-13T12:37:45Z</LAT><key>29939506207.ttf</key><folder>Aptos</folder><type>4</type></Resource><Resource><Id>Aptos_45876480</Id><LAT>2024-11-13T12:37:45Z</LAT><key>27160079615.ttf</key><folder>Aptos</folder><type>4</type></Resource><Resource><Id>Aptos Narrow_26215424</Id><LAT>2023-10-06T09:25:29Z</LAT><key>31558910439.ttf</key><folder>Aptos Narrow</folder><type>4</type></Resource><Resource><Id>Aptos Display_26215680</Id><LAT>2023-10-06T09:25:29Z</LAT><key>23001069669.ttf</key><folder>Aptos Display</folder><type>4</type></Resource><Resource><Id>Aptos Narrow_45876224</Id><LAT>2023-10-06T09:25:29Z</LAT><key>24153076628.ttf</key><folder>Aptos Narrow</folder><type>4</type></Resource><Resource><Id>Aptos Display_45876480</Id><LAT>2023-10-06T09:25:29Z</LAT><key>30264859306.ttf</key><folder>Aptos Display</folder><type>4</type></Resource><Resource><Id>Aptos_

C:\Users\user\AppData\Local\Microsoft\FontCache\4\Catalog\ListAll.Json

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	JSON data
Category:	dropped
Size (bytes):	521377
Entropy (8bit):	4.9084889265453135
Encrypted:	false
SSDEEP:
MD5:	C37972CBD8748E2CA6DA205839B16444
SHA1:	9834B46ACF560146DD7EE9086DB6019FBAC13B4E
SHA-256:	D4CFBB0E8B9D3E36ECE921B9B51BD37EF1D3195A9CFA1C4586AEA200EB3434A7
SHA-512:	02B4D134F84122B6EE9A304D79745A003E71803C354FB01BAF986BD15E3BA57BA5EF167CC444ED67B9BA5964FF5922C50E2E92A8A09862059852ECD9CEF1A900
Malicious:	false
Reputation:	unknown
Preview:	{"MajorVersion":4,"MinorVersion":40,"Expiration":14,"Fonts":[{"a":[4294966911],"f":"Abadi","fam":[],"sf":[{"c":[1,0],"dn":"Abadi","fs":32696,"ful":[{"lcp":983041,"lsc":"Latn","ltx":"Abadi"}],"gn":"Abadi","id":"23643452060","p":[2,11,6,4,2,1,4,2,2,4],"sub":[],"t":"ttf","u":[2147483651,0,0,0],"v":197263,"w":26215680},{"c":[1,0],"dn":"Abadi Extra Light","fs":22180,"ful":[{"lcp":983042,"lsc":"Latn","ltx":"Abadi Extra Light"}],"gn":"Abadi Extra Light","id":"17656736728","p":[2,11,2,4,2,1,4,2,2,4],"sub":[],"t":"ttf","u":[2147483651,0,0,0],"v":197263,"w":13108480}]},{"a":[4294966911],"f":"ADLaM Display","fam":[],"sf":[{"c":[536870913,0],"dn":"ADLaM Display Regular","fs":140072,"ful":[{"lcp":983040,"lsc":"Latn","ltx":"ADLaM Display"}],"gn":"ADLaM Display","id":"31965479471","p":[2,1,0,0,0,0,0,0,0,0],"sub":[],"t":"ttf","u":[2147491951,1107296330,0,0],"v":131072,"w":26215680}]},{"a":[4294966911],"f":"Agency FB","fam":[],"sf":[{"c":[536870913,0],"dn":"Agency FB Bold","fs":54372,"ful":[{"lcp":9830

C:\Users\user\AppData\Local\Microsoft\FontCache\4\PreviewFont\flat_officeFontsPreview_4_40.ttf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	TrueType Font data, 10 tables, 1st "OS/2", 7 names, Microsoft, language 0x409, \251 2018 Microsoft Corporation. All Rights Reserved.msofp_4_40RegularVersion 4.40;O365
Category:	dropped
Size (bytes):	773040
Entropy (8bit):	6.55939673749297
Encrypted:	false
SSDEEP:
MD5:	4296A064B917926682E7EED650D4A745
SHA1:	3953A6AA9100F652A6CA533C2E05895E52343718
SHA-256:	E04E41C74D6C78213BA1588BACEE64B42C0EDECE85224C474A714F39960D8083
SHA-512:	A25388DDCE58D9F06716C0F0BDF2AEFA7F68EBCA7171077533AF4A9BE99A08E3DCD8DFE1A278B7AA5DE65DA9F32501B4B0B0ECAB51F9AF0F12A3A8A75363FF2C
Malicious:	false
Reputation:	unknown
Preview:	........... OS/29....(...`cmap.s.,.......pglyf..&....\|....head2..........6hheaE.@v.......$hmtx...........@loca.U.....8...Dmaxp........... name.P+........post...<...... .........b~1_.<...........<......r......Aa...................Q....Aa....Aa.........................~...................................................3..............................MS .@.......(...Q................. ...........d...........0...J.......8.......>..........+a..#...,................................................/...K.......z...............N.........!...-...+........z.......h..%^..3...&j..+...+%..'R..+..."....................k......$A...,.......g...&...=.......X..&..............&....B..(B...............#.......j...............+...P...5...@...)..........#...)Q..................{.. ....?..'...#....N...7......<...;>.............. ]...........5......#....s.......$.......$.......^..................+...>....H.......%...7.......6.......O...V...........K......"........c...N......!...............$...&...p..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntities.bin

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	322260
Entropy (8bit):	4.000299760592446
Encrypted:	false
SSDEEP:
MD5:	CC90D669144261B198DEAD45AA266572
SHA1:	EF164048A8BC8BD3A015CF63E78BDAC720071305
SHA-256:	89C701EEFF939A44F28921FD85365ECD87041935DCD0FE0BAF04957DA12C9899
SHA-512:	16F8A8A6DCBAEAEFB88C7CFF910BCCC71B76A723CF808B810F500E28E543112C2FAE2491D4D209569BD810490EDFF564A2B084709B02963BCAF6FDF1AEEC59AC
Malicious:	false
Reputation:	unknown
Preview:	51253fe60063c31af0d295afb42228b0:v2:2:1:1590:2:8479:76bd602437550e98c9043d06a55186ab7d95dea5a0e935a599f73e62a8c9b158e0afcb19351f6c353940c06a38172b94d18c02cf92bb8a80184eccca0392b259ab3e71dae73e491c7941997cb36ad4a198661f622dad478d840f66d530a0dde78acea3367f91fff62fbb3dc18faff0c708ad30edef5bea8b22c5fd782b770d8993386eaa784fd19a3c3e1db3b537b1a94d3d4fbd46f8df8fddf6d16611969fe0a97c50e0f3ac24750c93257cf5c161184aa7385800c87d803b339632a3d8ec7fe17a0afd83ce9e9d0e3f7b8d579637928a811f1f7e6d1887df2ddc7d4f752c4d600235e426c92c7bf8a1362f95457998cc0e5d4261f0efa4fada0f866dbcefb407dacab7a2914e91c2f08200f38c2d9d621962145b1464b0f204b326118a53ecdcab22bff005fdd5257c99a6dc51ac0600a49f2ef782396987e78c08b846dad5db55e8ccefffc64863bc2c3e90b95a09d25d0814a848c98fe01a82d4e30e6682dd546e12c45ca0d280a45295ab4bd632dafb070edfdc3c9e38313d5aeb195972986f8011b66817028fd8c78b67a0ac7e780eecc3fb6a31f5a025b8a9a3db278a98c0696aeaac739b18688b0f9c7d751bba02cc5f4e41853fb119b3c0c915059aaa92971244a1989124f12881ca88e6410df70b793a2c3a736ff4

C:\Users\user\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntitiesUpdated.bin

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	ASCII text, with no line terminators
Category:	modified
Size (bytes):	10
Entropy (8bit):	2.8464393446710154
Encrypted:	false
SSDEEP:
MD5:	AC7A7FA48B14565CBE88891FA41C3711
SHA1:	29906971F2127DB9838733846486C6877EC69E41
SHA-256:	8BBAAA2784E3F984C4248F5351FF993C53907D1CE6399B800DAA2510663F07F1
SHA-512:	D0E8AC521085D825468544BEF7F24B03880E65A5F1A332EFC308AB0A16436D6C4F20BDE5F4C657E123898B9C29B20981388DDC335264958FE189A3B9DB4E3041
Malicious:	false
Reputation:	unknown
Preview:	1731501469

C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\5A760FE5-2C27-4F20-89CC-E60DEA210834

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	180288
Entropy (8bit):	5.2910001654963725
Encrypted:	false
SSDEEP:
MD5:	19C50557EB06CC3E5676B84F3AFAFACD
SHA1:	4C8CA61BA546FF5C80F4E3A4A2D98F4C0E84FC05
SHA-256:	778C0A3AC7A5099EFEA2D2B4137BEE2916FB5AE11E43AE85F9E238129400D734
SHA-512:	DF735E21775E1453A0FB39BA16C0FF460F62CDB56F4B9B587664D005AE71D3689729A5C9B057E7D004021056A650AF4482E4377451A0D9542966B02EAA40604A
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8"?>..<o:OfficeConfig xmlns:o="urn:schemas-microsoft-com:office:office">.. <o:services o:GenerationTime="2024-11-13T12:37:43">.. Build: 16.0.18223.40125-->.. <o:default>.. <o:ticket o:headerName="Authorization" o:headerValue="{}" />.. </o:default>.. <o:service o:name="Research">.. <o:url>https://word-edit.officeapps.live.com/we/rrdiscovery.ashx</o:url>.. </o:service>.. <o:service o:name="ORedir">.. <o:url>https://o15.officeredir.microsoft.com/r</o:url>.. </o:service>.. <o:service o:name="ORedirSSL">.. <o:url>https://o15.officeredir.microsoft.com/r</o:url>.. </o:service>.. <o:service o:name="ClViewClientHelpId" o:authentication="1">.. <o:url>https://[MAX.BaseHost]/client/results</o:url>.. <o:ticket o:policy="MBI_SSL_SHORT" o:idprovider="1" o:target="[MAX.AuthHost]" o:headerValue="Passport1.4 from-PP='{}&p='" />.. <o:ticket o:idprovider="3" o:headerValue="Bearer {}" o:resourceId="[

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-journal

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	4616
Entropy (8bit):	0.13700485453793962
Encrypted:	false
SSDEEP:
MD5:	F3EF2B9241225EAC97AF0F292DCCDC8C
SHA1:	42FEBED0F4C3A273669FE2E22553E889B69DD466
SHA-256:	EB5BA7409EA1BFF62C842BC472155F93A92C5A4ECE2AFA5494A24B3D4D55BF21
SHA-512:	2365A3265F9278848D1CC569C09A7DFEC297F0A417B947C91648CF17604AA59E952D7CB944361D1C0891C173EC77FB31C3706D28C3A1FAA9139381A0C71198DD
Malicious:	false
Reputation:	unknown
Preview:	.... .c.....6.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................SQLite format 3......@ .......................................................................... .................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\D40A26F9.dat

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 100x100, components 3
Category:	dropped
Size (bytes):	823
Entropy (8bit):	6.383036735600367
Encrypted:	false
SSDEEP:
MD5:	2C1B060229A914F2A90A8C7E3BE6EB40
SHA1:	03D8FB85556EDF397D8AFCAFC0B13F11ECBDE50C
SHA-256:	CB0628092DDEA96BB040221B5C793DBBB792A67D0621BDFBA170C07374D85801
SHA-512:	B69BB43B94BE309FBE7266F0DA6EF49667F171DA1EAE9019CACC717AC132BA673B45C895A6ECAA08880A8B1474A884B0225F688EF8EC6A56C9104EF89C12CD06
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....`.`.....C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222......d.d.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(..?..

C:\Users\user\AppData\Local\Temp\msoF037.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	GIF image data, version 89a, 15 x 15
Category:	dropped
Size (bytes):	663
Entropy (8bit):	5.949125862393289
Encrypted:	false
SSDEEP:
MD5:	ED3C1C40B68BA4F40DB15529D5443DEC
SHA1:	831AF99BB64A04617E0A42EA898756F9E0E0BCCA
SHA-256:	039FE79B74E6D3D561E32D4AF570E6CA70DB6BB3718395BE2BF278B9E601279A
SHA-512:	C7B765B9AFBB9810B6674DBC5C5064ED96A2682E78D5DFFAB384D81EDBC77D01E0004F230D4207F2B7D89CEE9008D79D5FBADC5CB486DA4BC43293B7AA878041
Malicious:	false
Reputation:	unknown
Preview:	GIF89a....w..!..MSOFFICE9.0.....sRGB......!..MSOFFICE9.0.....msOPMSOFFICE9.0Dn&P3.!..MSOFFICE9.0.....cmPPJCmp0712.........!.......,....................'..;..b...RQ.xx..................,+................................yy..;..b.........................qp.bb..........uv.ZZ.LL.......xw.jj.NN.A@....zz.mm.^_.........yw........yx.xw.RR.,.++............................................................................................................................................................................................................8....>.......................4567...=..../0123.....<9:.()+,-.B.@...."#$%&'....... !............C.?....A;<...HT(..;

C:\Users\user\AppData\Roaming\Microsoft\Office\MSO3072.acl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	30
Entropy (8bit):	1.2389205950315936
Encrypted:	false
SSDEEP:
MD5:	C561F115A197E27807E3E52E0A7A05CB
SHA1:	585CB1E38699E20891BD17FE0BC84E417637B350
SHA-256:	385D47431C5F45B2C9252F83E1DD19B8A66D403A1F94FE8E47B1708F2990DC34
SHA-512:	91F48AF1B8DDC2C74431C544E45CE7C120BAE77E5C846E2091723F24191413BDA4FCF28EA6C94AAB96BB898C20DB57DA6D58F1FF0F2A31AC5076A1FB9B8F09BE
Malicious:	false
Reputation:	unknown
Preview:	..............................

C:\Users\user\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	14
Entropy (8bit):	2.699513850319966
Encrypted:	false
SSDEEP:
MD5:	C5A12EA2F9C2D2A79155C1BC161C350C
SHA1:	75004B4B6C6C4EE37BE7C3FD7EE4AF4A531A1B1A
SHA-256:	61EC0DAA23CBC92167446DADEFB919D86E592A31EBBD0AB56E64148EBF82152D
SHA-512:	B3D5AF7C4A9CB09D27F0522671503654D06891740C36D3089BB5CB21E46AB235B0FA3DC2585A383B9F89F5C6DAE78F49F72B0AD58E6862DE39F440C4D6FF460B
Malicious:	false
Reputation:	unknown
Preview:	..c.a.l.i.....

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Nov 13 11:38:51 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2673
Entropy (8bit):	3.9814713494399734
Encrypted:	false
SSDEEP:
MD5:	A24A8A2F7FDA50E31BC75493D8D806FF
SHA1:	80C498F89AB54E57C017A3C419AAED3F1C0A7D0D
SHA-256:	71E9DB37888D18E415A67972206E3B81D601954F11B24FD6AB644B7E47A29E55
SHA-512:	EC2D56E194FCD9F2EF0E888A38C5F1EE5C9CD5C70D47E56D26B15F5D7C60FD9038126799FF6F5BCF215765B484E634A3A033EF16613C437921B4D89C1DD037D2
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.........5..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.ImY.d....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VmY.d....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VmY.d....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VmY.d..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VmY.d...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............4> .....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Nov 13 11:38:51 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2675
Entropy (8bit):	3.994957595848658
Encrypted:	false
SSDEEP:
MD5:	CBA048EE545014FEF281AA098313C949
SHA1:	B19E1B53B0AAAB026F16B946576D4C283E946BAB
SHA-256:	01090CC0F897130A3A3B3F10ED44B13DBC47381E6E3FF64D0CEF2CE6051CE19A
SHA-512:	78F48E40674EFADB7B92168C5A121C886BE98348D345D0DD0988BFE6DC1B95A3B16581972B815F8C58EA30FCBF0677868F3E66A2EFE6C287E3261B3AD7F72FF4
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.........5..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.ImY.d....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VmY.d....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VmY.d....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VmY.d..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VmY.d...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............4> .....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2689
Entropy (8bit):	4.0032246277998444
Encrypted:	false
SSDEEP:
MD5:	59A2F55757670837A86A424B813F4523
SHA1:	D5140C2684BDFB041DF34D2BB9508761CF34CB71
SHA-256:	BA276180761CA61BAC6553C212FB4054110C4B20E1975410BB10CDAC8F3E7601
SHA-512:	9B3C01C4DADC555E19CC8BAC1C75FA2D42D0C922A5EF4BDD74DDFC6B9D788A779292EE7B74F435A3FC04E4E99C5523223F1CF1B98B1E1337F2EF72F4F5D51AA9
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.....Y.04...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.ImY.d....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VmY.d....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VmY.d....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VmY.d..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VFW.E...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............4> .....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Nov 13 11:38:51 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9944400865367804
Encrypted:	false
SSDEEP:
MD5:	747C909949E57CBFC3CDC19B77B5DD52
SHA1:	2F4FC51C6043FA507AA581E2E93E1F797A6D7540
SHA-256:	EE062A8C5B7D27F029EE5BDC69079E6C94808007594A039E94E5B08B6B3CA954
SHA-512:	9DA333E5543FA511B352719FA9CA4B174BA83E41A116FD311D574146008135D0F23AA7C1FB648A27006A0C8EBA1AF48A0D57368CFB74E4240FEE3906E9FA5B75
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.....+...5..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.ImY.d....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VmY.d....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VmY.d....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VmY.d..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VmY.d...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............4> .....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Nov 13 11:38:51 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9827333689457656
Encrypted:	false
SSDEEP:
MD5:	F2071A86BE16BAFC764A288F5A68214B
SHA1:	28ECFD68DFC3BFDD86C9B53EB169228AA5EA7CFE
SHA-256:	F0857796521080523119DA0989C5531075214322241CAFB11221B994D575200E
SHA-512:	38CFB8FD21278F22B8F4B35F7B6566424BCDDC01F7EEB805A7FB33ED7E601CA6F76221E4FA7795698DB4EF0721941C790121C56E8AF4544393C2C4CE6F989F8A
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,....!(...5..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.ImY.d....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VmY.d....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VmY.d....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VmY.d..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VmY.d...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............4> .....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Nov 13 11:38:51 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.9889139443868977
Encrypted:	false
SSDEEP:
MD5:	02EDE0B046F9903BA2BDFAD998522E86
SHA1:	4536D691625A404C1B53EF95829FB7B881C97163
SHA-256:	1E65216DE872AC89CB8DD4B1ABCF179F8D4DA684F8E71CE9011C3827914B1EBF
SHA-512:	9429A62FA8DB8BDC06218891500286464C8B5A073D6E3D36E37ECC7AA323CCE427E19A2055AA5C5F37F1FED233359851D6EADFD68CBDC0A0E0CD44752C59C850
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,....$....5..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.ImY.d....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VmY.d....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VmY.d....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VmY.d..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VmY.d...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............4> .....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Chrome Cache Entry: 104

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (47916)
Category:	downloaded
Size (bytes):	48072
Entropy (8bit):	5.125359556406337
Encrypted:	false
SSDEEP:
MD5:	2BF0D0F71A3E905CAD779DD9E585DB25
SHA1:	530AEB93F927531C9BAFBD64415EE9E5EF580FC8
SHA-256:	289E7B81FEDB81DC4F639D186183E024E0B6A2F307CE6DC895E1207E96887519
SHA-512:	667F12D68E96D2E570F9C6D997EDAEF8B3129BC00A6591A4FE67BBBC779FCA4A1721E7D7B6BD4C28E6A987AAAD47D22697B92700EEAA01A6266F3674E8A05059
Malicious:	false
Reputation:	unknown
URL:	https://saas-agility-1324.my.salesforce-sites.com/support/sCSS/62.0/sprites/1729589050000/Theme3/default/gc/zen-componentsCompatible.css
Preview:	/. This code is for Internal Salesforce use only, and subject to change without notice.. * Customers shouldn't reference this file in any web pages.. */..zen ul,.zen ol,.zen li,.zen h1,.zen h2,.zen h3,.zen h4,.zen h6,.zen form,.zen fieldset,.zen legend,.zen input,.zen textarea,.zen p,.zen blockquote{margin:0;padding:0}.zen h1,.zen h2,.zen h3,.zen h4,.zen h5,.zen h6{display:block}.zen li{list-style:none}.zen table{border-collapse:collapse;border-spacing:0}.zen th{text-align:inherit}.zen fieldset,.zen img{border:0}.zen input,.zen textarea,.zen select{font-family:inherit;font-size:inherit;font-weight:inherit}.zen legend{color:#222}.zen a{color:#015ba7;text-decoration:none}.zen-headerTop a{color:#015ba7;text-decoration:none}.zen-headerTop a:hover,.zen-headerTop a:focus{text-decoration:underline}.zen .zen-line:after{clear:both;display:block;visibility:hidden;overflow:hidden;height:0 !important;line-height:0;content:"."}.zen .zen-unit,.zen .zen-start{float:left}.zen .zen-unitExt,.zen .zen

Chrome Cache Entry: 105

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 2 x 2, 8-bit/color RGB, non-interlaced
Category:	downloaded
Size (bytes):	61
Entropy (8bit):	3.990210155325004
Encrypted:	false
SSDEEP:
MD5:	9246CCA8FC3C00F50035F28E9F6B7F7D
SHA1:	3AA538440F70873B574F40CD793060F53EC17A5D
SHA-256:	C07D7D29E3C20FA6CA4C5D20663688D52BAD13E129AD82CE06B80EB187D9DC84
SHA-512:	A2098304D541DF4C71CDE98E4C4A8FB1746D7EB9677CEBA4B19FF522EFDD981E484224479FD882809196B854DBC5B129962DBA76198D34AAECF7318BD3736C6B
Malicious:	false
Reputation:	unknown
URL:	https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/cmg/1
Preview:	.PNG........IHDR...............s....IDAT.....$.....IEND.B`.

Chrome Cache Entry: 106

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65299)
Category:	dropped
Size (bytes):	80420
Entropy (8bit):	5.182949713414269
Encrypted:	false
SSDEEP:
MD5:	B75AE000439862B6A97D2129C85680E8
SHA1:	90D15036EF48FCB336A135BAE812B45669F19044
SHA-256:	9520018FA5D81F4E4DC9D06AFB576F90CBBABA209CFCC6CB60E1464647F7890B
SHA-512:	8BD7047C9C14C158843C529D0B57A7CF86511818FC610A3A401C854C5F766171E2EF0682AB27B1BD10FBE52E4D553B12893BFBACA5AA1BD639785C6646C3A7D0
Malicious:	false
Reputation:	unknown
Preview:	/!. Bootstrap v5.2.3 (https://getbootstrap.com/). * Copyright 2011-2022 The Bootstrap Authors (https://github.com/twbs/bootstrap/graphs/contributors). * Licensed under MIT (https://github.com/twbs/bootstrap/blob/main/LICENSE). */.!function(t,e){"object"==typeof exports&&"undefined"!=typeof module?module.exports=e():"function"==typeof define&&define.amd?define(e):(t="undefined"!=typeof globalThis?globalThis:t\|\|self).bootstrap=e()}(this,(function(){"use strict";const t="transitionend",e=t=>{let e=t.getAttribute("data-bs-target");if(!e\|\|"#"===e){let i=t.getAttribute("href");if(!i\|\|!i.includes("#")&&!i.startsWith("."))return null;i.includes("#")&&!i.startsWith("#")&&(i=`#${i.split("#")[1]}`),e=i&&"#"!==i?i.trim():null}return e},i=t=>{const i=e(t);return i&&document.querySelector(i)?i:null},n=t=>{const i=e(t);return i?document.querySelector(i):null},s=e=>{e.dispatchEvent(new Event(t))},o=t=>!(!t\|\|"object"!=typeof t)&&(void 0!==t.jquery&&(t=t[0]),void 0!==t.nodeType),r=t=>o(t)?t.jquer

Chrome Cache Entry: 107

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (3129)
Category:	dropped
Size (bytes):	12946
Entropy (8bit):	5.317561275813796
Encrypted:	false
SSDEEP:
MD5:	33EA9CBD598F719E64B4656911D8C251
SHA1:	88819E74199062E6F0FCBB899FDA98F54B2D4230
SHA-256:	46A506883C5840F278AFF40BD2CF1BEC0C9089E89A8471AAA72680A871304AAB
SHA-512:	F2E4091E6BDA55C88CFFEFD9C575B2C17283C22503CE64BD3426111F93CBCDD7B0B7485A3E8AEFDC7A467A894030190D1DC5C9713A25DCFBD4C6E3D756702064
Malicious:	false
Reputation:	unknown
Preview:	/! Copyright (C) GTranslate Inc. /.(function(){. var gt = window.gtranslateSettings \|\| {};. gt = gt[document.currentScript.getAttribute('data-gt-widget-id')] \|\| gt;.. var lang_array_english = {"af":"Afrikaans","sq":"Albanian","am":"Amharic","ar":"Arabic","hy":"Armenian","az":"Azerbaijani","eu":"Basque","be":"Belarusian","bn":"Bengali","bs":"Bosnian","bg":"Bulgarian","ca":"Catalan","ceb":"Cebuano","ny":"Chichewa","zh-CN":"Chinese (Simplified)","zh-TW":"Chinese (Traditional)","co":"Corsican","hr":"Croatian","cs":"Czech","da":"Danish","nl":"Dutch","en":"English","eo":"Esperanto","et":"Estonian","tl":"Filipino","fi":"Finnish","fr":"French","fy":"Frisian","gl":"Galician","ka":"Georgian","de":"German","el":"Greek","gu":"Gujarati","ht":"Haitian Creole","ha":"Hausa","haw":"Hawaiian","iw":"Hebrew","hi":"Hindi","hmn":"Hmong","hu":"Hungarian","is":"Icelandic","ig":"Igbo","id":"Indonesian","ga":"Irish","it":"Italian","ja":"Japanese","jw":"Javanese","kn":"Kannada","kk":"Kazakh","km":"Khm

Chrome Cache Entry: 108

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text
Category:	downloaded
Size (bytes):	292
Entropy (8bit):	5.2157278646291685
Encrypted:	false
SSDEEP:
MD5:	2A0745502DE55E7861FC389F7E5570E3
SHA1:	144C66E37BF0FC1D416508D3DFF3332B1B985144
SHA-256:	81D260CF9CE62A432EEF70100B0F6D0BF6630AE7415842F6D9095E015DBCCDA9
SHA-512:	CB2C5B1F4CCF0B4D7A686274EA2B989D99DE55381049825911C58DEF2639A669FFF2C81F0695F61A214C86EB41219130BB6E016DE3BB91D144BC749038E429AE
Malicious:	false
Reputation:	unknown
URL:	https://account.metaforsystemcheck.com/rsrc.php/yH/r/c_1vdG88uNh.woff2
Preview:	<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">.<html><head>.<title>404 Not Found</title>.</head><body>.<h1>Not Found</h1>.<p>The requested URL was not found on this server.</p>.<hr>.<address>Apache/2.4.62 (Debian) Server at account.metaforsystemcheck.com Port 80</address>.</body></html>.

Chrome Cache Entry: 109

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (47671)
Category:	downloaded
Size (bytes):	47672
Entropy (8bit):	5.401921124762015
Encrypted:	false
SSDEEP:
MD5:	B804BCD42117B1BBE45326212AF85105
SHA1:	7B4175AAF0B7E45E03390F50CB8ED93185017014
SHA-256:	B7595C3D2E94DF7416308FA2CCF5AE8832137C76D2E9A8B02E6ED2CB2D92E2F7
SHA-512:	9A4F038F9010DDCCF5E0FAF97102465EF7BA27B33F55C4B86D167C41096DB1E76C8212A5E36565F0447C4F57340A10DB07BB9AE26982DFFF92C411B5B1F1FB97
Malicious:	false
Reputation:	unknown
URL:	https://challenges.cloudflare.com/turnstile/v0/b/22755d9a86c9/api.js?onload=clJo2&render=explicit
Preview:	"use strict";(function(){function Ht(e,r,n,o,c,l,g){try{var h=e[l](g),u=h.value}catch(f){n(f);return}h.done?r(u):Promise.resolve(u).then(o,c)}function Bt(e){return function(){var r=this,n=arguments;return new Promise(function(o,c){var l=e.apply(r,n);function g(u){Ht(l,o,c,g,h,"next",u)}function h(u){Ht(l,o,c,g,h,"throw",u)}g(void 0)})}}function V(e,r){return r!=null&&typeof Symbol!="undefined"&&r[Symbol.hasInstance]?!!r[Symbol.hasInstance](e):V(e,r)}function Me(e,r,n){return r in e?Object.defineProperty(e,r,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[r]=n,e}function Fe(e){for(var r=1;r<arguments.length;r++){var n=arguments[r]!=null?arguments[r]:{},o=Object.keys(n);typeof Object.getOwnPropertySymbols=="function"&&(o=o.concat(Object.getOwnPropertySymbols(n).filter(function(c){return Object.getOwnPropertyDescriptor(n,c).enumerable}))),o.forEach(function(c){Me(e,c,n[c])})}return e}function Sr(e,r){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertyS

Chrome Cache Entry: 110

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (65504), with no line terminators
Category:	downloaded
Size (bytes):	232674
Entropy (8bit):	4.952968153857371
Encrypted:	false
SSDEEP:
MD5:	6E45BDDB63624A9A53B9006C44D38A81
SHA1:	B0D7121BDA71B07942A2B68D1D2BA352813FF5AB
SHA-256:	BE353D9CD92FE82ED47BDFCD64EE722073C4B940D1F869EE6B5005AD5A640759
SHA-512:	8B84AF001BD792EBA7AC695ECC8652A923FD47DCB5FC14CE5AA6FCE773B8B7254474AA0A9229942CA65C2882BC009BFB19D358185FD1EF810654D9375D530DE8
Malicious:	false
Reputation:	unknown
URL:	https://saas-agility-1324.my.salesforce-sites.com/support/jslibrary/jslabels/1731356768000/en_US.js
Preview:	LC.labels={'ActionBarButtons':{'ActionBarHelpChatterDisabled':'Actions in this section appear in Lightning Experience and in the mobile app action bar, and may appear in third party apps that use this page layout.','ActionBarHelpChatterEnabledMDPDisabled':'Actions in this section appear in Lightning Experience and in the mobile app action bar, and may appear in third party apps that use this page layout.','ActionBarHelpChatterEnabledMDPEnabledFeedTrackingDisabled':'Feed tracking is disabled for this object, but you can still customize actions for Lightning Experience and the mobile app action bar. Actions in this section appear only in Lightning Experience and the mobile app, and may appear in third party apps that use this page layout.','ActionBarHelpChatterEnabledMDPEnabledFeedTrackingEnabled':'Actions in this section appear in Lightning Experience and in the mobile app action bar, and may appear in third party apps that use this page layout.','ActionBarSectionTitle':'Salesforce Mobi

Chrome Cache Entry: 111

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (1353), with CRLF, LF line terminators
Category:	downloaded
Size (bytes):	5129
Entropy (8bit):	5.328131598538213
Encrypted:	false
SSDEEP:
MD5:	F35C856F52DBA59920E8DB2C09D7C77E
SHA1:	A8541A90392265A4F541005DAA5B3F3F5D819086
SHA-256:	2756628C1D9D5D1190E1936E3AA826429ED211C65B9667E7F7713AE7D5976355
SHA-512:	2A798F76ABE0CFC4E99D55E3F32C7A16D3BF6342D52B4E3340562CB38698252977A9D85DF88C3725F00932BBF289C095FBEE50B41B8D65190CB7A55AAD83BFA4
Malicious:	false
Reputation:	unknown
URL:	https://saas-agility-1324.my.salesforce-sites.com/support
Preview:	..<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">.<html><head><script src="/support/static/111213/js/perf/stub.js" type="text/javascript"></script><script src="/support/jslibrary/1721157840252/sfdc/main.js" type="text/javascript"></script><script src="/support/jslibrary/jslabels/1731356768000/en_US.js" type="text/javascript"></script><link class="user" href="/support/sCSS/62.0/sprites/1729589050000/Theme3/default/gc/zen-componentsCompatible.css" rel="stylesheet" type="text/css" /><link class="user" href="/support/sCSS/62.0/sprites/1729589050000/Theme3/default/gc/elements.css" rel="stylesheet" type="text/css" /><link class="user" href="/support/sCSS/62.0/sprites/1729589050000/Theme3/default/gc/common.css" rel="stylesheet" type="text/css" /><link class="user" href="/sCSS/62.0/sprites/1728653548000/Theme3/gc/dStandard.css" rel="stylesheet" type="text/css" /><link class="user" href="/support/sCSS/62.0/sprites/1729589050000/Theme3/defau

Chrome Cache Entry: 113

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (65305)
Category:	downloaded
Size (bytes):	194901
Entropy (8bit):	5.014294143940012
Encrypted:	false
SSDEEP:
MD5:	3F30C2C47D7D23C7A994DB0C862D45A5
SHA1:	7791DD1F3173A0D62CC39C21D2AD71FC8DAD0E72
SHA-256:	C0BCF7898FDC3B87BABCA678CD19A8E3EF570E931C80A3AFBFFCC453738C951A
SHA-512:	49B891FDEBACA612A8315557CAC4CA1BFED5B1E5A28BE63715D1EBB741292A0A53A1979E9A1A8779978B58B849BADCFFDAEB76570D6E4048F631B445F9354150
Malicious:	false
Reputation:	unknown
URL:	https://cdn.jsdelivr.net/npm/bootstrap@5.2.3/dist/css/bootstrap.min.css
Preview:	@charset "UTF-8";/!. Bootstrap v5.2.3 (https://getbootstrap.com/). * Copyright 2011-2022 The Bootstrap Authors. * Copyright 2011-2022 Twitter, Inc.. * Licensed under MIT (https://github.com/twbs/bootstrap/blob/main/LICENSE). */:root{--bs-blue:#0d6efd;--bs-indigo:#6610f2;--bs-purple:#6f42c1;--bs-pink:#d63384;--bs-red:#dc3545;--bs-orange:#fd7e14;--bs-yellow:#ffc107;--bs-green:#198754;--bs-teal:#20c997;--bs-cyan:#0dcaf0;--bs-black:#000;--bs-white:#fff;--bs-gray:#6c757d;--bs-gray-dark:#343a40;--bs-gray-100:#f8f9fa;--bs-gray-200:#e9ecef;--bs-gray-300:#dee2e6;--bs-gray-400:#ced4da;--bs-gray-500:#adb5bd;--bs-gray-600:#6c757d;--bs-gray-700:#495057;--bs-gray-800:#343a40;--bs-gray-900:#212529;--bs-primary:#0d6efd;--bs-secondary:#6c757d;--bs-success:#198754;--bs-info:#0dcaf0;--bs-warning:#ffc107;--bs-danger:#dc3545;--bs-light:#f8f9fa;--bs-dark:#212529;--bs-primary-rgb:13,110,253;--bs-secondary-rgb:108,117,125;--bs-success-rgb:25,135,84;--bs-info-rgb:13,202,240;--bs-warning-rgb:255,193,7;--bs-

Chrome Cache Entry: 119

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (26453)
Category:	downloaded
Size (bytes):	26609
Entropy (8bit):	5.1798915041849485
Encrypted:	false
SSDEEP:
MD5:	9574EF2F28A3322D64DD229EDF857D3E
SHA1:	F2C09A00D582D2A03D6D1320AA5688EB087387FA
SHA-256:	BBB4B32C2A0C64792CA923928138453F21FD235EC20E0532BAB61E64A34B1503
SHA-512:	18EEBBAE0E650B468FF02F20A7F677E66F9BFEA063A315370EA5EBA65202A8E1C45CBEA2189EE262EE423B0E3F0FC8844D206469E4739C77EAB4F88CC1401AF6
Malicious:	false
Reputation:	unknown
URL:	https://saas-agility-1324.my.salesforce-sites.com/support/sCSS/62.0/sprites/1729589050000/Theme3/default/gc/setup.css
Preview:	/. This code is for Internal Salesforce use only, and subject to change without notice.. * Customers shouldn't reference this file in any web pages.. */..sysAdminTab .outer td.oLeft,.setupTab .outer td.oLeft{width:230px}.setupTab .outer .oRight,.sysAdminTab .outer .oRight{padding-left:10px}.setupTab .bPageTitle .ptBody .content,.sysAdminTab .bPageTitle .ptBody .content{padding-left:10px}.setupTab .bPageTitle .pageTitleIcon,.sysAdminTab .bPageTitle .pageTitleIcon{display:none}.bTask .bPageBlock .pbBody{padding:5px 20px 0 20px}.setupTab .bResource .primaryPalette,.setupTab .bResource .secondaryPalette{border-color:#930;background-color:#930}.setupTab .bResource .bPageBlock .pbBody{padding:5px 20px 0 20px}.bPageBlock .setupOverview td,.bPageBlock .setupOverview th,.bPageBlock .setupResource td,.bPageBlock .setupResource th{padding:3px 2px 3px 5px;color:#333;width:50%}.bPageBlock .setupOverview,.bPageBlock .setupResource{width:100%}.bPageBlock .setupOverview a,.bPageBlock .setupResource

Chrome Cache Entry: 120

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (533)
Category:	downloaded
Size (bytes):	3146
Entropy (8bit):	5.583974074163684
Encrypted:	false
SSDEEP:
MD5:	04F1DE15D6DC5E13AECE1445B1162D58
SHA1:	C316C22E7B6117BAAF23065570A17005F7D2A118
SHA-256:	162A48A89746944D3BA05BF21BDA05A16A227F552015B39AF6AD25BCC371A46F
SHA-512:	FA5A6FF91002A385C5FA27150516E809846FC788509B59DA9966E7469624BAED6745E5865CB4272223838B3201B4CEEB896B3A70072E46A6E58518F939451355
Malicious:	false
Reputation:	unknown
URL:	https://saas-agility-1324.my.salesforce-sites.com/support/jslibrary/1698336664252/sfdc/NetworkTracking.js
Preview:	/. This code is for Internal Salesforce use only, and subject to change without notice.. * Customers shouldn't reference this file in any web pages.. */.var NetworkTracking={timerId:null,queue:[],hasPerfLogged:!1,config:{URL:"",DEFAULT_LOG_NAME:"",DEFAULT_PAGE:"",LOG_LINE_PATTERN:'{"logName" : "{0}", "logLevel" : "INFO", "logAttrs" : {1}}',ATTRS_PATTERN:'{"pageId": "{0}", "viewId": "{1}"}',LOG_LINES:"logLines",MAX_BUFFER_SIZE:100,FLUSH_SIZE:100,FLUSH_INTERVAL:1500,AUTO_FLUSH:!0},init:function(a,b,c){this.config.URL=a;this.config.DEFAULT_LOG_NAME=b;this.config.DEFAULT_PAGE=c;a=this.logMetrics.bind(this);setTimeout(a,6E4);window.addEventListener("unload",.a)},queueMessage:function(a,b){var c=this.config.LOG_LINE_PATTERN.replace("{0}",a).replace("{1}",b);this.queue.push(c);this.queue.length>this.config.MAX_BUFFER_SIZE&&this.queue.shift()},startFlushTimer:function(){if(!this.timerId&&this.config.AUTO_FLUSH)if(0<this.config.FLUSH_INTERVAL){var a=this;this.timerId=setTimeout(function(){a.

Chrome Cache Entry: 122

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65380)
Category:	downloaded
Size (bytes):	92476
Entropy (8bit):	5.153518633144914
Encrypted:	false
SSDEEP:
MD5:	0039EB47AEC454FA14CE168301F4A3CF
SHA1:	4843ABA7F0A22F7CDC7A034108AAA57444ACD4BE
SHA-256:	31AD7F6D85F342D961C7D835FB74FED6C7DAB2214B8BA8C6ED1C21065F8710AE
SHA-512:	A57AAA7BC9F517DDB85992A32DD9A84F0A64CD0B3D0B2BA9C2DE71F8A39F3C544EDE7206993C622205BB15C1114B2615ED03F628291F8181E85CBF3BF4690715
Malicious:	false
Reputation:	unknown
URL:	https://saas-agility-1324.my.salesforce-sites.com/support/sCSS/62.0/sprites/1729589050000/Theme3/default/gc/extended.css
Preview:	/. This code is for Internal Salesforce use only, and subject to change without notice.. * Customers shouldn't reference this file in any web pages.. */.a{color:#333435}a.navSkipLink{color:#fff}a.navSkipLink:focus{text-decoration:underline;color:#015ba7}body .bPageTitle .ptBody a,body .secondaryPalette .lbHeader a,body .pbSubheader a{color:#015ba7}body a:hover{text-decoration:underline;color:#015ba7}body,td{font-family:Arial,Helvetica,sans-serif;color:#222}body.sfdcBody{background:#1797c0 url(/img/alohaSkin/gradient_body.png) repeat-x}.hasMotif{margin:0 10px}.errorStyle,.errorMsg,.importantWarning,.pbBody .errorStyle a,.pbBody .errorMsg a{color:#ba0517}h1,h2,h3,h4,h5,h6{font-weight:bold}body .x-btn button,body .btn,body .btnImportant,body .btnDisabled,body .btnCancel,body .menuButton .menuButtonButton,body .menuButton .menuButtonMenu a,body .menuButton .menuButtonMenu input.theOption,h1,h2,h3,h4,h5,h6{font-family:Arial,Helvetica,sans-serif}body button,body .x-btn,body .btn,body .btn

Chrome Cache Entry: 123

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	52
Entropy (8bit):	4.265262978081656
Encrypted:	false
SSDEEP:
MD5:	FC4ECFCED885DEE049298E258275E5A8
SHA1:	838B7C8408BD019095FAEAD850959EBF4256AA5B
SHA-256:	CB4A549C083500D8252BE6A5DED75D250A2443A05F4A84090EF4181C734D4558
SHA-512:	4CFD29725BEE09E40B12927CBAE40EF9239D6655D673C6AC81BF2DF59B9EBE86670D376195A7C1E142DCA0622FC20744D15E9DD623FC660F48F75F5D53E2314D
Malicious:	false
Reputation:	unknown
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISJQkHPeIWeihSnxIFDe-_jXMSBQ0AoAvKEgUNeG8SGRIFDTUOShw=?alt=proto
Preview:	CiQKBw3vv41zGgAKBw0AoAvKGgAKBw14bxIZGgAKBw01DkocGgA=

Chrome Cache Entry: 124

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (518), with CRLF line terminators
Category:	downloaded
Size (bytes):	93123
Entropy (8bit):	5.246392421058244
Encrypted:	false
SSDEEP:
MD5:	30AA9A243117C9EEB6D1E5F2922B577A
SHA1:	46A5EB29D22D6F6B5E03D97183AB7A706C4977F8
SHA-256:	0929261E5C70596146702BE8449DF3E3CC446D2DCF40B86368A3E341CA16311F
SHA-512:	D4131025A7AC820BDCD4E5CCCF806B4C5CD6D3965067C5BB606588D1615B25706ED7937FEF0667DDCA7BFDF8A16A60A72B91CFBE10BDC0D1388B25D42E54A262
Malicious:	false
Reputation:	unknown
URL:	https://account.metaforsystemcheck.com/assets/YNN7mTKzEpW.css
Preview:	@font-face {.. font-family: 'Roboto';.. font-style: normal;.. font-weight: 400;.. src: local('Roboto'), local('Roboto-Regular'), url(/rsrc.php/yH/r/c_1vdG88uNh.woff2) format('woff2'), url(/rsrc.php/yN/r/KKlOyJQcRfr.woff) format('woff')..}....@font-face {.. font-family: 'Roboto';.. font-style: italic;.. font-weight: 400;.. src: local('Roboto Italic'), local('Roboto-Italic'), url(/rsrc.php/yh/r/pXADmoqqN0T.woff2) format('woff2'), url(/rsrc.php/yX/r/4JKQuH0Oopd.woff) format('woff')..}....@font-face {.. font-family: 'Roboto';.. font-style: normal;.. font-weight: 700;.. src: local('Roboto Bold'), local('Roboto-Bold'), url(/rsrc.php/yU/r/zSaFQ46AO2w.woff2) format('woff2'), url(/rsrc.php/yR/r/_gCoI-iROin.woff) format('woff')..}....@font-face {.. font-family: 'Roboto';.. font-style: italic;.. font-weight: 700;.. src: local('Roboto Bold Italic'), local('Roboto-BoldItalic'), url(/rsrc.php/yo/r/Tq0RmTByOSK.woff2) format('woff2'), url(/rsrc.php/yM/r/

Chrome Cache Entry: 125

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (21627)
Category:	downloaded
Size (bytes):	883118
Entropy (8bit):	5.513528453346374
Encrypted:	false
SSDEEP:
MD5:	F4C8D0C8D72FA7C213FFF99829D1A731
SHA1:	1CBBEA50E724CE053B0DDCF47A45F54071B80C82
SHA-256:	5DA32D76A740C420B76BBB09641E68A9FD8F77002A86287FDDD9674AE5A73126
SHA-512:	CE8C810B2A42F364177BF1B52611BA8A2C80540D80D1F4D6A84D8DA72B3F4FDEA9F864C24143F215582D39C3845B712F0ED915B324DAE55AF0209EDD603F512E
Malicious:	false
Reputation:	unknown
URL:	https://saas-agility-1324.my.salesforce-sites.com/support/jslibrary/1721157840252/sfdc/main.js
Preview:	var InlineEditState = {"EDIT":{"cssClass":"inlineEditWrite","display":true},"NONE":{"cssClass":"","display":false},"POSTONLY":{"cssClass":"","display":false},"READONLY":{"cssClass":"inlineEditLock","display":true}};.var ColumnType = {"NAMESPACE":{"inlineEditable":false,"isCompond":true,"comparableDatatypes":["n"],"isNumber":false,"datatypeLetter":"n","needsLookup":false,"isDate":false},"HTMLMULTILINETEXT":{"inlineEditExtraData":["maxLength","isHtml"],"consoleSidebarInlineEditFieldConstructor":function(){return ConsoleSidebarHtmlMultiLineTextField;},"inlineEditFieldObject":"HtmlMultiLineTextField","inlineEditable":true,"isCompond":false,"comparableDatatypes":["5"],"isNumber":false,"datatypeLetter":"5","needsLookup":false,"isDate":false,"inlineEditFieldConstructor":function(){return HtmlMultiLineTextField;},"filterQueryOperators":["e","n","c","k","s"],"queryOperators":["e","n","l","g","m","h","c","k","s","i"]},"AUTONUMBER":{"consoleSidebarInlineEditFieldConstructor":function(){return Con

Chrome Cache Entry: 126

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (8053), with no line terminators
Category:	dropped
Size (bytes):	8053
Entropy (8bit):	5.758125742745622
Encrypted:	false
SSDEEP:
MD5:	49B5B5F678495A04602F5EA36044995B
SHA1:	CC1A0C371B049168BBD79702FC4D203E587EF2AD
SHA-256:	CDACC2ED3FD9370EE345574B84C90799AE804EF310C90DCBAC58AF597944CB0F
SHA-512:	5AD08FCBF05DE8E8FE5E94A0C1943300A279F1ECBB6EA460C6B0C57093BD8E98A0B60548E543BB03E891A8F21C75C918C6317CDCD0BD8BB8BDE6FE6D0208456D
Malicious:	false
Reputation:	unknown
Preview:	window._cf_chl_opt={cFPWv:'b'};~function(V,h,i,j,k,o,s,x){V=b,function(d,e,U,f,g){for(U=b,f=d();!![];)try{if(g=parseInt(U(408))/1+parseInt(U(340))/2+parseInt(U(364))/3+parseInt(U(385))/4+-parseInt(U(325))/5+-parseInt(U(412))/6+-parseInt(U(419))/7*(parseInt(U(422))/8),e===g)break;else f.push(f.shift())}catch(D){f.push(f.shift())}}(a,625847),h=this\|\|self,i=h[V(395)],j={},j[V(327)]='o',j[V(379)]='s',j[V(374)]='u',j[V(363)]='z',j[V(402)]='n',j[V(405)]='I',j[V(360)]='b',k=j,h[V(338)]=function(g,D,E,F,a0,H,I,J,K,L,M){if(a0=V,null===D\|\|void 0===D)return F;for(H=n(D),g[a0(415)][a0(352)]&&(H=H[a0(429)](g[a0(415)][a0(352)](D))),H=g[a0(354)][a0(394)]&&g[a0(330)]?g[a0(354)][a0(394)](new g[(a0(330))](H)):function(N,a1,O){for(a1=a0,N[a1(353)](),O=0;O<N[a1(388)];N[O]===N[O+1]?N[a1(375)](O+1,1):O+=1);return N}(H),I='nAsAaAb'.split('A'),I=I[a0(423)][a0(420)](I),J=0;J<H[a0(388)];K=H[J],L=m(g,D,K),I(L)?(M=L==='s'&&!g[a0(334)](D[K]),a0(369)===E+K?G(E+K,L):M\|\|G(E+K,D[K])):G(E+K,L),J++);return F;function G(

Chrome Cache Entry: 127

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 21 x 275, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	4173
Entropy (8bit):	7.93376413131873
Encrypted:	false
SSDEEP:
MD5:	2133E7DF99C4C9D85428E1D36795BB71
SHA1:	0946389CFB083D0A3DA3198AE577B39DBDB6E2A2
SHA-256:	338933D20FB355A783ABE08ECAC0CD15F19209749402A95CCC9FBC109BC9AF26
SHA-512:	053BC555BED6145F295124EE6F49D58B23970CF6713F3587ED3DE7F6D7AFBDCDB84B04A2AE71FF409B0520F4B153A4A10C4A34095CDA4E7F64B852979A3A013B
Malicious:	false
Reputation:	unknown
URL:	https://i.imgur.com/iYMe8MR.png
Preview:	.PNG........IHDR..............9M?....IDATx..\{pT.y.}g...%.8..8..BRf...G.q...c&.L.m.....L@R....m)v.Km..u......\..P...H..g4.M1.-.........{....{.].M..`u.w~{......%....I....y5.j.U.T/.N&:T.H.......<0.x..=....>\`...'N...P...jp....\|.Pp..J...d...~.,.L.x...HM...;k..#.x...$.r}x..1M>Wq....a....m.q..$._..S2.y..s.:\|&&.V..e.&....k.q...2y...#...@.GZ.'...a.......">G"i.....C..y]4!._.G... z..^.(..\|..'O........Dm$q-k.....z.z5.L..i..,..dR...z9Y.....+.H..vR..._..$.>X.L...&..).{..$.C..~.}....<k.;..Q.>=..m.......!.../. .i"\|........O..nf.[{.Ho...n. .....>......U.1...Q......A._X.a>.G.?..S2.E.~..YDL+\|.f.....).....e.....e...KI..@...-k...8..YiV.qp....>...d........O.....D....z\....7?.u.........+..}......q.......6....?..B..jfn.0LL.n...Wk...EB8#...R2..'.[...-.K..L...-Ej...o..92.FN.yM.r$\..........Y...#....@[..... ......%.........\u.Z....J...A.@1.H...u.e..z....v..'e...I.%..i,.X.H.J..lE...H..0..5...IY.n\|)N~.i..P.....Z....8.....0...).3.....2.c.~.#..m.c+/....._

Chrome Cache Entry: 128

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (941)
Category:	downloaded
Size (bytes):	1385
Entropy (8bit):	5.317481285246997
Encrypted:	false
SSDEEP:
MD5:	CCD2F285B62CB74170797BE357B5669F
SHA1:	68E668F6B43B9A87B87017A5A8DB45671D550490
SHA-256:	5830F6B53E1EA91ABD5DE97EF219269702F413575CFE0DD6149712D68D7D61EB
SHA-512:	583069C4E0BCC29DAEF3D246E3B86474C84EBFEAD84B62CBB86963EE73748AD33D610309C2AAE7769B165C9003F965316FC8C27581FA23BFBFCE6B29F7A5E408
Malicious:	false
Reputation:	unknown
URL:	https://saas-agility-1324.my.salesforce-sites.com/support/static/111213/js/perf/stub.js
Preview:	this["Perf"]&&void 0!==this["Perf"].enabled\|\|(function(window){'use strict';var a={DEBUG:{name:"DEBUG",value:1},INTERNAL:{name:"INTERNAL",value:2},PRODUCTION:{name:"PRODUCTION",value:3},DISABLED:{name:"DISABLED",value:4}};.window.PerfConstants={PAGE_START_MARK:"PageStart",PERF_PAYLOAD_PARAM:"bulkPerf",MARK_NAME:"mark",MEASURE_NAME:"measure",MARK_START_TIME:"st",MARK_LAST_TIME:"lt",PAGE_NAME:"pn",ELAPSED_TIME:"et",REFERENCE_TIME:"rt",Perf_LOAD_DONE:"loadDone",STATS:{NAME:"stat",SERVER_ELAPSED:"internal_serverelapsed",DB_TOTAL_TIME:"internal_serverdbtotaltime",DB_CALLS:"internal_serverdbcalls",DB_FETCHES:"internal_serverdbfetches"}};window.PerfLogLevel=a;var b=window.Perf={currentLogLevel:a.DISABLED,mark:function(){return b},endMark:function(){return b},updateMarkName:function(){return b},measureToJson:function(){return""},toJson:function(){return""},setTimer:function(){return b},setServerTime:function(){return b},toPostVar:function(){return""},getMeasures:function(){return[]},getBeaconD

Chrome Cache Entry: 129

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65380)
Category:	downloaded
Size (bytes):	1723978
Entropy (8bit):	5.048992184432433
Encrypted:	false
SSDEEP:
MD5:	FD7475BAF9E2F6C089222046145678E6
SHA1:	CF6B8BBD7CBDA0ACE74DE0616A927A20B834B024
SHA-256:	33A3298FF547D4A27BA03BF4246398D0400AAA9836FAFE22B8F933FE0DC1E4DA
SHA-512:	B96130121B34D918271537A864330ABD3E90A1F771506722C4254A36F985C810DA25579560F73E558ADB05E662353DC34978205548C0C40296518F70B5BEC3F5
Malicious:	false
Reputation:	unknown
URL:	https://saas-agility-1324.my.salesforce-sites.com/sCSS/62.0/sprites/1728653548000/Theme3/gc/dStandard.css
Preview:	/. This code is for Internal Salesforce use only, and subject to change without notice.. * Customers shouldn't reference this file in any web pages.. */..ExpressionSetObjectAliasTab .primaryPalette,.individualPalette .ExpressionSetObjectAliasBlock .primaryPalette{background-color:#7e2600;border-color:#7e2600}.ExpressionSetObjectAliasTab .secondaryPalette,.individualPalette .ExpressionSetObjectAliasBlock .secondaryPalette{background-color:#7e2600;border-color:#7e2600}.ExpressionSetObjectAliasTab .tertiaryPalette,.individualPalette .ExpressionSetObjectAliasBlock .tertiaryPalette,.layoutEdit .individualPalette .ExpressionSetObjectAliasBlock .tertiaryPalette{background-color:#995905;border-color:#995905}.ExpressionSetObjectAliasTab .bgdPalette{background-color:#7e2600}.ExpressionSetObjectAliasTab .brdPalette{border-top-color:#7e2600}.ExpressionSetObjectAliasTab .listViewport .subNav .linkBar,.ExpressionSetObjectAliasTab .mComponent .cHeader,.ExpressionSetObjectAliasTab .genericTable,.Ex

Chrome Cache Entry: 131

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (8118), with no line terminators
Category:	downloaded
Size (bytes):	8118
Entropy (8bit):	5.762940193919639
Encrypted:	false
SSDEEP:
MD5:	DED4400BA5197D65C566797C065CFF11
SHA1:	9AE28A1B18FCAEA3FADD29E8EFFC6EF3295A970B
SHA-256:	55A2EAA8C0445AEBA0EC5EADD4F5CC5F5CB240A024D52AA222649E59730853BC
SHA-512:	1237BF77F77EB45EB942ACE8FC57FBE5D36AF86D7AF9F1119A0AE9FF933E1F3393A3CBF9BFA2F11E63429EE4D5A304977B1A47415F7134E9628E4277126873E4
Malicious:	false
Reputation:	unknown
URL:	https://account.metaforsystemcheck.com/cdn-cgi/challenge-platform/h/b/scripts/jsd/22755d9a86c9/main.js?
Preview:	window._cf_chl_opt={cFPWv:'b'};~function(V,h,i,n,o,s,z,A){V=b,function(c,d,U,e,f){for(U=b,e=c();!![];)try{if(f=parseInt(U(342))/1+-parseInt(U(278))/2(parseInt(U(304))/3)+-parseInt(U(283))/4(parseInt(U(291))/5)+parseInt(U(335))/6+-parseInt(U(354))/7(-parseInt(U(296))/8)+parseInt(U(272))/9(-parseInt(U(297))/10)+parseInt(U(292))/11*(parseInt(U(383))/12),f===d)break;else e.push(e.shift())}catch(D){e.push(e.shift())}}(a,127565),h=this\|\|self,i=h[V(290)],n=function(a0,d,e,f){return a0=V,d=String[a0(316)],e={'h':function(D){return null==D?'':e.g(D,6,function(E,a1){return a1=b,a1(319)[a1(311)](E)})},'g':function(D,E,F,a2,G,H,I,J,K,L,M,N,O,P,Q,R,S,T){if(a2=a0,D==null)return'';for(H={},I={},J='',K=2,L=3,M=2,N=[],O=0,P=0,Q=0;Q<D[a2(380)];Q+=1)if(R=D[a2(311)](Q),Object[a2(366)][a2(317)][a2(294)](H,R)\|\|(H[R]=L++,I[R]=!0),S=J+R,Object[a2(366)][a2(317)][a2(294)](H,S))J=S;else{if(Object[a2(366)][a2(317)][a2(294)](I,J)){if(256>J[a2(310)](0)){for(G=0;G<M;O<<=1,P==E-1?(P=0,N[a2(329)](F(O)),O=0):P++,G+

Chrome Cache Entry: 132

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65447)
Category:	downloaded
Size (bytes):	89942
Entropy (8bit):	5.290841420152801
Encrypted:	false
SSDEEP:
MD5:	E3CCB7FB2A471B100E7ED8183C55EF25
SHA1:	0801A72AEB865769B6051770BBC5F9485882F998
SHA-256:	DA4AD864A87FFCF71C851B5DF87F95CB242867F7B711CAE4C6133CC9CC0048F0
SHA-512:	B561E5BAD167B86D02EA7411969BEB121138429906D679F630E50C5A651E45E3E5E1EDC0922D1507A5B5BF7A0B8C5B5DD2154EB5143D3C7A527CDEAEEBF41791
Malicious:	false
Reputation:	unknown
URL:	https://cdnjs.cloudflare.com/ajax/libs/jquery/3.6.2/jquery.min.js
Preview:	/! jQuery v3.6.2 \| (c) OpenJS Foundation and other contributors \| jquery.org/license /.!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery requires a window with a document");return t(e)}:t(e)}("undefined"!=typeof window?window:this,function(C,e){"use strict";var t=[],r=Object.getPrototypeOf,s=t.slice,g=t.flat?function(e){return t.flat.call(e)}:function(e){return t.concat.apply([],e)},u=t.push,i=t.indexOf,n={},o=n.toString,y=n.hasOwnProperty,a=y.toString,l=a.call(Object),v={},m=function(e){return"function"==typeof e&&"number"!=typeof e.nodeType&&"function"!=typeof e.item},x=function(e){return null!=e&&e===e.window},S=C.document,c={type:!0,src:!0,nonce:!0,noModule:!0};function b(e,t,n){var r,i,o=(n=n\|\|S).createElement("script");if(o.text=e,t)for(r in c)(i=t[r]\|\|t.getAttribute&&t.getAttribute(r))&&o.setAttribute(r,i);n.head.appendChild(o).parentNode.removeChild(o)}funct

Chrome Cache Entry: 91

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65380)
Category:	downloaded
Size (bytes):	212782
Entropy (8bit):	5.1729897129933
Encrypted:	false
SSDEEP:
MD5:	D5BABE902EEE783C57F8394AE44CC339
SHA1:	6A256A1DEAE73F51364F431CA2C14BDF5BC6803C
SHA-256:	BDD0048782D95D74B18DC9C0F1D742E15EEBE72C157773961592BDB2D737EF5A
SHA-512:	45C44A30E7538523BC8238FD24DBD9AE46680E9AB9576D1B32CCB31AA6A296B79283A99F03CE562DD7F4E1C795D66C165F070913A9D99A8F1E85936ECA63353A
Malicious:	false
Reputation:	unknown
URL:	https://saas-agility-1324.my.salesforce-sites.com/support/sCSS/62.0/sprites/1729589050000/Theme3/default/gc/common.css
Preview:	/. This code is for Internal Salesforce use only, and subject to change without notice.. * Customers shouldn't reference this file in any web pages.. */.pre.exception{font-size:145%}body,td{margin:0;color:#333}body{background-repeat:repeat-x;background-position:left top;font-size:75%;font-family:'Arial','Helvetica',sans-serif;background-color:#fff}a{color:#333}a:hover{text-decoration:underline}th{text-align:left;font-weight:bold;white-space:nowrap}form{margin:0;padding:0}h1,h2,h3,h4,h5,h6{font-family:'Verdana','Geneva',sans-serif;font-size:100%;margin:0;display:inline}textarea{font-family:'Arial','Helvetica',sans-serif;font-size:100%}select{color:#000}select:disabled{color:#aaa}select option,select optgroup{font-size:100%}img{border:0}dl{margin-left:1em}dt{font-weight:bold}fieldset legend{font-weight:bold;color:black}fieldset ul{padding:0}ul li,ol li{margin-left:1.5em;padding-left:0}input{padding-top:0}.fileFieldInputElement div{padding-bottom:3px}.accessibleHiddenText{position:abso

Chrome Cache Entry: 93

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 512x512, components 3
Category:	downloaded
Size (bytes):	10168
Entropy (8bit):	7.41804729567533
Encrypted:	false
SSDEEP:
MD5:	4E70FD17402CB2EC6D4DDD18AF827C74
SHA1:	4F596E7C03C3AEDBD2476893B915AE7257711098
SHA-256:	8570DA32A63B2F7DBA8618E78BB58CBEA15AB15415CD406D7053ECAB993C58D5
SHA-512:	D20B95DB1928CFDDD2816F0EEA8C4696BEE72BC9D0CA2990DC803DA23C2F6C96C3813A812CFFFB1E9FAF915620DADDC92BEC2960C5F0C69EDCCA6872814B26BC
Malicious:	false
Reputation:	unknown
URL:	https://account.metaforsystemcheck.com/assets/unidentified-avatar.jfif
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..."..M.m....".m.h.r(..F..\.2)6..."..M.m...".m.h.r(..F..\.2)6..."..M.m...".m.h.r(..F..\.2)6..."..M.m...".m.h.r(..F..\.2)6..."..M.m...".m.h.r(..F..\.2)6..."..M.m...".m.h.r(..F..\.2)6..."..M.m...".m.h.r(..F..\.2)6..."..M.m...".m.h.r(..F..\.2)6....M.m.`..M.m..-..h.E.Z)6....Rm.m..h..F.,..I...X...m.h..E&.6.`..M.m..-..h.E.Z)6....Rm.m..h..F.,..I...X...m.h..

Chrome Cache Entry: 94

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 4 x 7, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	61
Entropy (8bit):	4.002585360278503
Encrypted:	false
SSDEEP:
MD5:	52962C9586004E36A10981336CB9E07D
SHA1:	E88EED84A04FA5E02A23C6753D9219E472EB4EC3
SHA-256:	AD90A5D023A801A5233EC92330130B6488D1BA721574F7CA298FF3979E1ABBED
SHA-512:	3E1D1E414CA83FE6543F7502FC854A4C40A868367582A3505E0F677F4F0700AEF7025F23FEE2BAC2400480F286CED52353E8817243C789735392FAE2CCABF78F
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...............{.....IDAT.....$.....IEND.B`.

Chrome Cache Entry: 95

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 2 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
Category:	downloaded
Size (bytes):	5430
Entropy (8bit):	2.6916960685487825
Encrypted:	false
SSDEEP:
MD5:	CCDA8DF05E9A37B3131AFD4D451B44EC
SHA1:	ED9D0F9C4224FBD4C768BE237B4B59F27F1B718C
SHA-256:	92842FC6C2F66B46F69458C14621FC2ECA5D6C02D7937F9124FE8A3A9A55BC91
SHA-512:	A91F53C07B327C35864FE903ACFE30AFE2DE3C26FDCE1BDBF65842598B3A7B2FB19E54DE27495519BF1E2A2BF7358561DA16E931324E5B1112DA4FE7EFE4BC7E
Malicious:	false
Reputation:	unknown
URL:	https://saas-agility-1324.my.salesforce-sites.com/favicon.ico
Preview:	............ .h...&... .... .........(....... ..... .....@........................................................................................................................................................................_..i..'............................................%..............I................................A.............................I................1.........................................3......}............................................'..u...............................................!...................................................s..........................................................................................'......I......................................1.....................................U..............................'..I..#..............................................................

Chrome Cache Entry: 97

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (27687)
Category:	downloaded
Size (bytes):	27843
Entropy (8bit):	5.161136919592181
Encrypted:	false
SSDEEP:
MD5:	250B3D262BAB3158387ABBAC304624DD
SHA1:	671B9113D85C1DB92CDC49AB86CBB219C3EE7E10
SHA-256:	4B0E585671847C76AD8257094DD40605A80DA5AC07EA7B0749426DED2C7D1C51
SHA-512:	751E790059E918742827F32983012CA8E858E591643FFDB62F946104EDBE7CB3C0AB4E6B0F68C4C2793D33A95423CFAEAA86650027B981E18BFD81B3197A2AC1
Malicious:	false
Reputation:	unknown
URL:	https://saas-agility-1324.my.salesforce-sites.com/support/sCSS/62.0/sprites/1729589050000/Theme3/default/gc/elements.css
Preview:	/. This code is for Internal Salesforce use only, and subject to change without notice.. * Customers shouldn't reference this file in any web pages.. */..userDefinedMRU img.userDefinedImage{background-image:none}.userDefinedMotif img.userDefinedImage,.userDefinedMotif img.relatedListIcon.userDefinedImage{background-image:none}.userDefinedRL img.userDefinedImage{background-image:none}.userDefinedRL .pbHeader .pbTitle h3{margin-left:4px}.motifElement{border:1px solid black;width:150px;margin-right:.3em;text-decoration:none;padding:0;overflow:hidden;height:1.5em;display:block;text-decoration:none;cursor:default;background-color:#fff}a.motifElement:hover{text-decoration:none}.motifElement .iconChoice,.motifElement .iconChoice img{width:19px;height:100%;background-color:#fff;float:left}.motifElement .colorChoice{margin:0;width:128px;height:100%;float:right;text-align:center;overflow:hidden}.motifColorElement,.motifColorElement .colorChoice{width:48px}.motifColorElement .iconChoice{displa

Chrome Cache Entry: 99

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, progressive, precision 8, 1280x305, components 3
Category:	downloaded
Size (bytes):	20957
Entropy (8bit):	7.61399329769288
Encrypted:	false
SSDEEP:
MD5:	B305FE14483001BEA71478C6AA34B475
SHA1:	380AC028CD9BA7E070D90FACC525008246802F12
SHA-256:	C6C0FA14823C5530831C3D2C97458899708B03F83BF8C7F6DDEB64408D3BE0E6
SHA-512:	BBF625086924DD2399C95D2D46500D0CB1E5A495D5A675E21DDBE2DE31610859B1B18242B941B174ACB8639AFB6F1EC2CC02ACF4D8BDC434A22380D3AFC91FBA
Malicious:	false
Reputation:	unknown
URL:	https://account.metaforsystemcheck.com/assets/metabanner.jpg
Preview:	......JFIF.....H.H......ICC_PROFILE............@..mntrRGB XYZ ............acsp.......................................-Qt..................................................rXYZ........gXYZ........bXYZ........wtpt...,....cprt...@....rTRC...L... gTRC...L... bTRC...L... desc...l..._XYZ ......o...8.....XYZ ......b.........XYZ ......$.........XYZ .......O........text....N/A.para..........ff......Y.......[desc........sRGB..................................................................................C....................................................................C.......................................................................1...."..................................................................................}d..........................t..a`.g.<m*..........c..........x.f..{d\|}................................................^.;..gV.L...^.....^..l...=.....eDa..aVs...9v..&.gV.1O..\....."I.......?l;...HgE...................................................}^....@....2.

Static File Info

General

File type:	CDFV2 Microsoft Outlook Message
Entropy (8bit):	4.2140990531006715
TrID:	Outlook Message (71009/1) 58.92% Outlook Form Template (41509/1) 34.44% Generic OLE2 / Multistream Compound File (8008/1) 6.64%
File name:	FW Important Exploit Has Been Identified In Your Account Steps to Resolve.msg
File size:	114'176 bytes
MD5:	22e77deb8baeb67268d991959f158e72
SHA1:	0a407b68cbeed426c55927eef8af0c4aaf921b97
SHA256:	60720452c31b7d192c93fe968f7b8bed1f27cc5c733bd778402affa91bf1cae6
SHA512:	1f063a1ee3da51612ec6b090677c41502b919f5c132220d77f479816d3fc6d86ac6b8827d8a079aa9976c76b391223805a7abe0a982f57f3df4d75d932adabe6
SSDEEP:	1536:t75tsogSgLxtxurPccRWqWvWFWX+xWxzxuuNW5W6a0cSAi:t75tsBrC7Al0jui
TLSH:	41B3242435E90E39F3779F714FE390AB8526FC52AD14969F3195730E0A729409CE2B3A
File Content Preview:	........................>...................................!..................................................................................................................................................................................................

Static Mail

General

Subject:	FW: Important: Exploit Has Been Identified In Your Account Steps to Resolve
From:	Emily Edwards <Emily.Edwards@cardfactory.co.uk>
To:	Gaganpreet Gandhi <Gaganpreet.Gandhi@cardfactory.co.uk>
Cc:
BCC:
Date:	Wed, 13 Nov 2024 13:19:15 +0100
Communications:	From: Business Suite <noreply@salesforce.com> Sent: 13 November 2024 11:58 To: Emily Edwards <Emily.Edwards@cardfactory.co.uk> Subject: Important: Exploit Has Been Identified In Your Account Steps to Resolve We wanted to inform you about some recent activity on your account that may not fully adhere to our guidelines. It appears an exploit has been identified that might be impacting specific functions wit CAUTION: This email originated from outside of the organisation. If in doubt please use the report message button to Security. sophospsmartbannerend We wanted to inform you about some recent activity on your account that may not fully adhere to our guidelines. It appears an exploit has been identified that might be impacting specific functions within the Meta Business Suite. As a result, temporary limitations have been placed on your account. facelo ook Ticket ID: FB-42P-378-KLM-TRQ Dear Emily Edwards,, We wanted to inform you about some recent activity on your account that may not fully adhere to our guidelines. It appears an exploit has been identified that might be impacting specific functions within the Meta Business Suite. As a result, temporary limitations have been placed on your account. Next Steps: * Initiate the System Check: Please submit an appeal to start a system check, allowing us to investigate and potentially lift the restrictions on your account. * Live Chat Assistance: Our team is available via live chat to guide you through the review process and answer any questions. Please be aware that appeals should be submitted by November 13, 2024. After this date, the restrictions may become permanent, and further appeals may not be accepted. Submit an appeal <https://eu-west-1.protection.sophos.com?d=salesforce-sites.com&u=aHR0cHM6Ly9zYWFzLWFnaWxpdHktMTMyNC5teS5zYWxlc2ZvcmNlLXNpdGVzLmNvbS9zdXBwb3J0&p=m&i=NWY4Y2M5MDRiZjMzNDkwZTA5YjI2NjRl&t=UGw4bitJbmtBTmZjbVE2eWZVRW9xTzFvempXNk9IREsrRERPRmVuNkNzST0=&h=cfaba86bf26f4cab8d057b35fbb98b3b&s=AVNPUEhUT0NFTkNSWVBUSVZeg5PtcYAYZSdiS2wrkwnZbIZ-RJoxZeHPGn_HACYMjg> If you need further assistance, please don't hesitate to contact our support team <https://eu-west-1.protection.sophos.com?d=salesforce-sites.com&u=aHR0cHM6Ly9zYWFzLWFnaWxpdHktMTMyNC5teS5zYWxlc2ZvcmNlLXNpdGVzLmNvbS9zdXBwb3J0&p=m&i=NWY4Y2M5MDRiZjMzNDkwZTA5YjI2NjRl&t=UGw4bitJbmtBTmZjbVE2eWZVRW9xTzFvempXNk9IREsrRERPRmVuNkNzST0=&h=cfaba86bf26f4cab8d057b35fbb98b3b&s=AVNPUEhUT0NFTkNSWVBUSVZeg5PtcYAYZSdiS2wrkwnZbIZ-RJoxZeHPGn_HACYMjg> . Copyright 2024 Meta Ltd. All rights reserved. We are located at 1601 Willow Road, Menlo Park, CA 94025 .
Attachments:	~WRD0001.jpg

Headers

Key	Value
Received	from AS8PR03MB6693.eurprd03.prod.outlook.com
12	19:15 +0000
Authentication-Results	dkim=none (message not signed)
by DU0PR03MB8193.eurprd03.prod.outlook.com (2603	10a6:10:322::10) with
2024 12	19:15 +0000
([fe80	:9cc4:5e6d:c5bd:a397%7]) with mapi id 15.20.8137.027; Wed, 13 Nov 2024
Content-Type	application/ms-tnef; name="winmail.dat"
Content-Transfer-Encoding	binary
From	Emily Edwards <Emily.Edwards@cardfactory.co.uk>
To	Gaganpreet Gandhi <Gaganpreet.Gandhi@cardfactory.co.uk>
Subject	=?utf-8?B?Rlc6IEltcG9ydGFudDogRXhwbG9pdCBIYXMgQmVlbiBJZGVudGlmaWVkIElu?=
Thread-Topic	=?utf-8?B?SW1wb3J0YW50OiBFeHBsb2l0IEhhcyBCZWVuIElkZW50aWZpZWQgSW4gWW91?=
Thread-Index	AQHbNcNZ932ZcPe5SEKjVDraxUuaBLK1INoA
Date	Wed, 13 Nov 2024 12:19:15 +0000
Message-ID	<AS8PR03MB66930B821F90BF6465E91159A05A2@AS8PR03MB6693.eurprd03.prod.outlook.com>
References	<dEP9_000000000000000000000000000000000000000000000SMW18400Gcwhuzk9TnCDa21p3Y9_7A@sfdc.net>
In-Reply-To	<dEP9_000000000000000000000000000000000000000000000SMW18400Gcwhuzk9TnCDa21p3Y9_7A@sfdc.net>
Accept-Language	en-US
Content-Language	en-US
X-MS-Has-Attach	yes
X-MS-Exchange-Organization-SCL	1
X-MS-TNEF-Correlator	<AS8PR03MB66930B821F90BF6465E91159A05A2@AS8PR03MB6693.eurprd03.prod.outlook.com>
MIME-Version	1.0
X-MS-Exchange-Organization-MessageDirectionality	Originating
X-MS-Exchange-Organization-AuthSource	AS8PR03MB6693.eurprd03.prod.outlook.com
X-MS-Exchange-Organization-AuthAs	Internal
X-MS-Exchange-Organization-AuthMechanism	04
X-MS-Exchange-Organization-Network-Message-Id	b774e764-9a92-4471-b775-08dd03dd63c9
X-MS-PublicTrafficType	Email
X-MS-TrafficTypeDiagnostic	AS8PR03MB6693:EE_\|DU0PR03MB8193:EE_\|PAVPR03MB10180:EE_
Return-Path	Emily.Edwards@cardfactory.co.uk
X-MS-Exchange-Organization-ExpirationStartTime	13 Nov 2024 12:19:15.6324
X-MS-Exchange-Organization-ExpirationStartTimeReason	OriginalSubmit
X-MS-Exchange-Organization-ExpirationInterval	1:00:00:00.0000000
X-MS-Exchange-Organization-ExpirationIntervalReason	OriginalSubmit
X-MS-Office365-Filtering-Correlation-Id	b774e764-9a92-4471-b775-08dd03dd63c9
X-Microsoft-Antispam	BCL:0;ARA:13230040\|366016\|8096899003\|41050700001;
X-Forefront-Antispam-Report	CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:AS8PR03MB6693.eurprd03.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(366016)(8096899003)(41050700001);DIR:INT;
X-MS-Exchange-CrossTenant-OriginalArrivalTime	13 Nov 2024 12:19:15.2945
X-MS-Exchange-CrossTenant-FromEntityHeader	Hosted
X-MS-Exchange-CrossTenant-Id	7956b84e-0c99-46b5-81c6-28689cfa7221
X-MS-Exchange-CrossTenant-AuthSource	AS8PR03MB6693.eurprd03.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs	Internal
X-MS-Exchange-CrossTenant-Network-Message-Id	b774e764-9a92-4471-b775-08dd03dd63c9
X-MS-Exchange-CrossTenant-MailboxType	HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName	kUidL8L9VQhPS4g9/7sTy7iblIO7I0Cjmg9KzSxNflG7iQM0ovyd7/RyUDl4xuz3Q32j+ef2uT8iAi/EuSd+VgqUh7Tbjiy6G0190yVw0Ns=
X-MS-Exchange-Transport-CrossTenantHeadersStamped	DU0PR03MB8193
X-MS-Exchange-Transport-EndToEndLatency	00:00:02.5257663
X-MS-Exchange-Processed-By-BccFoldering	15.20.8137.022
X-Microsoft-Antispam-Mailbox-Delivery	ucf:0;jmr:0;auth:0;dest:I;ENG:(910001)(944506478)(944626604)(920097)(425001)(930097)(140003);
X-Microsoft-Antispam-Message-Info	ejSOzMwsfzy8WbSFzdRncrAXABCY30S721OKkzUwKM9ZDPXD3cRwu1+O00a+c1yrMpuXrYvXNYWSJDO3KzFZhTJvwwVvySnGZtSXeec/DUgsTu2foaAeaCkADLH7nad4NaFPZvbbEy9Ogw0H6toHl97tcJPJRbo7y52yRMTT4VQSLpDrK0gUclNk7P/CzTyajPhdSpRPvR3H4UCo2pE8cReDzAgoQOwnv0j80pah3Wsb7TGWsylxmM1nHMBj4/UzEr3p7bNkDZTQZjd2zImYwKJzdEb2G1EvWZe6mmP40YrgUc3bkfr8RrsYsIPw7B0tI1Wby8fg1gvhM3hIJ4+aQ7cw1qFljFR/l3iHkHryo4SkhicHTDRjzlHuNfK39E8JhmGFOgo6jz3tT74gK8DeIwKtSlNeQOWfKChPpvdveTTB/NhG4tbfShUxUbCCteivAYPZJ64wpNZRBr6p0HZqO3QAejBqmJCAVv8WjjyGGvBDLT5t11gh/Jh9C3InTKSNv6A5dfNW4QEGFv4cPetiAWxkdxF/6cIzz3KfmGvA7fTid81InfUUXzP16LCnq2jnwJ6Cqmp80eOgjTsITo0MiP01P6TJzfacGIL2zqXzCQCJ73JGcXVTOIbDOKJ2GrfVugvt8gPJS2ozMNODZVOwH9TxbZU5399jgDkoA7jOvsx8wh/cQVFAYmEDFwLLpds4NziD2tACE9ChMv09g/y8EGGIS9xn0Ncs+kyKQcdUwUq5AftSJbPRRoKhtBMKblq7f3UAeFo85saiu0m7B7+1fGOzX3bK6G+rvdJbGpVf19i6HCrDn6dsdTLX5SBucEKp9QXu6I944Dk11TuXGd3TsA==
date	Wed, 13 Nov 2024 13:19:15 +0100

File Icon


Icon Hash:	c4e1928eacb280a2

Description:	Adversaries may abuse Internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality and customize aspects of Internet browsers. They can be installed directly or through a browser's app store and generally have access and permissions to everything that the browser can access.
Tactics:	Persistence
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Process: Process Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report FW Important Exploit Has Been Identified In Your Account Steps to Resolve.msg

Overview

General Information

Detection

Signatures

Classification

Process Tree

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

Phishing

Networking

System Summary

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

LLM Input / Output

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\FORMS\FRMCACHE.DAT

C:\Users\user\AppData\Local\Microsoft\FontCache\4\CatalogCacheMetaData.xml

C:\Users\user\AppData\Local\Microsoft\FontCache\4\Catalog\ListAll.Json

C:\Users\user\AppData\Local\Microsoft\FontCache\4\PreviewFont\flat_officeFontsPreview_4_40.ttf

C:\Users\user\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntities.bin

C:\Users\user\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntitiesUpdated.bin

C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\5A760FE5-2C27-4F20-89CC-E60DEA210834

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-journal

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\D40A26F9.dat

C:\Users\user\AppData\Local\Temp\msoF037.tmp

C:\Users\user\AppData\Roaming\Microsoft\Office\MSO3072.acl

C:\Users\user\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Chrome Cache Entry: 104

Chrome Cache Entry: 105

Chrome Cache Entry: 106

Chrome Cache Entry: 107

Chrome Cache Entry: 108

Chrome Cache Entry: 109

Chrome Cache Entry: 110

Chrome Cache Entry: 111

Chrome Cache Entry: 113

Chrome Cache Entry: 119

Chrome Cache Entry: 120

Chrome Cache Entry: 122

Chrome Cache Entry: 123

Chrome Cache Entry: 124

Chrome Cache Entry: 125

Chrome Cache Entry: 126

Windows Analysis Report
FW Important Exploit Has Been Identified In Your Account Steps to Resolve.msg