IOC Report
https://www.google.ie/url?q=queryy8px(spellCorrectionEnabled%3Atrue%2CrecentSearchParam%3A(id%3A3891228890%2CdoLogHistory%3Atrue)%2Cfilters%3AList((type%3AREGION%2Cvalues%3AList((id%3A103644278%2Ctext%3AUnited%2520States%2CselectionType%3AINCLUDED))))%2Ckeywords%3Aremote)&sessionId=5NTcRf4wT3OOZdAOu

loading gif

Files

File Path
Type
Category
Malicious
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Nov 19 20:35:47 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Nov 19 20:35:47 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:54:41 2023, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Nov 19 20:35:47 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Nov 19 20:35:47 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Nov 19 20:35:47 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
dropped
Chrome Cache Entry: 100
PNG image data, 50 x 1155, 8-bit/color RGBA, non-interlaced
downloaded
Chrome Cache Entry: 101
Web Open Font Format (Version 2), TrueType, length 105804, version 1.0
downloaded
Chrome Cache Entry: 102
gzip compressed data, from Unix, original size modulo 2^32 142317
dropped
Chrome Cache Entry: 103
gzip compressed data, from Unix, original size modulo 2^32 7324
downloaded
Chrome Cache Entry: 104
PNG image data, 70 x 70, 8-bit/color RGBA, non-interlaced
dropped
Chrome Cache Entry: 105
PNG image data, 50 x 1155, 8-bit/color RGBA, non-interlaced
dropped
Chrome Cache Entry: 106
PNG image data, 420 x 79, 8-bit/color RGBA, non-interlaced
downloaded
Chrome Cache Entry: 107
gzip compressed data, from Unix, original size modulo 2^32 209427
downloaded
Chrome Cache Entry: 108
gzip compressed data, from Unix, original size modulo 2^32 1810218
downloaded
Chrome Cache Entry: 109
gzip compressed data, from Unix, original size modulo 2^32 142317
downloaded
Chrome Cache Entry: 110
gzip compressed data, from Unix, original size modulo 2^32 223282
downloaded
Chrome Cache Entry: 111
JPEG image data, JFIF standard 1.02, resolution (DPI), density 300x300, segment length 16, Exif Standard: [TIFF image data, little-endian, direntries=16, height=4096, bps=206, compression=none, PhotometricIntepretation=RGB, manufacturer=Canon, model=Canon EOS 5D, orientation=upper-left, width=6144], baseline, precision 8, 6144x4096, components 3
downloaded
Chrome Cache Entry: 112
PNG image data, 70 x 70, 8-bit/color RGBA, non-interlaced
downloaded
Chrome Cache Entry: 113
SVG Scalable Vector Graphics image
downloaded
Chrome Cache Entry: 114
Web Open Font Format (Version 2), CFF, length 42632, version 2.0
downloaded
Chrome Cache Entry: 115
ASCII text, with no line terminators
downloaded
Chrome Cache Entry: 82
JPEG image data, JFIF standard 1.02, resolution (DPI), density 300x300, segment length 16, Exif Standard: [TIFF image data, little-endian, direntries=16, height=4096, bps=206, compression=none, PhotometricIntepretation=RGB, manufacturer=Canon, model=Canon EOS 5D, orientation=upper-left, width=6144], baseline, precision 8, 6144x4096, components 3
dropped
Chrome Cache Entry: 83
Unicode text, UTF-8 text, with very long lines (49026), with LF, NEL line terminators
dropped
Chrome Cache Entry: 84
gzip compressed data, from Unix, original size modulo 2^32 556
downloaded
Chrome Cache Entry: 85
PNG image data, 420 x 79, 8-bit/color RGBA, non-interlaced
dropped
Chrome Cache Entry: 86
PNG image data, 420 x 94, 8-bit/color RGBA, non-interlaced
downloaded
Chrome Cache Entry: 87
Web Open Font Format, CFF, length 20600, version 1.0
downloaded
Chrome Cache Entry: 88
ASCII text, with no line terminators
downloaded
Chrome Cache Entry: 89
PNG image data, 420 x 94, 8-bit/color RGBA, non-interlaced
dropped
Chrome Cache Entry: 90
Web Open Font Format (Version 2), TrueType, length 98868, version 1.0
downloaded
Chrome Cache Entry: 91
MS Windows icon resource - 1 icon, 16x16 with PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced, 32 bits/pixel
downloaded
Chrome Cache Entry: 92
JSON data
dropped
Chrome Cache Entry: 93
MS Windows icon resource - 1 icon, 16x16 with PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced, 32 bits/pixel
dropped
Chrome Cache Entry: 94
Unicode text, UTF-8 text, with very long lines (49026), with LF, NEL line terminators
downloaded
Chrome Cache Entry: 95
gzip compressed data, from Unix, original size modulo 2^32 1810218
dropped
Chrome Cache Entry: 96
gzip compressed data, from Unix, original size modulo 2^32 209427
dropped
Chrome Cache Entry: 97
SVG Scalable Vector Graphics image
dropped
Chrome Cache Entry: 98
HTML document, ASCII text, with very long lines (65080)
downloaded
Chrome Cache Entry: 99
JSON data
dropped
There are 31 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 --field-trial-handle=1968,i,18413991459941374636,2457918619707442337,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://www.google.ie/url?q=queryy8px(spellCorrectionEnabled%3Atrue%2CrecentSearchParam%3A(id%3A3891228890%2CdoLogHistory%3Atrue)%2Cfilters%3AList((type%3AREGION%2Cvalues%3AList((id%3A103644278%2Ctext%3AUnited%2520States%2CselectionType%3AINCLUDED))))%2Ckeywords%3Aremote)&sessionId=5NTcRf4wT3OOZdAOuNu6%2FQ%3D%3Dquery(spellCorrectionEnabled%3Atrue%2CrecentSearchParam%3A(id%3A3891228890%2CdoLogHistory%3Atrue)%2Cfilters%3AList((type%3AREGION%2Cvalues%3AList((id%3A103644278%2Ctext%3AUnited%2520States%2CselectionType%3AINCLUDED))))%2Ckeywords%3Aremote)&sessionId=5NTcRf4wT3OOZdAOuNu6%2FQ%3D%3Dquery(spellCorrectionEnabled%3Atrue%2CrecentSearchParam%3A(id%3A3891228890%2CdoLogHistory%3Atrue)%2Cfilters%3AList((type%3AREGION%2Cvalues%3AList((id%3A103644278%2Ctext%3AUnited%2520States%2CselectionType%3AINCLUDED))))%2Ckeywords%3Aremote)&sessionId=5NTcRf4wT3OOZdAOuNu6%2FQ%3D%3Dquery(spellCorrectionEnabled%3Atrue%2CrecentSearchParam%3A(id%3A3891228890%2CdoLogHistory%3Atrue)%2Cfilters%3AList((type%3AREGION%2Cvalues%3AList((id%3A103644278%2Ctext%3AUnited%2520States%2CselectionType%3AINCLUDED))))%2Ckeywords%3Aremote)&sessionId=5NTcRf4wT3OOZdAOuNu6%2FQ%3D%3D&sa=t&url=amp%2ftranscabrera.com%2fyaya%2f37w6telbuncxaji5ywvxeooxd1ok88ou67nhi/bWFyay5tY2tlbnppZUBtYWdlbGxhbmxwLmNvbQ==$?"

URLs

Name
IP
Malicious
https://www.google.ie/url?q=queryy8px(spellCorrectionEnabled%3Atrue%2CrecentSearchParam%3A(id%3A3891228890%2CdoLogHistory%3Atrue)%2Cfilters%3AList((type%3AREGION%2Cvalues%3AList((id%3A103644278%2Ctext%3AUnited%2520States%2CselectionType%3AINCLUDED))))%2Ckeywords%3Aremote)&sessionId=5NTcRf4wT3OOZdAOuNu6%2FQ%3D%3Dquery(spellCorrectionEnabled%3Atrue%2CrecentSearchParam%3A(id%3A3891228890%2CdoLogHistory%3Atrue)%2Cfilters%3AList((type%3AREGION%2Cvalues%3AList((id%3A103644278%2Ctext%3AUnited%2520States%2CselectionType%3AINCLUDED))))%2Ckeywords%3Aremote)&sessionId=5NTcRf4wT3OOZdAOuNu6%2FQ%3D%3Dquery(spellCorrectionEnabled%3Atrue%2CrecentSearchParam%3A(id%3A3891228890%2CdoLogHistory%3Atrue)%2Cfilters%3AList((type%3AREGION%2Cvalues%3AList((id%3A103644278%2Ctext%3AUnited%2520States%2CselectionType%3AINCLUDED))))%2Ckeywords%3Aremote)&sessionId=5NTcRf4wT3OOZdAOuNu6%2FQ%3D%3Dquery(spellCorrectionEnabled%3Atrue%2CrecentSearchParam%3A(id%3A3891228890%2CdoLogHistory%3Atrue)%2Cfilters%3AList((type%3AREGION%2Cvalues%3AList((id%3A103644278%2Ctext%3AUnited%2520States%2CselectionType%3AINCLUDED))))%2Ckeywords%3Aremote)&sessionId=5NTcRf4wT3OOZdAOuNu6%2FQ%3D%3D&sa=t&url=amp%2ftranscabrera.com%2fyaya%2f37w6telbuncxaji5ywvxeooxd1ok88ou67nhi/bWFyay5tY2tlbnppZUBtYWdlbGxhbmxwLmNvbQ==$?
malicious
https://djhdknfkfnkfjkfnf.kumovers.com/favicon.ico
209.38.247.52
 malicious
https://87fe9df4-de5da622.kumovers.com/assets/js/mvc/loginpage/initLoginPage.pack.58de3be0c9b511a0fdfd7ea4f69b56fc.js
209.38.247.52
 malicious
https://00c5488c-de5da622.kumovers.com/app/office365/exk177x2glprLjvIp697/sso/wsfed/passive?login_hint=mark.mckenzie%40magellanlp.com&client-request-id=93b0a0fa-c150-42e3-8d5a-a6dcdac8441c&username=mark.mckenzie%40magellanlp.com&wa=wsignin1.0&wtrealm=urn%3afederation%3aMicrosoftOnline&wctx=estsredirect%3d2%26estsrequest%3drQQIARAA42Kw0skoKSkottLXL8gvKknM0cvNTC7KL85PK8nPy8nMS9VLzs_Vyy9Kz0wBsYqEuAR-LdgwOeDgY6feqGV3bp1wkVnFqEzYCP0LjIwvGBknMcnkJhZl6-UmZ6fmVWWmOuQmpqfm5CTm5RSAVN1iEvQvSvdMCS92S01JLUosyczPe8SMV8sFFoFXLDwGzFYcHFwCDBIMCgw_WBgXsQLd-U_yhZRQX7DLqse98w2cnBhOsep755qlu4fpu2dmG7kZ-VpWVHkGmmQmGlqEhPlXmbkGZZT4aBtE5pckm2Tl25pbGU5gE5rAxnSKjeEDG2MHO8MsdoYDnIwHeBl-8DXf-fd60ZxD7zw2CDA8EGAAAA2
209.38.247.52
 malicious
https://87fe9df4-de5da622.kumovers.com/assets/js/sdk/okta-signin-widget/7.25.0/js/okta-sign-in.min.js
209.38.247.52
 malicious
https://3c5a958a-de5da622.kumovers.com/shared/1.0/content/js/BssoInterrupt_Core_zKox_QMcTIVut7mG_Z9Eew2.js
209.38.247.52
 malicious
https://87fe9df4-de5da622.kumovers.com/assets/loginpage/font/assets/Inter-SemiBold.b5f0f109bc88052d4000.woff2
209.38.247.52
 malicious
https://00c5488c-de5da622.kumovers.com/app/office365/exk177x2glprLjvIp697/sso/wsfed/passive?login_hint=mark.mckenzie%40magellanlp.com&client-request-id=93b0a0fa-c150-42e3-8d5a-a6dcdac8441c&username=mark.mckenzie%40magellanlp.com&wa=wsignin1.0&wtrealm=urn%3afederation%3aMicrosoftOnline&wctx=estsredirect%3d2%26estsrequest%3drQQIARAA42Kw0skoKSkottLXL8gvKknM0cvNTC7KL85PK8nPy8nMS9VLzs_Vyy9Kz0wBsYqEuAR-LdgwOeDgY6feqGV3bp1wkVnFqEzYCP0LjIwvGBknMcnkJhZl6-UmZ6fmVWWmOuQmpqfm5CTm5RSAVN1iEvQvSvdMCS92S01JLUosyczPe8SMV8sFFoFXLDwGzFYcHFwCDBIMCgw_WBgXsQLd-U_yhZRQX7DLqse98w2cnBhOsep755qlu4fpu2dmG7kZ-VpWVHkGmmQmGlqEhPlXmbkGZZT4aBtE5pckm2Tl25pbGU5gE5rAxnSKjeEDG2MHO8MsdoYDnIwHeBl-8DXf-fd60ZxD7zw2CDA8EGAAAA2#
malicious
https://87fe9df4-de5da622.kumovers.com/assets/js/sdk/okta-signin-widget/7.25.0/css/okta-sign-in.min.css
209.38.247.52
 malicious
https://87fe9df4-de5da622.kumovers.com/assets/loginpage/font/assets/Inter-Regular.c8ba52b05a9ef10f4758.woff2
209.38.247.52
 malicious
https://87fe9df4-de5da622.kumovers.com/assets/js/sdk/okta-signin-widget/7.25.0/img/icons/identifier/user-icon.svg
209.38.247.52
 malicious
https://87fe9df4-de5da622.kumovers.com/fs/bcg/4/gfs1iitj6mtRHwXoE1d8
209.38.247.52
 malicious
https://00c5488c-de5da622.kumovers.com/idp/idx/challenge/answer
209.38.247.52
 malicious
https://login-okta.kumovers.com/discovery/iframe.html
209.38.247.52
 malicious
https://login-okta.kumovers.com/de5da622bf084ff0b0c5db3b58bf1c67/
209.38.247.52
 malicious
https://87fe9df4-de5da622.kumovers.com/fs/bco/1/fs0tjdpam4AAR2CqZ696
209.38.247.52
 malicious
https://login-okta.kumovers.com/lib/discoveryIframe-a869d3b07ebd94f8cfae.min.js
209.38.247.52
 malicious
https://87fe9df4-de5da622.kumovers.com/bc/image/fileStoreRecord?id=fs0119sohrXGdEDmE697
209.38.247.52
 malicious
https://87fe9df4-de5da622.kumovers.com/assets/js/sdk/okta-signin-widget/7.25.0/img/ui/forms/checkbox-sign-in-widget.png
209.38.247.52
 malicious
https://00c5488c-de5da622.kumovers.com/auth/services/devicefingerprint
209.38.247.52
 malicious
https://00c5488c-de5da622.kumovers.com/idp/idx/identify
209.38.247.52
 malicious
https://87fe9df4-de5da622.kumovers.com/assets/js/sdk/okta-signin-widget/7.25.0/font/okticon.woff
209.38.247.52
 malicious
https://87fe9df4-de5da622.kumovers.com/assets/loginpage/css/loginpage-theme.c8c15f6857642c257bcd94823d968bb1.css
209.38.247.52
 malicious
https://00c5488c-de5da622.kumovers.com/idp/idx/introspect
209.38.247.52
 malicious
https://djhdknfkfnkfjkfnf.kumovers.com/?nf=bWFyay5tY2tlbnppZUBtYWdlbGxhbmxwLmNvbQ==$&sso_reload=true
209.38.247.52
 malicious
https://87fe9df4-de5da622.kumovers.com/assets/loginpage/font/assets/Aeonik-Regular.c672e6fbaa411f5719f3.woff2
209.38.247.52
 malicious
https://87fe9df4-de5da622.kumovers.com/fs/bco/7/fs0tlth7zFaclj5Hj696
209.38.247.52
 malicious
https://djhdknfkfnkfjkfnf.kumovers.com/de5da622bf084ff0b0c5db3b58bf1c67/
209.38.247.52
 malicious
https://54e2ff44-de5da622.kumovers.com/api/report?catId=GW+estsfd+ams2
209.38.247.52
 malicious
https://00c5488c-de5da622.kumovers.com/api/internal/brand/theme/style-sheet?touch-point=SIGN_IN_PAGE&v=0c87dd7c98ddc6357b84282899638428bbdf1fc84909aed3df3b474c8f376dd3ef084354afcd8447c32e0cf7d2b6de79
209.38.247.52
 malicious
https://87fe9df4-de5da622.kumovers.com/assets/js/sdk/okta-signin-widget/7.25.0/img/icons/mfa/password_70x70.png
209.38.247.52
 malicious
https://djhdknfkfnkfjkfnf.kumovers.com/?nf=bWFyay5tY2tlbnppZUBtYWdlbGxhbmxwLmNvbQ==$
https://www.google.ie/amp/transcabrera.com/yaya/37w6telbuncxaji5ywvxeooxd1ok88ou67nhi/bWFyay5tY2tlbnppZUBtYWdlbGxhbmxwLmNvbQ==$?
172.217.16.195
https://transcabrera.com/favicon.ico
207.210.229.228
https://transcabrera.com/yaya/37w6telbuncxaji5ywvxeooxd1ok88ou67nhi/bWFyay5tY2tlbnppZUBtYWdlbGxhbmxwLmNvbQ==$
https://www.google.ie/url?q=queryy8px(spellCorrectionEnabled%3Atrue%2CrecentSearchParam%3A(id%3A3891228890%2CdoLogHistory%3Atrue)%2Cfilters%3AList((type%3AREGION%2Cvalues%3AList((id%3A103644278%2Ctext%3AUnited%2520States%2CselectionType%3AINCLUDED))))%2Ckeywords%3Aremote)&sessionId=5NTcRf4wT3OOZdAOuNu6%2FQ%3D%3Dquery(spellCorrectionEnabled%3Atrue%2CrecentSearchParam%3A(id%3A3891228890%2CdoLogHistory%3Atrue)%2Cfilters%3AList((type%3AREGION%2Cvalues%3AList((id%3A103644278%2Ctext%3AUnited%2520States%2CselectionType%3AINCLUDED))))%2Ckeywords%3Aremote)&sessionId=5NTcRf4wT3OOZdAOuNu6%2FQ%3D%3Dquery(spellCorrectionEnabled%3Atrue%2CrecentSearchParam%3A(id%3A3891228890%2CdoLogHistory%3Atrue)%2Cfilters%3AList((type%3AREGION%2Cvalues%3AList((id%3A103644278%2Ctext%3AUnited%2520States%2CselectionType%3AINCLUDED))))%2Ckeywords%3Aremote)&sessionId=5NTcRf4wT3OOZdAOuNu6%2FQ%3D%3Dquery(spellCorrectionEnabled%3Atrue%2CrecentSearchParam%3A(id%3A3891228890%2CdoLogHistory%3Atrue)%2Cfilters%3AList((type%3AREGION%2Cvalues%3AList((id%3A103644278%2Ctext%3AUnited%2520States%2CselectionType%3AINCLUDED))))%2Ckeywords%3Aremote)&sessionId=5NTcRf4wT3OOZdAOuNu6%2FQ%3D%3D&sa=t&url=amp%2ftranscabrera.com%2fyaya%2f37w6telbuncxaji5ywvxeooxd1ok88ou67nhi/bWFyay5tY2tlbnppZUBtYWdlbGxhbmxwLmNvbQ==$?
172.217.16.195
There are 25 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
54e2ff44-de5da622.kumovers.com
209.38.247.52
 malicious
www.google.ie
172.217.16.195
djhdknfkfnkfjkfnf.kumovers.com
209.38.247.52
transcabrera.com
207.210.229.228
www.google.com
142.250.185.164
login-okta.kumovers.com
209.38.247.52
00c5488c-de5da622.kumovers.com
209.38.247.52
87fe9df4-de5da622.kumovers.com
209.38.247.52
3c5a958a-de5da622.kumovers.com
209.38.247.52

IPs

IP
Domain
Country
Malicious
192.168.2.17
unknown
unknown
malicious
209.38.247.52
djhdknfkfnkfjkfnf.kumovers.com
United States
192.168.2.18
unknown
unknown
239.255.255.250
unknown
Reserved
142.250.185.164
www.google.com
United States
207.210.229.228
transcabrera.com
United States
172.217.16.195
www.google.ie
United States

DOM / HTML

URL
Malicious
https://djhdknfkfnkfjkfnf.kumovers.com/?nf=bWFyay5tY2tlbnppZUBtYWdlbGxhbmxwLmNvbQ==$
 malicious
https://00c5488c-de5da622.kumovers.com/app/office365/exk177x2glprLjvIp697/sso/wsfed/passive?login_hint=mark.mckenzie%40magellanlp.com&client-request-id=93b0a0fa-c150-42e3-8d5a-a6dcdac8441c&username=mark.mckenzie%40magellanlp.com&wa=wsignin1.0&wtrealm=urn%3afederation%3aMicrosoftOnline&wctx=estsredirect%3d2%26estsrequest%3drQQIARAA42Kw0skoKSkottLXL8gvKknM0cvNTC7KL85PK8nPy8nMS9VLzs_Vyy9Kz0wBsYqEuAR-LdgwOeDgY6feqGV3bp1wkVnFqEzYCP0LjIwvGBknMcnkJhZl6-UmZ6fmVWWmOuQmpqfm5CTm5RSAVN1iEvQvSvdMCS92S01JLUosyczPe8SMV8sFFoFXLDwGzFYcHFwCDBIMCgw_WBgXsQLd-U_yhZRQX7DLqse98w2cnBhOsep755qlu4fpu2dmG7kZ-VpWVHkGmmQmGlqEhPlXmbkGZZT4aBtE5pckm2Tl25pbGU5gE5rAxnSKjeEDG2MHO8MsdoYDnIwHeBl-8DXf-fd60ZxD7zw2CDA8EGAAAA2#
 malicious
https://transcabrera.com/yaya/37w6telbuncxaji5ywvxeooxd1ok88ou67nhi/bWFyay5tY2tlbnppZUBtYWdlbGxhbmxwLmNvbQ==$
https://djhdknfkfnkfjkfnf.kumovers.com/?nf=bWFyay5tY2tlbnppZUBtYWdlbGxhbmxwLmNvbQ==$
https://00c5488c-de5da622.kumovers.com/app/office365/exk177x2glprLjvIp697/sso/wsfed/passive?login_hint=mark.mckenzie%40magellanlp.com&client-request-id=93b0a0fa-c150-42e3-8d5a-a6dcdac8441c&username=mark.mckenzie%40magellanlp.com&wa=wsignin1.0&wtrealm=urn%3afederation%3aMicrosoftOnline&wctx=estsredirect%3d2%26estsrequest%3drQQIARAA42Kw0skoKSkottLXL8gvKknM0cvNTC7KL85PK8nPy8nMS9VLzs_Vyy9Kz0wBsYqEuAR-LdgwOeDgY6feqGV3bp1wkVnFqEzYCP0LjIwvGBknMcnkJhZl6-UmZ6fmVWWmOuQmpqfm5CTm5RSAVN1iEvQvSvdMCS92S01JLUosyczPe8SMV8sFFoFXLDwGzFYcHFwCDBIMCgw_WBgXsQLd-U_yhZRQX7DLqse98w2cnBhOsep755qlu4fpu2dmG7kZ-VpWVHkGmmQmGlqEhPlXmbkGZZT4aBtE5pckm2Tl25pbGU5gE5rAxnSKjeEDG2MHO8MsdoYDnIwHeBl-8DXf-fd60ZxD7zw2CDA8EGAAAA2#
https://00c5488c-de5da622.kumovers.com/app/office365/exk177x2glprLjvIp697/sso/wsfed/passive?login_hint=mark.mckenzie%40magellanlp.com&client-request-id=93b0a0fa-c150-42e3-8d5a-a6dcdac8441c&username=mark.mckenzie%40magellanlp.com&wa=wsignin1.0&wtrealm=urn%3afederation%3aMicrosoftOnline&wctx=estsredirect%3d2%26estsrequest%3drQQIARAA42Kw0skoKSkottLXL8gvKknM0cvNTC7KL85PK8nPy8nMS9VLzs_Vyy9Kz0wBsYqEuAR-LdgwOeDgY6feqGV3bp1wkVnFqEzYCP0LjIwvGBknMcnkJhZl6-UmZ6fmVWWmOuQmpqfm5CTm5RSAVN1iEvQvSvdMCS92S01JLUosyczPe8SMV8sFFoFXLDwGzFYcHFwCDBIMCgw_WBgXsQLd-U_yhZRQX7DLqse98w2cnBhOsep755qlu4fpu2dmG7kZ-VpWVHkGmmQmGlqEhPlXmbkGZZT4aBtE5pckm2Tl25pbGU5gE5rAxnSKjeEDG2MHO8MsdoYDnIwHeBl-8DXf-fd60ZxD7zw2CDA8EGAAAA2#
https://00c5488c-de5da622.kumovers.com/app/office365/exk177x2glprLjvIp697/sso/wsfed/passive?login_hint=mark.mckenzie%40magellanlp.com&client-request-id=93b0a0fa-c150-42e3-8d5a-a6dcdac8441c&username=mark.mckenzie%40magellanlp.com&wa=wsignin1.0&wtrealm=urn%3afederation%3aMicrosoftOnline&wctx=estsredirect%3d2%26estsrequest%3drQQIARAA42Kw0skoKSkottLXL8gvKknM0cvNTC7KL85PK8nPy8nMS9VLzs_Vyy9Kz0wBsYqEuAR-LdgwOeDgY6feqGV3bp1wkVnFqEzYCP0LjIwvGBknMcnkJhZl6-UmZ6fmVWWmOuQmpqfm5CTm5RSAVN1iEvQvSvdMCS92S01JLUosyczPe8SMV8sFFoFXLDwGzFYcHFwCDBIMCgw_WBgXsQLd-U_yhZRQX7DLqse98w2cnBhOsep755qlu4fpu2dmG7kZ-VpWVHkGmmQmGlqEhPlXmbkGZZT4aBtE5pckm2Tl25pbGU5gE5rAxnSKjeEDG2MHO8MsdoYDnIwHeBl-8DXf-fd60ZxD7zw2CDA8EGAAAA2#