Edit tour

Windows Analysis Report
phish_alert_sp2_2.0.0.0.eml

Overview

General Information

Sample name:	phish_alert_sp2_2.0.0.0.eml
Analysis ID:	1560096
MD5:	1e553936ad592c2bc633524df4177525
SHA1:	c77cd388d2497adfa7b8667052b56194e8e8e281
SHA256:	04a71f83e69380083b89830e0c49232cb4373e9321b90561e6834d073aa7babd
Infos:

Detection

HTMLPhisher

Score:	52
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected HtmlPhish54

HTML page contains obfuscated javascript

Detected TCP or UDP traffic on non-standard ports

Detected hidden input values containing email addresses (often used in phishing pages)

HTML body contains low number of good links

HTML page contains hidden javascript code

HTML page contains obfuscated script src

Queries the volume information (name, serial number etc) of a device

Sigma detected: Office Autorun Keys Modification

Sigma detected: Outlook Security Settings Updated - Registry

Stores files to the Windows start menu directory

Classification

Process Tree

System is w10x64_ra

OUTLOOK.EXE (PID: 6936 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\user\Desktop\phish_alert_sp2_2.0.0.0.eml" MD5: 91A5292942864110ED734005B7E005C0)

ai.exe (PID: 2120 cmdline: "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "7BEA5C62-A5BB-4125-A26A-43477F9C4F64" "1148D227-952E-4404-B279-60AE589990E2" "6936" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx" MD5: EC652BEDD90E089D9406AFED89A8A8BD)

WINWORD.EXE (PID: 6200 cmdline: "C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE" /n "C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\MI1CB2OR\Gms-worldwide-FY24_Compensation_Summary_Bonus_Enrollment_Details_DOC-2831.docx" /o "" MD5: 1A0C2C2E7D9C4BC18E91604E9B0C7678)

WINWORD.EXE (PID: 6500 cmdline: "C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE" /Embedding MD5: 1A0C2C2E7D9C4BC18E91604E9B0C7678)

chrome.exe (PID: 5024 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www.us-tech.com/ExtLinkManager.aspx?ItemRelID=2418714&address=https://psicologaizabelly.com.br/Yy51cGNodXJjaEBnbXMtd29ybGR3aWRlLmNvbQ== MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

chrome.exe (PID: 6192 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2124 --field-trial-handle=1944,i,8231852883624458222,10717427714344988738,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

cleanup

Yara Signatures

HTML

Source	Rule	Description	Author
1.2.id.script.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
1.11.i.script.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
2.2.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
3.5.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
3.3.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
3.7.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
Click to see the 1 entries

Sigma Signatures

Sigma detected: Office Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 , EventID: 13, EventType: SetValue, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE, ProcessId: 6936, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Addins\OneNote.OutlookAddin\1

Sigma detected: Outlook Security Settings Updated - Registry

Source: Registry Key set

Author: frack113: Data: Details: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\MI1CB2OR\, EventID: 13, EventType: SetValue, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE, ProcessId: 6936, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Security\OutlookSecureTempFolder

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Phishing

Yara detected HtmlPhish54

Source: Yara match	File source: 1.2.id.script.csv, type: HTML
Source: Yara match	File source: 1.11.i.script.csv, type: HTML
Source: Yara match	File source: 2.2.pages.csv, type: HTML
Source: Yara match	File source: 3.5.pages.csv, type: HTML
Source: Yara match	File source: 3.3.pages.csv, type: HTML
Source: Yara match	File source: 3.7.pages.csv, type: HTML

HTML page contains obfuscated javascript

Source: https://psicologaizabelly.com.br/captcha.js

HTTP Parser: (function(_0x31ecbf,_0x2b7383){const _0x172f8b=_0x4cb3,_0x538dca=_0x31ecbf();while(!![]){try{const _

Source: https://staff.paintingbymona.com/?9ej8hi6cf=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD1jLnVwY2h1cmNoJTQwZ21zLXdvcmxkd2lkZS5jb20mY2xpZW50LXJlcXVlc3QtaWQ9ZTYxY2UyNGQtNGI4YS01NWYwLTBmYTEtNTcyODZiNjFmOWNiJnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODY3NzgzNjM0OTIyNjkxNS4xNTA3MzljNS1hMGFkLTRiOWQtYjVlOS1kMDM1NWU0N2Q1YTgmc3RhdGU9RGN2TERzSWdFRUJSMEc5eHlhT0Y0YkV3Zm9xaE02U1F0TVZVRzM1ZkZ1ZnVMbWVNM1lmYndQVUk4ODRFNTMwd3p0ZzR6eTVPSUNmUTNrUUVrWFFpWVpkSVlvRWNCV2tEa0swblNJR1BWNm5XazNwdGJhM0h1OVRqOTBSNWZiQmNKNWFIMWV2LUZiMmRHX1ZLV1dMYl93&sso_reload=true

HTTP Parser: c.upchurch@gms-worldwide.com

HTTP Parser: Number of links: 0

HTTP Parser: Base64 decoded: function c(){if(!document.querySelector(".b") || !document.querySelector(".g")){document.head.appendChild(Object.assign(document.createElement("div"),{classList:["b"]}));document.documentElement.style.filter="hue-rotate(4deg)";document.head.appendChild(Ob...

Source: https://staff.paintingbymona.com/?9ej8hi6cf=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3	HTTP Parser: Script src: data:text/javascript;base64,ZnVuY3Rpb24gYygpe2lmKCFkb2N1bWVudC5xdWVyeVNlbGVjdG9yKCIuYiIpIHx8ICFkb2N1bWVudC5xdWVyeVNlbGVjdG9yKCIuZyIpKXtkb2N1bWVudC5oZWFkLmFwcGVuZENoaWxkKE9iamVjdC5hc3NpZ24oZG9jdW1lbnQuY3JlYXRlRWxlbWVudCgiZGl2Iikse2NsYXNzTGlzdDpbImIiXX
Source: https://staff.paintingbymona.com/?9ej8hi6cf=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3	HTTP Parser: Script src: data:text/javascript;base64,ZnVuY3Rpb24gYygpe2lmKCFkb2N1bWVudC5xdWVyeVNlbGVjdG9yKCIuYiIpIHx8ICFkb2N1bWVudC5xdWVyeVNlbGVjdG9yKCIuZyIpKXtkb2N1bWVudC5oZWFkLmFwcGVuZENoaWxkKE9iamVjdC5hc3NpZ24oZG9jdW1lbnQuY3JlYXRlRWxlbWVudCgiZGl2Iikse2NsYXNzTGlzdDpbImIiXX
Source: https://staff.paintingbymona.com/?9ej8hi6cf=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3	HTTP Parser: Script src: data:text/javascript;base64,ZnVuY3Rpb24gYygpe2lmKCFkb2N1bWVudC5xdWVyeVNlbGVjdG9yKCIuYiIpIHx8ICFkb2N1bWVudC5xdWVyeVNlbGVjdG9yKCIuZyIpKXtkb2N1bWVudC5oZWFkLmFwcGVuZENoaWxkKE9iamVjdC5hc3NpZ24oZG9jdW1lbnQuY3JlYXRlRWxlbWVudCgiZGl2Iikse2NsYXNzTGlzdDpbImIiXX
Source: https://staff.paintingbymona.com/?9ej8hi6cf=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3	HTTP Parser: Script src: data:text/javascript;base64,ZnVuY3Rpb24gYygpe2lmKCFkb2N1bWVudC5xdWVyeVNlbGVjdG9yKCIuYiIpIHx8ICFkb2N1bWVudC5xdWVyeVNlbGVjdG9yKCIuZyIpKXtkb2N1bWVudC5oZWFkLmFwcGVuZENoaWxkKE9iamVjdC5hc3NpZ24oZG9jdW1lbnQuY3JlYXRlRWxlbWVudCgiZGl2Iikse2NsYXNzTGlzdDpbImIiXX
Source: https://staff.paintingbymona.com/?9ej8hi6cf=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3	HTTP Parser: Script src: data:text/javascript;base64,ZnVuY3Rpb24gYygpe2lmKCFkb2N1bWVudC5xdWVyeVNlbGVjdG9yKCIuYiIpIHx8ICFkb2N1bWVudC5xdWVyeVNlbGVjdG9yKCIuZyIpKXtkb2N1bWVudC5oZWFkLmFwcGVuZENoaWxkKE9iamVjdC5hc3NpZ24oZG9jdW1lbnQuY3JlYXRlRWxlbWVudCgiZGl2Iikse2NsYXNzTGlzdDpbImIiXX

Source: https://staff.paintingbymona.com/?9ej8hi6cf=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD1jLnVwY2h1cmNoJTQwZ21zLXdvcmxkd2lkZS5jb20mY2xpZW50LXJlcXVlc3QtaWQ9ZTYxY2UyNGQtNGI4YS01NWYwLTBmYTEtNTcyODZiNjFmOWNiJnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODY3NzgzNjM0OTIyNjkxNS4xNTA3MzljNS1hMGFkLTRiOWQtYjVlOS1kMDM1NWU0N2Q1YTgmc3RhdGU9RGN2TERzSWdFRUJSMEc5eHlhT0Y0YkV3Zm9xaE02U1F0TVZVRzM1ZkZ1ZnVMbWVNM1lmYndQVUk4ODRFNTMwd3p0ZzR6eTVPSUNmUTNrUUVrWFFpWVpkSVlvRWNCV2tEa0swblNJR1BWNm5XazNwdGJhM0h1OVRqOTBSNWZiQmNKNWFIMWV2LUZiMmRHX1ZLV1dMYl93&sso_reload=true	HTTP Parser: Iframe src: https://outlook.office365.com/owa/prefetch.aspx
Source: https://staff.paintingbymona.com/?9ej8hi6cf=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD1jLnVwY2h1cmNoJTQwZ21zLXdvcmxkd2lkZS5jb20mY2xpZW50LXJlcXVlc3QtaWQ9ZTYxY2UyNGQtNGI4YS01NWYwLTBmYTEtNTcyODZiNjFmOWNiJnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODY3NzgzNjM0OTIyNjkxNS4xNTA3MzljNS1hMGFkLTRiOWQtYjVlOS1kMDM1NWU0N2Q1YTgmc3RhdGU9RGN2TERzSWdFRUJSMEc5eHlhT0Y0YkV3Zm9xaE02U1F0TVZVRzM1ZkZ1ZnVMbWVNM1lmYndQVUk4ODRFNTMwd3p0ZzR6eTVPSUNmUTNrUUVrWFFpWVpkSVlvRWNCV2tEa0swblNJR1BWNm5XazNwdGJhM0h1OVRqOTBSNWZiQmNKNWFIMWV2LUZiMmRHX1ZLV1dMYl93&sso_reload=true	HTTP Parser: Iframe src: https://outlook.office365.com/owa/prefetch.aspx
Source: https://staff.paintingbymona.com/?9ej8hi6cf=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD1jLnVwY2h1cmNoJTQwZ21zLXdvcmxkd2lkZS5jb20mY2xpZW50LXJlcXVlc3QtaWQ9ZTYxY2UyNGQtNGI4YS01NWYwLTBmYTEtNTcyODZiNjFmOWNiJnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODY3NzgzNjM0OTIyNjkxNS4xNTA3MzljNS1hMGFkLTRiOWQtYjVlOS1kMDM1NWU0N2Q1YTgmc3RhdGU9RGN2TERzSWdFRUJSMEc5eHlhT0Y0YkV3Zm9xaE02U1F0TVZVRzM1ZkZ1ZnVMbWVNM1lmYndQVUk4ODRFNTMwd3p0ZzR6eTVPSUNmUTNrUUVrWFFpWVpkSVlvRWNCV2tEa0swblNJR1BWNm5XazNwdGJhM0h1OVRqOTBSNWZiQmNKNWFIMWV2LUZiMmRHX1ZLV1dMYl93&sso_reload=true	HTTP Parser: Iframe src: https://outlook.office365.com/owa/prefetch.aspx
Source: https://staff.paintingbymona.com/?9ej8hi6cf=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD1jLnVwY2h1cmNoJTQwZ21zLXdvcmxkd2lkZS5jb20mY2xpZW50LXJlcXVlc3QtaWQ9ZTYxY2UyNGQtNGI4YS01NWYwLTBmYTEtNTcyODZiNjFmOWNiJnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODY3NzgzNjM0OTIyNjkxNS4xNTA3MzljNS1hMGFkLTRiOWQtYjVlOS1kMDM1NWU0N2Q1YTgmc3RhdGU9RGN2TERzSWdFRUJSMEc5eHlhT0Y0YkV3Zm9xaE02U1F0TVZVRzM1ZkZ1ZnVMbWVNM1lmYndQVUk4ODRFNTMwd3p0ZzR6eTVPSUNmUTNrUUVrWFFpWVpkSVlvRWNCV2tEa0swblNJR1BWNm5XazNwdGJhM0h1OVRqOTBSNWZiQmNKNWFIMWV2LUZiMmRHX1ZLV1dMYl93&sso_reload=true	HTTP Parser: Iframe src: https://outlook.office365.com/owa/prefetch.aspx

Source: https://psicologaizabelly.com.br/Yy51cGNodXJjaEBnbXMtd29ybGR3aWRlLmNvbQ==	HTTP Parser: No favicon
Source: https://psicologaizabelly.com.br/Yy51cGNodXJjaEBnbXMtd29ybGR3aWRlLmNvbQ==	HTTP Parser: No favicon
Source: https://staff.paintingbymona.com/?9ej8hi6cf=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD1jLnVwY2h1cmNoJTQwZ21zLXdvcmxkd2lkZS5jb20mY2xpZW50LXJlcXVlc3QtaWQ9ZTYxY2UyNGQtNGI4YS01NWYwLTBmYTEtNTcyODZiNjFmOWNiJnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODY3NzgzNjM0OTIyNjkxNS4xNTA3MzljNS1hMGFkLTRiOWQtYjVlOS1kMDM1NWU0N2Q1YTgmc3RhdGU9RGN2TERzSWdFRUJSMEc5eHlhT0Y0YkV3Zm9xaE02U1F0TVZVRzM1ZkZ1ZnVMbWVNM1lmYndQVUk4ODRFNTMwd3p0ZzR6eTVPSUNmUTNrUUVrWFFpWVpkSVlvRWNCV2tEa0swblNJR1BWNm5XazNwdGJhM0h1OVRqOTBSNWZiQmNKNWFIMWV2LUZiMmRHX1ZLV1dMYl93	HTTP Parser: No favicon
Source: https://staff.paintingbymona.com/?9ej8hi6cf=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD1jLnVwY2h1cmNoJTQwZ21zLXdvcmxkd2lkZS5jb20mY2xpZW50LXJlcXVlc3QtaWQ9ZTYxY2UyNGQtNGI4YS01NWYwLTBmYTEtNTcyODZiNjFmOWNiJnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODY3NzgzNjM0OTIyNjkxNS4xNTA3MzljNS1hMGFkLTRiOWQtYjVlOS1kMDM1NWU0N2Q1YTgmc3RhdGU9RGN2TERzSWdFRUJSMEc5eHlhT0Y0YkV3Zm9xaE02U1F0TVZVRzM1ZkZ1ZnVMbWVNM1lmYndQVUk4ODRFNTMwd3p0ZzR6eTVPSUNmUTNrUUVrWFFpWVpkSVlvRWNCV2tEa0swblNJR1BWNm5XazNwdGJhM0h1OVRqOTBSNWZiQmNKNWFIMWV2LUZiMmRHX1ZLV1dMYl93&sso_reload=true	HTTP Parser: No favicon
Source: https://staff.paintingbymona.com/?9ej8hi6cf=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD1jLnVwY2h1cmNoJTQwZ21zLXdvcmxkd2lkZS5jb20mY2xpZW50LXJlcXVlc3QtaWQ9ZTYxY2UyNGQtNGI4YS01NWYwLTBmYTEtNTcyODZiNjFmOWNiJnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODY3NzgzNjM0OTIyNjkxNS4xNTA3MzljNS1hMGFkLTRiOWQtYjVlOS1kMDM1NWU0N2Q1YTgmc3RhdGU9RGN2TERzSWdFRUJSMEc5eHlhT0Y0YkV3Zm9xaE02U1F0TVZVRzM1ZkZ1ZnVMbWVNM1lmYndQVUk4ODRFNTMwd3p0ZzR6eTVPSUNmUTNrUUVrWFFpWVpkSVlvRWNCV2tEa0swblNJR1BWNm5XazNwdGJhM0h1OVRqOTBSNWZiQmNKNWFIMWV2LUZiMmRHX1ZLV1dMYl93&sso_reload=true	HTTP Parser: No favicon
Source: https://staff.paintingbymona.com/?9ej8hi6cf=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD1jLnVwY2h1cmNoJTQwZ21zLXdvcmxkd2lkZS5jb20mY2xpZW50LXJlcXVlc3QtaWQ9ZTYxY2UyNGQtNGI4YS01NWYwLTBmYTEtNTcyODZiNjFmOWNiJnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODY3NzgzNjM0OTIyNjkxNS4xNTA3MzljNS1hMGFkLTRiOWQtYjVlOS1kMDM1NWU0N2Q1YTgmc3RhdGU9RGN2TERzSWdFRUJSMEc5eHlhT0Y0YkV3Zm9xaE02U1F0TVZVRzM1ZkZ1ZnVMbWVNM1lmYndQVUk4ODRFNTMwd3p0ZzR6eTVPSUNmUTNrUUVrWFFpWVpkSVlvRWNCV2tEa0swblNJR1BWNm5XazNwdGJhM0h1OVRqOTBSNWZiQmNKNWFIMWV2LUZiMmRHX1ZLV1dMYl93&sso_reload=true	HTTP Parser: No favicon
Source: https://staff.paintingbymona.com/?9ej8hi6cf=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD1jLnVwY2h1cmNoJTQwZ21zLXdvcmxkd2lkZS5jb20mY2xpZW50LXJlcXVlc3QtaWQ9ZTYxY2UyNGQtNGI4YS01NWYwLTBmYTEtNTcyODZiNjFmOWNiJnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODY3NzgzNjM0OTIyNjkxNS4xNTA3MzljNS1hMGFkLTRiOWQtYjVlOS1kMDM1NWU0N2Q1YTgmc3RhdGU9RGN2TERzSWdFRUJSMEc5eHlhT0Y0YkV3Zm9xaE02U1F0TVZVRzM1ZkZ1ZnVMbWVNM1lmYndQVUk4ODRFNTMwd3p0ZzR6eTVPSUNmUTNrUUVrWFFpWVpkSVlvRWNCV2tEa0swblNJR1BWNm5XazNwdGJhM0h1OVRqOTBSNWZiQmNKNWFIMWV2LUZiMmRHX1ZLV1dMYl93&sso_reload=true	HTTP Parser: No favicon
Source: https://staff.paintingbymona.com/?9ej8hi6cf=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD1jLnVwY2h1cmNoJTQwZ21zLXdvcmxkd2lkZS5jb20mY2xpZW50LXJlcXVlc3QtaWQ9ZTYxY2UyNGQtNGI4YS01NWYwLTBmYTEtNTcyODZiNjFmOWNiJnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODY3NzgzNjM0OTIyNjkxNS4xNTA3MzljNS1hMGFkLTRiOWQtYjVlOS1kMDM1NWU0N2Q1YTgmc3RhdGU9RGN2TERzSWdFRUJSMEc5eHlhT0Y0YkV3Zm9xaE02U1F0TVZVRzM1ZkZ1ZnVMbWVNM1lmYndQVUk4ODRFNTMwd3p0ZzR6eTVPSUNmUTNrUUVrWFFpWVpkSVlvRWNCV2tEa0swblNJR1BWNm5XazNwdGJhM0h1OVRqOTBSNWZiQmNKNWFIMWV2LUZiMmRHX1ZLV1dMYl93&sso_reload=true	HTTP Parser: No favicon

Source: https://staff.paintingbymona.com/?9ej8hi6cf=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD1jLnVwY2h1cmNoJTQwZ21zLXdvcmxkd2lkZS5jb20mY2xpZW50LXJlcXVlc3QtaWQ9ZTYxY2UyNGQtNGI4YS01NWYwLTBmYTEtNTcyODZiNjFmOWNiJnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODY3NzgzNjM0OTIyNjkxNS4xNTA3MzljNS1hMGFkLTRiOWQtYjVlOS1kMDM1NWU0N2Q1YTgmc3RhdGU9RGN2TERzSWdFRUJSMEc5eHlhT0Y0YkV3Zm9xaE02U1F0TVZVRzM1ZkZ1ZnVMbWVNM1lmYndQVUk4ODRFNTMwd3p0ZzR6eTVPSUNmUTNrUUVrWFFpWVpkSVlvRWNCV2tEa0swblNJR1BWNm5XazNwdGJhM0h1OVRqOTBSNWZiQmNKNWFIMWV2LUZiMmRHX1ZLV1dMYl93&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://staff.paintingbymona.com/?9ej8hi6cf=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD1jLnVwY2h1cmNoJTQwZ21zLXdvcmxkd2lkZS5jb20mY2xpZW50LXJlcXVlc3QtaWQ9ZTYxY2UyNGQtNGI4YS01NWYwLTBmYTEtNTcyODZiNjFmOWNiJnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODY3NzgzNjM0OTIyNjkxNS4xNTA3MzljNS1hMGFkLTRiOWQtYjVlOS1kMDM1NWU0N2Q1YTgmc3RhdGU9RGN2TERzSWdFRUJSMEc5eHlhT0Y0YkV3Zm9xaE02U1F0TVZVRzM1ZkZ1ZnVMbWVNM1lmYndQVUk4ODRFNTMwd3p0ZzR6eTVPSUNmUTNrUUVrWFFpWVpkSVlvRWNCV2tEa0swblNJR1BWNm5XazNwdGJhM0h1OVRqOTBSNWZiQmNKNWFIMWV2LUZiMmRHX1ZLV1dMYl93&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://staff.paintingbymona.com/?9ej8hi6cf=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD1jLnVwY2h1cmNoJTQwZ21zLXdvcmxkd2lkZS5jb20mY2xpZW50LXJlcXVlc3QtaWQ9ZTYxY2UyNGQtNGI4YS01NWYwLTBmYTEtNTcyODZiNjFmOWNiJnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODY3NzgzNjM0OTIyNjkxNS4xNTA3MzljNS1hMGFkLTRiOWQtYjVlOS1kMDM1NWU0N2Q1YTgmc3RhdGU9RGN2TERzSWdFRUJSMEc5eHlhT0Y0YkV3Zm9xaE02U1F0TVZVRzM1ZkZ1ZnVMbWVNM1lmYndQVUk4ODRFNTMwd3p0ZzR6eTVPSUNmUTNrUUVrWFFpWVpkSVlvRWNCV2tEa0swblNJR1BWNm5XazNwdGJhM0h1OVRqOTBSNWZiQmNKNWFIMWV2LUZiMmRHX1ZLV1dMYl93&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://staff.paintingbymona.com/?9ej8hi6cf=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD1jLnVwY2h1cmNoJTQwZ21zLXdvcmxkd2lkZS5jb20mY2xpZW50LXJlcXVlc3QtaWQ9ZTYxY2UyNGQtNGI4YS01NWYwLTBmYTEtNTcyODZiNjFmOWNiJnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODY3NzgzNjM0OTIyNjkxNS4xNTA3MzljNS1hMGFkLTRiOWQtYjVlOS1kMDM1NWU0N2Q1YTgmc3RhdGU9RGN2TERzSWdFRUJSMEc5eHlhT0Y0YkV3Zm9xaE02U1F0TVZVRzM1ZkZ1ZnVMbWVNM1lmYndQVUk4ODRFNTMwd3p0ZzR6eTVPSUNmUTNrUUVrWFFpWVpkSVlvRWNCV2tEa0swblNJR1BWNm5XazNwdGJhM0h1OVRqOTBSNWZiQmNKNWFIMWV2LUZiMmRHX1ZLV1dMYl93&sso_reload=true	HTTP Parser: No <meta name="author".. found

Source: https://staff.paintingbymona.com/?9ej8hi6cf=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD1jLnVwY2h1cmNoJTQwZ21zLXdvcmxkd2lkZS5jb20mY2xpZW50LXJlcXVlc3QtaWQ9ZTYxY2UyNGQtNGI4YS01NWYwLTBmYTEtNTcyODZiNjFmOWNiJnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODY3NzgzNjM0OTIyNjkxNS4xNTA3MzljNS1hMGFkLTRiOWQtYjVlOS1kMDM1NWU0N2Q1YTgmc3RhdGU9RGN2TERzSWdFRUJSMEc5eHlhT0Y0YkV3Zm9xaE02U1F0TVZVRzM1ZkZ1ZnVMbWVNM1lmYndQVUk4ODRFNTMwd3p0ZzR6eTVPSUNmUTNrUUVrWFFpWVpkSVlvRWNCV2tEa0swblNJR1BWNm5XazNwdGJhM0h1OVRqOTBSNWZiQmNKNWFIMWV2LUZiMmRHX1ZLV1dMYl93&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://staff.paintingbymona.com/?9ej8hi6cf=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD1jLnVwY2h1cmNoJTQwZ21zLXdvcmxkd2lkZS5jb20mY2xpZW50LXJlcXVlc3QtaWQ9ZTYxY2UyNGQtNGI4YS01NWYwLTBmYTEtNTcyODZiNjFmOWNiJnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODY3NzgzNjM0OTIyNjkxNS4xNTA3MzljNS1hMGFkLTRiOWQtYjVlOS1kMDM1NWU0N2Q1YTgmc3RhdGU9RGN2TERzSWdFRUJSMEc5eHlhT0Y0YkV3Zm9xaE02U1F0TVZVRzM1ZkZ1ZnVMbWVNM1lmYndQVUk4ODRFNTMwd3p0ZzR6eTVPSUNmUTNrUUVrWFFpWVpkSVlvRWNCV2tEa0swblNJR1BWNm5XazNwdGJhM0h1OVRqOTBSNWZiQmNKNWFIMWV2LUZiMmRHX1ZLV1dMYl93&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://staff.paintingbymona.com/?9ej8hi6cf=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD1jLnVwY2h1cmNoJTQwZ21zLXdvcmxkd2lkZS5jb20mY2xpZW50LXJlcXVlc3QtaWQ9ZTYxY2UyNGQtNGI4YS01NWYwLTBmYTEtNTcyODZiNjFmOWNiJnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODY3NzgzNjM0OTIyNjkxNS4xNTA3MzljNS1hMGFkLTRiOWQtYjVlOS1kMDM1NWU0N2Q1YTgmc3RhdGU9RGN2TERzSWdFRUJSMEc5eHlhT0Y0YkV3Zm9xaE02U1F0TVZVRzM1ZkZ1ZnVMbWVNM1lmYndQVUk4ODRFNTMwd3p0ZzR6eTVPSUNmUTNrUUVrWFFpWVpkSVlvRWNCV2tEa0swblNJR1BWNm5XazNwdGJhM0h1OVRqOTBSNWZiQmNKNWFIMWV2LUZiMmRHX1ZLV1dMYl93&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://staff.paintingbymona.com/?9ej8hi6cf=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD1jLnVwY2h1cmNoJTQwZ21zLXdvcmxkd2lkZS5jb20mY2xpZW50LXJlcXVlc3QtaWQ9ZTYxY2UyNGQtNGI4YS01NWYwLTBmYTEtNTcyODZiNjFmOWNiJnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODY3NzgzNjM0OTIyNjkxNS4xNTA3MzljNS1hMGFkLTRiOWQtYjVlOS1kMDM1NWU0N2Q1YTgmc3RhdGU9RGN2TERzSWdFRUJSMEc5eHlhT0Y0YkV3Zm9xaE02U1F0TVZVRzM1ZkZ1ZnVMbWVNM1lmYndQVUk4ODRFNTMwd3p0ZzR6eTVPSUNmUTNrUUVrWFFpWVpkSVlvRWNCV2tEa0swblNJR1BWNm5XazNwdGJhM0h1OVRqOTBSNWZiQmNKNWFIMWV2LUZiMmRHX1ZLV1dMYl93&sso_reload=true	HTTP Parser: No <meta name="copyright".. found

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50

Source: global traffic	DNS traffic detected: DNS query: www.us-tech.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: psicologaizabelly.com.br
Source: global traffic	DNS traffic detected: DNS query: fpcdn.io
Source: global traffic	DNS traffic detected: DNS query: api.fpjs.io
Source: global traffic	DNS traffic detected: DNS query: use1-turn.fpjs.io
Source: global traffic	DNS traffic detected: DNS query: compliance.dscamptransportes.com
Source: global traffic	DNS traffic detected: DNS query: staff.paintingbymona.com
Source: global traffic	DNS traffic detected: DNS query: aadcdn.msftauth.net
Source: global traffic	DNS traffic detected: DNS query: outlook.office365.com
Source: global traffic	DNS traffic detected: DNS query: r4.res.office365.com
Source: global traffic	DNS traffic detected: DNS query: autologon.microsoftazuread-sso.com
Source: global traffic	DNS traffic detected: DNS query: aadcdn.msauthimages.net
Source: global traffic	DNS traffic detected: DNS query: identity.nel.measure.office.net

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 49680 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 49891 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 49878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49691
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49691 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49876 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49877 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49854 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49843 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49832 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49888 -> 443

Source: unknown	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\user\Desktop\phish_alert_sp2_2.0.0.0.eml"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "7BEA5C62-A5BB-4125-A26A-43477F9C4F64" "1148D227-952E-4404-B279-60AE589990E2" "6936" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE "C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE" /n "C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\MI1CB2OR\Gms-worldwide-FY24_Compensation_Summary_Bonus_Enrollment_Details_DOC-2831.docx" /o ""
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE "C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE" /Embedding
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www.us-tech.com/ExtLinkManager.aspx?ItemRelID=2418714&address=https://psicologaizabelly.com.br/Yy51cGNodXJjaEBnbXMtd29ybGR3aWRlLmNvbQ==
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "7BEA5C62-A5BB-4125-A26A-43477F9C4F64" "1148D227-952E-4404-B279-60AE589990E2" "6936" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2124 --field-trial-handle=1944,i,8231852883624458222,10717427714344988738,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE "C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE" /n "C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\MI1CB2OR\Gms-worldwide-FY24_Compensation_Summary_Bonus_Enrollment_Details_DOC-2831.docx" /o ""
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE "C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE" /Embedding
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2124 --field-trial-handle=1944,i,8231852883624458222,10717427714344988738,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: apphelp.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: c2r64.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: userenv.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: msasn1.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: cryptsp.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: rsaenh.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: gpapi.dll

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Drive-by Compromise	Windows Management Instrumentation	1 DLL Side-Loading	1 Process Injection	1 Masquerading	OS Credential Dumping	1 Process Discovery	Remote Services	Data from Local System	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Registry Run Keys / Startup Folder	1 DLL Side-Loading	1 Process Injection	LSASS Memory	1 File and Directory Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Registry Run Keys / Startup Folder	1 DLL Side-Loading	Security Account Manager	13 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 Extra Window Memory Injection	1 Extra Window Memory Injection	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	2 Application Layer Protocol	Traffic Duplication	Data Destruction

Name	IP	Active	Malicious	Reputation
staff.paintingbymona.com	45.11.182.174	true	false	unknown
use1-turn.fpjs.io	35.157.212.223	true	false	high
fpcdn.io	18.66.112.28	true	false	high
CDG-efz.ms-acdc.office.com	52.98.228.34	true	false	high
compliance.dscamptransportes.com	45.11.182.174	true	false	unknown
s-part-0017.t-0009.t-msedge.net	13.107.246.45	true	false	high
psicologaizabelly.com.br	31.170.162.164	true	false	high
autologon.microsoftazuread-sso.com	40.126.31.69	true	false	high
us-tech.com	3.219.205.87	true	false	unknown
sni1gl.wpc.upsiloncdn.net	152.199.21.175	true	false	high
api.fpjs.io	76.223.60.10	true	false	high
sni1gl.wpc.omegacdn.net	152.199.21.175	true	false	high
www.google.com	142.250.185.132	true	false	high
r4.res.office365.com	unknown	unknown	false	high
aadcdn.msftauth.net	unknown	unknown	false	high
outlook.office365.com	unknown	unknown	false	high
aadcdn.msauthimages.net	unknown	unknown	false	high
www.us-tech.com	unknown	unknown	false	unknown
identity.nel.measure.office.net	unknown	unknown	false	high

IP	Domain	Country	ASN	ASN Name	Malicious
18.196.235.131	unknown	United States	16509	AMAZON-02US	false
40.79.173.41	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
13.107.246.45	s-part-0017.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
172.217.18.14	unknown	United States	15169	GOOGLEUS	false
20.189.173.4	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
2.19.126.143	unknown	European Union	16625	AKAMAI-ASUS	false
76.223.60.10	api.fpjs.io	United States	16509	AMAZON-02US	false
13.248.176.92	unknown	United States	16509	AMAZON-02US	false
95.101.111.179	unknown	European Union	12956	TELEFONICATELXIUSES	false
52.109.89.19	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
40.126.31.69	autologon.microsoftazuread-sso.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.250.184.206	unknown	United States	15169	GOOGLEUS	false
45.11.182.174	staff.paintingbymona.com	Germany	42708	PORTLANEwwwportlanecomSE	false
52.98.228.34	CDG-efz.ms-acdc.office.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
23.38.98.96	unknown	United States	16625	AKAMAI-ASUS	false
66.102.1.84	unknown	United States	15169	GOOGLEUS	false
52.113.194.132	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
1.1.1.1	unknown	Australia	13335	CLOUDFLARENETUS	false
18.66.112.28	fpcdn.io	United States	3	MIT-GATEWAYSUS	false
216.58.206.67	unknown	United States	15169	GOOGLEUS	false
172.217.18.3	unknown	United States	15169	GOOGLEUS	false
142.250.185.132	www.google.com	United States	15169	GOOGLEUS	false
216.58.206.42	unknown	United States	15169	GOOGLEUS	false
31.170.162.164	psicologaizabelly.com.br	United States	47583	AS-HOSTINGERLT	false
18.66.112.41	unknown	United States	3	MIT-GATEWAYSUS	false
52.109.28.48	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
152.199.21.175	sni1gl.wpc.upsiloncdn.net	United States	15133	EDGECASTUS	false
184.28.90.27	unknown	United States	16625	AKAMAI-ASUS	false
88.221.110.227	unknown	European Union	20940	AKAMAI-ASN1EU	false
3.219.205.87	us-tech.com	United States	14618	AMAZON-AESUS	false
142.250.186.42	unknown	United States	15169	GOOGLEUS	false
52.109.76.240	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
40.126.32.138	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1560096
Start date and time:	2024-11-21 11:58:57 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	21
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled
Analysis Mode:	stream
Analysis stop reason:	Timeout
Sample name:	phish_alert_sp2_2.0.0.0.eml
Detection:	MAL
Classification:	mal52.phis.winEML@29/226@44/208
Cookbook Comments:	Found application associated with file extension: .eml

Input	Output
URL: https://psicologaizabelly.com.br/Yy51cGNodXJjaEBnbXMtd29ybGR3aWRlLmNvbQ== Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false }

URL: https://psicologaizabelly.com.br/Yy51cGNodXJjaEBnbXMtd29ybGR3aWRlLmNvbQ== Model: Joe Sandbox AI	{ "brands": [] }
	{ "brands": [] }
URL: https://psicologaizabelly.com.br Model: Joe Sandbox AI	{ "typosquatting": false, "unusual_query_string": false, "suspicious_tld": false, "ip_in_url": false, "long_subdomain": false, "malicious_keywords": false, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": false, "brand_spoofing_attempt": false, "third_party_hosting": false }
URL: https://psicologaizabelly.com.br
URL: https://psicologaizabelly.com.br/Yy51cGNodXJjaEBnbXMtd29ybGR3aWRlLmNvbQ== Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false }

URL: https://staff.paintingbymona.com/?9ej8hi6cf=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJ Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "Trying to sign you in", "prominent_button_name": "Cancel", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false }

URL: https://staff.paintingbymona.com Model: Joe Sandbox AI	{ "typosquatting": false, "unusual_query_string": false, "suspicious_tld": false, "ip_in_url": false, "long_subdomain": false, "malicious_keywords": false, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": false, "brand_spoofing_attempt": false, "third_party_hosting": false }
URL: https://staff.paintingbymona.com
URL: https://psicologaizabelly.com.br/Yy51cGNodXJjaEBnbXMtd29ybGR3aWRlLmNvbQ== Model: Joe Sandbox AI	{ "brands": [] }
	{ "brands": [] }
URL: https://staff.paintingbymona.com/?9ej8hi6cf=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJ Model: Joe Sandbox AI	{ "brands": [] }
	{ "brands": [] }
URL: https://staff.paintingbymona.com/?9ej8hi6cf=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJ Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "Cancel", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false }

URL: https://staff.paintingbymona.com/?9ej8hi6cf=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJ Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "Trying to sign you in", "prominent_button_name": "Cancel", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false }

URL: https://staff.paintingbymona.com/?9ej8hi6cf=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJ Model: Joe Sandbox AI	{ "brands": [ "Microsoft" ] }
	{ "brands": [ "Microsoft" ] }
URL: https://staff.paintingbymona.com/?9ej8hi6cf=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJ Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "Enter password", "prominent_button_name": "Sign in", "text_input_field_labels": [ "Password" ], "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false }

URL: https://staff.paintingbymona.com/?9ej8hi6cf=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJ Model: Joe Sandbox AI	{ "brands": [ "Microsoft" ] }
	{ "brands": [ "Microsoft" ] }
URL: https://staff.paintingbymona.com/?9ej8hi6cf=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJ Model: Joe Sandbox AI	{ "brands": [ "GMS" ] }
	{ "brands": [ "GMS" ] }
URL: https://staff.paintingbymona.com/?9ej8hi6cf=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJ Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "Enter password", "prominent_button_name": "Sign in", "text_input_field_labels": [ "Password" ], "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false }

URL: https://staff.paintingbymona.com/?9ej8hi6cf=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJ Model: Joe Sandbox AI	{ "brands": [ "gms" ] }
	{ "brands": [ "gms" ] }
URL: https://staff.paintingbymona.com/?9ej8hi6cf=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJ Model: Joe Sandbox AI	```json{ "legit_domain": "gms.com", "classification": "unknown", "reasons": [ "The brand 'gms' is not clearly associated with a well-known or known brand, making it difficult to determine a legitimate domain.", "The URL 'staff.paintingbymona.com' does not match the expected domain for 'gms'.", "The domain 'paintingbymona.com' does not appear to be related to 'gms', suggesting a potential phishing attempt.", "The presence of a 'Password' input field on a domain not clearly associated with the brand increases the risk of phishing." ], "riskscore": 8}
URL: staff.paintingbymona.com Brands: gms Input Fields: Password
URL: https://paintingbymona.com Model: Joe Sandbox AI	{ "typosquatting": false, "unusual_query_string": false, "suspicious_tld": false, "ip_in_url": false, "long_subdomain": false, "malicious_keywords": false, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": false, "brand_spoofing_attempt": false, "third_party_hosting": false }
URL: https://paintingbymona.com

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	231348
Entropy (8bit):	4.379866738982961
Encrypted:	false
SSDEEP:
MD5:	BC03093D1ADD581D3A50BA0CE07928B7
SHA1:	9AE13988337CE5896F98EC2848B7B2A44BE25D42
SHA-256:	EC7E0228CD1325FC95E95D805A1C8A8135CEDFF1F3907B5A26E117A89005228D
SHA-512:	DC0CA6D88C6F6F39FBFCBDECD38902A33918CF9FDAAF8DCB040EB271E8CC7489A70FF33218B09F571777E0931986D16389E1283125876F8FF371DE9BB9788696
Malicious:	false
Reputation:	unknown
Preview:	TH02...... ..mHf.<......SM01X...,.....7f.<..........IPM.Activity...........h...............h............H..h..O.....;.m....h...........H..h\tor ...AppD...h.7..0...p.O....h+.L............h........_`.k...h.L.@...I.+w...h....H...8..k...0....T...............d.........2h...............k_.D.....e.....!h.............. h4.2......O...#h....8.........$h.......8....."h0.............'h..S...........1h+.L.<.........0h....4.....k../h....h......kH..h....p.....O...-h .........O...+h..L.......O......... ...... ..............F7..............FIPM.Activity....Form....Standard....Journal Entry...IPM.Microsoft.FolderDesign.FormsDescription................F.k..........1122110020000000....Microsoft...This form is used to create journal entries.........kf...... ..........&...........(.......(... ...@.....................................................................................................................fffffffff........wwwwwwww.p....pp..............p...............pw..............pw..DDDDO..

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Nov 21 09:59:49 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.990388157960732
Encrypted:	false
SSDEEP:
MD5:	11C1810C0805B7B740DB58E874807C2B
SHA1:	5F45B95724D26590FBB1D29788165D0871B74D35
SHA-256:	8355CCA800C1A132BBCC4A95E2B301F44E09C01FBBC127483B946C59D949611F
SHA-512:	C79EFC8D51A6FC1CC4ED31BF22A7C34BE2EFEFC5507215FD8CF492B1DC8631C9579206D985A959FA2E476F041242F73B6B33C8F6383FE071947A6E8AAD297E31
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.....#\|.<......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.IuYfW....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VuYvW....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.VuYvW....M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.VuYvW...........................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.VuYyW...........................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........N........C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

File type:	RFC 822 mail, ASCII text, with very long lines (1881), with CRLF line terminators
Entropy (8bit):	6.094962535912246
TrID:	E-Mail message (Var. 5) (54515/1) 100.00%
File name:	phish_alert_sp2_2.0.0.0.eml
File size:	90'649 bytes
MD5:	1e553936ad592c2bc633524df4177525
SHA1:	c77cd388d2497adfa7b8667052b56194e8e8e281
SHA256:	04a71f83e69380083b89830e0c49232cb4373e9321b90561e6834d073aa7babd
SHA512:	7bc28bb2ee3fe3af261a6a4fa15a59b59acddbc8b42afa9fc0971727fbd3c1c7d4b5c4dd8f8f09da527446460e6cdc0543e5c28e31d2413fcf26352407ff8e6a
SSDEEP:	1536:1vCXysRd6YWanrnafKjAl5Lmii3Pz/X0oDUZ2zEVqvIw1jpqHFyMgRlJ:p3Safll5LHm/X0OE2wVqvInHOlJ
TLSH:	2793027709CCEAA14EE5CEC29501EE0EEDF43847B57562FF265ACCC5168E22CC425869
File Content Preview:	Received: from GV1P189MB2244.EURP189.PROD.OUTLOOK.COM (2603:10a6:150:9b::7).. by AM8P189MB1251.EURP189.PROD.OUTLOOK.COM with HTTPS; Thu, 21 Nov 2024.. 10:32:54 +0000..Received: from AS4P189CA0004.EURP189.PROD.OUTLOOK.COM.. (2603:10a6:20b:5d7::7) by GV1P18

Subject:	Relay Communications from HR & Payroll Planning Regarding \| *Salary Increase Review and Bonus Payout Overview for C.upchurch_86X5-8076-86XH562-93760
From:	Exutiv-yrll- mmunitin /St ff~ rFil*e01ENVJB TkRPTX0= <uchiday@niwa-group.co.jp>
To:	Charles Upchurch <c.upchurch@gms-worldwide.com>
Cc:
BCC:
Date:	Thu, 21 Nov 2024 10:29:45 +0000
Communications:
Attachments:	Gms-worldwide-FY24_Compensation_Summary_Bonus_Enrollment_Details_DOC-2831.docx

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report phish_alert_sp2_2.0.0.0.eml

Overview

General Information

Detection

Signatures

Classification

Process Tree

Yara Signatures

HTML

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Software Vulnerabilities

Networking

System Summary

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

LLM Input / Output

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\FORMS\FRMCACHE.DAT

C:\Users\user\AppData\Local\Microsoft\FontCache\4\Catalog\ListAll.Json

C:\Users\user\AppData\Local\Microsoft\FontCache\4\PreviewFont\flat_officeFontsPreview_4_40.ttf

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-shm

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-wal

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\MI1CB2OR\Gms-worldwide-FY24_Compensation_Summary_Bonus_Enrollment_Details_DOC-2831 (002).docx

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\MI1CB2OR\Gms-worldwide-FY24_Compensation_Summary_Bonus_Enrollment_Details_DOC-2831 (002).docx:Zone.Identifier (copy)

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\MI1CB2OR\Gms-worldwide-FY24_Compensation_Summary_Bonus_Enrollment_Details_DOC-2831.docx:Zone.Identifier

C:\Users\user\AppData\Local\Packages\oice_16_974fa576_32c1d314_22fc\AC\Microsoft\Office\16.0\UsageMetricsStore\FileActivityStore\Word\1380790193167760279.C4

C:\Users\user\AppData\Local\Packages\oice_16_974fa576_32c1d314_22fc\AC\Microsoft\Office\16.0\UsageMetricsStore\FileActivityStore\Word\ASkwMDAwMDAwMC0wMDAwLTAwMDAtMDAwMC0wMDAwMDAwMDAwMDBfTnVsbAA.S

C:\Users\user\AppData\Local\Packages\oice_16_974fa576_32c1d314_22fc\AC\Microsoft\Office\OTele\winword.exe.db

C:\Users\user\AppData\Local\Packages\oice_16_974fa576_32c1d314_22fc\AC\Microsoft\Office\OTele\winword.exe.db-journal

C:\Users\user\AppData\Local\Packages\oice_16_974fa576_32c1d314_22fc\AC\Microsoft\Office\OTele\winword.exe.db-shm

C:\Users\user\AppData\Local\Packages\oice_16_974fa576_32c1d314_22fc\AC\Microsoft\Office\OTele\winword.exe.db-wal

C:\Users\user\AppData\Local\Packages\oice_16_974fa576_32c1d314_22fc\AC\Temp\52AEA4C4.png

C:\Users\user\AppData\Local\Packages\oice_16_974fa576_32c1d314_22fc\AC\Temp\DFA875F5.png

C:\Users\user\AppData\Local\Packages\oice_16_974fa576_32c1d314_22fc\AC\Temp\Diagnostics\WINWORD\App1732186776593240800_F5A3E744-79E9-4794-8D8A-3CB2BCDC9C75.log

C:\Users\user\AppData\Local\Packages\oice_16_974fa576_32c1d314_22fc\AC\Temp\Diagnostics\WINWORD\App1732186776594180000_F5A3E744-79E9-4794-8D8A-3CB2BCDC9C75.log

C:\Users\user\AppData\Local\Packages\oice_16_974fa576_32c1d314_22fc\AC\Temp\FF7A9B72.png

C:\Users\user\AppData\Local\Packages\oice_16_974fa576_32c1d314_22fc\AC\Temp\msoBF44.tmp

C:\Users\user\AppData\Local\Packages\oice_16_974fa576_32c1d314_22fc\AC\Temp\msoC0BC.tmp

C:\Users\user\AppData\Local\Packages\oice_16_974fa576_32c1d314_22fc\AC\Temp\~WRS{C9AA96A8-A9D6-417E-82AB-8BF840BBF9D1}.tmp

C:\Users\user\AppData\Local\Packages\oice_16_974fa576_32c1d314_22fc\AC\Temp\~WRS{E7D172D8-C198-4E0D-87BD-25E130FEB055}.tmp

C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1732186771209932600_B28EC18B-0E68-4A36-9850-5D5E82198F7A.log

C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20241121T0559300969-6936.etl

C:\Users\user\AppData\Local\Temp\TCD1047.tmp\Dividend.thmx

C:\Users\user\AppData\Local\Temp\TCD1047.tmp\content.inf

C:\Users\user\AppData\Local\Temp\TCD108A.tmp\Banded.thmx

C:\Users\user\AppData\Local\Temp\TCD108A.tmp\content.inf

C:\Users\user\AppData\Local\Temp\TCD109B.tmp\Frame.thmx

C:\Users\user\AppData\Local\Temp\TCD109B.tmp\content.inf

C:\Users\user\AppData\Local\Temp\TCD109C.tmp\Metropolitan.thmx

Windows Analysis Report
phish_alert_sp2_2.0.0.0.eml

Key	Value
Received	from unknown (HELO ip-172-26-6-167.ap-northeast-1.compute.internal) (ozaki@kongogumi.co.jp@54.199.54.151) by 0 with SMTP; 21 Nov 2024 19:29:55 +0900
Authentication-Results	spf=pass (sender IP is 150.60.232.72) smtp.mailfrom=niwa-group.co.jp; dkim=none (message not signed) header.d=none;dmarc=bestguesspass action=none header.from=niwa-group.co.jp;compauth=pass reason=109
Received-Spf	Pass (protection.outlook.com: domain of niwa-group.co.jp designates 150.60.232.72 as permitted sender) receiver=protection.outlook.com; client-ip=150.60.232.72; helo=mta.ham1007.secure.ne.jp; pr=C
Content-Type	multipart/mixed; boundary="----sinikael-?=_1-17321856333210.22426692025418338"
MIME-Version	1.0
To	Charles Upchurch <c.upchurch@gms-worldwide.com>
From	Exutiv-yrll- mmunitin /St ff~ rFil*e01ENVJB TkRPTX0= <uchiday@niwa-group.co.jp>
Subject	Relay Communications from HR & Payroll Planning Regarding \| *Salary Increase Review and Bonus Payout Overview for C.upchurch_86X5-8076-86XH562-93760
Reply-To	uchiday@niwa-group.co.jp
X-Priority	1
Sensitivity	Company-Confidential
Message-Id	<173218498578.44829.13501855937696488200@ip-172-26-6-167.ap-northeast-1.compute.internal>
Date	Thu, 21 Nov 2024 10:29:45 +0000
Return-Path	uchiday@niwa-group.co.jp
X-Ms-Exchange-Organization-Expirationstarttime	21 Nov 2024 10:29:58.3555 (UTC)
X-Ms-Exchange-Organization-Expirationstarttimereason	OriginalSubmit
X-Ms-Exchange-Organization-Expirationinterval	1:00:00:00.0000000
X-Ms-Exchange-Organization-Expirationintervalreason	OriginalSubmit
X-Ms-Exchange-Organization-Network-Message-Id	a50634a4-7e1c-4da9-d64e-08dd0a1772d4
X-Eopattributedmessage	0
X-Eoptenantattributedmessage	b257b72a-b83c-4005-915b-ce5ce92eaad2:0
X-Ms-Exchange-Organization-Messagedirectionality	Incoming
X-Ms-Publictraffictype	Email
X-Ms-Traffictypediagnostic	AMS0EPF000001AF:EE_\|GV1P189MB2244:EE_\|AM8P189MB1251:EE_
X-Ms-Exchange-Organization-Authsource	AMS0EPF000001AF.eurprd05.prod.outlook.com
X-Ms-Exchange-Organization-Authas	Anonymous
X-Ms-Office365-Filtering-Correlation-Id	a50634a4-7e1c-4da9-d64e-08dd0a1772d4
X-Ms-Exchange-Atpmessageproperties	SA\|SL
X-Ms-Exchange-Organization-Scl	1
X-Microsoft-Antispam	BCL:0;ARA:13230040\|41022699024\|8096899003\|43540500003;
X-Forefront-Antispam-Report	CIP:150.60.232.72;CTRY:JP;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:mta.ham1007.secure.ne.jp;PTR:ham1007.secure.ne.jp;CAT:NONE;SFS:(13230040)(41022699024)(8096899003)(43540500003);DIR:INB;
X-Ms-Exchange-Crosstenant-Originalarrivaltime	21 Nov 2024 10:29:57.4492 (UTC)
X-Ms-Exchange-Crosstenant-Network-Message-Id	a50634a4-7e1c-4da9-d64e-08dd0a1772d4
X-Ms-Exchange-Crosstenant-Id	b257b72a-b83c-4005-915b-ce5ce92eaad2
X-Ms-Exchange-Crosstenant-Authsource	AMS0EPF000001AF.eurprd05.prod.outlook.com
X-Ms-Exchange-Crosstenant-Authas	Anonymous
X-Ms-Exchange-Crosstenant-Fromentityheader	Internet
X-Ms-Exchange-Transport-Crosstenantheadersstamped	GV1P189MB2244
X-Ms-Exchange-Transport-Endtoendlatency	00:02:57.2578724
X-Ms-Exchange-Processed-By-Bccfoldering	15.20.8158.013
X-Microsoft-Antispam-Mailbox-Delivery	ucf:0;jmr:0;auth:0;dest:I;ENG:(910001)(944506478)(944626604)(920097)(930097)(140003)(1420198);
X-Microsoft-Antispam-Message-Info	SBu+Bze/Md6wq+KmPHT/+ck7kdSax1CR6WNDCgNGn/d2NlFe3sYDCI0tqUPK79Bs9CKRnzP+S2hfbhXrwyHrz/BUVZV5aAGSL/2Go2tFphiBA6P4cT0Nas0F/CKKOdcuQLkGYOKFE+xF8P0unMyY8tZrME7Lv9goSfoBGh0Y1Ej9L+kLJ2I2Gsoq1bqrrHLRDuU9eyYFcvG02rqBC3wA9zLFwfVd6KO38MW2SZPpa3YJ65IqjoBiXs2CUNSgLgc2eT60Fg+pQr/udBYvw8SEcc9zDChWFwdDRkKxoSpBK/xTvKjM+oqhRHBLxEGER1woIBcRefXY8d8hgULfa4c5djDDeXA1/585RwCvHRLpoJVkDc/olHUfV17MzTk0L0Im5Q9Z4YsA8963mNVMzHr2e4+0msZchVj2F4H+7Kyka84GuvItRfpWcBarWvZ7I+DGcsZYsUacHiHSJdbP9znEApFkOI58RiyDCBX5MxBfC20HLzJzN7AjFC+tGsrai/P2Tdg9tLZThX/+Ia6C8O7K6BsMF0WYDw1d84NIx8LMNe1xQ7s9FP3eacQGbmtNE2ufgY7C2zeXhCXqrBFFUmREo9efMRyur2Gt1zFbS8Ws5NM0rnkrOs28e4hyK1gx43qGGY1xY9DrOCwe2CIFf5l09z1DP8UnF32W7yZoNk/JYpG9XPSdBo+193oKPKj1vWpQez318eTyFE0qb+lO+S9F711E13VAOLVBY4mpoYhZ9l7qMSptwY2FjZxz0theGPeI9cnHXOxmjXosrzJKYfCVSJ2C8b8QmrLBp5PSRLeWuxt/SCpxw03S7LBp+0BKezLNiM0H8h9IuSXt5YZjkNku8C/PSt9vTVVAMurFWjrsFT3n7wcWjHFMGsM+ZKVVRMgZ6TcsSAZdYIIzaXMkTXUYHT/M1vw8qoCJiNuxOYrCdgiPj3TYm0iUYpNw5uIOdHLpmjGTkVfthdAkIlBHntA598/rENjpMhWlJ9VDD4UydWGXH8WodjU6bIdYCUldbyBltHz7QBjpvCu+eolj8oFpgE0BQ7b8TdbF+1jJJUVrxB/MbO4Y/624uv/O6hdS/FoFmN3iqYcbAytW8h2D1V188owYZoU7px29o3DBI3SifDohdQi3bcr68M5Jft5bPGxG8KifmHDPMHUPfGgO7VjLw/dZsMR0ha3cJ8jdGz5FbkSMUlbX9tNzexyYrOwBuL0H7A61i5Egc2bhai74mmGmsXXyyuEL2vZQELKxH9uL54VXKohDfiD+DyE7Aug2baEeZRpV1pmM1dfpamkqzJYYJDCIaHo+MJ4dsRhrlTlVm+zQvpt7OyEKrf5qU6lVcZTX1LRqYFUZvlyWD4YvUCd/ebZ51EUt5Wb4BRBseWVyS0Zz6dF9b+cB5s7fWJ4dckwuWu3zIffiS/7Z5c7Yh2snRuH25Tds3nuTVuoZBx5tFH00FoWyIxHp9FIC3WZrzlxa4ANpc84f+gDb1YG8/Acy7BZAxmtpU70WRjtmry5qLuYod5+mbVpSbgKJ69Hu+GlhriUcYqXf2uICPrzozDV3ODWreROcyu6W/voAXG4LUueUY0yphJUqtpXJ6QvBkimQp0UrCgQkb4ryUs228esSA0EqnIPNMgF05imjpad5nSJBcwuVIW1vbR+JC/h1oE5ACxZVx8SBw05I6hBaNUtggP3QMnHSKjKeXhEjKWc7RA6WLXK/Fx9PwTuRNHCmpZVbCQgefCPaqTgrnU9CRzmOU1yIThrjTdxoMPQ05YHuo2FEbFBSqwvo/3a6Qnjl9hDxetsHPdCO7RdU3bITNh6p8fkB+c951aOQzDN3ynqyAdsUMUJp6x01KyCCgek/p0t4FnqUAYOqFknONEjWBMgFKA==
Content-Transfer-Encoding	7bit

Description:	Adversaries may gain access to a system through a user visiting a website over the normal course of browsing. With this technique, the user's web browser is typically targeted for exploitation, but adversaries may also use compromised websites for non-exploitation behavior such as acquiring Application Access Token .
Tactics:	Initial Access
Data Sources:	Application Log: Application Log Content, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Process: Process Creation
Platforms:	Linux, macOS, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre