Edit tour

Windows Analysis Report
securedoc_20241216T121346.html

Overview

General Information

Sample name:	securedoc_20241216T121346.html
Analysis ID:	1576362
MD5:	2a3629d13e32b7a808df62dd6b70d992
SHA1:	e9f6686d976a275f2ca1fa73a0d4c94175ec6e14
SHA256:	2dd926883acc2e4e939002b4c1ebfe6eb2134555694ae9b868edba7b63506afc

Detection

Score:	60
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

AI detected phishing page

AI detected suspicious Javascript

HTML file submission containing password form

Suspicious Javascript code found in HTML file

Detected hidden input values containing email addresses (often used in phishing pages)

HTML body contains low number of good links

HTML page contains hidden javascript code

HTML title does not match URL

HTTP GET or POST without a user agent

None HTTPS page querying sensitive user data (password, username or email)

Stores files to the Windows start menu directory

Classification

Process Tree

System is w10x64_ra

chrome.exe (PID: 6800 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument C:\Users\user\Desktop\securedoc_20241216T121346.html MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7072 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 --field-trial-handle=1768,i,13132331378037480680,11710520669971933826,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

rundll32.exe (PID: 780 cmdline: C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding MD5: EF3179D498793BF4234F708D3BE28633)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Phishing

AI detected phishing page

Source: file:///C:/Users/user/Desktop/securedoc_20241216T121346.html

Joe Sandbox AI: Score: 10 Reasons: HTML file with login form DOM: 1.0.pages.csv

AI detected suspicious Javascript

Source: 0.10.id.script.csv

Joe Sandbox AI: Detected suspicious JavaScript with source url: file:///C:/Users/user/Desktop/securedoc_20241216T1... This script exhibits several high-risk behaviors, including dynamic code execution, data exfiltration, and redirects to suspicious domains. The use of obfuscated code and the presence of a payload being sent to an external server are also highly concerning. Overall, this script demonstrates a clear intent to perform malicious activities and should be considered a high-risk threat.

Suspicious Javascript code found in HTML file

Source: securedoc_20241216T121346.html	HTTP Parser: document.write
Source: securedoc_20241216T121346.html	HTTP Parser: location.href
Source: securedoc_20241216T121346.html	HTTP Parser: .location
Source: securedoc_20241216T121346.html	HTTP Parser: .location

Source: securedoc_20241216T121346.html	HTTP Parser: Josh Mejia <Josh.Mejia@mitchell.com>
Source: file:///C:/Users/user/Desktop/securedoc_20241216T121346.html	HTTP Parser: {'name':null,'msgID':'\|1__bd0a17fc00000193d11afb0644e88dbdf42f43bf@esa1.mitchell.iphmx.com','keysize':24,'flags':2049,'rid':'bXlsZXMgb2xzb24gPG1vbHNvbkBmbW5lLmNvbT4=','algnames':{'encryption':{'data':'AES'}},'algparams':{'encryption':{'data':{'IV':'fIfkk05zUSO/RyO4cvoI/g=='}}},'keyserverhost':'res.cisco.com:443','securereplyhost':'res.cisco.com:443','openerhost':'res.cisco.com:443','toc':[['Body-1734380026633.txt',1,'','',13,[0,6068],'Body-1734380026633.txt','ISO-8859-1'],['image001.png',2,'','image001.png',21,[6068,5520],'image001.png','ISO-8859-1'],['MessageBar.html',4,'','',1,[11588,28407],'MessageBar.html','ISO-8859-1']],'salt':'SajcmDqehO0ww5fotwx+YKEuW8Q=','data':['','','']}
Source: file:///C:/Users/user/Desktop/securedoc_20241216T121346.html	HTTP Parser: \|1__bd0a17fc00000193d11afb0644e88dbdf42f43bf@esa1.mitchell.iphmx.com
Source: file:///C:/Users/user/Desktop/securedoc_20241216T121346.html	HTTP Parser: molson@fmne.com

Source: file:///C:/Users/user/Desktop/securedoc_20241216T121346.html

HTTP Parser: Number of links: 1

Source: securedoc_20241216T121346.html

HTTP Parser: Base64 decoded: Zeppelin rules!

Source: securedoc_20241216T121346.html	HTTP Parser: Title: Secure Registered Envelope:FN UAT Users @secure does not match URL
Source: file:///C:/Users/user/Desktop/securedoc_20241216T121346.html	HTTP Parser: Title: Authentication Frame does not match URL

Source: file:///C:/Users/user/Desktop/securedoc_20241216T121346.html

HTTP Parser: Has password / email / username input fields

Source: securedoc_20241216T121346.html	HTTP Parser: <input type="password" .../> found
Source: file:///C:/Users/user/Desktop/securedoc_20241216T121346.html	HTTP Parser: <input type="password" .../> found

Source: securedoc_20241216T121346.html	HTTP Parser: No favicon
Source: file:///C:/Users/user/Desktop/securedoc_20241216T121346.html	HTTP Parser: No favicon
Source: file:///C:/Users/user/Desktop/securedoc_20241216T121346.html	HTTP Parser: No favicon
Source: file:///C:/Users/user/Desktop/securedoc_20241216T121346.html	HTTP Parser: No favicon

Source: securedoc_20241216T121346.html	HTTP Parser: No <meta name="author".. found
Source: file:///C:/Users/user/Desktop/securedoc_20241216T121346.html	HTTP Parser: No <meta name="author".. found

Source: file:///C:/Users/user/Desktop/securedoc_20241216T121346.html

HTTP Parser: No <meta name="copyright".. found

Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.16:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.16:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.16:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.16:49759 version: TLS 1.2

Source: chrome.exe

Memory has grown: Private usage: 1MB later: 27MB

Source: global traffic	HTTP traffic detected: GET /envelopeopener/pf/ZGJAVG9rZW43ODc2OjIxNTQ5/kq2iUBINAy0.LOAHqcY9wMJ551awcCpdSHTCEfGwg4xsepncLRtPZWbVczvVBhFXPfzTCF.4Z9-fAN20QdqA7uIUBKS0bBzrXQ!!/?p=0&d=%7B%27name%27%3Anull,%0D%0A%27msgID%27%3A%27%7C1__bd0a17fc00000193d11afb0644e88dbdf42f43bf%40esa1%2Emitchell%2Eiphmx%2Ecom%27,%0D%0A%27keysize%27%3A24,%0D%0A%27flags%27%3A2049,%0D%0A%27rid%27%3A%27bXlsZXMgb2xzb24gPG1vbHNvbkBmbW5lLmNvbT4%3D%27,%0D%0A%27algnames%27%3A%7B%27encryption%27%3A%7B%27data%27%3A%27AES%27%7D%7D,%0D%0A%27algparams%27%3A%7B%27encryption%27%3A%7B%27data%27%3A%7B%27IV%27%3A%27fIfkk05zUSO%2FRyO4cvoI%2Fg%3D%3D%27%7D%7D%7D,%0D%0A%27keyserverhost%27%3A%27res%2Ecisco%2Ecom%3A443%27,%0D%0A%27securereplyhost%27%3A%27res%2Ecisco%2Ecom%3A443%27,%0D%0A%27openerhost%27%3A%27res%2Ecisco%2Ecom%3A443%27,%0D%0A%27toc%27%3A%5B%0D%0A%5B%27Body-1734380026633%2Etxt%27,1,%0D%0A%27%27,%0D%0A%27%27,%0D%0A13,%5B0,6068%5D,%27Body-1734380026633%2Etxt%27,%0D%0A%27ISO-8859-1%27%5D,%0D%0A%5B%27image001%2Epng%27,2,%0D%0A%27%27,%0D%0A%27image001%2Epng%27,%0D%0A21,%5B6068,5520%5D,%27image001%2Epng%27,%0D%0A%27ISO-8859-1%27%5D,%0D%0A%5B%27MessageBar%2Ehtml%27,4,%0D%0A%27%27,%0D%0A%27%27,%0D%0A1,%5B11588,28407%5D,%27MessageBar%2Ehtml%27,%0D%0A%27ISO-8859-1%27%5D%0D%0A%5D,%0D%0A%27salt%27%3A%27SajcmDqehO0ww5fotwx%2BYKEuW8Q%3D%27,%0D%0A%27data%27%3A%5B%0D%0A%27%27,%27End6kG1Xup0qFCNKcCBJtK8AsyTDq9KNGkXBDtT8s%2FDCtoAz0jZKvni7SQAQLIsP5uEoMoOdwpaR%2Fzxd4k6iK9%2BKX2jwhtpxe5MULXIvVN7gN0i5EPlRtpz4poQ2NsYHjL1padlY8KX7fKJDbhj%2FC%2FB33RqS%2FFfEltRTJfjDcDbfKnCux0uBsZx%2Bn13mp9Hsb%2FVGJlato56ZrU%2FlaB2pur%2B0zsI3QzxWNHY330TnZriKCmhfEGqndLmUvj4FrrkVgfPqeLWewwqzjhs6kDtOX9pIZh%2B4QR4INVISkb%2FBhQcs7uzXpZGWOU4FQGElzBxxa3OvueTqqyrUwC1fUmn9KR2hOheIqVIWvO3Aezr84islcX%2FvdLIhc%2FOI7HWw8KIoLsqui8Ye0U%2BUcZuD5ZdnjrQ4dIQiQ%2F2WJIUNU1yRwaxK%2B9iIQfLDTpgjo9bWNow6XQ2mPZJpscAU5lAOPrKAp%2B%2FrfFZmPUOP%2B3RpIiUBBffDrCZnYjMny8maut9wic5YNmvKVioOeqTrV%2B6ht0tZnEfNSuA37dZr5B8jvahOG4X12s0NAbr3mF1TMOnES92y5Y9zLOAG3GFF0VjyyiWh5UlYiw7gYPmIgT%2BYJlkdeQ5JNeP5hkbWbjbU0T2zlosdhOXsxRj%2FcaLdMvNH2UjGE7YJOh%2Fdb%2FrU75PaImVog04wxbynHuFVN7q48jHrMgF%2BwZOJWq%2Fqlv6OMtOsTHlxADGl70YHcjLHM2X34aS60FiSO1%2FdBnd%2Bo6CtTh3wrH0eGemk%2FF%2FXuqBFnUfkn8c0nEXZey8P%2BeHPVdHrkWwYUpXPKJz7TzD%2FbgohlB1ZGds3vXUgMHUhXAvnt2YCb9v%2BgDZDmVJFdWyDCvPhhj16bGTcDolrfBPa3cO2bxTcxgAf%2FXL3sPpKgdOUwGqC0UbJgMUViXuvoVkqvHl5Eh4t6gGjafiB%2FzLyuft2z6PqsaX5OVA5ww5f9%2BRv86yuldx4URyQ%2Bev%2BwwX03OdRfB3AuOIFug%2FEicBhBnylABDAt%2BVm3aUXzeoWPcCniJVjmCqqRggF9MGVzKBKFRPRF7wqX7SVKNjkL60PVfsmy%2B8GOwCdKXdfsTJbmXMKxBF5ZeZHcOtnHIMimSmg092I2H%2FjRiMMrQoZvP2%2FzFog2Ye6yGmzDuTtX0EH9M7ygVAgpDnzPTKAtsdRG0rSpAw%2BgQZ1jHZKYFtBcjjyZpGJOXDrMJ51odoBQtypcqjSJ5mFobGfhRrlFdR0La2jX6BT%2BL4N9%2FzU54s8D8OCCiQb4mzjvto2fmVzwwezATmN1mE%2BrtuyRheOtQzAAiafms0JaEarN2Pai8uRILcUQAEA5S7rVy8mn8pBo4yLM%2F2G0Q8hoYR9B4WAattO%2BycCimm4AcDo%2FniNLO%2BuLFiGN0LznhoxgvWIgy%2BwICgZr%2BM7MaPSvMr9wQCBJ%2Fx6Z9m%2FrXvVAqhkkWiuHtbD%2BHaWL52CFZ306m6cvZxHGRzdqiU%2BVHXOKYnP%2Fyx2KysG3%2Fnyok89x0NM8B3i1u49h9Tq3GKOf9DFMnHrj4CQ%2FZ0VTiJ4bc%
Source: global traffic	HTTP traffic detected: GET /envelopeopener/pf/ZGJAVG9rZW43ODc2OjIxNTQ5/kq2iUBINAy0.LOAHqcY9wMJ551awcCpdSHTCEfGwg4xsepncLRtPZWbVczvVBhFXPfzTCF.4Z9-fAN20QdqA7uIUBKS0bBzrXQ!!/?p=0&d=%7B%27name%27%3Anull,%0D%0A%27msgID%27%3A%27%7C1__bd0a17fc00000193d11afb0644e88dbdf42f43bf%40esa1%2Emitchell%2Eiphmx%2Ecom%27,%0D%0A%27keysize%27%3A24,%0D%0A%27flags%27%3A2049,%0D%0A%27rid%27%3A%27bXlsZXMgb2xzb24gPG1vbHNvbkBmbW5lLmNvbT4%3D%27,%0D%0A%27algnames%27%3A%7B%27encryption%27%3A%7B%27data%27%3A%27AES%27%7D%7D,%0D%0A%27algparams%27%3A%7B%27encryption%27%3A%7B%27data%27%3A%7B%27IV%27%3A%27fIfkk05zUSO%2FRyO4cvoI%2Fg%3D%3D%27%7D%7D%7D,%0D%0A%27keyserverhost%27%3A%27res%2Ecisco%2Ecom%3A443%27,%0D%0A%27securereplyhost%27%3A%27res%2Ecisco%2Ecom%3A443%27,%0D%0A%27openerhost%27%3A%27res%2Ecisco%2Ecom%3A443%27,%0D%0A%27toc%27%3A%5B%0D%0A%5B%27Body-1734380026633%2Etxt%27,1,%0D%0A%27%27,%0D%0A%27%27,%0D%0A13,%5B0,6068%5D,%27Body-1734380026633%2Etxt%27,%0D%0A%27ISO-8859-1%27%5D,%0D%0A%5B%27image001%2Epng%27,2,%0D%0A%27%27,%0D%0A%27image001%2Epng%27,%0D%0A21,%5B6068,5520%5D,%27image001%2Epng%27,%0D%0A%27ISO-8859-1%27%5D,%0D%0A%5B%27MessageBar%2Ehtml%27,4,%0D%0A%27%27,%0D%0A%27%27,%0D%0A1,%5B11588,28407%5D,%27MessageBar%2Ehtml%27,%0D%0A%27ISO-8859-1%27%5D%0D%0A%5D,%0D%0A%27salt%27%3A%27SajcmDqehO0ww5fotwx%2BYKEuW8Q%3D%27,%0D%0A%27data%27%3A%5B%0D%0A%27%27,%27End6kG1Xup0qFCNKcCBJtK8AsyTDq9KNGkXBDtT8s%2FDCtoAz0jZKvni7SQAQLIsP5uEoMoOdwpaR%2Fzxd4k6iK9%2BKX2jwhtpxe5MULXIvVN7gN0i5EPlRtpz4poQ2NsYHjL1padlY8KX7fKJDbhj%2FC%2FB33RqS%2FFfEltRTJfjDcDbfKnCux0uBsZx%2Bn13mp9Hsb%2FVGJlato56ZrU%2FlaB2pur%2B0zsI3QzxWNHY330TnZriKCmhfEGqndLmUvj4FrrkVgfPqeLWewwqzjhs6kDtOX9pIZh%2B4QR4INVISkb%2FBhQcs7uzXpZGWOU4FQGElzBxxa3OvueTqqyrUwC1fUmn9KR2hOheIqVIWvO3Aezr84islcX%2FvdLIhc%2FOI7HWw8KIoLsqui8Ye0U%2BUcZuD5ZdnjrQ4dIQiQ%2F2WJIUNU1yRwaxK%2B9iIQfLDTpgjo9bWNow6XQ2mPZJpscAU5lAOPrKAp%2B%2FrfFZmPUOP%2B3RpIiUBBffDrCZnYjMny8maut9wic5YNmvKVioOeqTrV%2B6ht0tZnEfNSuA37dZr5B8jvahOG4X12s0NAbr3mF1TMOnES92y5Y9zLOAG3GFF0VjyyiWh5UlYiw7gYPmIgT%2BYJlkdeQ5JNeP5hkbWbjbU0T2zlosdhOXsxRj%2FcaLdMvNH2UjGE7YJOh%2Fdb%2FrU75PaImVog04wxbynHuFVN7q48jHrMgF%2BwZOJWq%2Fqlv6OMtOsTHlxADGl70YHcjLHM2X34aS60FiSO1%2FdBnd%2Bo6CtTh3wrH0eGemk%2FF%2FXuqBFnUfkn8c0nEXZey8P%2BeHPVdHrkWwYUpXPKJz7TzD%2FbgohlB1ZGds3vXUgMHUhXAvnt2YCb9v%2BgDZDmVJFdWyDCvPhhj16bGTcDolrfBPa3cO2bxTcxgAf%2FXL3sPpKgdOUwGqC0UbJgMUViXuvoVkqvHl5Eh4t6gGjafiB%2FzLyuft2z6PqsaX5OVA5ww5f9%2BRv86yuldx4URyQ%2Bev%2BwwX03OdRfB3AuOIFug%2FEicBhBnylABDAt%2BVm3aUXzeoWPcCniJVjmCqqRggF9MGVzKBKFRPRF7wqX7SVKNjkL60PVfsmy%2B8GOwCdKXdfsTJbmXMKxBF5ZeZHcOtnHIMimSmg092I2H%2FjRiMMrQoZvP2%2FzFog2Ye6yGmzDuTtX0EH9M7ygVAgpDnzPTKAtsdRG0rSpAw%2BgQZ1jHZKYFtBcjjyZpGJOXDrMJ51odoBQtypcqjSJ5mFobGfhRrlFdR0La2jX6BT%2BL4N9%2FzU54s8D8OCCiQb4mzjvto2fmVzwwezATmN1mE%2BrtuyRheOtQzAAiafms0JaEarN2Pai8uRILcUQAEA5S7rVy8mn8pBo4yLM%2F2G0Q8hoYR9B4WAattO%2BycCimm4AcDo%2FniNLO%2BuLFiGN0LznhoxgvWIgy%2BwICgZr%2BM7MaPSvMr9wQCBJ%2Fx6Z9m%2FrXvVAqhkkWiuHtbD%2BHaWL52CFZ306m6cvZxHGRzdqiU%2BVHXOKYnP%2Fyx2KysG3%2Fnyok89x0NM8B3i1u49h9Tq3GKOf9DFMnHrj4CQ%2FZ0VTiJ4bc%

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /envelopeopener/pf/ZGJAVG9rZW43ODc2OjIxNTQ5/kq2iUBINAy0.LOAHqcY9wMJ551awcCpdSHTCEfGwg4xsepncLRtPZWbVczvVBhFXPfzTCF.4Z9-fAN20QdqA7uIUBKS0bBzrXQ!!/?lp=en HTTP/1.1Host: res.cisco.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /envelopeopener/pf/ZGJAVG9rZW43ODc2OjIxNTQ5/kq2iUBINAy0.LOAHqcY9wMJ551awcCpdSHTCEfGwg4xsepncLRtPZWbVczvVBhFXPfzTCF.4Z9-fAN20QdqA7uIUBKS0bBzrXQ!!/?p=0&d=%7B%27name%27%3Anull,%0D%0A%27msgID%27%3A%27%7C1__bd0a17fc00000193d11afb0644e88dbdf42f43bf%40esa1%2Emitchell%2Eiphmx%2Ecom%27,%0D%0A%27keysize%27%3A24,%0D%0A%27flags%27%3A2049,%0D%0A%27rid%27%3A%27bXlsZXMgb2xzb24gPG1vbHNvbkBmbW5lLmNvbT4%3D%27,%0D%0A%27algnames%27%3A%7B%27encryption%27%3A%7B%27data%27%3A%27AES%27%7D%7D,%0D%0A%27algparams%27%3A%7B%27encryption%27%3A%7B%27data%27%3A%7B%27IV%27%3A%27fIfkk05zUSO%2FRyO4cvoI%2Fg%3D%3D%27%7D%7D%7D,%0D%0A%27keyserverhost%27%3A%27res%2Ecisco%2Ecom%3A443%27,%0D%0A%27securereplyhost%27%3A%27res%2Ecisco%2Ecom%3A443%27,%0D%0A%27openerhost%27%3A%27res%2Ecisco%2Ecom%3A443%27,%0D%0A%27toc%27%3A%5B%0D%0A%5B%27Body-1734380026633%2Etxt%27,1,%0D%0A%27%27,%0D%0A%27%27,%0D%0A13,%5B0,6068%5D,%27Body-1734380026633%2Etxt%27,%0D%0A%27ISO-8859-1%27%5D,%0D%0A%5B%27image001%2Epng%27,2,%0D%0A%27%27,%0D%0A%27image001%2Epng%27,%0D%0A21,%5B6068,5520%5D,%27image001%2Epng%27,%0D%0A%27ISO-8859-1%27%5D,%0D%0A%5B%27MessageBar%2Ehtml%27,4,%0D%0A%27%27,%0D%0A%27%27,%0D%0A1,%5B11588,28407%5D,%27MessageBar%2Ehtml%27,%0D%0A%27ISO-8859-1%27%5D%0D%0A%5D,%0D%0A%27salt%27%3A%27SajcmDqehO0ww5fotwx%2BYKEuW8Q%3D%27,%0D%0A%27data%27%3A%5B%0D%0A%27%27,%27End6kG1Xup0qFCNKcCBJtK8AsyTDq9KNGkXBDtT8s%2FDCtoAz0jZKvni7SQAQLIsP5uEoMoOdwpaR%2Fzxd4k6iK9%2BKX2jwhtpxe5MULXIvVN7gN0i5EPlRtpz4poQ2NsYHjL1padlY8KX7fKJDbhj%2FC%2FB33RqS%2FFfEltRTJfjDcDbfKnCux0uBsZx%2Bn13mp9Hsb%2FVGJlato56ZrU%2FlaB2pur%2B0zsI3QzxWNHY330TnZriKCmhfEGqndLmUvj4FrrkVgfPqeLWewwqzjhs6kDtOX9pIZh%2B4QR4INVISkb%2FBhQcs7uzXpZGWOU4FQGElzBxxa3OvueTqqyrUwC1fUmn9KR2hOheIqVIWvO3Aezr84islcX%2FvdLIhc%2FOI7HWw8KIoLsqui8Ye0U%2BUcZuD5ZdnjrQ4dIQiQ%2F2WJIUNU1yRwaxK%2B9iIQfLDTpgjo9bWNow6XQ2mPZJpscAU5lAOPrKAp%2B%2FrfFZmPUOP%2B3RpIiUBBffDrCZnYjMny8maut9wic5YNmvKVioOeqTrV%2B6ht0tZnEfNSuA37dZr5B8jvahOG4X12s0NAbr3mF1TMOnES92y5Y9zLOAG3GFF0VjyyiWh5UlYiw7gYPmIgT%2BYJlkdeQ5JNeP5hkbWbjbU0T2zlosdhOXsxRj%2FcaLdMvNH2UjGE7YJOh%2Fdb%2FrU75PaImVog04wxbynHuFVN7q48jHrMgF%2BwZOJWq%2Fqlv6OMtOsTHlxADGl70YHcjLHM2X34aS60FiSO1%2FdBnd%2Bo6CtTh3wrH0eGemk%2FF%2FXuqBFnUfkn8c0nEXZey8P%2BeHPVdHrkWwYUpXPKJz7TzD%2FbgohlB1ZGds3vXUgMHUhXAvnt2YCb9v%2BgDZDmVJFdWyDCvPhhj16bGTcDolrfBPa3cO2bxTcxgAf%2FXL3sPpKgdOUwGqC0UbJgMUViXuvoVkqvHl5Eh4t6gGjafiB%2FzLyuft2z6PqsaX5OVA5ww5f9%2BRv86yuldx4URyQ%2Bev%2BwwX03OdRfB3AuOIFug%2FEicBhBnylABDAt%2BVm3aUXzeoWPcCniJVjmCqqRggF9MGVzKBKFRPRF7wqX7SVKNjkL60PVfsmy%2B8GOwCdKXdfsTJbmXMKxBF5ZeZHcOtnHIMimSmg092I2H%2FjRiMMrQoZvP2%2FzFog2Ye6yGmzDuTtX0EH9M7ygVAgpDnzPTKAtsdRG0rSpAw%2BgQZ1jHZKYFtBcjjyZpGJOXDrMJ51odoBQtypcqjSJ5mFobGfhRrlFdR0La2jX6BT%2BL4N9%2FzU54s8D8OCCiQb4mzjvto2fmVzwwezATmN1mE%2BrtuyRheOtQzAAiafms0JaEarN2Pai8uRILcUQAEA5S7rVy8mn8pBo4yLM%2F2G0Q8hoYR9B4WAattO%2BycCimm4AcDo%2FniNLO%2BuLFiGN0LznhoxgvWIgy%2BwICgZr%2BM7MaPSvMr9wQCBJ%2Fx6Z9m%2FrXvVAqhkkWiuHtbD%2BHaWL52CFZ306m6cvZxHGRzdqiU%2BVHXOKYnP%2Fyx2KysG3%2Fnyok89x0NM8B3i1u49h9Tq3GKOf9DFMnHrj4CQ%2FZ0VTiJ4bc%
Source: global traffic	HTTP traffic detected: GET /envelopeopener/pf/ZGJAVG9rZW43ODc2OjIxNTQ5/kq2iUBINAy0.LOAHqcY9wMJ551awcCpdSHTCEfGwg4xsepncLRtPZWbVczvVBhFXPfzTCF.4Z9-fAN20QdqA7uIUBKS0bBzrXQ!!/?button=google&lp=en HTTP/1.1Host: res.cisco.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /envelopeopener/pf/ZGJAVG9rZW43ODc2OjIxNTQ5/kq2iUBINAy0.LOAHqcY9wMJ551awcCpdSHTCEfGwg4xsepncLRtPZWbVczvVBhFXPfzTCF.4Z9-fAN20QdqA7uIUBKS0bBzrXQ!!/?button=ok&lp=en HTTP/1.1Host: res.cisco.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /envelopeopener/pf/ZGJAVG9rZW43ODc2OjIxNTQ5/kq2iUBINAy0.LOAHqcY9wMJ551awcCpdSHTCEfGwg4xsepncLRtPZWbVczvVBhFXPfzTCF.4Z9-fAN20QdqA7uIUBKS0bBzrXQ!!/?p=0&d=%7B%27name%27%3Anull,%0D%0A%27msgID%27%3A%27%7C1__bd0a17fc00000193d11afb0644e88dbdf42f43bf%40esa1%2Emitchell%2Eiphmx%2Ecom%27,%0D%0A%27keysize%27%3A24,%0D%0A%27flags%27%3A2049,%0D%0A%27rid%27%3A%27bXlsZXMgb2xzb24gPG1vbHNvbkBmbW5lLmNvbT4%3D%27,%0D%0A%27algnames%27%3A%7B%27encryption%27%3A%7B%27data%27%3A%27AES%27%7D%7D,%0D%0A%27algparams%27%3A%7B%27encryption%27%3A%7B%27data%27%3A%7B%27IV%27%3A%27fIfkk05zUSO%2FRyO4cvoI%2Fg%3D%3D%27%7D%7D%7D,%0D%0A%27keyserverhost%27%3A%27res%2Ecisco%2Ecom%3A443%27,%0D%0A%27securereplyhost%27%3A%27res%2Ecisco%2Ecom%3A443%27,%0D%0A%27openerhost%27%3A%27res%2Ecisco%2Ecom%3A443%27,%0D%0A%27toc%27%3A%5B%0D%0A%5B%27Body-1734380026633%2Etxt%27,1,%0D%0A%27%27,%0D%0A%27%27,%0D%0A13,%5B0,6068%5D,%27Body-1734380026633%2Etxt%27,%0D%0A%27ISO-8859-1%27%5D,%0D%0A%5B%27image001%2Epng%27,2,%0D%0A%27%27,%0D%0A%27image001%2Epng%27,%0D%0A21,%5B6068,5520%5D,%27image001%2Epng%27,%0D%0A%27ISO-8859-1%27%5D,%0D%0A%5B%27MessageBar%2Ehtml%27,4,%0D%0A%27%27,%0D%0A%27%27,%0D%0A1,%5B11588,28407%5D,%27MessageBar%2Ehtml%27,%0D%0A%27ISO-8859-1%27%5D%0D%0A%5D,%0D%0A%27salt%27%3A%27SajcmDqehO0ww5fotwx%2BYKEuW8Q%3D%27,%0D%0A%27data%27%3A%5B%0D%0A%27%27,%27End6kG1Xup0qFCNKcCBJtK8AsyTDq9KNGkXBDtT8s%2FDCtoAz0jZKvni7SQAQLIsP5uEoMoOdwpaR%2Fzxd4k6iK9%2BKX2jwhtpxe5MULXIvVN7gN0i5EPlRtpz4poQ2NsYHjL1padlY8KX7fKJDbhj%2FC%2FB33RqS%2FFfEltRTJfjDcDbfKnCux0uBsZx%2Bn13mp9Hsb%2FVGJlato56ZrU%2FlaB2pur%2B0zsI3QzxWNHY330TnZriKCmhfEGqndLmUvj4FrrkVgfPqeLWewwqzjhs6kDtOX9pIZh%2B4QR4INVISkb%2FBhQcs7uzXpZGWOU4FQGElzBxxa3OvueTqqyrUwC1fUmn9KR2hOheIqVIWvO3Aezr84islcX%2FvdLIhc%2FOI7HWw8KIoLsqui8Ye0U%2BUcZuD5ZdnjrQ4dIQiQ%2F2WJIUNU1yRwaxK%2B9iIQfLDTpgjo9bWNow6XQ2mPZJpscAU5lAOPrKAp%2B%2FrfFZmPUOP%2B3RpIiUBBffDrCZnYjMny8maut9wic5YNmvKVioOeqTrV%2B6ht0tZnEfNSuA37dZr5B8jvahOG4X12s0NAbr3mF1TMOnES92y5Y9zLOAG3GFF0VjyyiWh5UlYiw7gYPmIgT%2BYJlkdeQ5JNeP5hkbWbjbU0T2zlosdhOXsxRj%2FcaLdMvNH2UjGE7YJOh%2Fdb%2FrU75PaImVog04wxbynHuFVN7q48jHrMgF%2BwZOJWq%2Fqlv6OMtOsTHlxADGl70YHcjLHM2X34aS60FiSO1%2FdBnd%2Bo6CtTh3wrH0eGemk%2FF%2FXuqBFnUfkn8c0nEXZey8P%2BeHPVdHrkWwYUpXPKJz7TzD%2FbgohlB1ZGds3vXUgMHUhXAvnt2YCb9v%2BgDZDmVJFdWyDCvPhhj16bGTcDolrfBPa3cO2bxTcxgAf%2FXL3sPpKgdOUwGqC0UbJgMUViXuvoVkqvHl5Eh4t6gGjafiB%2FzLyuft2z6PqsaX5OVA5ww5f9%2BRv86yuldx4URyQ%2Bev%2BwwX03OdRfB3AuOIFug%2FEicBhBnylABDAt%2BVm3aUXzeoWPcCniJVjmCqqRggF9MGVzKBKFRPRF7wqX7SVKNjkL60PVfsmy%2B8GOwCdKXdfsTJbmXMKxBF5ZeZHcOtnHIMimSmg092I2H%2FjRiMMrQoZvP2%2FzFog2Ye6yGmzDuTtX0EH9M7ygVAgpDnzPTKAtsdRG0rSpAw%2BgQZ1jHZKYFtBcjjyZpGJOXDrMJ51odoBQtypcqjSJ5mFobGfhRrlFdR0La2jX6BT%2BL4N9%2FzU54s8D8OCCiQb4mzjvto2fmVzwwezATmN1mE%2BrtuyRheOtQzAAiafms0JaEarN2Pai8uRILcUQAEA5S7rVy8mn8pBo4yLM%2F2G0Q8hoYR9B4WAattO%2BycCimm4AcDo%2FniNLO%2BuLFiGN0LznhoxgvWIgy%2BwICgZr%2BM7MaPSvMr9wQCBJ%2Fx6Z9m%2FrXvVAqhkkWiuHtbD%2BHaWL52CFZ306m6cvZxHGRzdqiU%2BVHXOKYnP%2Fyx2KysG3%2Fnyok89x0NM8B3i1u49h9Tq3GKOf9DFMnHrj4CQ%2FZ0VTiJ4bc%

Source: global traffic	DNS traffic detected: DNS query: static.cres-aws.com
Source: global traffic	DNS traffic detected: DNS query: cdnjs.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: res.cisco.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49694
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49694 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.16:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.16:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.16:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.16:49759 version: TLS 1.2

Source: classification engine

Classification label: mal60.phis.winHTML@17/27@28/190

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Source: C:\Windows\System32\rundll32.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: unknown

Process created: C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument C:\Users\user\Desktop\securedoc_20241216T121346.html
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 --field-trial-handle=1768,i,13132331378037480680,11710520669971933826,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 --field-trial-handle=1768,i,13132331378037480680,11710520669971933826,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: unknown	Process created: C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Source: C:\Windows\System32\rundll32.exe

Process information set: NOOPENFILEERRORBOX

Stealing of Sensitive Information

HTML file submission containing password form

Source: file:///C:/Users/user/Desktop/securedoc_20241216T121346.html

HTTP Parser: file:///C:/Users/user/Desktop/securedoc_20241216T121346.html

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Browser Extensions	1 Process Injection	1 Masquerading	OS Credential Dumping	1 System Information Discovery	Remote Services	Data from Local System	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Registry Run Keys / Startup Folder	1 Registry Run Keys / Startup Folder	1 Rundll32	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Extra Window Memory Injection	1 Process Injection	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Extra Window Memory Injection	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Source	Detection	Scanner	Label	Link
file:///C:/Users/user/Desktop/securedoc_20241216T121346.html	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
res.cisco.com	184.73.13.143	true	false	high
cdnjs.cloudflare.com	104.17.24.14	true	false	high
www.google.com	142.250.181.68	true	false	high
d2qj7djftjbj85.cloudfront.net	18.66.161.34	true	false	unknown
static.cres-aws.com	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
file:///C:/Users/user/Desktop/securedoc_20241216T121346.html	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
104.17.24.14	cdnjs.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
172.217.19.206	unknown	United States	15169	GOOGLEUS	false
172.217.19.238	unknown	United States	15169	GOOGLEUS	false
1.1.1.1	unknown	Australia	13335	CLOUDFLARENETUS	false
172.217.17.35	unknown	United States	15169	GOOGLEUS	false
18.235.210.193	unknown	United States	14618	AMAZON-AESUS	false
142.250.181.138	unknown	United States	15169	GOOGLEUS	false
184.73.13.143	res.cisco.com	United States	14618	AMAZON-AESUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
172.217.21.42	unknown	United States	15169	GOOGLEUS	false
142.250.181.68	www.google.com	United States	15169	GOOGLEUS	false
172.217.21.35	unknown	United States	15169	GOOGLEUS	false
64.233.162.84	unknown	United States	15169	GOOGLEUS	false
172.217.17.42	unknown	United States	15169	GOOGLEUS	false
44.199.0.156	unknown	United States	14618	AMAZON-AESUS	false
104.17.25.14	unknown	United States	13335	CLOUDFLARENETUS	false
18.66.161.34	d2qj7djftjbj85.cloudfront.net	United States	3	MIT-GATEWAYSUS	false

Private

IP
192.168.2.16

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1576362
Start date and time:	2024-12-16 22:02:47 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled
Analysis Mode:	stream
Analysis stop reason:	Timeout
Sample name:	securedoc_20241216T121346.html
Detection:	MAL
Classification:	mal60.phis.winHTML@17/27@28/190
Cookbook Comments:	Found application associated with file extension: .html

Warnings

Exclude process from analysis (whitelisted): dllhost.exe
Excluded IPs from analysis (whitelisted): 172.217.21.35, 172.217.19.238, 64.233.162.84, 142.250.181.138, 172.217.17.46, 172.217.21.42
Excluded domains from analysis (whitelisted): fs.microsoft.com, clients2.google.com, accounts.google.com, redirector.gvt1.com, slscr.update.microsoft.com, ajax.googleapis.com, clientservices.googleapis.com, clients.l.google.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
VT rate limit hit for: securedoc_20241216T121346.html

LLM Input / Output

Input	Output
URL: :// Model: Joe Sandbox AI	{ "typosquatting": false, "unusual_query_string": false, "suspicious_tld": false, "ip_in_url": false, "long_subdomain": false, "malicious_keywords": false, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": false, "brand_spoofing_attempt": false, "third_party_hosting": false }
URL: ://
URL: file:///C:/Users/user/Desktop/securedoc_20241216T1... Model: Joe Sandbox AI	{ "risk_score": 9, "reasoning": "This script exhibits several high-risk behaviors, including dynamic code execution, data exfiltration, and redirects to suspicious domains. The use of obfuscated code and the presence of a payload being sent to an external server are also highly concerning. Overall, this script demonstrates a clear intent to perform malicious activities and should be considered a high-risk threat." }
ew('browserLoading','');if(typeof ag=='function')ag();window.onload=pv; window.onkeydown=pv;var ey=document.forms[0];ey.method='POST'; ey.onsubmit=function(){return qg(ey,payload)};ey.onkeyup= function(oj){ql(ey,oj)};p5();if(!fP){qt();setTimeout(function(){i9(0,'payloadValue','payloadImage', 'metaPayloadValue','metaPayloadImage',"qJ(0,'key1',payload,"+ '"https://res.cisco.com:443/keyserver/keyserver")' ,{'progressFn':fq,'progressArgs':{'progressBar':{'bgColor':'#808080', 'borderColor':'#000000'}}})},125)}//-->
URL: https://res.cisco.com/keyserver/keyserver?su=MOlso... Model: Joe Sandbox AI	{ "risk_score": 6, "reasoning": "The provided JavaScript snippet appears to be a part of a larger application or system, and it contains a mix of behaviors that require further review. While some aspects, such as the use of an `XHR` request and the inclusion of sensitive user data, raise moderate concerns, the overall context and intent are not entirely clear. Additional investigation would be necessary to determine the full scope and potential risks associated with this script." }
if(l_) l_({ "RPCRef":payload.rpc, "callback":qr ,'action':'open' ,'status':16 ,'message':'Authentication required.' ,'state':1 ,'reqTime':1734383007929 ,'reqNumber':2 ,'recipientIdentified':false ,'success':true ,'cookiesEnabled':true ,'hadRememberMe':false ,'hadEnablePSP':false ,'openOnline':false ,'recipient':'molson@fmne.com' ,'sessionId':'FD833C7B61A155B752A377827E7DE1D8' ,'lp':'en' ,'credentialsExpiredWarning':false ,'credentialsExpiredDays':-1 ,'pswdExpLink':'https://res.cisco.com/websafe/custom.action?cmd=changeExpiredPassword&id=molson@fmne.com' ,'waitTime':50000 ,'minPoll':1000 ,'maxPoll':5000 ,'totalPoll':1200000 ,'supportedLocales':[['en','English (US)'],['nl_NL','Dutch'],['de','Deutsch'],['es','Espa\xf1ol'],['fr','Fran\xe7ais'],['it','Italiano'],['pl','Polski'],['pt','Portugu\xeas'],['ru','\u0420\u0443\u0441\u0441\u043a\u0438\u0439'],['zh_CN','\u4e2d\u6587(\u7b80\u4f53)'],['ja','\u65e5\u672c\u8a9e'],['ko','\ud55c\uad6d\uc5b4']] ,'sensitivity':'High' ,'senderAuth':false ,'trafficKey':'JM\xae(sr\xa9\xce\x8c\xfa\x90M3\x958\xcb\x02Er\xb7a\xa6\x14\xf93%\xfa\xca\x81\xd3\xec\xe4' ,'expiryDate':'' ,'createDateEpoch':1734380027000 ,'createDate':'12/16/2024 08:13:47\xa0PM\xa0GMT' });
URL: file:///C:/Users/user/Desktop/securedoc_20241216T1... Model: Joe Sandbox AI	{ "risk_score": 6, "reasoning": "The provided JavaScript snippet contains several behaviors that raise moderate security concerns. It includes external data transmission, the use of legacy APIs, and some obfuscation techniques. While there are no clear indications of malicious intent, the overall complexity and lack of transparency in the code warrant further review." }
'$Serial: 6261 $ $Revision: 1.16 $'; 'Copyright (c) 2001-2019, Cisco Systems, Inc. All rights reserved.'; 'Protected by United States patent numbers 6,014,688, 6,304,897,'; '7,533,422, 7,694,297, 7,802,096, 7,814,317, 8,005,920 and others.'; '$Serial: 3328 $ $Revision: 1.7 $';'Version: 2.3'; '$Serial: 6248 $ $Revision: 1.15 $';var ad='EnvelopeTools51',db='PostXBPC', dd='PostXPreferences',dc='PostXCookieCheck',ac='PostXCarbon.',de= 'PostXSessionKey.',df='PostXUserKey.',dk=315360000000,dg='',di= 'Tue, 19-Jan-2038 03:14:07 GMT',dh=315360000000,dj=315360000000,dl= 315360000000; '$Serial: 0478 $ $Revision: 1.9 $';var ae='appletHolder',f0='appletHolder', fE='undefined',aG='object',dv='string';try{if(typeof Array.prototype.push== fE)Array.prototype.push=function(){for(var _=0;_<arguments.length;_++)this[ this.length]=arguments[_];return this.length}}catch(fx){}try{if(typeof String.prototype.trim==fE)String.prototype.trim=function(){return this. replace(/^\s+\|\s+$/g,'')}}catch(fx){} '$Serial: 3888 $ $Revision: 1.23 $';function _w(a8){var gS= /^\sfunction\s+([^(]+)/,cS;if((cS=gS.exec(a8)))return cS[1];return''} function mp(i){i=i.toString(16);if(i.length&1)i='0'+i;return'%'+i}function _N(c,mr){c+='';var au,_,d=c.length,aw='';for(_=0;_<d;_++){au=c.charAt(_);if( au>='A'&&au<='Z'\|\|au>='a'&&au<='z'\|\|au>='0'&&au<='9'\|\|au=='.'\|\|au=='-'\|\|au== ''\|\|au=='_')aw+=au;else{au=au.charCodeAt(0);if(mr\|\|au<128){aw+=mp(au&255)} else if(au<2048){aw+=mp(192\|au>>>6);aw+=mp(128\|au&63)}else{aw+=mp(224\|au>>> 12);aw+=mp(128\|(au>>>6)&63);aw+=mp(128\|au&63)}}}return aw}function a_(c,mr){ c+='';var au,dE,_,d=c.length,aw='';for(_=0;_<d;_++){au=c.charAt(_);switch(au ){default:aw+=au;break;case'+':aw+=' ';break;case'%':if(c.charAt(_+1)=='u'){ au=c.substr(_+2,4);_+=5;dE=parseInt(au,16)}else{au=c.substr(_+1,2);_+=2;dE= parseInt(au,16);if(mr\|\|dE<128){}else if(dE<224){if(d-_<4\|\|c.charAt(_+1)!='%' ){}else{au=c.substr(_+2,2);_+=3;dE=((dE&31)<<6)\|(parseInt(au,16)&63)}}else{ if(d-_<7\|\|c.charAt(_+1)!='%'\|\|c.charAt(_+4)!='%'){}else{au=c.substr(_+2,2);_ +=3;dE=((dE&15)<<6)\|(parseInt(au,16)&63);au=c.substr(_+2,2);_+=3;dE=(dE<<6)\| (parseInt(au,16)&63)}}}aw+=String.fromCharCode(dE);break}}return aw}function _Y(c){c+='';var au,_,d=c.length,aw='';for(_=0;_<d;_++){au=c.charAt(_);if(au< ' '\|\|au>'~'\|\|au=='\''\|\|au=='"')aw+='&#'+c.charCodeAt(_)+';';else aw+=au} return aw}function mv(my,mu){var k0=arguments.length,j=[],_;if(k0==3&& arguments[2].elements){var ey=arguments[2],eq;for(_=1;eq=ey['key'+_];_++)if( eq.value!='')j[j.length]=eq.value}else{for(_=2;_<k0;_++)if(arguments[_]!='') j[j.length]=arguments[_]}j=j.join(my);if(mu)j=j.toLowerCase();return j} function go(cN,mq){if(!mq)mq=72;var _,b,d=cN.length;if('\ '=='')return cN;var cS=new Array(Math.floor((d+mq-1)/mq));for(_=b=0;_<d;_+= mq+1,b++)cS[b]=cN.substr(_,mq);cS.length=b;return cS.join('')}var mt=0; function mw(ir){var c;if(fM)c=ir+new Date().getTime()+mt++;else do{c=ir+mt++ }while(document.getElementById(c));return c}function jy(hq){var mo='',_,d=hq .length;for(_=0;_<d;_++){var au=hq.charCodeAt(_);if(au<128)mo+=String. fromCharCode(au);else if(au<2048){mo+=String.fromCharCode(192\|(au>>>6));mo+= String.fromCharCode(128\|(au&63))}else{mo+=String.fromCharCode(224\|(au>>>12)) ;mo+=String.fromCharCode(128\|((au>>>6)&63));mo+=String.fromCharCode(128\|(au& 63))}}return mo}function mz(ge,gM){var iS=ge.indexOf('#');if(iS<0)iS=ge. length;var mn=ge.substring(0,iS),ms='&',mx=mn.indexOf('?');if(mx<0)ms='?'; for(var j in gM){mn+=ms;ms='&';mn+=_N(j);mn+='=';mn+=_N(gM[j])}mn+=ge. substring(iS);return mn}zw=formKey=mv;zj=fixMultilineString=go;zi=genId=mw; attrEsc=_Y; '$Serial: 0611 $ $Revision: 1.6 $';function du(_8){var e=new Date().getTime( );if(!_8)_8=dc;_9(_8,e,'','/');if((e=(al(_8)==e)))aj(_8,'/');return e} function al(_8){_8=_N(_8);var c=document.cookie,dr=c.indexOf(_8+'=');if(dr== -1)return null;var ds=dr+_8.length+1,dp=c.indexOf(';',ds);if(dp==-1)dp=c. length;return a_(c.substring(ds,dp))}function _9(_8,_H,dm,_S,dn,dt){var c=_N (_8)+'='+_N(_
URL: https://cdnjs.cloudflare.com/ajax/libs/select2/4.0... Model: Joe Sandbox AI	{ "risk_score": 1, "reasoning": "The provided JavaScript snippet appears to be the Select2 library, which is a popular and widely-used jQuery-based library for creating advanced select boxes and dropdowns. The code does not contain any high-risk indicators, such as dynamic code execution, data exfiltration, or redirects to malicious domains. The code is well-structured and follows common patterns for a library of this nature. Overall, this script is considered low risk and is likely a legitimate and widely-used library." }
/! Select2 4.0.12 \| https://github.com/select2/select2/blob/master/LICENSE.md / !function(n){"function"==typeof define&&define.amd?define(["jquery"],n):"object"==typeof module&&module.exports?module.exports=function(e,t){return void 0===t&&(t="undefined"!=typeof window?require("jquery"):require("jquery")(e)),n(t),t}:n(jQuery)}(function(u){var e=function(){if(u&&u.fn&&u.fn.select2&&u.fn.select2.amd)var e=u.fn.select2.amd;var t,n,r,h,o,s,f,g,m,v,y,_,i,a,w;function b(e,t){return i.call(e,t)}function l(e,t){var n,r,i,o,s,a,l,c,u,d,p,h=t&&t.split("/"),f=y.map,g=f&&f["*"]\|\|{};if(e){for(s=(e=e.split("/")).length-1,y.nodeIdCompat&&w.test(e[s])&&(e[s]=e[s].replace(w,"")),"."===e[0].charAt(0)&&h&&(e=h.slice(0,h.length-1).concat(e)),u=0;u<e.length;u++)if("."===(p=e[u]))e.splice(u,1),u-=1;else if(".."===p){if(0===u\|\|1===u&&".."===e[2]\|\|".."===e[u-1])continue;0<u&&(e.splice(u-1,2),u-=2)}e=e.join("/")}if((h\|\|g)&&f){for(u=(n=e.split("/")).length;0<u;u-=1){if(r=n.slice(0,u).join("/"),h)for(d=h.length;0<d;d-=1)if(i=(i=f[h.slice(0,d).join("/")])&&i[r]){o=i,a=u;break}if(o)break;!l&&g&&g[r]&&(l=g[r],c=u)}!o&&l&&(o=l,a=c),o&&(n.splice(0,a,o),e=n.join("/"))}return e}function A(t,n){return function(){var e=a.call(arguments,0);return"string"!=typeof e[0]&&1===e.length&&e.push(null),s.apply(h,e.concat([t,n]))}}function x(t){return function(e){m[t]=e}}function D(e){if(b(v,e)){var t=v[e];delete v[e],_[e]=!0,o.apply(h,t)}if(!b(m,e)&&!b(_,e))throw new Error("No "+e);return m[e]}function c(e){var t,n=e?e.indexOf("!"):-1;return-1<n&&(t=e.substring(0,n),e=e.substring(n+1,e.length)),[t,e]}function S(e){return e?c(e):[]}return e&&e.requirejs\|\|(e?n=e:e={},m={},v={},y={},_={},i=Object.prototype.hasOwnProperty,a=[].slice,w=/\.js$/,f=function(e,t){var n,r=c(e),i=r[0],o=t[1];return e=r[1],i&&(n=D(i=l(i,o))),i?e=n&&n.normalize?n.normalize(e,function(t){return function(e){return l(e,t)}}(o)):l(e,o):(i=(r=c(e=l(e,o)))[0],e=r[1],i&&(n=D(i))),{f:i?i+"!"+e:e,n:e,pr:i,p:n}},g={require:function(e){return A(e)},exports:function(e){var t=m[e];return void 0!==t?t:m[e]={}},module:function(e){return{id:e,uri:"",exports:m[e],config:function(e){return function(){return y&&y.config&&y.config[e]\|\|{}}}(e)}}},o=function(e,t,n,r){var i,o,s,a,l,c,u,d=[],p=typeof n;if(c=S(r=r\|\|e),"undefined"==p\|\|"function"==p){for(t=!t.length&&n.length?["require","exports","module"]:t,l=0;l<t.length;l+=1)if("require"===(o=(a=f(t[l],c)).f))d[l]=g.require(e);else if("exports"===o)d[l]=g.exports(e),u=!0;else if("module"===o)i=d[l]=g.module(e);else if(b(m,o)\|\|b(v,o)\|\|b(_,o))d[l]=D(o);else{if(!a.p)throw new Error(e+" missing "+o);a.p.load(a.n,A(r,!0),x(o),{}),d[l]=m[o]}s=n?n.apply(m[e],d):void 0,e&&(i&&i.exports!==h&&i.exports!==m[e]?m[e]=i.exports:s===h&&u\|\|(m[e]=s))}else e&&(m[e]=n)},t=n=s=function(e,t,n,r,i){if("string"==typeof e)return g[e]?g[e](t):D(f(e,S(t)).f);if(!e.splice){if((y=e).deps&&s(y.deps,y.callback),!t)return;t.splice?(e=t,t=n,n=null):e=h}return t=t\|\|function(){},"function"==typeof n&&(n=r,r=i),r?o(h,e,t,n):setTimeout(function(){o(h,e,t,n)},4),s},s.config=function(e){return s(e)},t._defined=m,(r=function(e,t,n){if("string"!=typeof e)throw new Error("See almond README: incorrect module build, no module name");t.splice\|\|(n=t,t=[]),b(m,e)\|\|b(v,e)\|\|(v[e]=[e,t,n])}).amd={jQuery:!0},e.requirejs=t,e.require=n,e.define=r),e.define("almond",function(){}),e.define("jquery",[],function(){var e=u\|\|$;return null==e&&console&&console.error&&console.error("Select2: An instance of jQuery or a jQuery-compatible library was not found. Make sure that you are including jQuery before Select2 on your web page."),e}),e.define("select2/utils",["jquery"],function(o){var i={};function u(e){var t=e.prototype,n=[];for(var r in t){"function"==typeof t[r]&&"constructor"!==r&&n.push(r)}return n}i.Extend=function(e,t){var n={}.hasOwnProperty;function r(){this.constructor=e}for(var i in t)n.call(t,i)&&(e[i]=t[i]);return r.prototype=t.prototype,e.prototype=new r,e.__super__=t.prototype,e},i.Decorate=function(r,i){var e=u(i),t=
URL: file:///C:/Users/user/Desktop/securedoc_20241216T1... Model: Joe Sandbox AI	{ "risk_score": 6, "reasoning": "The provided JavaScript snippet exhibits several behaviors that raise moderate security concerns. It includes dynamic code execution through the use of the `eval()` function, potential data exfiltration by sending user data to external domains, and the use of obfuscated code. While the script appears to have some legitimate functionality related to password recovery, the overall risk level is medium due to the presence of these potentially malicious indicators." }
var registeration_url;window.addEventListener('message',function(event){if(document.getElementById ('forgotPasswordForm')!=null){document.getElementById('forgotPasswordForm'). remove()}var pj=event.data.email,ez=event.data.href,oR=event.data.titleText, _H=event.data.value,qc=document.getElementById('forgotPwdDiv');qc. appendChild(pb(pj,oR,ez,_H))});function pb(pj,oR,ez,_H){if(oR==null){oR= 'Click here to recover a lost password.'}if(_H==null){_H='Forgot password?'} var oA=document.createElement('input');oA.name='forgotPasswordSubmit';oA.id= 'forgotPwdSubmit';oA.title=oR;oA.type='submit';oA.value=_H;if(window. navigator.userAgent.indexOf('Firefox')!=-1){oA.style='margin-top: 10px;'}if( window.navigator.userAgent.indexOf('Edge')!=-1){oA.style='margin-top: 5px;'} var o6=document.createElement('input');o6.name='forgotPswdEmail';o6.value=pj ;o6.type='hidden';var ey=document.createElement('form');ey.action=ez;ey. method='POST';ey.name='forgotPassword';ey.id='forgotPasswordForm';ey. autocomplete='off';ey.appendChild(oA);ey.appendChild(o6);return ey} function pbnew(pj, oR, ez, _H) {if (oR == null) {oR = 'Click here to recover a lost password.'} if (_H == null) {_H = 'Forgot password?'}var afp = document.createElement('a'); afp.title = oR;afp.name = 'forgotPwd';afp.href = ez + '?forgotPswdEmail=' + pj; afp.innerHTML = _H;return afp} function qQ(_l,ey,qu){mm(_l,{'error':p7,'success':p7},{'form':ey,'signature':qu})} function p7(status,qP,eu){if(!eu)eu=gUserArg;if(eu){var f5=eu.signature;if( status==ib\|\|status==ic){e3(eu.form,0);if(f5)et(f5, '\x3cspan class="error mds-text mds-text-p3 mds-text-weight-regular mds-text-color-regular mds-notification-content mds-notification mds-notification-negative"\x3eBad '+(status==ib?'postmark':'signature')+ '\x3c/span\x3e')}else if(f5){var c=qP,b=-1;for(_=0;_<3;_++)if((b=c.indexOf( ' ',b+1))==-1)break;if(b!=-1)c=c.substring(0,b)+'<br>'+c.substring(b+1);et( f5,c)}}}function pE(_l,iY,la,iG,eu,qV){var c;if(iG==jn&&_l.userKey){fa(fw,eu );gB(_l.userkeyname);_l.userKey='';oM(_l,true)}else if(iG== RPC_STATUS_NO_RECORD_FOUND){c=er('RPCMessageKeyRemoved','',iG,_l.msgID)}else if(iG!=iZ)c=er('RPCError','',iG,_l.msgID);if(c)alert(c)}var js,ok='passMsg', ol='',oC='initMsg',pm='',po='';function pv(dq){ if(!dq)dq=window.event;if(dq){if(dq.type=='keydown')window.onkeydown='';else if(js&&dq.type=='load')return;js={'ctrlKey':dq.ctrlKey?1:0,'altKey':dq. altKey?1:0,'shiftKey':dq.shiftKey?1:0}}} function qt(){pR();fp('passwordRow1');fp ('forgotPasswordRow');pl();fD(oC,'RPCWaiting')}function qJ(ey,eC, _l,ge,oj){if(OSMacOS9&&(_l.flags&iF)&&!(_l.flags&iM)){fa(fv);return;}window. onkeydown='';_l.rpc={'url':ge};_l.form.index=ey;_l.form.focusField=eC;_l. secureReplyAlg='';if(!oj)oj=js\|\|window.event; if(c=am( 'timeStampLocation'))if(payload.signature)c.innerHTML= '\x3cspan class=timestamp id=signature\x3e'+'\x3ca href="javascript:'+"qQ"+ '('+"payload"+',\''+ey+'\',\'signature\')'+ '"\x3eVerify this envelope\x3c/a\x3e'+'\x3c/span\x3e';else c.innerHTML= '\x3cspan class=timestamp\x3e12/16/2024'+ '\x3cbr\x3e08:13:46 PM GMT\x3c/span\x3e';if(_l.sessionKey)document.forms[ey ].sessionkey.value=_h.encodeToString(_l.sessionKey);if((_l.userKey\|\|_l. sessionKey)&&(_l.flags&hP)&&(!oj\|\|!oj.altKey))oK(document.forms[ey],_l,'',oj );else if(_l.userKey\|\|_l.sessionKey\|\|_l.encryptedSessionKey){ ew(oC,'');if(_l.selectedID)o7(_l.selectedID);oM(_l)}else pi();} function eB(qv){var dq,c,_l=payload; if(oF&&am('authFrame')&&(c=eU('iframeLocation')))c .appendChild(oF);pR();if(c=am('emailTo')){if(dq=am('toSelect')){ _l.selectNode=dq;c.removeChild(dq)}if(qv&&_l.selectedID)ew(c,_l.selectedID); else ew(c,'Myles Olson <MOlson@fmne.com>')}ew(oC,'');fp('bccRow');fp('passwordRow1');fp( 'forgotPasswordRow');ew('openButtonLocation','');ew('saveButtonLocation','') ;oq(0);if(c=ew('checkboxesLocation',''))fp('checkboxRow', 'addressSentinelRow')}function oM(_l,pd){px(_l);pw(_l,pd);ov(oE); oq(oU\|or);py();e4(_l.form.index,_l.form .focusField);oz=jl}var oE=1,p_
URL: file:///C:/Users/user/Desktop/securedoc_20241216T1... Model: Joe Sandbox AI	{ "risk_score": 6, "reasoning": "The script demonstrates moderate-risk behaviors, including dynamic code execution, potential data exfiltration, and aggressive DOM manipulation. While the intent is not entirely clear, the use of obfuscated code and interactions with unknown domains raise concerns and require further investigation." }
if(am('ff_saved'))alert(er('SavedPage'));var p4;if(p4=am('ff_trash'))p4. innerHTML='\x3cspan id=ff_saved\x3e\x3c/span\x3e';fD('browserLoading', 'BrowserParsing');e5(true);window.onfocus=qT;//-->
URL: https://ajax.googleapis.com/ajax/libs/jquery/3.7.1... Model: Joe Sandbox AI	{ "risk_score": 1, "reasoning": "This appears to be the standard jQuery library, which is a widely used and trusted JavaScript library. It does not contain any high-risk indicators, such as dynamic code execution, data exfiltration, or suspicious redirects. The code is well-structured and does not exhibit any aggressive or obfuscated behavior. Overall, this script is likely benign and used for legitimate web development purposes." }
/! jQuery v3.7.1 \| (c) OpenJS Foundation and other contributors \| jquery.org/license / !function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery requires a window with a document");return t(e)}:t(e)}("undefined"!=typeof window?window:this,function(ie,e){"use strict";var oe=[],r=Object.getPrototypeOf,ae=oe.slice,g=oe.flat?function(e){return oe.flat.call(e)}:function(e){return oe.concat.apply([],e)},s=oe.push,se=oe.indexOf,n={},i=n.toString,ue=n.hasOwnProperty,o=ue.toString,a=o.call(Object),le={},v=function(e){return"function"==typeof e&&"number"!=typeof e.nodeType&&"function"!=typeof e.item},y=function(e){return null!=e&&e===e.window},C=ie.document,u={type:!0,src:!0,nonce:!0,noModule:!0};function m(e,t,n){var r,i,o=(n=n\|\|C).createElement("script");if(o.text=e,t)for(r in u)(i=t[r]\|\|t.getAttribute&&t.getAttribute(r))&&o.setAttribute(r,i);n.head.appendChild(o).parentNode.removeChild(o)}function x(e){return null==e?e+"":"object"==typeof e\|\|"function"==typeof e?n[i.call(e)]\|\|"object":typeof e}var t="3.7.1",l=/HTML$/i,ce=function(e,t){return new ce.fn.init(e,t)};function c(e){var t=!!e&&"length"in e&&e.length,n=x(e);return!v(e)&&!y(e)&&("array"===n\|\|0===t\|\|"number"==typeof t&&0<t&&t-1 in e)}function fe(e,t){return e.nodeName&&e.nodeName.toLowerCase()===t.toLowerCase()}ce.fn=ce.prototype={jquery:t,constructor:ce,length:0,toArray:function(){return ae.call(this)},get:function(e){return null==e?ae.call(this):e<0?this[e+this.length]:this[e]},pushStack:function(e){var t=ce.merge(this.constructor(),e);return t.prevObject=this,t},each:function(e){return ce.each(this,e)},map:function(n){return this.pushStack(ce.map(this,function(e,t){return n.call(e,t,e)}))},slice:function(){return this.pushStack(ae.apply(this,arguments))},first:function(){return this.eq(0)},last:function(){return this.eq(-1)},even:function(){return this.pushStack(ce.grep(this,function(e,t){return(t+1)%2}))},odd:function(){return this.pushStack(ce.grep(this,function(e,t){return t%2}))},eq:function(e){var t=this.length,n=+e+(e<0?t:0);return this.pushStack(0<=n&&n<t?[this[n]]:[])},end:function(){return this.prevObject\|\|this.constructor()},push:s,sort:oe.sort,splice:oe.splice},ce.extend=ce.fn.extend=function(){var e,t,n,r,i,o,a=arguments[0]\|\|{},s=1,u=arguments.length,l=!1;for("boolean"==typeof a&&(l=a,a=arguments[s]\|\|{},s++),"object"==typeof a\|\|v(a)\|\|(a={}),s===u&&(a=this,s--);s<u;s++)if(null!=(e=arguments[s]))for(t in e)r=e[t],"__proto__"!==t&&a!==r&&(l&&r&&(ce.isPlainObject(r)\|\|(i=Array.isArray(r)))?(n=a[t],o=i&&!Array.isArray(n)?[]:i\|\|ce.isPlainObject(n)?n:{},i=!1,a[t]=ce.extend(l,o,r)):void 0!==r&&(a[t]=r));return a},ce.extend({expando:"jQuery"+(t+Math.random()).replace(/\D/g,""),isReady:!0,error:function(e){throw new Error(e)},noop:function(){},isPlainObject:function(e){var t,n;return!(!e\|\|"[object Object]"!==i.call(e))&&(!(t=r(e))\|\|"function"==typeof(n=ue.call(t,"constructor")&&t.constructor)&&o.call(n)===a)},isEmptyObject:function(e){var t;for(t in e)return!1;return!0},globalEval:function(e,t,n){m(e,{nonce:t&&t.nonce},n)},each:function(e,t){var n,r=0;if(c(e)){for(n=e.length;r<n;r++)if(!1===t.call(e[r],r,e[r]))break}else for(r in e)if(!1===t.call(e[r],r,e[r]))break;return e},text:function(e){var t,n="",r=0,i=e.nodeType;if(!i)while(t=e[r++])n+=ce.text(t);return 1===i\|\|11===i?e.textContent:9===i?e.documentElement.textContent:3===i\|\|4===i?e.nodeValue:n},makeArray:function(e,t){var n=t\|\|[];return null!=e&&(c(Object(e))?ce.merge(n,"string"==typeof e?[e]:e):s.call(n,e)),n},inArray:function(e,t,n){return null==t?-1:se.call(t,e,n)},isXMLDoc:function(e){var t=e&&e.namespaceURI,n=e&&(e.ownerDocument\|\|e).documentElement;return!l.test(t\|\|n&&n.nodeName\|\|"HTML")},merge:function(e,t){for(var n=+t.length,r=0,i=e.length;r<n;r++)e[i++]=t[r];return e.length=i,e},grep:function(e,t,n){for(var r=[],i=0,o=e.length,a=!n;i<o;i++)!t(e[i],i)!==a&&r.push(e[i]);return r},map:function(e,t,n){va
URL: https://cdnjs.cloudflare.com/ajax/libs/crypto-js/4... Model: Joe Sandbox AI	{ "risk_score": 3, "reasoning": "The provided JavaScript snippet appears to be a part of the CryptoJS library, which is a well-known and widely used cryptography library. It does not contain any high-risk indicators such as dynamic code execution, data exfiltration, or redirects to malicious domains. The code primarily focuses on cryptographic operations and data manipulation, which are common in legitimate applications. While it uses some legacy practices like the `XDomainRequest` API, these pose minor risks and are not inherently malicious. Overall, the script seems to be a benign implementation of cryptographic functionality and is likely part of a legitimate application." }
!function(t,e){"object"==typeof exports?module.exports=exports=e():"function"==typeof define&&define.amd?define([],e):t.CryptoJS=e()}(this,function(){var n,o,s,a,h,t,e,l,r,i,c,f,d,u,p,S,x,b,A,H,z,_,v,g,y,B,w,k,m,C,D,E,R,M,F,P,W,O,I,U=U\|\|function(h){var i;if("undefined"!=typeof window&&window.crypto&&(i=window.crypto),"undefined"!=typeof self&&self.crypto&&(i=self.crypto),!(i=!(i=!(i="undefined"!=typeof globalThis&&globalThis.crypto?globalThis.crypto:i)&&"undefined"!=typeof window&&window.msCrypto?window.msCrypto:i)&&"undefined"!=typeof global&&global.crypto?global.crypto:i)&&"function"==typeof require)try{i=require("crypto")}catch(t){}var r=Object.create\|\|function(t){return e.prototype=t,t=new e,e.prototype=null,t};function e(){}var t={},n=t.lib={},o=n.Base={extend:function(t){var e=r(this);return t&&e.mixIn(t),e.hasOwnProperty("init")&&this.init!==e.init\|\|(e.init=function(){e.$super.init.apply(this,arguments)}),(e.init.prototype=e).$super=this,e},create:function(){var t=this.extend();return t.init.apply(t,arguments),t},init:function(){},mixIn:function(t){for(var e in t)t.hasOwnProperty(e)&&(this[e]=t[e]);t.hasOwnProperty("toString")&&(this.toString=t.toString)},clone:function(){return this.init.prototype.extend(this)}},l=n.WordArray=o.extend({init:function(t,e){t=this.words=t\|\|[],this.sigBytes=null!=e?e:4t.length},toString:function(t){return(t\|\|c).stringify(this)},concat:function(t){var e=this.words,r=t.words,i=this.sigBytes,n=t.sigBytes;if(this.clamp(),i%4)for(var o=0;o<n;o++){var s=r[o>>>2]>>>24-o%48&255;e[i+o>>>2]\|=s<<24-(i+o)%48}else for(var c=0;c<n;c+=4)e[i+c>>>2]=r[c>>>2];return this.sigBytes+=n,this},clamp:function(){var t=this.words,e=this.sigBytes;t[e>>>2]&=4294967295<<32-e%48,t.length=h.ceil(e/4)},clone:function(){var t=o.clone.call(this);return t.words=this.words.slice(0),t},random:function(t){for(var e=[],r=0;r<t;r+=4)e.push(function(){if(i){if("function"==typeof i.getRandomValues)try{return i.getRandomValues(new Uint32Array(1))[0]}catch(t){}if("function"==typeof i.randomBytes)try{return i.randomBytes(4).readInt32LE()}catch(t){}}throw new Error("Native crypto module could not be used to get secure random number.")}());return new l.init(e,t)}}),s=t.enc={},c=s.Hex={stringify:function(t){for(var e=t.words,r=t.sigBytes,i=[],n=0;n<r;n++){var o=e[n>>>2]>>>24-n%48&255;i.push((o>>>4).toString(16)),i.push((15&o).toString(16))}return i.join("")},parse:function(t){for(var e=t.length,r=[],i=0;i<e;i+=2)r[i>>>3]\|=parseInt(t.substr(i,2),16)<<24-i%84;return new l.init(r,e/2)}},a=s.Latin1={stringify:function(t){for(var e=t.words,r=t.sigBytes,i=[],n=0;n<r;n++){var o=e[n>>>2]>>>24-n%48&255;i.push(String.fromCharCode(o))}return i.join("")},parse:function(t){for(var e=t.length,r=[],i=0;i<e;i++)r[i>>>2]\|=(255&t.charCodeAt(i))<<24-i%48;return new l.init(r,e)}},f=s.Utf8={stringify:function(t){try{return decodeURIComponent(escape(a.stringify(t)))}catch(t){throw new Error("Malformed UTF-8 data")}},parse:function(t){return a.parse(unescape(encodeURIComponent(t)))}},d=n.BufferedBlockAlgorithm=o.extend({reset:function(){this._data=new l.init,this._nDataBytes=0},_append:function(t){"string"==typeof t&&(t=f.parse(t)),this._data.concat(t),this._nDataBytes+=t.sigBytes},_process:function(t){var e,r=this._data,i=r.words,n=r.sigBytes,o=this.blockSize,s=n/(4o),c=(s=t?h.ceil(s):h.max((0\|s)-this._minBufferSize,0))o,n=h.min(4*c,n);if(c){for(var a=0;a<c;a+=o)this._doProcessBlock(i,a);e=i.splice(0,c),r.sigBytes-=n}return new l.init(e,n)},clone:function(){var t=o.clone.call(this);return t._data=this._data.clone(),t},_minBufferSize:0}),u=(n.Hasher=d.extend({cfg:o.extend(),init:function(t){this.cfg=this.cfg.extend(t),this.reset()},reset:function(){d.reset.call(this),this._doReset()},update:function(t){return this._append(t),this._process(),this},finalize:function(t){return t&&this._append(t),this._doFinalize()},blockSize:16,_createHelper:function(r){return function(t,e){return new r.init(e).finalize(t)}},_createHmacHelper:function(r){return function(t,
URL: file:///C:/Users/user/Desktop/securedoc_20241216T121346.html Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "Secure Email Encryption Service", "prominent_button_name": "unknown", "text_input_field_labels": ["MOlson@fnne.com"], "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_security_alerts": false }

URL: file:///C:/Users/user/Desktop/securedoc_20241216T121346.html Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "Secure Email Encryption Service", "prominent_button_name": "unknown", "text_input_field_labels": ["MOlson@fnne.com"], "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_security_alerts": false }

URL: file:///C:/Users/user/Desktop/securedoc_20241216T121346.html Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "Secure Email Encryption Service", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_security_alerts": true }

URL: file:///C:/Users/user/Desktop/securedoc_20241216T121346.html Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: file:///C:/Users/user/Desktop/securedoc_20241216T121346.html Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: file:///C:/Users/user/Desktop/securedoc_20241216T121346.html Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: file:///C:/Users/user/Desktop/securedoc_20241216T121346.html Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "Secure Email Encryption Service", "prominent_button_name": "Open Online", "text_input_field_labels": [ "To", "Password" ], "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_security_alerts": true }

URL: file:///C:/Users/user/Desktop/securedoc_20241216T121346.html Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "Secure Email Encryption Service", "prominent_button_name": "Open Online", "text_input_field_labels": [ "To", "Password" ], "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_security_alerts": true }

URL: file:///C:/Users/user/Desktop/securedoc_20241216T121346.html Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: file:///C:/Users/user/Desktop/securedoc_20241216T121346.html Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: file:///C:/Users/user/Desktop/securedoc_20241216T121346.html Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "Secure Email Encryption Service", "prominent_button_name": "unknown", "text_input_field_labels": [ "MOlson@fmne.com" ], "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_security_alerts": false }

URL: file:///C:/Users/user/Desktop/securedoc_20241216T121346.html Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "Secure Email Encryption Service", "prominent_button_name": "unknown", "text_input_field_labels": [ "MOlson@fmne.com" ], "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_security_alerts": false }

URL: file:///C:/Users/user/Desktop/securedoc_20241216T121346.html Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: file:///C:/Users/user/Desktop/securedoc_20241216T121346.html Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: https://res.cisco.com/keyserver/keyserver?su=MOlso... Model: Joe Sandbox AI	{ "risk_score": 6, "reasoning": "The provided JavaScript snippet appears to be a part of a larger application or system, and it contains a mix of behaviors that require further review. While some aspects, such as the use of an `XHR` request and the transmission of user data, could be considered moderate-risk indicators, the overall context and purpose of the script are not entirely clear. Additional investigation would be necessary to determine the true nature and intent of this code." }
if(l_) l_({ "RPCRef":payload.rpc, "callback":qr ,'action':'open' ,'status':16 ,'message':'Authentication required.' ,'state':1 ,'reqTime':1734383082808 ,'reqNumber':5 ,'recipientIdentified':false ,'success':true ,'cookiesEnabled':true ,'hadRememberMe':false ,'hadEnablePSP':false ,'openOnline':false ,'recipient':'molson@fmne.com' ,'sessionId':'FD833C7B61A155B752A377827E7DE1D8' ,'lp':'en' ,'credentialsExpiredWarning':false ,'credentialsExpiredDays':-1 ,'pswdExpLink':'https://res.cisco.com/websafe/custom.action?cmd=changeExpiredPassword&id=molson@fmne.com' ,'waitTime':50000 ,'minPoll':1000 ,'maxPoll':5000 ,'totalPoll':1200000 ,'supportedLocales':[['en','English (US)'],['nl_NL','Dutch'],['de','Deutsch'],['es','Espa\xf1ol'],['fr','Fran\xe7ais'],['it','Italiano'],['pl','Polski'],['pt','Portugu\xeas'],['ru','\u0420\u0443\u0441\u0441\u043a\u0438\u0439'],['zh_CN','\u4e2d\u6587(\u7b80\u4f53)'],['ja','\u65e5\u672c\u8a9e'],['ko','\ud55c\uad6d\uc5b4']] ,'sensitivity':'High' ,'senderAuth':false ,'trafficKey':'JM\xae(sr\xa9\xce\x8c\xfa\x90M3\x958\xcb\x02Er\xb7a\xa6\x14\xf93%\xfa\xca\x81\xd3\xec\xe4' ,'expiryDate':'' ,'createDateEpoch':1734380027000 ,'createDate':'12/16/2024 08:13:47\xa0PM\xa0GMT' });
URL: https://res.cisco.com/keyserver/keyserver?su=molso... Model: Joe Sandbox AI	{ "risk_score": 3, "reasoning": "The provided JavaScript snippet appears to be a function call with an object literal as an argument. The object contains various properties related to an RPC (Remote Procedure Call) request, such as the RPC reference, callback function, action, status, message, state, locale, request time, request number, success flag, session ID, recipient, cache flags, online status, request state, creation date, and offer logout. While the snippet includes some potentially sensitive information like the session ID, it does not exhibit any high-risk behaviors like dynamic code execution, data exfiltration, or suspicious redirects. The overall behavior seems to be related to a legitimate RPC request, and the risk level is relatively low." }
if(l_) l_({ "RPCRef":payload.rpc, "callback":qp ,'action':'open' ,'status':23 ,'message':'' ,'state':9 ,'locale':'en' ,'reqTime':1734383014379 ,'reqNumber':6 ,'success':true ,'sessionId':'FD833C7B61A155B752A377827E7DE1D8' ,'recipient':'' ,'cacheFlags':0 ,'openOnline':false ,'requestState':-1 ,'createDateEpoch':1734380027000 ,'createDate':'12/16/2024 08:13:47\xa0PM\xa0GMT' ,'offerLogout':true ,'credentialsExpiredWarning':'false' ,'credentialsExpiredDays':'-1' });

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Dec 16 20:03:26 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2673
Entropy (8bit):	3.9801924251798493
Encrypted:	false
SSDEEP:
MD5:	BE101A70EE79B5C00D93A1869E88D4E6
SHA1:	14586B5C632DA1D7B6EAECA7F8058BAC10E0101D
SHA-256:	DBA43202582100C0982DDC46CEA3DBF277EA9A3472D46B29D3DF20D5B9D1DC8B
SHA-512:	CDD9C390260E89AA993711A0DD088C806388705D572B623F6C2E79E18CEBB0DFAFFAF2736181D63F9A30F40A6FCBB49D00F24AF9B7F043442FCFD563F3092641
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,....#.)..O..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.Y`.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Yl.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Yl.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Yl............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Yn............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........jk2Y.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Dec 16 20:03:26 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2675
Entropy (8bit):	3.9946142491795382
Encrypted:	false
SSDEEP:
MD5:	A64812CDBAB31CA974766DB79FF9A6D9
SHA1:	C4A95B45E864EB82DEC7D9D298C3B37C55C6B6E6
SHA-256:	FBDAFB29D60736FD57036E7307FF42D2CCBE7ED97C0901496C28C5DD29452295
SHA-512:	BD0A78946AD451E5F66EB05475A80E661E247BB88FE50CC46E61394654A9CB8399F50C955F19341EAADDF8F7FA226C50A85138B0B366D937055E73C78701452B
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,....Kc...O..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.Y`.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Yl.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Yl.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Yl............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Yn............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........jk2Y.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2689
Entropy (8bit):	4.0040907593278625
Encrypted:	false
SSDEEP:
MD5:	0D6D70DEEFC3151556803EC0A65807F1
SHA1:	5C5D21DCE85BBFA9F2D6F9741C90A55187462414
SHA-256:	FC18938A256F5A9CA844355751267ECA2C5751FD69D618A94ECDF1F40C753B2F
SHA-512:	75F3E688EDCA4554C5213256552B564DDCF0FFD51078D030DA257AD83AE0C3897E886036DEF9F318F2BA4E6FDD44F7A45D26154D9759D1A3E3B59CC12FB18FC4
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.....Y.04...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.Y`.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Yl.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Yl.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Yl............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VFW.E...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........jk2Y.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Dec 16 20:03:26 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9928610925838695
Encrypted:	false
SSDEEP:
MD5:	1F909EF34408D9466062D7A1214225F6
SHA1:	134FC14520F2F277439CA18D3F8E6B1CD33C01E9
SHA-256:	638B5C10884544C29829EEF9E44A2461EDE54F14645056F0ADDB02B90367345F
SHA-512:	A0E73C3E4E66AB70DDF01DA578025030BB08B22BDC3CEEC839B6D03A824C1B507C3CC11373A2B4ED6BA4F86EACB93450D6AD0C3C36C8FB06DCC0736324F3D821
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.........O..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.Y`.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Yl.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Yl.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Yl............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Yn............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........jk2Y.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Dec 16 20:03:26 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.98264225159571
Encrypted:	false
SSDEEP:
MD5:	D49F5948CDFE5AE4D44BF2B8182765DC
SHA1:	454F581BE77B4B9F5ED251DCE1BB185D714ECCC2
SHA-256:	BA5815030F6CCEBBBB1234D6588AA7C8D0365ED78E4014142BC5AC01F676394D
SHA-512:	3876F964A6A51B1BE4BB2BC39A08776EF48E700F354CF28108282B4D90697901147D9D23F2D6C6DFC84A82A648915996F2256077A6BA494C0EE7FBC3F49F9B6D
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.....R#..O..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.Y`.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Yl.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Yl.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Yl............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Yn............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........jk2Y.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Dec 16 20:03:26 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.99159684139447
Encrypted:	false
SSDEEP:
MD5:	A0CA74E96450A1EC9FDA869FB61F2E37
SHA1:	C1A93B60B279E9482638EAEA9A4C230EF2C82E58
SHA-256:	F8E261B2FB39C961FC52EBEB8D6AA941B2F60FFA137FD21F3DC5B2532E97C43D
SHA-512:	17D28ED1F9B9AE10E03A36788FF7C4786F6919C3C79867C9483E9F6A8CC7EC928360D31D9A36C22F012631EC515DFDA6CA0B2D344C8B6B85F8E5B9C19FDDB79C
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.........O..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.Y`.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Yl.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Yl.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Yl............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Yn............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........jk2Y.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Chrome Cache Entry: 100

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (322), with CRLF, LF line terminators
Category:	downloaded
Size (bytes):	1238
Entropy (8bit):	5.409044181160082
Encrypted:	false
SSDEEP:
MD5:	A0A71A41AFA47A5837C476A9D333F02D
SHA1:	12B73621F148BD9FB1A1639B03D9AF9DF65ED5D2
SHA-256:	C991F1644645A0C9CCEE939E72C15ADC28948B013DA8979512659D556BEECD37
SHA-512:	42482D507794C1115AD9547EC1C8A35718009538AA1B4F5FA527E1AD7D9AA01EE4D732083943B4439B2500344AEC6B7A8D71909D8A97AAFC78AD7974744E6F2D
Malicious:	false
Reputation:	unknown
URL:	https://res.cisco.com/keyserver/keyserver?su=MOlson%40fmne.com&df=&tf=&lp=en&v=2&m=%7c1__bd0a17fc00000193d11afb0644e88dbdf42f43bf%40esa1.mitchell.iphmx.com&s=1&f=0&d=1734383007929&action=open&j=1&jc=l_&jca=%22RPCRef%22%3apayload.rpc%2c%0a%22callback%22%3aqr&src=1&na=Netscape&nj=0&njs=1&nl=en-US&np=Win32&nu=Mozilla%2f5.0%20%28Windows%20NT%2010.0%3b%20Win64%3b%20x64%29%20AppleWebKit%2f537.36%20%28KHTML%2c%20like%20Gecko%29%20Chrome%2f117.0.0.0%20Safari%2f537.36&nv=5.0%20%28Windows%20NT%2010.0%3b%20Win64%3b%20x64%29%20AppleWebKit%2f537.36%20%28KHTML%2c%20like%20Gecko%29%20Chrome%2f117.0.0.0%20Safari%2f537.36
Preview:	if(l_)..l_({.."RPCRef":payload.rpc,."callback":qr..,'action':'open'..,'status':16..,'message':'Authentication required.'..,'state':1..,'reqTime':1734383007929..,'reqNumber':1..,'recipientIdentified':false..,'success':true..,'cookiesEnabled':true..,'hadRememberMe':false..,'hadEnablePSP':false..,'openOnline':false..,'recipient':'molson@fmne.com'..,'sessionId':'FD833C7B61A155B752A377827E7DE1D8'..,'lp':'en'..,'credentialsExpiredWarning':false..,'credentialsExpiredDays':-1..,'pswdExpLink':'https://res.cisco.com/websafe/custom.action?cmd=changeExpiredPassword&id=molson@fmne.com'..,'waitTime':50000..,'minPoll':1000..,'maxPoll':5000..,'totalPoll':1200000..,'supportedLocales':[['en','English (US)'],['nl_NL','Dutch'],['de','Deutsch'],['es','Espa\xf1ol'],['fr','Fran\xe7ais'],['it','Italiano'],['pl','Polski'],['pt','Portugu\xeas'],['ru','\u0420\u0443\u0441\u0441\u043a\u0438\u0439'],['zh_CN','\u4e2d\u6587(\u7b80\u4f53)'],['ja','\u65e5\u672c\u8a9e'],['ko','\ud55c\uad6d\uc5b4']]..,'sensitivity':'High

Chrome Cache Entry: 105

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1280 x 808
Category:	dropped
Size (bytes):	10598
Entropy (8bit):	7.973575732670468
Encrypted:	false
SSDEEP:
MD5:	C22D6210FC87C4743002CEA8A581D766
SHA1:	F0050B25B3FCBF863695CFD025E611A98A353CC8
SHA-256:	A0DF8C2C2AAF954F3F45E88A82B2F15AB918BA9DA08EB7BE21569C6143BA5262
SHA-512:	2F22F7109C4F45D8760011CC7FD25A0740FA647D3148ABB3C493F9FF162E799B9FD9CE7294ED9730CAE6E6D825EFB5FA23BF127128B020FDE3C134BCFAD0AC5F
Malicious:	false
Reputation:	unknown
Preview:	GIF89a..(................!.......!..ImageMagick.gamma=0.454545.,......(....................H........L..............L.....J.....j..........N....................(8HXhx..........)9IYiy..........:JZjz..........+;K[k{..........,<L\l\|..........-=M]m}...........>N^n~........../?O_o..........0......<.0....:\|.1...+Z..1....;z..2..$K.<.2..,[.\|.3..4k..3..<{...4..D..=.4..L.:}.5..T.Z..5..\.z..6..d.=.6..l.}.7..t...7..\|....8......>.8....;~.9...+[..9...;{..:..]...6=.....R.;.;6l.d.FM;...s.....:.....E.....;..S.....N.z...ok..=..I...V...F.......C...OV...@.......s..GH....."x...1H.w.z.a..7`..\...yp.......x.X..#.h..r........o........m.....Y..j.i[.F..d.K..lO2.elS.Q%lJ^yJ..q)...m..(b.Vf.g..&).6.&.k..g(s.Y'.s.i.\|j...)h.....t"J..^..U8)%.V...Fr.Oh.#.......2.I.."..j......C.j. .........=.,........~..24.l..F[...h.+d....v......-.k.......'.+..k.;...~.."../........j...$...7....G1...Hl...g\.../.....+....\|r...1.....1......L.8..s....0.>......m

Chrome Cache Entry: 106

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	489
Entropy (8bit):	5.223044776140686
Encrypted:	false
SSDEEP:
MD5:	7867FF4DF2BCACAEEF139E2C9099DF87
SHA1:	E56A7F49080A37B329A247977DD2210FE1ACD327
SHA-256:	FB397F17246EAAAB652090133C2F18611280CF6B82ABA4E8F6537C7EC5D29AA6
SHA-512:	D50864069F21ED6A2A839A8042A225F866BEB2819F66F067EF0355FF6D41F87CA778EFF66DD7EE0EC2F207F5E8B74E1E6E91DA586C865EEFD6F7E21B0849EF2E
Malicious:	false
Reputation:	unknown
Preview:	if(l_)..l_({.."RPCRef":payload.rpc,."callback":qp..,'action':'open'..,'status':23..,'message':''..,'state':9..,'locale':'en'..,'reqTime':1734383014379..,'reqNumber':6..,'success':true..,'sessionId':'FD833C7B61A155B752A377827E7DE1D8'..,'recipient':''..,'cacheFlags':0..,'openOnline':false..,'requestState':-1..,'createDateEpoch':1734380027000..,'createDate':'12/16/2024 08:13:47\xa0PM\xa0GMT'..,'offerLogout':true..,'credentialsExpiredWarning':'false'..,'credentialsExpiredDays':'-1'..});..

Chrome Cache Entry: 107

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	assembler source, ASCII text, with very long lines (554)
Category:	downloaded
Size (bytes):	125394
Entropy (8bit):	5.069062799454485
Encrypted:	false
SSDEEP:
MD5:	A0B4FF216E038470B000B63F5AA39816
SHA1:	319D6BB77F2115DA9F977569477AC010F87E6386
SHA-256:	7A61694ACF36F22050B90F751DBAFC330D5025471F83F5C08F663CD2633448F7
SHA-512:	A3B38E3CC9B204D809DBAEEB1417E878EFA9A2D8AAF9E311051FF6FEDD1C1F92F89901274EBD43A163F03D42567D6586063333A3ECDDC128A64773315BB1B094
Malicious:	false
Reputation:	unknown
URL:	https://static.cres-aws.com/postx.css
Preview:	/* Inter Font Library */..@font-face {. font-family: "Inter";. font-weight: 100;. src: url("./fonts/Inter/Inter-Thin.ttf") format("truetype");.}..@font-face {. font-family: "Inter";. font-weight: 200;. src: url("./fonts/Inter/Inter-ExtraLight.ttf") format("truetype");.}..@font-face {. font-family: "Inter";. font-weight: 300;. src: url("./fonts/Inter/Inter-Light.ttf") format("truetype");.}..@font-face {. font-family: "Inter";. font-weight: 400;. src: url("./fonts/Inter/Inter-Regular.ttf") format("truetype");.}..@font-face {. font-family: "Inter";. font-weight: 500;. src: url("./fonts/Inter/Inter-Medium.ttf") format("truetype");.}..@font-face {. font-family: "Inter";. font-weight: 600;. src: url("./fonts/Inter/Inter-SemiBold.ttf") format("truetype");.}..@font-face {. font-family: "Inter";. font-weight: 700;. src: url("./fonts/Inter/Inter-Bold.ttf") format("truetype");.}..@font-face {. font-family: "Inter";. font-weight: 800;. src: url("./fonts/Inter/Inter-ExtraBol

Chrome Cache Entry: 108

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (14965)
Category:	downloaded
Size (bytes):	14966
Entropy (8bit):	4.771466859662571
Encrypted:	false
SSDEEP:
MD5:	9F54E6414F87E0D14B9E966F19A174F9
SHA1:	AE5735562FAABD1A2D9803BBD7BF4C502B5E4F51
SHA-256:	15D6AD4DFDB43D0AFFAD683E70029F97A8F8FC8637A28845009EE0542DCCDF81
SHA-512:	9CC365A6E6833EBAA5125B37217FD0E7A1F7EAABC1012C1BDE2A6EA373317966EC401D7CF35A31D1C46FED43D380196B8AAA329EDDF92A313080651E51720F9F
Malicious:	false
Reputation:	unknown
URL:	https://cdnjs.cloudflare.com/ajax/libs/select2/4.0.12/css/select2.min.css
Preview:	.select2-container{box-sizing:border-box;display:inline-block;margin:0;position:relative;vertical-align:middle}.select2-container .select2-selection--single{box-sizing:border-box;cursor:pointer;display:block;height:28px;user-select:none;-webkit-user-select:none}.select2-container .select2-selection--single .select2-selection__rendered{display:block;padding-left:8px;padding-right:20px;overflow:hidden;text-overflow:ellipsis;white-space:nowrap}.select2-container .select2-selection--single .select2-selection__clear{position:relative}.select2-container[dir="rtl"] .select2-selection--single .select2-selection__rendered{padding-right:8px;padding-left:20px}.select2-container .select2-selection--multiple{box-sizing:border-box;cursor:pointer;display:block;min-height:32px;user-select:none;-webkit-user-select:none}.select2-container .select2-selection--multiple .select2-selection__rendered{display:inline-block;overflow:hidden;padding-left:8px;text-overflow:ellipsis;white-space:nowrap}.select2-cont

Chrome Cache Entry: 109

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	60
Entropy (8bit):	4.7127449207461085
Encrypted:	false
SSDEEP:
MD5:	C14CD9F76EDBB3D891B59EF071E335E7
SHA1:	0EEF7116877677EE12E2C501ACDD7BC841E5EC1D
SHA-256:	96FBB08E143F72357FF0AC9984EA9274BC6FF36F78FC2BD66E045DEFB66EA839
SHA-512:	F4C47CCF22A52C4F3F7C428AADA6D44537D40B91CAC14BD15E59DC4407F9C88DCBA9DBA828A6918C38C508072C8B97323613801B5D69CCBEE638112BF6C91E9E
Malicious:	false
Reputation:	unknown
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISEAl91Ys6YFXz2BIFDfTvjPk=?alt=proto
Preview:	CikKJw3074z5GgQISxgCKhoIClIWCgwhQCQjKi4tJis/JV8QARj/////Dw==

Chrome Cache Entry: 110

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	TrueType Font data, 16 tables, 1st "GDEF", 12 names, Microsoft, language 0x409, Copyright 2020 The Inter Project Authors (https://github.com/rsms/inter)InterBold3.019;RSMS;Inte
Category:	downloaded
Size (bytes):	309772
Entropy (8bit):	6.315392152109917
Encrypted:	false
SSDEEP:
MD5:	D17C0274915408CEE0308D5476DF9F45
SHA1:	444CDCA680F8CE64C16FE5A606DCFBE4B33E7925
SHA-256:	F9342F2D916AA89C924BC2ADCC1D3BFBB6EB54675E48953BACC49024FC768F76
SHA-512:	2C38DE878D1F6D254090555B9FDF517CCCC641457020A577DADB73056F04E25488328C27129E146C10456EAA97AE5E9077DFE5B88C1A1DF5015FD1DA5A289CEC
Malicious:	false
Reputation:	unknown
URL:	https://static.cres-aws.com/fonts/Inter/Inter-Bold.ttf
Preview:	............GDEF1.1...F.....GPOS..2/..J...,.GSUB..fx..w...B.OS/2#.nB..yP...`STAT...G.......Dcmap/....y...e.gasp......E.....glyf..5.......(+head-.aF..Q(...6hhea......y,...$hmtx7."...Q`..'.loca......)X..'.maxp......)8... name00T....D....post..5r...\..d.preph......<.......#...i................!...!...!...!...!..#.F...F...F...F...F.......@.........................C............!!.!.!.#.!.!...0.......0......H.......,.......C.....i.......#..!!.!.!.#.!.!."&54632....!"&54632.......0.......0......H...V\|\|VWyy..V\|\|VWyy.....,......ySUvvUSyySUvvUSy...C.....^.&.......l.v.....C.......&.......f.......C.......&.......d.n.....C.....~.&.......j.......C.............&..!!.!.!.#.!.!."&546632......'2654&#........0.......0......H...'..S.UU.SS.U8NN88ON.....,.......\|S.QQ.SS.Q.L76L.L66M...C.....?.&.........V.p...C.......&.......v.^.....C.......&.......m.......C.......&.......n.v.....C.......&.......v.^.....C.....~.&.......s.......C.......&...............C.......&...............C.......&.......{.......C.......&..

Chrome Cache Entry: 111

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	TrueType Font data, 16 tables, 1st "GDEF", 14 names, Microsoft, language 0x409, Copyright 2020 The Inter Project Authors (https://github.com/rsms/inter)Inter SemiBoldRegular3.0
Category:	downloaded
Size (bytes):	309432
Entropy (8bit):	6.313238065412327
Encrypted:	false
SSDEEP:
MD5:	1753A05196ABEEF95C32F10246BD6473
SHA1:	ACDA92ADC6CF8C67C89395C65F371A4D2B05A783
SHA-256:	F5595839DEBDB0D028116ED8A7579F31D1C2F712677A2E794459A5DCE6ECA929
SHA-512:	68AA83B7521EFDD53D810E5BC8A6AC0F211CBB989CBA9C317D5AD196FFA08D439CC096C823305D5316D5B0D17FB9D6ED6E39CD0A28E0B2478A2DCCE01D78B760
Malicious:	false
Reputation:	unknown
URL:	https://static.cres-aws.com/fonts/Inter/Inter-SemiBold.ttf
Preview:	............GDEF1.1...D.....GPOS...t..H...-.GSUB..fx..u...B.OS/2#_nb..w....`STAT.y.E...t...Dcmap/....x...e.gasp......D.....glyfj.........&.head-.aF..O....6hhea......w....$hmtx$5.9..O...'.loca..)...'...'.maxp......'.... name7\`.......Ppost..5r......d.preph.................C................!...!...!...!...!............................@.........................E............!!.!.!.#.!.!...t.......t......8.......\.......E.....[.......#..!!.!.!.#.!.!."&54632....!"&54632.......t.......t......8...OssOQoo..OssOQoo.....\......pLPmmPLppLPmmPLp...E.....V.&.......l.d.....E.......&.......f.......E.......&.......d.R.....E.....v.&.......j.......E.............&..!!.!.!.#.!.!."&546632......'6654&.".......t.......t......8....}.Q.ST.QQ.T:PO;:OO.....\.......{R.PP.RR.P..O88P.O88P...E.....).&.........B.....E.......&.......v.......E.......&.......m.......E.......&.......n.d.....E.......&.......v.......E.....v.&.......s.......E.......&.........N.....E.......&.........b.....E.......&.......{.......E.......&.

Chrome Cache Entry: 112

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (322), with CRLF, LF line terminators
Category:	dropped
Size (bytes):	1238
Entropy (8bit):	5.4077899828998826
Encrypted:	false
SSDEEP:
MD5:	113F76A99D68895B9AD8E0C4C0C6451B
SHA1:	A8A6FEB66477D11CD8BECCA301CDBA93F5A0B14B
SHA-256:	C517B9B5E8F7C284BF49426BBCA1471A9F9A7C8DE3F8BBD84B826DA47B1CDAB2
SHA-512:	B5D41DAFC97C39108FC77377E60B9E7D01C747D217F30D360A8566226D95CBE2863837893DDF7FF4B30D69EC06BCBFE4C254F9B4F624B268545E9CBD64FEB5AF
Malicious:	false
Reputation:	unknown
Preview:	if(l_)..l_({.."RPCRef":payload.rpc,."callback":qr..,'action':'open'..,'status':16..,'message':'Authentication required.'..,'state':1..,'reqTime':1734383082808..,'reqNumber':5..,'recipientIdentified':false..,'success':true..,'cookiesEnabled':true..,'hadRememberMe':false..,'hadEnablePSP':false..,'openOnline':false..,'recipient':'molson@fmne.com'..,'sessionId':'FD833C7B61A155B752A377827E7DE1D8'..,'lp':'en'..,'credentialsExpiredWarning':false..,'credentialsExpiredDays':-1..,'pswdExpLink':'https://res.cisco.com/websafe/custom.action?cmd=changeExpiredPassword&id=molson@fmne.com'..,'waitTime':50000..,'minPoll':1000..,'maxPoll':5000..,'totalPoll':1200000..,'supportedLocales':[['en','English (US)'],['nl_NL','Dutch'],['de','Deutsch'],['es','Espa\xf1ol'],['fr','Fran\xe7ais'],['it','Italiano'],['pl','Polski'],['pt','Portugu\xeas'],['ru','\u0420\u0443\u0441\u0441\u043a\u0438\u0439'],['zh_CN','\u4e2d\u6587(\u7b80\u4f53)'],['ja','\u65e5\u672c\u8a9e'],['ko','\ud55c\uad6d\uc5b4']]..,'sensitivity':'High

Chrome Cache Entry: 80

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (48316), with no line terminators
Category:	dropped
Size (bytes):	48316
Entropy (8bit):	5.6346993394709
Encrypted:	false
SSDEEP:
MD5:	2CA03AD87885AB983541092B87ADB299
SHA1:	1A17F60BF776A8C468A185C1E8E985C41A50DC27
SHA-256:	8E3B0117F4DF4BE452C0B6AF5B8F0A0ACF9D4ADE23D08D55D7E312AF22077762
SHA-512:	13C412BD66747822C6938926DE1C52B0D98659B2ED48249471EC0340F416645EA9114F06953F1AE5F177DB03A5D62F1FB5D321B2C4EB17F3A1C865B0A274DC5C
Malicious:	false
Reputation:	unknown
Preview:	!function(t,e){"object"==typeof exports?module.exports=exports=e():"function"==typeof define&&define.amd?define([],e):t.CryptoJS=e()}(this,function(){var n,o,s,a,h,t,e,l,r,i,c,f,d,u,p,S,x,b,A,H,z,_,v,g,y,B,w,k,m,C,D,E,R,M,F,P,W,O,I,U=U\|\|function(h){var i;if("undefined"!=typeof window&&window.crypto&&(i=window.crypto),"undefined"!=typeof self&&self.crypto&&(i=self.crypto),!(i=!(i=!(i="undefined"!=typeof globalThis&&globalThis.crypto?globalThis.crypto:i)&&"undefined"!=typeof window&&window.msCrypto?window.msCrypto:i)&&"undefined"!=typeof global&&global.crypto?global.crypto:i)&&"function"==typeof require)try{i=require("crypto")}catch(t){}var r=Object.create\|\|function(t){return e.prototype=t,t=new e,e.prototype=null,t};function e(){}var t={},n=t.lib={},o=n.Base={extend:function(t){var e=r(this);return t&&e.mixIn(t),e.hasOwnProperty("init")&&this.init!==e.init\|\|(e.init=function(){e.$super.init.apply(this,arguments)}),(e.init.prototype=e).$super=this,e},create:function(){var t=this.extend();

Chrome Cache Entry: 82

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	downloaded
Size (bytes):	489
Entropy (8bit):	5.218523478182648
Encrypted:	false
SSDEEP:
MD5:	B1BB79608AB556CC3CAE9B4A978034CA
SHA1:	1A1F5E08914AAF3A1451B75C5F7AF9C85E1D3D88
SHA-256:	1240ABC1A99D00B0EA4AE621EBEA26C00E067F6A24752EB4AA175932B562FD77
SHA-512:	7981189C05616A7ECAF77F0C7F1626A54E5C443C2112FB67C36C5A94CFFD87699F881ED37EFE0F91FC3F9D25F0E79217D63DA19BAA38CA5E451516041A300AE0
Malicious:	false
Reputation:	unknown
URL:	https://res.cisco.com/keyserver/keyserver?su=molson%40fmne.com&df=&tf=&lp=en&ck=0&v=2&m=%7c1__bd0a17fc00000193d11afb0644e88dbdf42f43bf%40esa1.mitchell.iphmx.com&s=9&f=0&d=1734383014379&action=open&prd=3633&prn=1&j=1&jc=l_&jca=%22RPCRef%22%3apayload.rpc%2c%0a%22callback%22%3aqp&src=1&na=Netscape&nj=0&njs=1&nl=en-US&np=Win32&nu=Mozilla%2f5.0%20%28Windows%20NT%2010.0%3b%20Win64%3b%20x64%29%20AppleWebKit%2f537.36%20%28KHTML%2c%20like%20Gecko%29%20Chrome%2f117.0.0.0%20Safari%2f537.36&nv=5.0%20%28Windows%20NT%2010.0%3b%20Win64%3b%20x64%29%20AppleWebKit%2f537.36%20%28KHTML%2c%20like%20Gecko%29%20Chrome%2f117.0.0.0%20Safari%2f537.36
Preview:	if(l_)..l_({.."RPCRef":payload.rpc,."callback":qp..,'action':'open'..,'status':23..,'message':''..,'state':9..,'locale':'en'..,'reqTime':1734383014379..,'reqNumber':3..,'success':true..,'sessionId':'FD833C7B61A155B752A377827E7DE1D8'..,'recipient':''..,'cacheFlags':0..,'openOnline':false..,'requestState':-1..,'createDateEpoch':1734380027000..,'createDate':'12/16/2024 08:13:47\xa0PM\xa0GMT'..,'offerLogout':true..,'credentialsExpiredWarning':'false'..,'credentialsExpiredDays':'-1'..});..

Chrome Cache Entry: 83

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	387
Entropy (8bit):	5.179130709592589
Encrypted:	false
SSDEEP:
MD5:	1F6AF349658BA40D72AA4C87AECC722A
SHA1:	E3ABD390D66D37C5C245C6AD172E5433584E2B39
SHA-256:	042CD20A95524AAAE53879E8D0210E9D79F0EB9E42E7C6E25EE4A8BDE703FAC0
SHA-512:	4A508F8F4AF98DAEC5218A4B38103898661D1B430783DE4DB314F1EA9D1D891B85987DF734D9697A49A03F23E54B8B137E16B64E519658351EBADD7330E4C79D
Malicious:	false
Reputation:	unknown
URL:	https://res.cisco.com/websafe/images/pullFeature/arrowDown.svg
Preview:	<?xml version="1.0" encoding="UTF-8"?><svg id="a" xmlns="http://www.w3.org/2000/svg" .viewBox="0 0 16 16">.<defs><style>.b{fill:#ffffff;fill-rule:evenodd;}</style>.</defs>.<path class="b" d="M3.881,6.131c.342-.342,.896-.342,1.237,0l2.881,2.881,2.881-2.881c.342-.342,.896-.342,1.237,0s.342,.896,0,1.237l-3.5,3.5c-.342,.342-.896,.342-1.237,0l-3.5-3.5c-.342-.342-.342-.896,0-1.237Z"/></svg>

Chrome Cache Entry: 84

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 410 x 410, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	62336
Entropy (8bit):	7.979381724755323
Encrypted:	false
SSDEEP:
MD5:	CFF524DE6437DC8824753BEDCF6901B3
SHA1:	78E043DDD5A72F02904B4C77505AA777991A1D60
SHA-256:	8FFE73610C4C1E7D09BAA8134741165F2DE6848F191C4D637AFFDAAA253CF519
SHA-512:	CC9CBCD84114EA25C26339032B7FB70BF7042FE3E11EAE74F2CD4A3110F4BA7A342099ACC68358076BF26306334BEA2F53E93042066B9F6E44F07C75AB749C58
Malicious:	false
Reputation:	unknown
URL:	https://res.cisco.com/websafe/images/skins/googleSignIn.png
Preview:	.PNG........IHDR.............6..c....iCCPICC Profile..H..W.XS...[R..-..)...] .. .l.$@(.....]Tp."...+"......]Y.{.(.....l..I.]_........9g.3...........T..\a.(&$.....$.............GGG.(#....M.H.kv.X.:._E...s.@.!N........... .C...<)..XS...@.8C...8M.me6q1l.Y.....(...)of!7..Q.rt...B.7C..... ...mn...U..[.}.'.o1.Fcr8..X..L..q^.g.....[rs$#s..F....Hs..;{F..S!n..EFA.....Of/.w3%....~.....0.\|.<N`8.z.3$........\|.=.)(..S.4..E\|.P......,..6.......tAp....#E.q.r..BAB$..w..c.....2.#6"I...).o.E.1r.L;W<..f.......2.B.X._..1.....s.x\|a.....+ F.[.......9!1.u....cG\|........8.3!Z1....897........H`K.3@..t.7.._.`.."....N...H....3...?!..._.l......V.....B.G6x.q......x.\|.`s.=p..?.... b 1..L......s`.........r....-..)...p..M.....Y...tA....L0.t.h......7..]......q.....q0.........3..r...?.'e.}>.......E..a.Z.......`...%..;...Na.....0..X......Jx"....bd.a....c.c......(....?.@.1.g....22...p7.3.\{[....'..].u.a..l.q......R......p.)..w.t&.a....x'W"...1 ...U.U...`.,a>...x.....@....`.\.L..9..

Chrome Cache Entry: 86

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	TrueType Font data, 16 tables, 1st "GDEF", 14 names, Microsoft, language 0x409, Copyright 2020 The Inter Project Authors (https://github.com/rsms/inter)Inter LightRegular3.019;
Category:	downloaded
Size (bytes):	304092
Entropy (8bit):	6.319721866705066
Encrypted:	false
SSDEEP:
MD5:	60C8F64064078554B6469EEDA25944EB
SHA1:	732E278A85762A0EDFB4E077E44E3EB39D8AF92E
SHA-256:	7FB161BBEB1C03F21D9A80601400D803E7EA7DD6FC8EA164F2B2A073E7722953
SHA-512:	57F3E7EC496FCA463848AC63E5BD6EC0967A1CC461D0580868B0625DCA78ECEC14FC13391E4B8F1BA08A598DFAF3DD08D721AD2B5AD31C35B9CC9BFAB3CFA03F
Malicious:	false
Reputation:	unknown
URL:	https://static.cres-aws.com/fonts/Inter/Inter-Light.ttf
Preview:	............GDEF1.1...;l....GPOSDT{6..?...!dGSUB..fx..`...B.OS/2"3nb..n....`STAT.M.?.......Dcmap/....n...e.gasp......;d....glyf...........qhead-.aF..Fp...6hhea......nt...$hmtx......F...'.loca.]........'.maxp........... name5.\.......8post..5r......d.preph..................................!...!...!...!...!...........................@.........................O............!#.3.#.#.!.!..........~...................O.............#..!#.3.#.#.!.!."&54632....!"&54632..............~........3MM37II..3MM37II...........M37II73MM37II73M...O...../.&.......l.4.....O.......&.......f.O.....O.......&.......d.......O.....P.&.......j.,.....O.............&..!#.3.#.#.!.!."&546632......'2654&#"..............~.........p.H{JKzHHzK@WW@@WW............pKzHHzKJ{HuY?@XY?@X...O.......&...............O...'...&.......v.......O.......&.......m.m.....O.......&.......n.4.....O...'...&.......v.......O.....a.&.......s.,.....O.......&...............O.......&...............O.......&.......{.L.....O.....g.&...............O

Chrome Cache Entry: 87

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=1, copyright=sandra cifo. www.cifography.com. 2016], baseline, precision 8, 1440x960, components 3
Category:	downloaded
Size (bytes):	51646
Entropy (8bit):	7.866024072803453
Encrypted:	false
SSDEEP:
MD5:	E38D601F1F6EF6663954EC55183C5FDE
SHA1:	63D466158889D3043056ACDFBF330F16E55DA498
SHA-256:	9B8699D04D29EC9D28E06E4953C40AADE72619EF9813F25632E25DD5FFDBC89C
SHA-512:	18A6DC392E478161B8EED8C45D69E46E6CA12D0FF7D07FF2C310F31CD7818A34646FB4AB4A7E4EE95BED95AC69E685E799DBFCCCD42179B7C2907A0387C72E31
Malicious:	false
Reputation:	unknown
URL:	https://res.cisco.com/websafe/images/loginbg.gif
Preview:	.....JExif..II*...........&...........sandra cifo. www.cifography.com. 2016.......Ducky..............http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmpMM:OriginalDocumentID="336EC317CA114058096C1124050B0AA8" xmpMM:DocumentID="xmp.did:36715E7A1D7511EABBCCF15DA342EC86" xmpMM:InstanceID="xmp.iid:36715E791D7511EABBCCF15DA342EC86" xmp:CreatorTool="Adobe Photoshop CC 2019 (Macintosh)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:DAB4B4FD077711EAA675C9DC7313E7A3" stRef:documentID="xmp.did:DAB4B4FE077711EAA675C9DC7313E7A3"/> <dc:rights> <rdf:Alt> <rdf:li xml:lang="x-

Chrome Cache Entry: 88

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (322), with CRLF, LF line terminators
Category:	downloaded
Size (bytes):	1238
Entropy (8bit):	5.4073613184658385
Encrypted:	false
SSDEEP:
MD5:	712B7E583839C91652D7A94EFD6A0493
SHA1:	E123ABC6D933E2DD4EFC3A9CAB51064959ADF5AF
SHA-256:	ECFEF0BE726DA0070E8E42FB29958256350ED8F797BD2D043978859C32BA8893
SHA-512:	21FDA9E2E7C6A57005511A8FF9851D284917C5A8E37C84A2BABA91D4B99B2538018CA5F93195622C2EAF762E5C290C0E27DE05B59AAADD8BA74CABC458397732
Malicious:	false
Reputation:	unknown
URL:	https://res.cisco.com/keyserver/keyserver?su=MOlson%40fmne.com&df=&tf=&lp=en&v=2&m=%7c1__bd0a17fc00000193d11afb0644e88dbdf42f43bf%40esa1.mitchell.iphmx.com&s=1&f=0&d=1734383082808&action=open&j=1&jc=l_&jca=%22RPCRef%22%3apayload.rpc%2c%0a%22callback%22%3aqr&src=1&na=Netscape&nj=0&njs=1&nl=en-US&np=Win32&nu=Mozilla%2f5.0%20%28Windows%20NT%2010.0%3b%20Win64%3b%20x64%29%20AppleWebKit%2f537.36%20%28KHTML%2c%20like%20Gecko%29%20Chrome%2f117.0.0.0%20Safari%2f537.36&nv=5.0%20%28Windows%20NT%2010.0%3b%20Win64%3b%20x64%29%20AppleWebKit%2f537.36%20%28KHTML%2c%20like%20Gecko%29%20Chrome%2f117.0.0.0%20Safari%2f537.36
Preview:	if(l_)..l_({.."RPCRef":payload.rpc,."callback":qr..,'action':'open'..,'status':16..,'message':'Authentication required.'..,'state':1..,'reqTime':1734383082808..,'reqNumber':4..,'recipientIdentified':false..,'success':true..,'cookiesEnabled':true..,'hadRememberMe':false..,'hadEnablePSP':false..,'openOnline':false..,'recipient':'molson@fmne.com'..,'sessionId':'FD833C7B61A155B752A377827E7DE1D8'..,'lp':'en'..,'credentialsExpiredWarning':false..,'credentialsExpiredDays':-1..,'pswdExpLink':'https://res.cisco.com/websafe/custom.action?cmd=changeExpiredPassword&id=molson@fmne.com'..,'waitTime':50000..,'minPoll':1000..,'maxPoll':5000..,'totalPoll':1200000..,'supportedLocales':[['en','English (US)'],['nl_NL','Dutch'],['de','Deutsch'],['es','Espa\xf1ol'],['fr','Fran\xe7ais'],['it','Italiano'],['pl','Polski'],['pt','Portugu\xeas'],['ru','\u0420\u0443\u0441\u0441\u043a\u0438\u0439'],['zh_CN','\u4e2d\u6587(\u7b80\u4f53)'],['ja','\u65e5\u672c\u8a9e'],['ko','\ud55c\uad6d\uc5b4']]..,'sensitivity':'High

Chrome Cache Entry: 89

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (322), with CRLF, LF line terminators
Category:	dropped
Size (bytes):	1238
Entropy (8bit):	5.409501213795208
Encrypted:	false
SSDEEP:
MD5:	E27CE294101F9AED03F5D06E03641B4F
SHA1:	18D28E05C8964148CF93B4B2A5C7952229F9CDE6
SHA-256:	E81F31745B7C70F7F4AA947CAB9DD70348357C8B8861FDD9F12D3103695795A9
SHA-512:	2D2AA00AECE1508F4A10FA5FF9346783E157C4A0C1C19AB8AACCA1D855751A5CA86251ED148EAA60DA7FB493265053F0FC4B9D01B654A78F8930513541FC389C
Malicious:	false
Reputation:	unknown
Preview:	if(l_)..l_({.."RPCRef":payload.rpc,."callback":qr..,'action':'open'..,'status':16..,'message':'Authentication required.'..,'state':1..,'reqTime':1734383007929..,'reqNumber':2..,'recipientIdentified':false..,'success':true..,'cookiesEnabled':true..,'hadRememberMe':false..,'hadEnablePSP':false..,'openOnline':false..,'recipient':'molson@fmne.com'..,'sessionId':'FD833C7B61A155B752A377827E7DE1D8'..,'lp':'en'..,'credentialsExpiredWarning':false..,'credentialsExpiredDays':-1..,'pswdExpLink':'https://res.cisco.com/websafe/custom.action?cmd=changeExpiredPassword&id=molson@fmne.com'..,'waitTime':50000..,'minPoll':1000..,'maxPoll':5000..,'totalPoll':1200000..,'supportedLocales':[['en','English (US)'],['nl_NL','Dutch'],['de','Deutsch'],['es','Espa\xf1ol'],['fr','Fran\xe7ais'],['it','Italiano'],['pl','Polski'],['pt','Portugu\xeas'],['ru','\u0420\u0443\u0441\u0441\u043a\u0438\u0439'],['zh_CN','\u4e2d\u6587(\u7b80\u4f53)'],['ja','\u65e5\u672c\u8a9e'],['ko','\ud55c\uad6d\uc5b4']]..,'sensitivity':'High

Chrome Cache Entry: 92

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	TrueType Font data, 16 tables, 1st "GDEF", 11 names, Microsoft, language 0x409, Copyright 2020 The Inter Project Authors (https://github.com/rsms/inter)InterRegular3.019;RSMS;I
Category:	downloaded
Size (bytes):	303504
Entropy (8bit):	6.240980841374878
Encrypted:	false
SSDEEP:
MD5:	A4A7379505CD554EA9523594B7C28B2A
SHA1:	C2767D146C3C10FE6C9B8AC0F181EF907C111F19
SHA-256:	EEAB48280AACD4FC83C1C7E735681DF9EDD1B59588DDE23D0339BCF6552FB788
SHA-512:	469B0C4390DAEAC176EB9D5EF5B709E00D6957137A8EB61E1A82F70B8920CED5CCE7AD33FF94410E74F27D36CD33A7D73A97F7EEFF8CAA390195CEEEBFAB60AF
Malicious:	false
Reputation:	unknown
URL:	https://static.cres-aws.com/fonts/Inter/Inter-Regular.ttf
Preview:	............GDEF1.1...;.....GPOS...X..?.....GSUB..fx..^...B.OS/2".nb..nL...`STAT.q.E...H...Hcmap/....n...e.gasp......:.....glyf..O4.......&head-.aF..F$...6hhea......n(...$hmtx..L...F\..'.loca.].4...T..'.maxp.......4... name0$Q@...@....post..5r...X..d.preph......8............................!...!...!...!...!...........................@.........................H...(........!!.!.!.#.!.!.L..........................d....H...(.@.......#..!!.!.!.#.!.!."&54632....!"&54632.....L....................?aa?E[[..?aa?E[[.......d...a?E[[E?aa?E[[E?a...H...(.H.&.......l.@.....H...(...&.......f.d.....H...(...&.......d.......H...(.h.&.......j.8.....H...(.........&..!!.!.!.#.!.!."&546632......'2654&#".....L.....................x.N.PP.NN.P>RR>>RR.......d..H.xP.NN.PP.N.U==UU==U...H...(...&...............H...@...&.......v.......H...(...&.......m.@.....H...(...&.......n.@.....H...@...&.......v.......H...(.h.&.......s.8.....H...(...&...............H...(...&...............H...(...&.......{.@.....H...(.t.&.......

Chrome Cache Entry: 93

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=1, copyright=sandra cifo. www.cifography.com. 2016], baseline, precision 8, 1920x1280, components 3
Category:	dropped
Size (bytes):	155249
Entropy (8bit):	7.9359220373800605
Encrypted:	false
SSDEEP:
MD5:	C3598F2D3BF6694DF3378AAFC792BFEE
SHA1:	BBCA95477B9B15A41E4EDC59784D76F621A27263
SHA-256:	A7842139A79734699FB6BD749733DA53E30B3634FB8C2695B57FD1A017DD1FE2
SHA-512:	5623BDBCD1FC446518E1DCE0817813E55938136D09375F35CFF3F828085C5B9A383DB43904565B7B5399B12919C72D56E0D4E00CB5582FE158E793CF41795425
Malicious:	false
Reputation:	unknown
Preview:	.....JExif..II*...........&...........sandra cifo. www.cifography.com. 2016.......Ducky..............http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmpMM:OriginalDocumentID="336EC317CA114058096C1124050B0AA8" xmpMM:DocumentID="xmp.did:DAB4B4FE077711EAA675C9DC7313E7A3" xmpMM:InstanceID="xmp.iid:DAB4B4FD077711EAA675C9DC7313E7A3" xmp:CreatorTool="Adobe Photoshop CC 2019 (Macintosh)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:E712D444FE6211E994A3CEA94946B049" stRef:documentID="xmp.did:E712D445FE6211E994A3CEA94946B049"/> <dc:rights> <rdf:Alt> <rdf:li xml:lang="x-

Chrome Cache Entry: 94

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (64131)
Category:	downloaded
Size (bytes):	70357
Entropy (8bit):	5.316512415217151
Encrypted:	false
SSDEEP:
MD5:	7C909F6DD07BED69C9CDABC9DEE2C131
SHA1:	7EF0ABFDB5935CDC2D50953FC0CEE43ABB501C28
SHA-256:	C1F5534ED276A1EAA57B106C7DADCC994A01EFBC033513EA4F5435580D8C327E
SHA-512:	E7E16B1264A28E3C5102B25678B7022048284180205348126BD32034C37EB55492F8C3D9B0493D6BB3A43D9AFB0338CD2678352A5FAD5CE415B4972C53E031D3
Malicious:	false
Reputation:	unknown
URL:	https://cdnjs.cloudflare.com/ajax/libs/select2/4.0.12/js/select2.min.js
Preview:	/! Select2 4.0.12 \| https://github.com/select2/select2/blob/master/LICENSE.md /.!function(n){"function"==typeof define&&define.amd?define(["jquery"],n):"object"==typeof module&&module.exports?module.exports=function(e,t){return void 0===t&&(t="undefined"!=typeof window?require("jquery"):require("jquery")(e)),n(t),t}:n(jQuery)}(function(u){var e=function(){if(u&&u.fn&&u.fn.select2&&u.fn.select2.amd)var e=u.fn.select2.amd;var t,n,r,h,o,s,f,g,m,v,y,_,i,a,w;function b(e,t){return i.call(e,t)}function l(e,t){var n,r,i,o,s,a,l,c,u,d,p,h=t&&t.split("/"),f=y.map,g=f&&f["*"]\|\|{};if(e){for(s=(e=e.split("/")).length-1,y.nodeIdCompat&&w.test(e[s])&&(e[s]=e[s].replace(w,"")),"."===e[0].charAt(0)&&h&&(e=h.slice(0,h.length-1).concat(e)),u=0;u<e.length;u++)if("."===(p=e[u]))e.splice(u,1),u-=1;else if(".."===p){if(0===u\|\|1===u&&".."===e[2]\|\|".."===e[u-1])continue;0<u&&(e.splice(u-1,2),u-=2)}e=e.join("/")}if((h\|\|g)&&f){for(u=(n=e.split("/")).length;0<u;u-=1){if(r=n.slice(0,u).join("/"),h)for(d=h.lengt

Chrome Cache Entry: 99

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65447)
Category:	dropped
Size (bytes):	87533
Entropy (8bit):	5.262536918435756
Encrypted:	false
SSDEEP:
MD5:	2C872DBE60F4BA70FB85356113D8B35E
SHA1:	EE48592D1FFF952FCF06CE0B666ED4785493AFDC
SHA-256:	FC9A93DD241F6B045CBFF0481CF4E1901BECD0E12FB45166A8F17F95823F0B1A
SHA-512:	BF6089ED4698CB8270A8B0C8AD9508FF886A7A842278E98064D5C1790CA3A36D5D69D9F047EF196882554FC104DA2C88EB5395F1EE8CF0F3F6FF8869408350FE
Malicious:	false
Reputation:	unknown
Preview:	/! jQuery v3.7.1 \| (c) OpenJS Foundation and other contributors \| jquery.org/license /.!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery requires a window with a document");return t(e)}:t(e)}("undefined"!=typeof window?window:this,function(ie,e){"use strict";var oe=[],r=Object.getPrototypeOf,ae=oe.slice,g=oe.flat?function(e){return oe.flat.call(e)}:function(e){return oe.concat.apply([],e)},s=oe.push,se=oe.indexOf,n={},i=n.toString,ue=n.hasOwnProperty,o=ue.toString,a=o.call(Object),le={},v=function(e){return"function"==typeof e&&"number"!=typeof e.nodeType&&"function"!=typeof e.item},y=function(e){return null!=e&&e===e.window},C=ie.document,u={type:!0,src:!0,nonce:!0,noModule:!0};function m(e,t,n){var r,i,o=(n=n\|\|C).createElement("script");if(o.text=e,t)for(r in u)(i=t[r]\|\|t.getAttribute&&t.getAttribute(r))&&o.setAttribute(r,i);n.head.appendChild(o).parentNode.remove

Static File Info

General

File type:	HTML document, Unicode text, UTF-8 text, with very long lines (491), with CRLF, LF line terminators
Entropy (8bit):	5.948957416079878
TrID:	Scalable Vector Graphics (18501/1) 24.18% HyperText Markup Language (12001/1) 15.69% HyperText Markup Language (12001/1) 15.69% HyperText Markup Language (11501/1) 15.03% HyperText Markup Language (11501/1) 15.03%
File name:	securedoc_20241216T121346.html
File size:	155'973 bytes
MD5:	2a3629d13e32b7a808df62dd6b70d992
SHA1:	e9f6686d976a275f2ca1fa73a0d4c94175ec6e14
SHA256:	2dd926883acc2e4e939002b4c1ebfe6eb2134555694ae9b868edba7b63506afc
SHA512:	54ae914e068db7a225524283633e0088cae68eee1fd576e0fffcdb61c0187bd022307be6ab66d1ab69afc634ac547eb1089c41714207cf2cd2d55644a449cb20
SSDEEP:	3072:tRl/LQISQGjA4RPeTp+IHYONivQ28Thnid6c4l:J/LQIGWp+IHYONivQ2mIkj
TLSH:	8BE37DC93312503603D718F7707B158A7A3198070509A8A1FBACC99CBBB9E96427FF9D
File Content Preview:	saved from url=(0025)https://res.cisco.com:443 -->..<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN". "http://www.w3.org/TR/html4/loose.dtd"><html.lang="en"><head><base href="http://res.cisco.com/envelopeopener/pf/ZGJAVG9rZW43ODc2OjIxNT

File Icon


Icon Hash:	173149cccc490307

Description:	Adversaries may abuse Internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality and customize aspects of Internet browsers. They can be installed directly or through a browser's app store and generally have access and permissions to everything that the browser can access.
Tactics:	Persistence
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Process: Process Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: `rundll32.exe {DLLname, DLLfunction}` ).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report securedoc_20241216T121346.html

Overview

General Information

Detection

Signatures

Classification

Process Tree

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Software Vulnerabilities

Networking

System Summary

Boot Survival

Hooking and other Techniques for Hiding and Protection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

LLM Input / Output

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Chrome Cache Entry: 100

Chrome Cache Entry: 105

Chrome Cache Entry: 106

Chrome Cache Entry: 107

Chrome Cache Entry: 108

Chrome Cache Entry: 109

Chrome Cache Entry: 110

Chrome Cache Entry: 111

Chrome Cache Entry: 112

Chrome Cache Entry: 80

Chrome Cache Entry: 82

Chrome Cache Entry: 83

Chrome Cache Entry: 84

Chrome Cache Entry: 86

Chrome Cache Entry: 87

Chrome Cache Entry: 88

Chrome Cache Entry: 89

Chrome Cache Entry: 92

Chrome Cache Entry: 93

Chrome Cache Entry: 94

Chrome Cache Entry: 99

Static File Info

General

File Icon

Windows Analysis Report
securedoc_20241216T121346.html