Edit tour

Windows Analysis Report
http://customervoice.microsoft.com/Pages/ResponsePage.aspx?id=N_pyUL0QJkeR_KiXHZsVlyTB1Qoy7S9IkE8Ogzl8coFUQlZDVFpDUkpSUUhUQzVRN0Q2MFNLQU1XTy4u

Overview

General Information

Sample URL:	http://customervoice.microsoft.com/Pages/ResponsePage.aspx?id=N_pyUL0QJkeR_KiXHZsVlyTB1Qoy7S9IkE8Ogzl8coFUQlZDVFpDUkpSUUhUQzVRN0Q2MFNLQU1XTy4u
Analysis ID:	1578170
Infos:

Detection

HTMLPhisher

Score:	80
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Suricata IDS alerts for network traffic

Yara detected HtmlPhish29

AI detected landing page (webpage, office document or email)

Phishing site or detected (based on various text indicators)

HTML page contains hidden javascript code

Classification

Process Tree

System is w10x64

chrome.exe (PID: 5440 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 1216 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2056 --field-trial-handle=2016,i,1279528855948395339,5561323063681271135,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6496 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://customervoice.microsoft.com/Pages/ResponsePage.aspx?id=N_pyUL0QJkeR_KiXHZsVlyTB1Qoy7S9IkE8Ogzl8coFUQlZDVFpDUkpSUUhUQzVRN0Q2MFNLQU1XTy4u" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

HTML

Source	Rule	Description	Author	Strings
1.2.pages.csv	JoeSecurity_HtmlPhish_29	Yara detected HtmlPhish_29	Joe Security
1.3.pages.csv	JoeSecurity_HtmlPhish_29	Yara detected HtmlPhish_29	Joe Security

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

ET PHISHING MAMBA Credential Phish Landing Page 2024-11-08

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-19T11:15:51.334626+0100	2057333	1	Successful Credential Theft Detected	192.168.2.4	49795	185.66.75.112	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: http://customervoice.microsoft.com/Pages/ResponsePage.aspx?id=N_pyUL0QJkeR_KiXHZsVlyTB1Qoy7S9IkE8Ogzl8coFUQlZDVFpDUkpSUUhUQzVRN0Q2MFNLQU1XTy4u

SlashNext: detection malicious, Label: Credential Stealing type: Phishing & Social Engineering

Antivirus detection for URL or domain

Source: https://cargalia.com/es/favicon.ico	Avira URL Cloud: Label: malware
Source: https://cargalia.com/o/?c3Y9bzM2NV8xX29uZSZyYW5kPWVFczJZems9JnVpZD1VU0VSMjkxMTIwMjRVNDYxMTI5NTU=N012	Avira URL Cloud: Label: malware
Source: https://cargalia.com/o/?c3Y9bzM2NV8xX29uZSZyYW5kPWVFczJZems9JnVpZD1VU0VSMjkxMTIwMjRVNDYxMTI5NTU=N0123N	Avira URL Cloud: Label: malware
Source: https://cargalia.com/templates/system/css/error.css	Avira URL Cloud: Label: malware
Source: https://cargalia.com/favicon.ico	Avira URL Cloud: Label: malware

Phishing

Yara detected HtmlPhish29

Source: Yara match	File source: 1.2.pages.csv, type: HTML
Source: Yara match	File source: 1.3.pages.csv, type: HTML

AI detected landing page (webpage, office document or email)

Source: https://customervoice.microsoft.com/Pages/ResponsePage.aspx?id=N_pyUL0QJkeR_KiXHZsVlyTB1Qoy7S9IkE8Ogzl8coFUQlZDVFpDUkpSUUhUQzVRN0Q2MFNLQU1XTy4u

Joe Sandbox AI: Page contains button: 'VIEW DOCUMENT HERE' Source: '1.2.pages.csv'

Phishing site or detected (based on various text indicators)

Source: Chrome DOM: 1.3

OCR Text: New PDF Document Received Received on Thursday, December 12 2024 You've received (2) PDF Documents for your review VIEW DOCUMENT HERE

Source: https://customervoice.microsoft.com/Pages/ResponsePage.aspx?id=N_pyUL0QJkeR_KiXHZsVlyTB1Qoy7S9IkE8Ogzl8coFUQlZDVFpDUkpSUUhUQzVRN0Q2MFNLQU1XTy4u

HTTP Parser: Base64 decoded: sv=o365_1_one&rand=eEs2Yzk=&uid=USER29112024U46112955

Source: https://cargalia.com/es/o?c3Y9bzM2NV8xX29uZSZyYW5kPWVFczJZems9JnVpZD1VU0VSMjkxMTIwMjRVNDYxMTI5NTU=N0123N

HTTP Parser: No favicon

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2057333 - Severity 1 - ET PHISHING MAMBA Credential Phish Landing Page 2024-11-08 : 192.168.2.4:49795 -> 185.66.75.112:443

Source: unknown	TCP traffic detected without corresponding DNS query: 217.20.58.99
Source: unknown	TCP traffic detected without corresponding DNS query: 217.20.58.99
Source: unknown	TCP traffic detected without corresponding DNS query: 217.20.58.99
Source: unknown	TCP traffic detected without corresponding DNS query: 217.20.58.99
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /o/?c3Y9bzM2NV8xX29uZSZyYW5kPWVFczJZems9JnVpZD1VU0VSMjkxMTIwMjRVNDYxMTI5NTU=N0123N HTTP/1.1Host: cargalia.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentReferer: https://customervoice.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /es/o?c3Y9bzM2NV8xX29uZSZyYW5kPWVFczJZems9JnVpZD1VU0VSMjkxMTIwMjRVNDYxMTI5NTU=N0123N HTTP/1.1Host: cargalia.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://customervoice.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: f66b39256cfc1ac0c6f9894655f3609d=8a27i0rfa5bvuql86j8sun90sv
Source: global traffic	HTTP traffic detected: GET /templates/system/css/error.css HTTP/1.1Host: cargalia.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://cargalia.com/es/o?c3Y9bzM2NV8xX29uZSZyYW5kPWVFczJZems9JnVpZD1VU0VSMjkxMTIwMjRVNDYxMTI5NTU=N0123NAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: f66b39256cfc1ac0c6f9894655f3609d=8a27i0rfa5bvuql86j8sun90sv
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: cargalia.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cargalia.com/es/o?c3Y9bzM2NV8xX29uZSZyYW5kPWVFczJZems9JnVpZD1VU0VSMjkxMTIwMjRVNDYxMTI5NTU=N0123NAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: f66b39256cfc1ac0c6f9894655f3609d=8a27i0rfa5bvuql86j8sun90sv
Source: global traffic	HTTP traffic detected: GET /es/favicon.ico HTTP/1.1Host: cargalia.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cargalia.com/es/o?c3Y9bzM2NV8xX29uZSZyYW5kPWVFczJZems9JnVpZD1VU0VSMjkxMTIwMjRVNDYxMTI5NTU=N0123NAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: f66b39256cfc1ac0c6f9894655f3609d=8a27i0rfa5bvuql86j8sun90sv

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: cdn.forms.office.net
Source: global traffic	DNS traffic detected: DNS query: cargalia.com

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 19 Dec 2024 10:15:51 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeX-Powered-By: PHP/7.4.33Cache-Control: no-cachePragma: no-cacheX-Content-Type-Options: nosniff
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 19 Dec 2024 10:15:58 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeX-Powered-By: PHP/7.4.33Cache-Control: no-cachePragma: no-cacheX-Content-Type-Options: nosniff

Source: chromecache_83.2.dr, chromecache_100.2.dr	String found in binary or memory: http://api.jqueryui.com/category/ui-core/
Source: chromecache_83.2.dr, chromecache_100.2.dr	String found in binary or memory: http://jquery.org/license
Source: chromecache_83.2.dr, chromecache_100.2.dr	String found in binary or memory: http://jqueryui.com
Source: chromecache_95.2.dr, chromecache_76.2.dr	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: chromecache_96.2.dr, chromecache_99.2.dr	String found in binary or memory: https://artifacts.dev.azure.com/office/_apis/symbol/symsrv/response-page-pro.cachegroup-nerve.min.7d
Source: chromecache_78.2.dr, chromecache_88.2.dr	String found in binary or memory: https://artifacts.dev.azure.com/office/_apis/symbol/symsrv/response-page-pro.chunk.1ds.e8b22bb.js.ma
Source: chromecache_84.2.dr, chromecache_87.2.dr	String found in binary or memory: https://artifacts.dev.azure.com/office/_apis/symbol/symsrv/response-page-pro.chunk.616.93becff.js.ma
Source: chromecache_102.2.dr, chromecache_85.2.dr	String found in binary or memory: https://artifacts.dev.azure.com/office/_apis/symbol/symsrv/response-page-pro.chunk.cvheadertheme.5c3
Source: chromecache_80.2.dr, chromecache_91.2.dr	String found in binary or memory: https://artifacts.dev.azure.com/office/_apis/symbol/symsrv/response-page-pro.chunk.cvtitlerender.e68
Source: chromecache_75.2.dr, chromecache_94.2.dr	String found in binary or memory: https://artifacts.dev.azure.com/office/_apis/symbol/symsrv/response-page-pro.chunk.ir.96ce202.js.map
Source: chromecache_105.2.dr	String found in binary or memory: https://artifacts.dev.azure.com/office/_apis/symbol/symsrv/response-page-pro.chunk.postsubmit.ae2b31
Source: chromecache_79.2.dr	String found in binary or memory: https://artifacts.dev.azure.com/office/_apis/symbol/symsrv/response-page-pro.chunk.quiz.4c32c58.js.m
Source: chromecache_93.2.dr, chromecache_86.2.dr	String found in binary or memory: https://artifacts.dev.azure.com/office/_apis/symbol/symsrv/response-page-pro.chunk.vendors.aa37695.j
Source: chromecache_83.2.dr, chromecache_100.2.dr	String found in binary or memory: https://artifacts.dev.azure.com/office/_apis/symbol/symsrv/response-page-pro.min.5e8194d.js.map/7508
Source: chromecache_77.2.dr, chromecache_106.2.dr	String found in binary or memory: https://cargalia.com/o/?c3Y9bzM2NV8xX29uZSZyYW5kPWVFczJZems9JnVpZD1VU0VSMjkxMTIwMjRVNDYxMTI5NTU=N012
Source: chromecache_76.2.dr	String found in binary or memory: https://fb.me/react-polyfills
Source: chromecache_92.2.dr	String found in binary or memory: https://forms.office.com.
Source: chromecache_71.2.dr	String found in binary or memory: https://getbootstrap.com/)
Source: chromecache_71.2.dr	String found in binary or memory: https://getbootstrap.com/docs/3.4/customize/)
Source: chromecache_82.2.dr, chromecache_103.2.dr	String found in binary or memory: https://github.com/SoapBox/linkifyjs
Source: chromecache_71.2.dr	String found in binary or memory: https://github.com/twbs/bootstrap/blob/master/LICENSE)
Source: chromecache_84.2.dr, chromecache_87.2.dr	String found in binary or memory: https://jquery.com/
Source: chromecache_84.2.dr, chromecache_87.2.dr	String found in binary or memory: https://jquery.org/license
Source: chromecache_84.2.dr, chromecache_87.2.dr	String found in binary or memory: https://js.foundation/
Source: chromecache_77.2.dr, chromecache_106.2.dr	String found in binary or memory: https://mfpembedcdnwus2.azureedge.net/mfpembedcontwus2/Embed.css
Source: chromecache_77.2.dr, chromecache_106.2.dr	String found in binary or memory: https://mfpembedcdnwus2.azureedge.net/mfpembedcontwus2/Embed.js
Source: chromecache_83.2.dr, chromecache_100.2.dr	String found in binary or memory: https://raw.githubusercontent.com/stefanpenner/es6-promise/master/LICENSE
Source: chromecache_76.2.dr	String found in binary or memory: https://reactjs.org/docs/error-decoder.html?invariant=
Source: chromecache_84.2.dr, chromecache_87.2.dr	String found in binary or memory: https://sizzlejs.com/
Source: chromecache_95.2.dr, chromecache_76.2.dr	String found in binary or memory: https://underscorejs.org

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49832 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443

Source: classification engine

Classification label: mal80.phis.win@18/57@8/5

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2056 --field-trial-handle=2016,i,1279528855948395339,5561323063681271135,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://customervoice.microsoft.com/Pages/ResponsePage.aspx?id=N_pyUL0QJkeR_KiXHZsVlyTB1Qoy7S9IkE8Ogzl8coFUQlZDVFpDUkpSUUhUQzVRN0Q2MFNLQU1XTy4u"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2056 --field-trial-handle=2016,i,1279528855948395339,5561323063681271135,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: chromecache_71.2.dr

Binary or memory string: '}.ms-Icon--ConnectVirtualMachine::before{content:'

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Browser Extensions	1 Process Injection	1 Process Injection	OS Credential Dumping	1 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	3 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
http://customervoice.microsoft.com/Pages/ResponsePage.aspx?id=N_pyUL0QJkeR_KiXHZsVlyTB1Qoy7S9IkE8Ogzl8coFUQlZDVFpDUkpSUUhUQzVRN0Q2MFNLQU1XTy4u	0%	Avira URL Cloud	safe
http://customervoice.microsoft.com/Pages/ResponsePage.aspx?id=N_pyUL0QJkeR_KiXHZsVlyTB1Qoy7S9IkE8Ogzl8coFUQlZDVFpDUkpSUUhUQzVRN0Q2MFNLQU1XTy4u	100%	SlashNext	Credential Stealing type: Phishing & Social Engineering

Source	Detection	Scanner	Label
https://forms.office.com.	0%	Avira URL Cloud	safe
https://cargalia.com/es/favicon.ico	100%	Avira URL Cloud	malware
https://cargalia.com/o/?c3Y9bzM2NV8xX29uZSZyYW5kPWVFczJZems9JnVpZD1VU0VSMjkxMTIwMjRVNDYxMTI5NTU=N012	100%	Avira URL Cloud	malware
https://cargalia.com/o/?c3Y9bzM2NV8xX29uZSZyYW5kPWVFczJZems9JnVpZD1VU0VSMjkxMTIwMjRVNDYxMTI5NTU=N0123N	100%	Avira URL Cloud	malware
https://cargalia.com/templates/system/css/error.css	100%	Avira URL Cloud	malware
https://cargalia.com/favicon.ico	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
www.google.com	142.250.181.132	true	false	high
s-part-0035.t-0009.t-msedge.net	13.107.246.63	true	false	high
cargalia.com	185.66.75.112	true	true	unknown
cdn.forms.office.net	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://cargalia.com/templates/system/css/error.css	true	Avira URL Cloud: malware	unknown
https://cargalia.com/es/o?c3Y9bzM2NV8xX29uZSZyYW5kPWVFczJZems9JnVpZD1VU0VSMjkxMTIwMjRVNDYxMTI5NTU=N0123N	false		unknown
https://cargalia.com/favicon.ico	true	Avira URL Cloud: malware	unknown
https://cargalia.com/o/?c3Y9bzM2NV8xX29uZSZyYW5kPWVFczJZems9JnVpZD1VU0VSMjkxMTIwMjRVNDYxMTI5NTU=N0123N	true	Avira URL Cloud: malware	unknown
https://cargalia.com/es/favicon.ico	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.apache.org/licenses/LICENSE-2.0	chromecache_95.2.dr, chromecache_76.2.dr	false		high
https://getbootstrap.com/docs/3.4/customize/)	chromecache_71.2.dr	false		high
http://jquery.org/license	chromecache_83.2.dr, chromecache_100.2.dr	false		high
https://artifacts.dev.azure.com/office/_apis/symbol/symsrv/response-page-pro.chunk.cvtitlerender.e68	chromecache_80.2.dr, chromecache_91.2.dr	false		high
https://reactjs.org/docs/error-decoder.html?invariant=	chromecache_76.2.dr	false		high
http://api.jqueryui.com/category/ui-core/	chromecache_83.2.dr, chromecache_100.2.dr	false		high
http://jqueryui.com	chromecache_83.2.dr, chromecache_100.2.dr	false		high
https://artifacts.dev.azure.com/office/_apis/symbol/symsrv/response-page-pro.chunk.vendors.aa37695.j	chromecache_93.2.dr, chromecache_86.2.dr	false		high
https://getbootstrap.com/)	chromecache_71.2.dr	false		high
https://cargalia.com/o/?c3Y9bzM2NV8xX29uZSZyYW5kPWVFczJZems9JnVpZD1VU0VSMjkxMTIwMjRVNDYxMTI5NTU=N012	chromecache_77.2.dr, chromecache_106.2.dr	false	Avira URL Cloud: malware	unknown
https://artifacts.dev.azure.com/office/_apis/symbol/symsrv/response-page-pro.chunk.cvheadertheme.5c3	chromecache_102.2.dr, chromecache_85.2.dr	false		high
https://jquery.org/license	chromecache_84.2.dr, chromecache_87.2.dr	false		high
https://raw.githubusercontent.com/stefanpenner/es6-promise/master/LICENSE	chromecache_83.2.dr, chromecache_100.2.dr	false		high
https://artifacts.dev.azure.com/office/_apis/symbol/symsrv/response-page-pro.chunk.quiz.4c32c58.js.m	chromecache_79.2.dr	false		high
https://jquery.com/	chromecache_84.2.dr, chromecache_87.2.dr	false		high
https://github.com/SoapBox/linkifyjs	chromecache_82.2.dr, chromecache_103.2.dr	false		high
https://artifacts.dev.azure.com/office/_apis/symbol/symsrv/response-page-pro.chunk.ir.96ce202.js.map	chromecache_75.2.dr, chromecache_94.2.dr	false		high
https://artifacts.dev.azure.com/office/_apis/symbol/symsrv/response-page-pro.min.5e8194d.js.map/7508	chromecache_83.2.dr, chromecache_100.2.dr	false		high
https://artifacts.dev.azure.com/office/_apis/symbol/symsrv/response-page-pro.chunk.616.93becff.js.ma	chromecache_84.2.dr, chromecache_87.2.dr	false		high
https://forms.office.com.	chromecache_92.2.dr	false	Avira URL Cloud: safe	unknown
https://artifacts.dev.azure.com/office/_apis/symbol/symsrv/response-page-pro.chunk.postsubmit.ae2b31	chromecache_105.2.dr	false		high
https://artifacts.dev.azure.com/office/_apis/symbol/symsrv/response-page-pro.cachegroup-nerve.min.7d	chromecache_96.2.dr, chromecache_99.2.dr	false		high
https://github.com/twbs/bootstrap/blob/master/LICENSE)	chromecache_71.2.dr	false		high
https://fb.me/react-polyfills	chromecache_76.2.dr	false		high
https://underscorejs.org	chromecache_95.2.dr, chromecache_76.2.dr	false		high
https://artifacts.dev.azure.com/office/_apis/symbol/symsrv/response-page-pro.chunk.1ds.e8b22bb.js.ma	chromecache_78.2.dr, chromecache_88.2.dr	false		high
https://sizzlejs.com/	chromecache_84.2.dr, chromecache_87.2.dr	false		high
https://js.foundation/	chromecache_84.2.dr, chromecache_87.2.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.181.132	www.google.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
185.66.75.112	cargalia.com	Spain	15954	TECNOCRATICATecnocraticaCentrodeDatosSLES	true

Private

IP
192.168.2.7
192.168.2.4

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1578170
Start date and time:	2024-12-19 11:14:15 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 6s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	http://customervoice.microsoft.com/Pages/ResponsePage.aspx?id=N_pyUL0QJkeR_KiXHZsVlyTB1Qoy7S9IkE8Ogzl8coFUQlZDVFpDUkpSUUhUQzVRN0Q2MFNLQU1XTy4u
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal80.phis.win@18/57@8/5

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.181.99, 172.217.17.78, 64.233.164.84, 142.250.181.142, 13.107.246.69, 13.107.246.51, 13.107.246.41, 13.107.246.57, 13.107.246.31, 13.107.246.40, 2.18.66.226, 104.86.110.161, 104.86.110.152, 23.54.80.57, 13.74.129.1, 204.79.197.237, 13.107.21.237, 192.229.221.95, 172.217.17.35, 23.218.208.109, 4.245.163.56, 13.107.246.63
Not all processes where analyzed, report is missing behavior information
VT rate limit hit for: http://customervoice.microsoft.com/Pages/ResponsePage.aspx?id=N_pyUL0QJkeR_KiXHZsVlyTB1Qoy7S9IkE8Ogzl8coFUQlZDVFpDUkpSUUhUQzVRN0Q2MFNLQU1XTy4u

Input	Output
URL: http://customervoice.microsoft.com Model: Joe Sandbox AI	{ "typosquatting": false, "unusual_query_string": false, "suspicious_tld": false, "ip_in_url": false, "long_subdomain": false, "malicious_keywords": false, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": true, "brand_spoofing_attempt": false, "third_party_hosting": false }
URL: http://customervoice.microsoft.com
URL: https://customervoice.microsoft.com/Pages/ResponsePage.aspx?id=N_pyUL0QJkeR_KiXHZsVlyTB1Qoy7S9IkE8Ogzl8coFUQlZDVFpDUkpSUUhUQzVRN0Q2MFNLQU1XTy4u Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://customervoice.microsoft.com/Pages/ResponsePage.aspx?id=N_pyUL0QJkeR_KiXHZsVlyTB1Qoy7S9IkE8Ogzl8coFUQlZDVFpDUkpSUUhUQzVRN0Q2MFNLQU1XTy4u Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: https://customervoice.microsoft.com/Pages/ResponsePage.aspx?id=N_pyUL0QJkeR_KiXHZsVlyTB1Qoy7S9IkE8Ogzl8coFUQlZDVFpDUkpSUUhUQzVRN0Q2MFNLQU1XTy4u Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "New PDF Document Received", "prominent_button_name": "VIEW DOCUMENT HERE", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://cargalia.com/es/o?c3Y9bzM2NV8xX29uZSZyYW5kPWVFczJZems9JnVpZD1VU0VSMjkxMTIwMjRVNDYxMTI5NTU=N0123N Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://customervoice.microsoft.com/Pages/ResponsePage.aspx?id=N_pyUL0QJkeR_KiXHZsVlyTB1Qoy7S9IkE8Ogzl8coFUQlZDVFpDUkpSUUhUQzVRN0Q2MFNLQU1XTy4u Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: https://cargalia.com/es/o?c3Y9bzM2NV8xX29uZSZyYW5kPWVFczJZems9JnVpZD1VU0VSMjkxMTIwMjRVNDYxMTI5NTU=N0123N Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (32102)
Category:	dropped
Size (bytes):	799726
Entropy (8bit):	5.380183078880162
Encrypted:	false
SSDEEP:	6144:Ns98kk/vJAfnbZFe8rpd+z91LGAb2RkNI1M+zeO6crrFtSg9+dUAevGXuUOwcLxr:2NtfnXWBueTqw2r
MD5:	11A99865B8D25E480C23CD2B63F20E28
SHA1:	BCD35D6657DB5C064ED94312472EF1E592B8D0A6
SHA-256:	3E0C2F6A344AFE5E9E3B81DA71656F8CEA6044572A5193048287D83C5A5DF94D
SHA-512:	7A548DF17738C359B918B717AE7EDAC4F400F9AB954EB1F3890A7AC2043162BDD6E33FEDCE55EF7516050D016B3798A7EF88F0FF53C9611F82F324E580DF9A97
Malicious:	false
Reputation:	low
Preview:	(function(){var __webpack_modules__={71191:function(n,t,e){"use strict";e.d(t,{EW:function(){return m},Il:function(){return f},KJ:function(){return l},Kz:function(){return S},My:function(){return g},Nn:function(){return p},OD:function(){return a},ay:function(){return d},qw:function(){return v},rh:function(){return h}});var r=e(120);function i(n,t){return n?n+"."+t:t}function o(n,t,e,o,u){void 0===u&&(u=4),o&&n.push((0,r.m9)("".concat(i(t,e)),o,u))}function u(n,t,e,o){"boolean"==typeof o&&n.push((0,r.LK)("".concat(i(t,e)),o))}function s(n,t,e,o){"number"==typeof o&&n.push((0,r.Ug)("".concat(i(t,e)),o))}var a,c=function(n){var t="Activity.Result",e=[];return s(e,t,"Code",n.code),o(e,t,"Type",n.type),s(e,t,"Tag",n.tag),u(e,t,"IsExpected",n.isExpected),e.push((0,r.m9)("zC.Activity.Result","Office.System.Result")),e},f={contractName:"Office.System.Activity",getFields:function(n){var t="Activity",e=[];return o(e,t,"CV",n.cV),s(e,t,"Duration",n.duration),s(e,t,"Count",n.count),s(e,t,"AggMode"

Chrome Cache Entry: 101

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (65506), with no line terminators
Category:	downloaded
Size (bytes):	528595
Entropy (8bit):	5.074596954565412
Encrypted:	false
SSDEEP:	12288:hHU5EFMAKR+/rI5LsTKkw8sX9P7BePb/V6bFSDqwnZhqtRqwzXZ5HzK3DgmGNNYZ:hHU5EKAKR+/rI5LsTKkw8sX9P7BePb/b
MD5:	8562191137BA1917CF5887508E36853D
SHA1:	146F6F85316DF9BAF351440378732BB81ABF26D8
SHA-256:	92AE085B781A59E40B73EFC9AC4210804DEC629F49F90ACA02FF470596AF963F
SHA-512:	C2F22FD0937D4F1EC9C1E42D364BD39CDEC8E6D093119BDA4E28682992CD781A13CEDC1CBCF33009EF656FB0A011959B4F6923E3E3D9B913B337974EBDF885A9
Malicious:	false
Reputation:	low
URL:	https://cdn.forms.office.net/forms/scripts/dists/ls-pro.en-us.ba3db0403.js
Preview:	window.FormsLsMap = (window.FormsLsMap \|\| {});window.FormsLsMap["en-us"]={"Common_Close_Text":"Close","Common_Back_Text":"Back","Common_Cancel_Text":"Cancel","Common_Stop_Text":"Stop","Common_Delete_Text":"Delete","Common_Deleted_Text":"Deleted","Common_Responses_Text":"Responses","Common_Loading_Text":"Loading.","Common_Refresh_Text":"Refresh","Common_Edit_Text":"Edit","Common_Yes_Text":"Yes","Common_No_Text":"No","Common_Or_Text_Lowercased":"or","Common_Retry_Text":"Retry","Common_Try_again_Text":"Try again","Common_Prefill_Text":"Prefill","Common_Preview_Text":"Preview","Common_Points_Text":"Points","Common_Number_Text":"Number","Common_Next_Text":"Next","Common_Go_Text":"GO","Common_More_Options_Text":"More options","Common_Copy_Text":"Copy","Common_Copylink_Text":"Copy link","Common_UnknownUser_Text":"Unknown user","Common_UnknownGroup_Text":"Unknown group","Common_SearchResult_Text":"Search Result","Common_Info_Icon":"Info Icon","Common_Generate_Text":"Generate","Common_Files":

Chrome Cache Entry: 102

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (23927)
Category:	dropped
Size (bytes):	24179
Entropy (8bit):	5.331646264644295
Encrypted:	false
SSDEEP:	384:qiivZp4gVgTgJg9g0gsgwgtgfgmvgbgkg1grgBzAJtg/gL9gpgLg5gkLgagFgNEb:jOGMqCQZ1rAijvit2I+zAJtCu9KUSZLE
MD5:	CF27DD148552070F1ECAC4B8D635413E
SHA1:	94916A1867C288FDB3D22E9B81B6634195A87C3D
SHA-256:	64B8B4F1BA65815D2AFC31A44FC57CDF7EBB645DBDCCE75AC4D5A3DC6A497F79
SHA-512:	FF0799AD73340DFFF67BA2F42CB26AD4F18318BB0F099287C5EFFBB56BAEC29CC558D8EB7C7476BE5FFCEF5FACB26573C64E653AD1DA7957721404E471F6108E
Malicious:	false
Reputation:	low
Preview:	"use strict";(self.webpackChunk=self.webpackChunk\|\|[]).push([[954],{9688:function(o,e,r){r.d(e,{$_:function(){return n},G0:function(){return l},R2:function(){return d},Tz:function(){return p},d9:function(){return i},kU:function(){return c},qN:function(){return m},re:function(){return t},uF:function(){return a}});var i=.5,t=1.5,c=4.5,n=3,a=1.5,f=[{BackgroundColor:"#eee6f2",BackgroundImage:null,Name:"CV_HBG_Professional",PrimaryColor:"#21052e",SecondaryColor:"#0f0214",Thumbnail:null},{BackgroundColor:"#e6eff2",BackgroundImage:null,Name:"CV_HBG_Friendly",PrimaryColor:"#185b75",SecondaryColor:"#13475b",Thumbnail:null},{BackgroundColor:"#e6f2eb",BackgroundImage:null,Name:"CV_HBG_Playful",PrimaryColor:"#237547",SecondaryColor:"#1b5b38",Thumbnail:null},{BackgroundColor:"#f2ece6",BackgroundImage:null,Name:"CV_HBG_Relaxed",PrimaryColor:"#68503c",SecondaryColor:"#4f3c2d",Thumbnail:null},{BackgroundColor:"#e6ecf2",BackgroundImage:null,Name:"CV_HBG_3DMolecules",PrimaryColor:"#416083",SecondaryColo

Chrome Cache Entry: 103

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (19569), with CRLF line terminators
Category:	downloaded
Size (bytes):	31572
Entropy (8bit):	5.333378143141286
Encrypted:	false
SSDEEP:	768:GJdE/g/UkYPHHAEOY/Pz+TPkoo0PsH6p91U1k8o:8UHHA4LcQe91U1kp
MD5:	9ACA0AFBC4561365D1DB07D88037EE53
SHA1:	A5DC94C7BD49DEED5C4E2FC9FA671A93ECA85766
SHA-256:	31EFB5F52CD1CFAFB214D34CD7135227160302BE2022772496D8EC33FAD2E03B
SHA-512:	FBA5CC91054F03AF253D2FA1B5D4C45A272117FC9423F37AE5C6F58A6619F6DD85EFF0DADB1516D661097C0165278F1C8DAC3478186324FA83EA700151346291
Malicious:	false
Reputation:	low
URL:	https://cdn.forms.office.net/forms/scripts/vendors/combinedmin/response_v2.min.ad1c4f6.js
Preview:	/!.. linkify.js v2.1.8.. * https://github.com/SoapBox/linkifyjs.. * Copyright (c) 2014 SoapBox Innovations Inc... * Licensed under the MIT license.. */..!function(){"use strict";var n="function"==typeof Symbol&&"symbol"==typeof Symbol.iterator?function(n){return typeof n}:function(n){return n&&"function"==typeof Symbol&&n.constructor===Symbol&&n!==Symbol.prototype?"symbol":typeof n};!function(e){function a(n,e){var a=arguments.length>2&&void 0!==arguments[2]?arguments[2]:{},t=Object.create(n.prototype);for(var o in a)t[o]=a[o];return t.constructor=e,e.prototype=t,e}function t(n){n=n\|\|{},this.defaultProtocol=n.hasOwnProperty("defaultProtocol")?n.defaultProtocol:h.defaultProtocol,this.events=n.hasOwnProperty("events")?n.events:h.events,this.format=n.hasOwnProperty("format")?n.format:h.format,this.formatHref=n.hasOwnProperty("formatHref")?n.formatHref:h.formatHref,this.nl2br=n.hasOwnProperty("nl2br")?n.nl2br:h.nl2br,this.tagName=n.hasOwnProperty("tagName")?n.tagName:h.tagName,this.targ

Chrome Cache Entry: 104

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	89
Entropy (8bit):	5.265726863868522
Encrypted:	false
SSDEEP:	3:YMwVJ7ezJAn4cFMzWJdphw62FXb3B52jYn:YMw77Hn4cLzI6gDBPn
MD5:	373237E89EA7328170A580C96031F25E
SHA1:	2E5A0421BE4972C4F5C043814C75AE2E52A1F20F
SHA-256:	50E8DC6A1B6781D6C6B1FC9F47A29FF8C44F42900D8C2328606E12743948ADD2
SHA-512:	CF0B8AFEEDE859EE6142F0955CF2D9E56DA14E06756F27D57AE35E8A223E09C72206DDD264418F128367B73258D65CEB045235E667423CE9D3387F8A98111A5E
Malicious:	false
Reputation:	low
Preview:	{"id":"N_pyUL0QJkeR_KiXHZsVlyTB1Qoy7S9IkE8Ogzl8coFUQlZDVFpDUkpSUUhUQzVRN0Q2MFNLQU1XTy4u"}

Chrome Cache Entry: 105

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	109092
Entropy (8bit):	5.4064484604607514
Encrypted:	false
SSDEEP:	1536:XfDKniNuN8bBBg0oJ4ezARl/HbpWXkxkt/lNc7t/uEWzrEWsXThdH0TEMb:LLIN8bBB2yY5E4x
MD5:	02F0CBBF60618FEEF34460F4081679AA
SHA1:	712447B023A5B83BA7D9ECB81452B5B6CF82745D
SHA-256:	0BD8087AD441197168B6C21E6F38E704C1A4620F423ABFEC13254011AD58B194
SHA-512:	E229940D121D819D31A5673A64AF4FDF0EF2FFE3E5777B795CA31F7728DB9DFEC60E2DFC68086CBED2DDC112EAD019C54E8BFA77154AE4A40B7946F4DBD745C2
Malicious:	false
Reputation:	low
URL:	https://cdn.forms.office.net/forms/scripts/dists/response-page-pro.chunk.postsubmit.ae2b319.js
Preview:	"use strict";(self.webpackChunk=self.webpackChunk\|\|[]).push([[981],{94335:function(e,t,r){function n(e){i!==e&&(i=e)}function o(){return void 0===i&&(i="undefined"!=typeof document&&!!document.documentElement&&"rtl"===document.documentElement.getAttribute("dir")),i}var i;function a(){return{rtl:o()}}r.d(t,{DU:function(){return n},Iy:function(){return a}}),i=o()},75265:function(e,t,r){r.d(t,{b:function(){return i},n:function(){return c}});var n,o=r(34629),i={none:0,insertNode:1,appendChild:2},a="undefined"!=typeof navigator&&/rv:11.0/.test(navigator.userAgent),s={};try{s=window\|\|{}}catch(e){}var c=function(){function e(e,t){var r,n,a,s,c,u;this._rules=[],this._preservedRules=[],this._counter=0,this._keyToClassName={},this._onInsertRuleCallbacks=[],this._onResetCallbacks=[],this._classNameToArgs={},this._config=(0,o.Cl)({injectionMode:"undefined"==typeof document?i.none:i.insertNode,defaultPrefix:"css",namespace:void 0,cspSettings:void 0},e),this._classNameToArgs=null!==(r=null==t?void 0

Chrome Cache Entry: 106

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	5730
Entropy (8bit):	5.183773167231501
Encrypted:	false
SSDEEP:	96:ilDVs5t3HPnjtG+rdfCNbzPckSvYXU9eIzJaZ4JkQ95:EsDHbtG+rdfCNbzklvLYk0ZRQb
MD5:	C710AD7529046BE987967AEF916EB3E8
SHA1:	51D0F87307EB03D0D1FC2BCBB46B629EA07BA1B9
SHA-256:	7086A39ADB8FF2483252BB4848D21A6D8834310A21C8D9FEB9120A63A033DD29
SHA-512:	B4DDEF85E5D9D467F8ACF6858242D2B4DE1193C85B1C17FB02DA2754067CDB01774AB4D49F5746101A657CF94B15893052D14ABB48AF80DAD9656FA3589B0E06
Malicious:	false
Reputation:	low
Preview:	{"description":"Received on Thursday, December 12.2024\n","onlineSafetyLevel":0,"reputationTier":1,"background":{"altText":null,"contentType":null,"fileIdentifier":null,"originalFileName":null,"resourceId":null,"resourceUrl":null,"height":null,"width":null,"size":null},"header":{"altText":null,"contentType":null,"fileIdentifier":null,"originalFileName":null,"resourceId":null,"resourceUrl":null,"height":null,"width":null,"size":null},"logo":{"altText":null,"contentType":null,"fileIdentifier":null,"originalFileName":null,"resourceId":null,"resourceUrl":null,"height":null,"width":null,"size":null},"tableId":"TBVCTZCRJRQHTC5Q7D60SKAMWO","otherInfo":"{\"Theme\":{\"Name\":\"CV_Blue\"}}","runtimeResponses":null,"permissions":[],"responderPermissions":[],"status":"Active","category":null,"localeInfo":"{\"TimezoneOffset\":-480,\"Locale\":\"en-US\",\"TimezoneId\":\"America/Los_Angeles\"}","descriptiveQuestions":[{"groupId":null,"defaultValue":null,"image":{"altText":null,"contentType":null,"fil

Chrome Cache Entry: 71

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (64954), with CRLF line terminators
Category:	downloaded
Size (bytes):	213851
Entropy (8bit):	5.088246037410228
Encrypted:	false
SSDEEP:	1536:1IuiHlqxqvT5Rbs+VvaHTwhW2CyUueSRboS2aaY9hiCA3:tAT5Ns+VkTwhWRq1Qaxu
MD5:	1E32CA6BBAFE052158A41BF5C67F5DEA
SHA1:	B54FA24F0670E191B0CDEFEE82AE4F9C75C4FAB8
SHA-256:	2AE8446022C65DEFC2BDB3B4E0760F4F1AB95D054CAC799AE33168C67C17C872
SHA-512:	EC615FCA5E92BDAFFC95BC589942FDC8A50A4CBD57EB70E0E9D20E3DC15733E995DC4C0F112BB28272A3A256FF43BDCDBA7914CEEBD044A6033B77098078EFB0
Malicious:	false
Reputation:	low
URL:	https://cdn.forms.office.net/forms/css/dist/cv-response-page.min.92870c5.css
Preview:	@charset 'UTF-8';/!.. Generated using the Bootstrap Customizer (https://getbootstrap.com/docs/3.4/customize/).. //!.. * Bootstrap v3.4.1 (https://getbootstrap.com/).. * Copyright 2011-2019 Twitter, Inc... * Licensed under MIT (https://github.com/twbs/bootstrap/blob/master/LICENSE).. //! normalize.css v3.0.3 \| MIT License \| github.com/necolas/normalize.css */html{font-family:sans-serif;-ms-text-size-adjust:100%;-webkit-text-size-adjust:100%}body{margin:0}article,aside,details,figcaption,figure,footer,header,hgroup,main,menu,nav,section,summary{display:block}audio,canvas,progress,video{display:inline-block;vertical-align:baseline}audio:not([controls]){display:none;height:0}[hidden],template{display:none}a{background-color:transparent}a:active,a:hover{outline:0}abbr[title]{border-bottom:none;text-decoration:underline;text-decoration:underline dotted}b,strong{font-weight:700}dfn{font-style:italic}h1{font-size:2em;margin:.67em 0}mark{background:#ff0;color:#000}small{font-size:80%}sub

Chrome Cache Entry: 72

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	17
Entropy (8bit):	3.4992275471326932
Encrypted:	false
SSDEEP:	3:YVXMTvciJHw:Y9M74
MD5:	AF469AC6ABAAF7DA1ACC59F7292E6671
SHA1:	75ACAD50ED8287D26D5EA2C7380B09B6095DA453
SHA-256:	AC8EA734A33366EF42F62398D95B4A9D912043522CF945405FD691F7AA342FED
SHA-512:	7422A346D1B74D672EB6DBEC85D63F3A6D8C394FA8318F128E9594469DFC4FDEAA190DE5426224BDB1B77C53E73CD29BA8A42780683B6B586C717F4AB3D8CE02
Malicious:	false
Reputation:	low
URL:	https://customervoice.microsoft.com/formapi/api/privacy?ownerTenantId=5072fa37-10bd-4726-91fc-a8971d9b1597&currentUserTenantId=5072fa37-10bd-4726-91fc-a8971d9b1597&isAnonymous=true
Preview:	{"privacyUrl":""}

Chrome Cache Entry: 73

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	17
Entropy (8bit):	3.4992275471326932
Encrypted:	false
SSDEEP:	3:YVXMTvciJHw:Y9M74
MD5:	AF469AC6ABAAF7DA1ACC59F7292E6671
SHA1:	75ACAD50ED8287D26D5EA2C7380B09B6095DA453
SHA-256:	AC8EA734A33366EF42F62398D95B4A9D912043522CF945405FD691F7AA342FED
SHA-512:	7422A346D1B74D672EB6DBEC85D63F3A6D8C394FA8318F128E9594469DFC4FDEAA190DE5426224BDB1B77C53E73CD29BA8A42780683B6B586C717F4AB3D8CE02
Malicious:	false
Reputation:	low
Preview:	{"privacyUrl":""}

Chrome Cache Entry: 74

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	89
Entropy (8bit):	5.265726863868522
Encrypted:	false
SSDEEP:	3:YMwVJ7ezJAn4cFMzWJdphw62FXb3B52jYn:YMw77Hn4cLzI6gDBPn
MD5:	373237E89EA7328170A580C96031F25E
SHA1:	2E5A0421BE4972C4F5C043814C75AE2E52A1F20F
SHA-256:	50E8DC6A1B6781D6C6B1FC9F47A29FF8C44F42900D8C2328606E12743948ADD2
SHA-512:	CF0B8AFEEDE859EE6142F0955CF2D9E56DA14E06756F27D57AE35E8A223E09C72206DDD264418F128367B73258D65CEB045235E667423CE9D3387F8A98111A5E
Malicious:	false
Reputation:	low
URL:	"https://customervoice.microsoft.com/formapi/api/5072fa37-10bd-4726-91fc-a8971d9b1597/users/0ad5c124-ed32-482f-904f-0e83397c7281/light/runtimeForms('N_pyUL0QJkeR_KiXHZsVlyTB1Qoy7S9IkE8Ogzl8coFUQlZDVFpDUkpSUUhUQzVRN0Q2MFNLQU1XTy4u')?$select=id,customCssFileName,customCSSInLineHeaderToggle,footerText"
Preview:	{"id":"N_pyUL0QJkeR_KiXHZsVlyTB1Qoy7S9IkE8Ogzl8coFUQlZDVFpDUkpSUUhUQzVRN0Q2MFNLQU1XTy4u"}

Chrome Cache Entry: 75

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (13674)
Category:	dropped
Size (bytes):	13904
Entropy (8bit):	5.193200580759521
Encrypted:	false
SSDEEP:	384:vidEgOqvmRD5iS+XMC0ylrheyMvlfVi85cuif2KgKePRyIzqtz1gae6lH/0Xrm:KdEaeRl+MlyRhe1vlfVi8iuiuKgKeP4x
MD5:	B2B10F546DE6BE78084077ED645DDD51
SHA1:	DF56C5487AF39450EEAF72A306ECA661FF8B8971
SHA-256:	05F16A397E831F59497911C154656D7D0E4BFACE8AD907707109AD6F14A66540
SHA-512:	7E633296C6F2C0DAF6D513805A2FC8BA29171096D5EF507535988DC5B46A8751219E639F05E67F280F2DB474636AACAE25A71B11C37C58982E9BC72C0F41F572
Malicious:	false
Reputation:	low
Preview:	"use strict";(self.webpackChunk=self.webpackChunk\|\|[]).push([[902],{3750:function(e,t,n){n.r(t),n.d(t,{TitleOverflowMenu:function(){return I}});var o=n(34629),r=n(41594),i=n(53013),s=n(16038),u=n(59198),a=n(33589),l=n(39962),p=n(97410),c=n(33330),d=n(22224),h=n(38826),m=n(98031),f=n(29169),M=n(71683),g=n(17280),b=n(66970);var v=function(e){function t(t){var n=e.call(this,t)\|\|this;return n.menuTriggerRef=r.createRef(),n.subMenuTriggerRef=r.createRef(),n.menuTableRef=r.createRef(),n.resizeTimeId=null,n.blurTimeId=null,n.triggerFocused=!1,n.selectedElement=null,n.controlId=d.uniqueId("menu"),n.allowScrollBar=!n.props.SubMenu,n.state={MenuExpanded:!1,DisableButtonFocused:!1},n.getRoot=n.getRoot.bind(n),n.onMenuBlur=n.onMenuBlur.bind(n),n.onKeyDownForMenuTriggerButton=n.onKeyDownForMenuTriggerButton.bind(n),n.handleKeyUpOnTable=n.handleKeyUpOnTable.bind(n),n.resizeWindowCallback=n.resizeWindowCallback.bind(n),n.focusOnMenuItem=n.focusOnMenuItem.bind(n),n.setSelectedElement=n.setSelectedElem

Chrome Cache Entry: 76

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (47421), with CRLF line terminators
Category:	dropped
Size (bytes):	369103
Entropy (8bit):	5.381338995618774
Encrypted:	false
SSDEEP:	6144:dMy8G6RujcHX6MQ47GK4C/YG7jtogSPiRoUQrwYq4UKHZeSY8/sLy9:qywRuI36TCIPiRoUqKMZZ/aW
MD5:	6E9386843C22345A256F324692D627F2
SHA1:	FEF7FADB3A27032695AAB726682A340D583BFC51
SHA-256:	D40E9F33813211AA5DFABEEBF4A1571D488E56878954DE4D513A25B3525B3988
SHA-512:	C90E8A26A10AFA84C74C1D4828466E75D0FB24E826BB984EE0C50C96E44488031D4F43068614559A77967BE58E63E5BB12D3BF0999F763725BC7E1C0BF75C6BB
Malicious:	false
Reputation:	low
Preview:	!function(e,t){if("object"==typeof exports&&"object"==typeof module)module.exports=t();else if("function"==typeof define&&define.amd)define([],t);else{var i=t();for(var n in i)("object"==typeof exports?exports:e)[n]=i[n]}}(this,function(){return function(e){function t(n){if(i[n])return i[n].exports;var r=i[n]={i:n,l:!1,exports:{}};return e[n].call(r.exports,r,r.exports,t),r.l=!0,r.exports}var i={};return t.m=e,t.c=i,t.i=function(e){return e},t.d=function(e,i,n){t.o(e,i)\|\|Object.defineProperty(e,i,{configurable:!1,enumerable:!0,get:n})},t.n=function(e){var i=e&&e.e?function(){return e.default}:function(){return e};return t.d(i,"a",i),i},t.o=function(e,t){return Object.prototype.hasOwnProperty.call(e,t)},t.p="",t(t.s=30)}([function(e,t,i){"use strict";Object.defineProperty(t,"__esModule",{value:!0});!function(e){e[e.Unspecified=0]="Unspecified",e[e.String=1]="String",e[e.Int64=2]="Int64",e[e.Double=3]="Double",e[e.Boolean=4]="Boolean",e[e.Date=5]="Date"}(t.AWTPropertyType\|\|(t.AWTProperty

Chrome Cache Entry: 77

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	5730
Entropy (8bit):	5.183773167231501
Encrypted:	false
SSDEEP:	96:ilDVs5t3HPnjtG+rdfCNbzPckSvYXU9eIzJaZ4JkQ95:EsDHbtG+rdfCNbzklvLYk0ZRQb
MD5:	C710AD7529046BE987967AEF916EB3E8
SHA1:	51D0F87307EB03D0D1FC2BCBB46B629EA07BA1B9
SHA-256:	7086A39ADB8FF2483252BB4848D21A6D8834310A21C8D9FEB9120A63A033DD29
SHA-512:	B4DDEF85E5D9D467F8ACF6858242D2B4DE1193C85B1C17FB02DA2754067CDB01774AB4D49F5746101A657CF94B15893052D14ABB48AF80DAD9656FA3589B0E06
Malicious:	false
Reputation:	low
URL:	https://customervoice.microsoft.com/formapi/api/5072fa37-10bd-4726-91fc-a8971d9b1597/users/0ad5c124-ed32-482f-904f-0e83397c7281/light/runtimeForms('N_pyUL0QJkeR_KiXHZsVlyTB1Qoy7S9IkE8Ogzl8coFUQlZDVFpDUkpSUUhUQzVRN0Q2MFNLQU1XTy4u')?$expand=questions($expand=choices)
Preview:	{"description":"Received on Thursday, December 12.2024\n","onlineSafetyLevel":0,"reputationTier":1,"background":{"altText":null,"contentType":null,"fileIdentifier":null,"originalFileName":null,"resourceId":null,"resourceUrl":null,"height":null,"width":null,"size":null},"header":{"altText":null,"contentType":null,"fileIdentifier":null,"originalFileName":null,"resourceId":null,"resourceUrl":null,"height":null,"width":null,"size":null},"logo":{"altText":null,"contentType":null,"fileIdentifier":null,"originalFileName":null,"resourceId":null,"resourceUrl":null,"height":null,"width":null,"size":null},"tableId":"TBVCTZCRJRQHTC5Q7D60SKAMWO","otherInfo":"{\"Theme\":{\"Name\":\"CV_Blue\"}}","runtimeResponses":null,"permissions":[],"responderPermissions":[],"status":"Active","category":null,"localeInfo":"{\"TimezoneOffset\":-480,\"Locale\":\"en-US\",\"TimezoneId\":\"America/Los_Angeles\"}","descriptiveQuestions":[{"groupId":null,"defaultValue":null,"image":{"altText":null,"contentType":null,"fil

Chrome Cache Entry: 78

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (34054)
Category:	downloaded
Size (bytes):	107394
Entropy (8bit):	5.423584978243818
Encrypted:	false
SSDEEP:	1536:2X05mT9ntavn4MIKsjcWw1xHvWPxBaReA1wITNdJfIW:2XamBntavn4MVWw1xPlR5HTHJwW
MD5:	A9FAF67DA30136D5F428BE56EFADDC86
SHA1:	EADA0F80A6723EC152F56C0C03652205E126BBDE
SHA-256:	31A6F00AD24FED514454D008063823AB704B87382690DF2406E020E124D40A96
SHA-512:	1576643AA0C4EC3507270FC708B21871CF9520D3A1A4AA2148E4487B94D6AF6E18474FE94C99CCDDE3D99BCD147506850BCB892B76E1943300C496FAF2615158
Malicious:	false
Reputation:	low
URL:	https://cdn.forms.office.net/forms/scripts/dists/response-page-pro.chunk.1ds.e8b22bb.js
Preview:	"use strict";(self.webpackChunk=self.webpackChunk\|\|[]).push([[267],{8730:function(n,e,t){t.d(e,{A:function(){return N}});var r=t(86783),i=t(25621),o=t(35091),u=t(1880),a=t(38805),c=t(75072),s=t(98090),f=t(98104),l=t(78984),d=t(82873),v=t(48832),h=500;function p(n,e,t){e&&(0,a.cy)(e)&&e[s.oI]>0&&(e=e.sort((function(n,e){return n[l.Vo]-e[l.Vo]})),(0,a.Iu)(e,(function(n){n[l.Vo]<h&&(0,a.$8)("Channel has invalid priority - "+n[s.Ju])})),n[s.y5]({queue:(0,a.N6)(e),chain:(0,d.PV)(e,t[s.GA],t)}))}var g=t(73214),m=t(62032),y=t(49759),C=function(n){function e(){var t,r,u=n.call(this)\|\|this;function f(){t=0,r=[]}return u.identifier="TelemetryInitializerPlugin",u.priority=199,f(),(0,i.A)(e,u,(function(n,e){n.addTelemetryInitializer=function(n){var e={id:t++,fn:n};return r[s.y5](e),{remove:function(){(0,a.Iu)(r,(function(n,t){if(n.id===e.id)return r[s.Ic](t,1),-1}))}}},n[l.qT]=function(e,t){for(var i=!1,u=r[s.oI],f=0;f<u;++f){var l=r[f];if(l)try{if(!1===l.fn[s.y9](null,[e])){i=!0;break}}catch(n){(

Chrome Cache Entry: 79

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2531)
Category:	downloaded
Size (bytes):	2765
Entropy (8bit):	5.360796985586596
Encrypted:	false
SSDEEP:	48:icCVJPGKtGy7aYa9bEkW9v+KwcDAvHbZpBXzM5JaYGbELXzM2JaYGbEHecy7uQRz:+JRN5QbEkW9HDAfbZPM5JaYGbEfM2Jan
MD5:	5E49FA04443B3840E9F4DE7C7D25EE1D
SHA1:	F3BA9D1731104A2791DDBA59604DAD319F28562B
SHA-256:	F1EDE636B08818B1766E85AB3D00FECD7C5719C3EA3BB9A4DC61BE5BD775AC8A
SHA-512:	FC9C481C3E2A7CF9AC8DE887681B5E484FF5A6434275EB9C0DD5706D6CE81F2EE0D7923BF712A811F635D3A4BF85ABFFE64A20C51C680603D7DDA2D2AF0E6632
Malicious:	false
Reputation:	low
URL:	https://cdn.forms.office.net/forms/scripts/dists/response-page-pro.chunk.quiz.4c32c58.js
Preview:	"use strict";(self.webpackChunk=self.webpackChunk\|\|[]).push([[308],{91389:function(e,t,r){r.r(t),r.d(t,{createResultContainerInternal:function(){return a},validateQuizPoint:function(){return l}});var o=r(41594),n=r(33589),i=r(50793);function a(e){var t=function(e){if(e.state.IsStudentViewMode){var t=e.props.Response.Feedback;if(t){var r=(0,n.qn)().RuntimeView_FormComment.format(t),a=(0,i.e)({Text:r,ContainsHtml:!0,RenderMode:"RichText"});return o.createElement("div",{className:"office-form-formcomment-container"},o.createElement("div",{className:"office-form-formcomment office-form-theme-primary-foreground"},a))}return}}(e),r=function(e){var t=0,r=0,i=0,a=0,s=!1;(4===e.state.SubmitState\|\|e.state.IsStudentViewMode)&&e.formRuntimeMaster.TopQuestionRuntimeMasters().forEach((function(o){var n=o.Question.Model,u=o.Question;if(n.IsQuiz)if(u.hasCorrectAnswers(o.Model.QuizResult)&&++i,r+=n.Point\|\|0,a+=o.Model.QuizResult&&o.Model.QuizResult.IsAnswerCorrect?1:0,4===e.state.SubmitState)t+=o.Model

Chrome Cache Entry: 80

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (14187)
Category:	dropped
Size (bytes):	14439
Entropy (8bit):	5.4166061737255085
Encrypted:	false
SSDEEP:	384:/2iiKZgUDEnc7+o9gnfxZXeMOgBOgtZuQ5nXL:/PrgAEnc+o9OJOOOGZuQ5b
MD5:	8D038A2BA8B8FA1D6C6504346BE90959
SHA1:	41CCBECEF0FAF09D838B2C9FE897103E1BB327A9
SHA-256:	6A4471CA3D8DACE9974EFF8103FC7DE7FC9D8F908B04C5AC4E8383A07BB1AA82
SHA-512:	4BBA4430D85D21061C7B693C1BBE51DDEB8E1452BC34497C9F00D04656F3A26537057C43C482D769FEA9068000B0D994B069BAA984B07AFDC4D8D4274377107E
Malicious:	false
Reputation:	low
Preview:	"use strict";(self.webpackChunk=self.webpackChunk\|\|[]).push([[906],{9688:function(e,o,t){t.d(o,{$_:function(){return n},G0:function(){return u},R2:function(){return m},Tz:function(){return p},d9:function(){return r},kU:function(){return a},qN:function(){return c},re:function(){return i},uF:function(){return l}});var r=.5,i=1.5,a=4.5,n=3,l=1.5,s=[{BackgroundColor:"#eee6f2",BackgroundImage:null,Name:"CV_HBG_Professional",PrimaryColor:"#21052e",SecondaryColor:"#0f0214",Thumbnail:null},{BackgroundColor:"#e6eff2",BackgroundImage:null,Name:"CV_HBG_Friendly",PrimaryColor:"#185b75",SecondaryColor:"#13475b",Thumbnail:null},{BackgroundColor:"#e6f2eb",BackgroundImage:null,Name:"CV_HBG_Playful",PrimaryColor:"#237547",SecondaryColor:"#1b5b38",Thumbnail:null},{BackgroundColor:"#f2ece6",BackgroundImage:null,Name:"CV_HBG_Relaxed",PrimaryColor:"#68503c",SecondaryColor:"#4f3c2d",Thumbnail:null},{BackgroundColor:"#e6ecf2",BackgroundImage:null,Name:"CV_HBG_3DMolecules",PrimaryColor:"#416083",SecondaryColo

Chrome Cache Entry: 81

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	downloaded
Size (bytes):	4286
Entropy (8bit):	5.790142327810594
Encrypted:	false
SSDEEP:	48:SPVe3xrp8vtSgzZwuOhNYBIakka4sSSSSgU0B/4QL/d54hUHy5c59fHIre1YHyph:SPVUBpozOsBn+4Y0B/4QhuWw29foKWw
MD5:	EE2B357FA5FBA69AF238168E3A1A27E1
SHA1:	B5DD4606BEDBF1D705A01F833802248E03D01518
SHA-256:	0FD813BAE48835570858A2508D9C29900B8A4CDDEBFF4A250E79AD12F8ACBDCB
SHA-512:	EC00810F1DAD54D6036359386C7A205953CF1E8F81909471376EA7F77786BAABCF2EBB37A68CEB63531147A92080195EF64D93FE750380038E0AA00797DFCBDA
Malicious:	false
Reputation:	low
URL:	https://cdn.forms.office.net/forms/images/customervoice/customervoice.ico
Preview:	...... .... .........(... ...@..... .......................................................................................................................................................................................................p...{@..\|o..x...x...w...wo..s@..........................................................................................`..}...}...\|...{...{...y...x...x...v...w ........]e.`\d..[b..Ze.`......................................................`...........~...~...}...p...^...R...W...]...V.^f..^f..\e..]e..\d..[d..Zd............................................ ....................[...1...!... ...!...!...!.]f.._h..^g..^g..]e..]e..\e..\d..\d....................................0.................\|...E...!...!..."...!..."..."... .Zb.._h..^g..^g..^g..^g..]f..]e..\e..\f.P..........................0.....................3...#...#...#...#...#...#...$.x...`i..`i..`i..`i.._h.._h.._h..^g..]f..^g..`h .................. ....................G...

Chrome Cache Entry: 82

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (19569), with CRLF line terminators
Category:	dropped
Size (bytes):	31572
Entropy (8bit):	5.333378143141286
Encrypted:	false
SSDEEP:	768:GJdE/g/UkYPHHAEOY/Pz+TPkoo0PsH6p91U1k8o:8UHHA4LcQe91U1kp
MD5:	9ACA0AFBC4561365D1DB07D88037EE53
SHA1:	A5DC94C7BD49DEED5C4E2FC9FA671A93ECA85766
SHA-256:	31EFB5F52CD1CFAFB214D34CD7135227160302BE2022772496D8EC33FAD2E03B
SHA-512:	FBA5CC91054F03AF253D2FA1B5D4C45A272117FC9423F37AE5C6F58A6619F6DD85EFF0DADB1516D661097C0165278F1C8DAC3478186324FA83EA700151346291
Malicious:	false
Reputation:	low
Preview:	/!.. linkify.js v2.1.8.. * https://github.com/SoapBox/linkifyjs.. * Copyright (c) 2014 SoapBox Innovations Inc... * Licensed under the MIT license.. */..!function(){"use strict";var n="function"==typeof Symbol&&"symbol"==typeof Symbol.iterator?function(n){return typeof n}:function(n){return n&&"function"==typeof Symbol&&n.constructor===Symbol&&n!==Symbol.prototype?"symbol":typeof n};!function(e){function a(n,e){var a=arguments.length>2&&void 0!==arguments[2]?arguments[2]:{},t=Object.create(n.prototype);for(var o in a)t[o]=a[o];return t.constructor=e,e.prototype=t,e}function t(n){n=n\|\|{},this.defaultProtocol=n.hasOwnProperty("defaultProtocol")?n.defaultProtocol:h.defaultProtocol,this.events=n.hasOwnProperty("events")?n.events:h.events,this.format=n.hasOwnProperty("format")?n.format:h.format,this.formatHref=n.hasOwnProperty("formatHref")?n.formatHref:h.formatHref,this.nl2br=n.hasOwnProperty("nl2br")?n.nl2br:h.nl2br,this.tagName=n.hasOwnProperty("tagName")?n.tagName:h.tagName,this.targ

Chrome Cache Entry: 83

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (32102)
Category:	downloaded
Size (bytes):	799726
Entropy (8bit):	5.380183078880162
Encrypted:	false
SSDEEP:	6144:Ns98kk/vJAfnbZFe8rpd+z91LGAb2RkNI1M+zeO6crrFtSg9+dUAevGXuUOwcLxr:2NtfnXWBueTqw2r
MD5:	11A99865B8D25E480C23CD2B63F20E28
SHA1:	BCD35D6657DB5C064ED94312472EF1E592B8D0A6
SHA-256:	3E0C2F6A344AFE5E9E3B81DA71656F8CEA6044572A5193048287D83C5A5DF94D
SHA-512:	7A548DF17738C359B918B717AE7EDAC4F400F9AB954EB1F3890A7AC2043162BDD6E33FEDCE55EF7516050D016B3798A7EF88F0FF53C9611F82F324E580DF9A97
Malicious:	false
Reputation:	low
URL:	https://cdn.forms.office.net/forms/scripts/dists/response-page-pro.min.5e8194d.js
Preview:	(function(){var __webpack_modules__={71191:function(n,t,e){"use strict";e.d(t,{EW:function(){return m},Il:function(){return f},KJ:function(){return l},Kz:function(){return S},My:function(){return g},Nn:function(){return p},OD:function(){return a},ay:function(){return d},qw:function(){return v},rh:function(){return h}});var r=e(120);function i(n,t){return n?n+"."+t:t}function o(n,t,e,o,u){void 0===u&&(u=4),o&&n.push((0,r.m9)("".concat(i(t,e)),o,u))}function u(n,t,e,o){"boolean"==typeof o&&n.push((0,r.LK)("".concat(i(t,e)),o))}function s(n,t,e,o){"number"==typeof o&&n.push((0,r.Ug)("".concat(i(t,e)),o))}var a,c=function(n){var t="Activity.Result",e=[];return s(e,t,"Code",n.code),o(e,t,"Type",n.type),s(e,t,"Tag",n.tag),u(e,t,"IsExpected",n.isExpected),e.push((0,r.m9)("zC.Activity.Result","Office.System.Result")),e},f={contractName:"Office.System.Activity",getFields:function(n){var t="Activity",e=[];return o(e,t,"CV",n.cV),s(e,t,"Duration",n.duration),s(e,t,"Count",n.count),s(e,t,"AggMode"

Chrome Cache Entry: 84

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (60976)
Category:	dropped
Size (bytes):	91082
Entropy (8bit):	5.304260101835755
Encrypted:	false
SSDEEP:	1536:LLi6M9GIr+b5z24bx60BWDkubX8Tahi3kpG5r+At/sEVsIOBLRhwxhh7bcfkkQCe:cFhi3kpG5XZIZ2qQCY3
MD5:	A557D8D7C3F63445005902EE024876E6
SHA1:	6D097FFCCFBCE4270ADAE2261D4D6A511AF58754
SHA-256:	E2C7997DC15755E59C0DB23D2A5481AF59A26A986C19873083B0FF4995AD0B96
SHA-512:	772CE0B3711057F8149617A0145167AC193BEC8009CC6282AE850A6582103E3EB89499DD460162A3C0BF693E3065E6BB20FEFC1295A9ECD0A54415915FC114D8
Malicious:	false
Reputation:	low
Preview:	(self.webpackChunk=self.webpackChunk\|\|[]).push([[616],{95616:function(e,t){var n;./!. jQuery JavaScript Library v3.6.1. * https://jquery.com/. . Includes Sizzle.js. * https://sizzlejs.com/. . Copyright OpenJS Foundation and other contributors. * Released under the MIT license. * https://jquery.org/license. . Date: 2022-08-26T17:52Z. */!function(t,n){"use strict";"object"==typeof e.exports?e.exports=t.document?n(t,!0):function(e){if(!e.document)throw new Error("jQuery requires a window with a document");return n(e)}:n(t)}("undefined"!=typeof window?window:this,(function(r,i){"use strict";var o,a=[],s=Object.getPrototypeOf,u=a.slice,l=a.flat?function(e){return a.flat.call(e)}:function(e){return a.concat.apply([],e)},c=a.push,f=a.indexOf,p={},d=p.toString,h=p.hasOwnProperty,g=h.toString,v=g.call(Object),y={},m=function(e){return"function"==typeof e&&"number"!=typeof e.nodeType&&"function"!=typeof e.item},x=function(e){return null!=e&&e===e.window},b=r.document;function w(e){re

Chrome Cache Entry: 85

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (23927)
Category:	downloaded
Size (bytes):	24179
Entropy (8bit):	5.331646264644295
Encrypted:	false
SSDEEP:	384:qiivZp4gVgTgJg9g0gsgwgtgfgmvgbgkg1grgBzAJtg/gL9gpgLg5gkLgagFgNEb:jOGMqCQZ1rAijvit2I+zAJtCu9KUSZLE
MD5:	CF27DD148552070F1ECAC4B8D635413E
SHA1:	94916A1867C288FDB3D22E9B81B6634195A87C3D
SHA-256:	64B8B4F1BA65815D2AFC31A44FC57CDF7EBB645DBDCCE75AC4D5A3DC6A497F79
SHA-512:	FF0799AD73340DFFF67BA2F42CB26AD4F18318BB0F099287C5EFFBB56BAEC29CC558D8EB7C7476BE5FFCEF5FACB26573C64E653AD1DA7957721404E471F6108E
Malicious:	false
Reputation:	low
URL:	https://cdn.forms.office.net/forms/scripts/dists/response-page-pro.chunk.cvheadertheme.5c38bfd.js
Preview:	"use strict";(self.webpackChunk=self.webpackChunk\|\|[]).push([[954],{9688:function(o,e,r){r.d(e,{$_:function(){return n},G0:function(){return l},R2:function(){return d},Tz:function(){return p},d9:function(){return i},kU:function(){return c},qN:function(){return m},re:function(){return t},uF:function(){return a}});var i=.5,t=1.5,c=4.5,n=3,a=1.5,f=[{BackgroundColor:"#eee6f2",BackgroundImage:null,Name:"CV_HBG_Professional",PrimaryColor:"#21052e",SecondaryColor:"#0f0214",Thumbnail:null},{BackgroundColor:"#e6eff2",BackgroundImage:null,Name:"CV_HBG_Friendly",PrimaryColor:"#185b75",SecondaryColor:"#13475b",Thumbnail:null},{BackgroundColor:"#e6f2eb",BackgroundImage:null,Name:"CV_HBG_Playful",PrimaryColor:"#237547",SecondaryColor:"#1b5b38",Thumbnail:null},{BackgroundColor:"#f2ece6",BackgroundImage:null,Name:"CV_HBG_Relaxed",PrimaryColor:"#68503c",SecondaryColor:"#4f3c2d",Thumbnail:null},{BackgroundColor:"#e6ecf2",BackgroundImage:null,Name:"CV_HBG_3DMolecules",PrimaryColor:"#416083",SecondaryColo

Chrome Cache Entry: 86

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	106767
Entropy (8bit):	5.680047259595656
Encrypted:	false
SSDEEP:	1536:CO8OOQk8HuAkYcgnWaBuJY/a/tR6NgcnCoWbKxKJBmSEPgMgAzkSV/0iLinkQVaF:CO8OOQk80aQL/OWb99A4mInkQVaURBK
MD5:	242105D60A98B9D7EDC5A1A86FCE6644
SHA1:	2D7BC903956BAC5A167BBEB32AD199C5485E2C25
SHA-256:	4A3B861E7D6CEFEC3284D4C7D9FC9BC382A68D00F22ADF73450D67CBB386F50D
SHA-512:	96941939675A0B8E520ADC615365BD9ECDA5E0A31730499C451C4DB938661120408D1E1ADE709E07CB693AF873CF9B6D1AF34042102C69A0A030D14289E7B531
Malicious:	false
Reputation:	low
Preview:	(self.webpackChunk=self.webpackChunk\|\|[]).push([[96],{90116:function(e,t,r){var n={version:{major:4,minor:0,build:1}};n.utils=r(97241),n.xml=r(82009),n.oData=r(37929),n.utils.inBrowser()&&(window.odatajs=n),n.node="node",e.exports=n},37929:function(e,t,r){"use strict";var n=r(97241),a=t.utils=r(84546),o=t.handler=r(77582),i=t.metadata=r(56193),l=r(55344),s=t.net=n.inBrowser()?l:r(44241),u=t.json=r(28442);t.batch=r(62278);var c=n.assigned,d=(n.defined,n.throwErrorCallback),p=(a.invokeRequest,o.MAX_DATA_SERVICE_VERSION),f=(a.prepareRequest,i.metadataParser),m=[u.jsonHandler,o.textHandler];function h(e,t,r){var n,a;for(n=0,a=m.length;n<a&&!m[n][e](t,r);n++);if(n===a)throw{message:"no handler for data"}}t.defaultSuccess=function(e){window.alert(window.JSON.stringify(e))},t.defaultError=d,t.defaultHandler={read:function(e,t){e&&c(e.body)&&e.headers["Content-Type"]&&h("read",e,t)},write:function(e,t){h("write",e,t)},maxDataServiceVersion:p,accept:"application/json;q=0.9, /;q=0.1"},t.defaul

Chrome Cache Entry: 87

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (60976)
Category:	downloaded
Size (bytes):	91082
Entropy (8bit):	5.304260101835755
Encrypted:	false
SSDEEP:	1536:LLi6M9GIr+b5z24bx60BWDkubX8Tahi3kpG5r+At/sEVsIOBLRhwxhh7bcfkkQCe:cFhi3kpG5XZIZ2qQCY3
MD5:	A557D8D7C3F63445005902EE024876E6
SHA1:	6D097FFCCFBCE4270ADAE2261D4D6A511AF58754
SHA-256:	E2C7997DC15755E59C0DB23D2A5481AF59A26A986C19873083B0FF4995AD0B96
SHA-512:	772CE0B3711057F8149617A0145167AC193BEC8009CC6282AE850A6582103E3EB89499DD460162A3C0BF693E3065E6BB20FEFC1295A9ECD0A54415915FC114D8
Malicious:	false
Reputation:	low
URL:	https://cdn.forms.office.net/forms/scripts/dists/response-page-pro.chunk.616.93becff.js
Preview:	(self.webpackChunk=self.webpackChunk\|\|[]).push([[616],{95616:function(e,t){var n;./!. jQuery JavaScript Library v3.6.1. * https://jquery.com/. . Includes Sizzle.js. * https://sizzlejs.com/. . Copyright OpenJS Foundation and other contributors. * Released under the MIT license. * https://jquery.org/license. . Date: 2022-08-26T17:52Z. */!function(t,n){"use strict";"object"==typeof e.exports?e.exports=t.document?n(t,!0):function(e){if(!e.document)throw new Error("jQuery requires a window with a document");return n(e)}:n(t)}("undefined"!=typeof window?window:this,(function(r,i){"use strict";var o,a=[],s=Object.getPrototypeOf,u=a.slice,l=a.flat?function(e){return a.flat.call(e)}:function(e){return a.concat.apply([],e)},c=a.push,f=a.indexOf,p={},d=p.toString,h=p.hasOwnProperty,g=h.toString,v=g.call(Object),y={},m=function(e){return"function"==typeof e&&"number"!=typeof e.nodeType&&"function"!=typeof e.item},x=function(e){return null!=e&&e===e.window},b=r.document;function w(e){re

Chrome Cache Entry: 88

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (34054)
Category:	dropped
Size (bytes):	107394
Entropy (8bit):	5.423584978243818
Encrypted:	false
SSDEEP:	1536:2X05mT9ntavn4MIKsjcWw1xHvWPxBaReA1wITNdJfIW:2XamBntavn4MVWw1xPlR5HTHJwW
MD5:	A9FAF67DA30136D5F428BE56EFADDC86
SHA1:	EADA0F80A6723EC152F56C0C03652205E126BBDE
SHA-256:	31A6F00AD24FED514454D008063823AB704B87382690DF2406E020E124D40A96
SHA-512:	1576643AA0C4EC3507270FC708B21871CF9520D3A1A4AA2148E4487B94D6AF6E18474FE94C99CCDDE3D99BCD147506850BCB892B76E1943300C496FAF2615158
Malicious:	false
Reputation:	low
Preview:	"use strict";(self.webpackChunk=self.webpackChunk\|\|[]).push([[267],{8730:function(n,e,t){t.d(e,{A:function(){return N}});var r=t(86783),i=t(25621),o=t(35091),u=t(1880),a=t(38805),c=t(75072),s=t(98090),f=t(98104),l=t(78984),d=t(82873),v=t(48832),h=500;function p(n,e,t){e&&(0,a.cy)(e)&&e[s.oI]>0&&(e=e.sort((function(n,e){return n[l.Vo]-e[l.Vo]})),(0,a.Iu)(e,(function(n){n[l.Vo]<h&&(0,a.$8)("Channel has invalid priority - "+n[s.Ju])})),n[s.y5]({queue:(0,a.N6)(e),chain:(0,d.PV)(e,t[s.GA],t)}))}var g=t(73214),m=t(62032),y=t(49759),C=function(n){function e(){var t,r,u=n.call(this)\|\|this;function f(){t=0,r=[]}return u.identifier="TelemetryInitializerPlugin",u.priority=199,f(),(0,i.A)(e,u,(function(n,e){n.addTelemetryInitializer=function(n){var e={id:t++,fn:n};return r[s.y5](e),{remove:function(){(0,a.Iu)(r,(function(n,t){if(n.id===e.id)return r[s.Ic](t,1),-1}))}}},n[l.qT]=function(e,t){for(var i=!1,u=r[s.oI],f=0;f<u;++f){var l=r[f];if(l)try{if(!1===l.fn[s.y9](null,[e])){i=!0;break}}catch(n){(

Chrome Cache Entry: 89

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	5.790142327810594
Encrypted:	false
SSDEEP:	48:SPVe3xrp8vtSgzZwuOhNYBIakka4sSSSSgU0B/4QL/d54hUHy5c59fHIre1YHyph:SPVUBpozOsBn+4Y0B/4QhuWw29foKWw
MD5:	EE2B357FA5FBA69AF238168E3A1A27E1
SHA1:	B5DD4606BEDBF1D705A01F833802248E03D01518
SHA-256:	0FD813BAE48835570858A2508D9C29900B8A4CDDEBFF4A250E79AD12F8ACBDCB
SHA-512:	EC00810F1DAD54D6036359386C7A205953CF1E8F81909471376EA7F77786BAABCF2EBB37A68CEB63531147A92080195EF64D93FE750380038E0AA00797DFCBDA
Malicious:	false
Reputation:	low
Preview:	...... .... .........(... ...@..... .......................................................................................................................................................................................................p...{@..\|o..x...x...w...wo..s@..........................................................................................`..}...}...\|...{...{...y...x...x...v...w ........]e.`\d..[b..Ze.`......................................................`...........~...~...}...p...^...R...W...]...V.^f..^f..\e..]e..\d..[d..Zd............................................ ....................[...1...!... ...!...!...!.]f.._h..^g..^g..]e..]e..\e..\d..\d....................................0.................\|...E...!...!..."...!..."..."... .Zb.._h..^g..^g..^g..^g..]f..]e..\e..\f.P..........................0.....................3...#...#...#...#...#...#...$.x...`i..`i..`i..`i.._h.._h.._h..^g..]f..^g..`h .................. ....................G...

Chrome Cache Entry: 90

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	1443
Entropy (8bit):	5.140370106966154
Encrypted:	false
SSDEEP:	24:/533A3/JTOUSvYv2QEQDvwl0vdTIIcQPrepMogWqX2UxYWqWQATWn:h3w3/JTkg+Qdwl0VTjcQPryrgvfYPCC
MD5:	0C28EAB905DF619DBF56B048D3664B92
SHA1:	00566E511F0C48606FDC93D1792E36D7E2246E6E
SHA-256:	8E303CEC476F0DDA1608F525DCBE71FEBF07CDB5D1DC5E509EE77A71C76C9019
SHA-512:	30B1F161F5988E8DEC946EA999D0A0BB2DEE767A3B1261FF5F8F8DA206E2E3381EBB0ED40FF80A931B490E005E5545E80DF923DA239FFDEFBC5F81E3D7FF2E16
Malicious:	false
Reputation:	low
URL:	https://cargalia.com/templates/system/css/error.css
Preview:	/*. @copyright.Copyright (C) 2005 - 2020 Open Source Matters, Inc. All rights reserved.. * @license..GNU General Public License version 2 or later; see LICENSE.txt. /../ Start Common Styles /. {..font-family: helvetica, arial, sans-serif;..font-size: 11px;..color: #5F6565;.}..html {..height: 100%;..margin-bottom: 1px;.}..body {..margin: 0px;..padding: 0px;..height: 100%;..margin-bottom: 1px;..background: #FFFFFF;..font-family: helvetica, arial, sans-serif;..font-weight: normal;..padding-top: 0px;..margin-top: 0px;.}...error {..margin-left: auto;..margin-right: auto;.}..table, td, th, div, pre, blockquote, ul, ol, dl, address,.componentheading,.contentheading,.contentpagetitle,.sectiontableheader,.newsfeedheading {..font-family: helvetica, arial, sans-serif;..font-weight: normal;.}..#outline {..width: 900px;..margin: 0 auto;..padding: 0px;..padding-top: 60px;..padding-bottom: 60px;..background: #FFFFFF;.}.#errorboxoutline {..width: 900px;..margin: 0px;..padding: 0px;..border: 1px

Chrome Cache Entry: 91

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (14187)
Category:	downloaded
Size (bytes):	14439
Entropy (8bit):	5.4166061737255085
Encrypted:	false
SSDEEP:	384:/2iiKZgUDEnc7+o9gnfxZXeMOgBOgtZuQ5nXL:/PrgAEnc+o9OJOOOGZuQ5b
MD5:	8D038A2BA8B8FA1D6C6504346BE90959
SHA1:	41CCBECEF0FAF09D838B2C9FE897103E1BB327A9
SHA-256:	6A4471CA3D8DACE9974EFF8103FC7DE7FC9D8F908B04C5AC4E8383A07BB1AA82
SHA-512:	4BBA4430D85D21061C7B693C1BBE51DDEB8E1452BC34497C9F00D04656F3A26537057C43C482D769FEA9068000B0D994B069BAA984B07AFDC4D8D4274377107E
Malicious:	false
Reputation:	low
URL:	https://cdn.forms.office.net/forms/scripts/dists/response-page-pro.chunk.cvtitlerender.e688a7b.js
Preview:	"use strict";(self.webpackChunk=self.webpackChunk\|\|[]).push([[906],{9688:function(e,o,t){t.d(o,{$_:function(){return n},G0:function(){return u},R2:function(){return m},Tz:function(){return p},d9:function(){return r},kU:function(){return a},qN:function(){return c},re:function(){return i},uF:function(){return l}});var r=.5,i=1.5,a=4.5,n=3,l=1.5,s=[{BackgroundColor:"#eee6f2",BackgroundImage:null,Name:"CV_HBG_Professional",PrimaryColor:"#21052e",SecondaryColor:"#0f0214",Thumbnail:null},{BackgroundColor:"#e6eff2",BackgroundImage:null,Name:"CV_HBG_Friendly",PrimaryColor:"#185b75",SecondaryColor:"#13475b",Thumbnail:null},{BackgroundColor:"#e6f2eb",BackgroundImage:null,Name:"CV_HBG_Playful",PrimaryColor:"#237547",SecondaryColor:"#1b5b38",Thumbnail:null},{BackgroundColor:"#f2ece6",BackgroundImage:null,Name:"CV_HBG_Relaxed",PrimaryColor:"#68503c",SecondaryColor:"#4f3c2d",Thumbnail:null},{BackgroundColor:"#e6ecf2",BackgroundImage:null,Name:"CV_HBG_3DMolecules",PrimaryColor:"#416083",SecondaryColo

Chrome Cache Entry: 92

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (65506), with no line terminators
Category:	dropped
Size (bytes):	528595
Entropy (8bit):	5.074596954565412
Encrypted:	false
SSDEEP:	12288:hHU5EFMAKR+/rI5LsTKkw8sX9P7BePb/V6bFSDqwnZhqtRqwzXZ5HzK3DgmGNNYZ:hHU5EKAKR+/rI5LsTKkw8sX9P7BePb/b
MD5:	8562191137BA1917CF5887508E36853D
SHA1:	146F6F85316DF9BAF351440378732BB81ABF26D8
SHA-256:	92AE085B781A59E40B73EFC9AC4210804DEC629F49F90ACA02FF470596AF963F
SHA-512:	C2F22FD0937D4F1EC9C1E42D364BD39CDEC8E6D093119BDA4E28682992CD781A13CEDC1CBCF33009EF656FB0A011959B4F6923E3E3D9B913B337974EBDF885A9
Malicious:	false
Reputation:	low
Preview:	window.FormsLsMap = (window.FormsLsMap \|\| {});window.FormsLsMap["en-us"]={"Common_Close_Text":"Close","Common_Back_Text":"Back","Common_Cancel_Text":"Cancel","Common_Stop_Text":"Stop","Common_Delete_Text":"Delete","Common_Deleted_Text":"Deleted","Common_Responses_Text":"Responses","Common_Loading_Text":"Loading.","Common_Refresh_Text":"Refresh","Common_Edit_Text":"Edit","Common_Yes_Text":"Yes","Common_No_Text":"No","Common_Or_Text_Lowercased":"or","Common_Retry_Text":"Retry","Common_Try_again_Text":"Try again","Common_Prefill_Text":"Prefill","Common_Preview_Text":"Preview","Common_Points_Text":"Points","Common_Number_Text":"Number","Common_Next_Text":"Next","Common_Go_Text":"GO","Common_More_Options_Text":"More options","Common_Copy_Text":"Copy","Common_Copylink_Text":"Copy link","Common_UnknownUser_Text":"Unknown user","Common_UnknownGroup_Text":"Unknown group","Common_SearchResult_Text":"Search Result","Common_Info_Icon":"Info Icon","Common_Generate_Text":"Generate","Common_Files":

Chrome Cache Entry: 93

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	106767
Entropy (8bit):	5.680047259595656
Encrypted:	false
SSDEEP:	1536:CO8OOQk8HuAkYcgnWaBuJY/a/tR6NgcnCoWbKxKJBmSEPgMgAzkSV/0iLinkQVaF:CO8OOQk80aQL/OWb99A4mInkQVaURBK
MD5:	242105D60A98B9D7EDC5A1A86FCE6644
SHA1:	2D7BC903956BAC5A167BBEB32AD199C5485E2C25
SHA-256:	4A3B861E7D6CEFEC3284D4C7D9FC9BC382A68D00F22ADF73450D67CBB386F50D
SHA-512:	96941939675A0B8E520ADC615365BD9ECDA5E0A31730499C451C4DB938661120408D1E1ADE709E07CB693AF873CF9B6D1AF34042102C69A0A030D14289E7B531
Malicious:	false
Reputation:	low
URL:	https://cdn.forms.office.net/forms/scripts/dists/response-page-pro.chunk.vendors.aa37695.js
Preview:	(self.webpackChunk=self.webpackChunk\|\|[]).push([[96],{90116:function(e,t,r){var n={version:{major:4,minor:0,build:1}};n.utils=r(97241),n.xml=r(82009),n.oData=r(37929),n.utils.inBrowser()&&(window.odatajs=n),n.node="node",e.exports=n},37929:function(e,t,r){"use strict";var n=r(97241),a=t.utils=r(84546),o=t.handler=r(77582),i=t.metadata=r(56193),l=r(55344),s=t.net=n.inBrowser()?l:r(44241),u=t.json=r(28442);t.batch=r(62278);var c=n.assigned,d=(n.defined,n.throwErrorCallback),p=(a.invokeRequest,o.MAX_DATA_SERVICE_VERSION),f=(a.prepareRequest,i.metadataParser),m=[u.jsonHandler,o.textHandler];function h(e,t,r){var n,a;for(n=0,a=m.length;n<a&&!m[n][e](t,r);n++);if(n===a)throw{message:"no handler for data"}}t.defaultSuccess=function(e){window.alert(window.JSON.stringify(e))},t.defaultError=d,t.defaultHandler={read:function(e,t){e&&c(e.body)&&e.headers["Content-Type"]&&h("read",e,t)},write:function(e,t){h("write",e,t)},maxDataServiceVersion:p,accept:"application/json;q=0.9, /;q=0.1"},t.defaul

Chrome Cache Entry: 94

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (13674)
Category:	downloaded
Size (bytes):	13904
Entropy (8bit):	5.193200580759521
Encrypted:	false
SSDEEP:	384:vidEgOqvmRD5iS+XMC0ylrheyMvlfVi85cuif2KgKePRyIzqtz1gae6lH/0Xrm:KdEaeRl+MlyRhe1vlfVi8iuiuKgKeP4x
MD5:	B2B10F546DE6BE78084077ED645DDD51
SHA1:	DF56C5487AF39450EEAF72A306ECA661FF8B8971
SHA-256:	05F16A397E831F59497911C154656D7D0E4BFACE8AD907707109AD6F14A66540
SHA-512:	7E633296C6F2C0DAF6D513805A2FC8BA29171096D5EF507535988DC5B46A8751219E639F05E67F280F2DB474636AACAE25A71B11C37C58982E9BC72C0F41F572
Malicious:	false
Reputation:	low
URL:	https://cdn.forms.office.net/forms/scripts/dists/response-page-pro.chunk.ir.96ce202.js
Preview:	"use strict";(self.webpackChunk=self.webpackChunk\|\|[]).push([[902],{3750:function(e,t,n){n.r(t),n.d(t,{TitleOverflowMenu:function(){return I}});var o=n(34629),r=n(41594),i=n(53013),s=n(16038),u=n(59198),a=n(33589),l=n(39962),p=n(97410),c=n(33330),d=n(22224),h=n(38826),m=n(98031),f=n(29169),M=n(71683),g=n(17280),b=n(66970);var v=function(e){function t(t){var n=e.call(this,t)\|\|this;return n.menuTriggerRef=r.createRef(),n.subMenuTriggerRef=r.createRef(),n.menuTableRef=r.createRef(),n.resizeTimeId=null,n.blurTimeId=null,n.triggerFocused=!1,n.selectedElement=null,n.controlId=d.uniqueId("menu"),n.allowScrollBar=!n.props.SubMenu,n.state={MenuExpanded:!1,DisableButtonFocused:!1},n.getRoot=n.getRoot.bind(n),n.onMenuBlur=n.onMenuBlur.bind(n),n.onKeyDownForMenuTriggerButton=n.onKeyDownForMenuTriggerButton.bind(n),n.handleKeyUpOnTable=n.handleKeyUpOnTable.bind(n),n.resizeWindowCallback=n.resizeWindowCallback.bind(n),n.focusOnMenuItem=n.focusOnMenuItem.bind(n),n.setSelectedElement=n.setSelectedElem

Chrome Cache Entry: 95

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (47421), with CRLF line terminators
Category:	downloaded
Size (bytes):	369103
Entropy (8bit):	5.381338995618774
Encrypted:	false
SSDEEP:	6144:dMy8G6RujcHX6MQ47GK4C/YG7jtogSPiRoUQrwYq4UKHZeSY8/sLy9:qywRuI36TCIPiRoUqKMZZ/aW
MD5:	6E9386843C22345A256F324692D627F2
SHA1:	FEF7FADB3A27032695AAB726682A340D583BFC51
SHA-256:	D40E9F33813211AA5DFABEEBF4A1571D488E56878954DE4D513A25B3525B3988
SHA-512:	C90E8A26A10AFA84C74C1D4828466E75D0FB24E826BB984EE0C50C96E44488031D4F43068614559A77967BE58E63E5BB12D3BF0999F763725BC7E1C0BF75C6BB
Malicious:	false
Reputation:	low
URL:	https://cdn.forms.office.net/forms/scripts/vendors/combinedmin/basics_osi_v5_j3.min.14e59a0.js
Preview:	!function(e,t){if("object"==typeof exports&&"object"==typeof module)module.exports=t();else if("function"==typeof define&&define.amd)define([],t);else{var i=t();for(var n in i)("object"==typeof exports?exports:e)[n]=i[n]}}(this,function(){return function(e){function t(n){if(i[n])return i[n].exports;var r=i[n]={i:n,l:!1,exports:{}};return e[n].call(r.exports,r,r.exports,t),r.l=!0,r.exports}var i={};return t.m=e,t.c=i,t.i=function(e){return e},t.d=function(e,i,n){t.o(e,i)\|\|Object.defineProperty(e,i,{configurable:!1,enumerable:!0,get:n})},t.n=function(e){var i=e&&e.e?function(){return e.default}:function(){return e};return t.d(i,"a",i),i},t.o=function(e,t){return Object.prototype.hasOwnProperty.call(e,t)},t.p="",t(t.s=30)}([function(e,t,i){"use strict";Object.defineProperty(t,"__esModule",{value:!0});!function(e){e[e.Unspecified=0]="Unspecified",e[e.String=1]="String",e[e.Int64=2]="Int64",e[e.Double=3]="Double",e[e.Boolean=4]="Boolean",e[e.Date=5]="Date"}(t.AWTPropertyType\|\|(t.AWTProperty

Chrome Cache Entry: 96

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (63105)
Category:	downloaded
Size (bytes):	63359
Entropy (8bit):	5.12221168883596
Encrypted:	false
SSDEEP:	768:hVh9K3992UNwiq3DE/NH1SHuK7Pdok8SdOFozxHQJr7K7szXlwm+pvN77hd9XO:zY2UNWDTuwLOFoVk7K7szVwF1/O
MD5:	7AE4934CE8DA0B569F4EE13F7624B52D
SHA1:	D25C3D09B71D9AC0472C8832E3F7547ECE952903
SHA-256:	F3F402B75A352F62BB0A400BBE828E760BA509D1B4A6C29C69EEBDA56C9BADDC
SHA-512:	AA0171205C9365A4AD18E1C3A204F0E7A09276606DEC7E4DCDED40A7F52924BDBB35CF5FDE9D2F6421984C454E58305BCBEC3CDC080A22DA789624E55744F92B
Malicious:	false
Reputation:	low
URL:	https://cdn.forms.office.net/forms/scripts/dists/response-page-pro.cachegroup-nerve.min.7d75bb5.js
Preview:	"use strict";(self.webpackChunk=self.webpackChunk\|\|[]).push([[859],{38290:function(n,t,r){function i(n,t){n\|\|(console.assert(n,"Nerve - "+t),s("assert failed: ".concat(t)))}function e(n){return s("TODO: ".concat(n))}function u(){return s("to be overridden.")}function o(n){if(n="Nerve - warning: ".concat(n),console.warn(n),c){var t=new Error(n).stack;c(t)}}r.d(t,{$8:function(){return s},Lj:function(){return u},R8:function(){return o},dU:function(){return e},vA:function(){return i}});var c=null;function s(n){throw Error("Nerve - "+n)}},86230:function(n,t,r){r.d(t,{b:function(){return u},k:function(){return e}});var i=r(10529),e=function(){return function(n){void 0===n&&(n={}),u(this,n)}}();function u(n,t,r){void 0===r&&(r=!1),(0,i._0)(n,"__nerve__",t,r)}},80974:function(n,t,r){r.d(t,{AH:function(){return h},EY:function(){return w},QN:function(){return a},gu:function(){return l}});var i=r(76654),e=r(38290),u=r(86230),o=r(10529),c="Spec",s=Object.freeze({IsKeyField:!1,IsLocalField:!1,IsNum

Chrome Cache Entry: 97

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, Unicode text, UTF-8 text
Category:	downloaded
Size (bytes):	1410
Entropy (8bit):	4.869348620290232
Encrypted:	false
SSDEEP:	24:hY8XDLBfvVIWHDOKN3fo2kohTLmuw67aLUGtc2ghYvIpWrAkyFDuIhjQY:T/deWaKtCN67QZtcluvrbIhj/
MD5:	8893A6F8301868F838F05779EE4CDE8E
SHA1:	C52BC86C49B83FC096179D1ECACCE808F04DF3BD
SHA-256:	C9EFA289353EDA3D04A3EB7C666E1F7BFA14F3209241D99351F1CBC56902D4C7
SHA-512:	13DF6F453102099CC80D67478DBCF2E375FDF8C7141E5921D5B85578AD4BF06929073A37777F768487CA43F2AA560C5D548F4E3527CE18EE2477E6F3307B5C52
Malicious:	false
Reputation:	low
URL:	https://cargalia.com/es/o?c3Y9bzM2NV8xX29uZSZyYW5kPWVFczJZems9JnVpZD1VU0VSMjkxMTIwMjRVNDYxMTI5NTU=N0123N
Preview:	<!DOCTYPE html>.<html lang="es-es" dir="ltr">.<head>..<meta charset="utf-8" />..<title>404 - Art.culo no encontrado</title>..<link href="/templates/system/css/error.css" rel="stylesheet" />.... [if lt IE 9]><script src="/media/jui/js/html5.js"></script><![endif]-->.</head>.<body>..<div class="error">...<div id="outline">...<div id="errorboxoutline">....<div id="errorboxheader">404 - Art.culo no encontrado</div>....<div id="errorboxbody">....<p><strong>No puede visitar esta p.gina debido a:</strong></p>....<ol>.....<li>Un <strong>marcador o favorito caducado</strong></li>.....<li>Un motor de b.squedas que tiene un <strong>listado caducado para este sitio</strong></li>.....<li>Una <strong>direcci.n mal escrita</strong></li>.....<li>Usted no tiene <strong>acceso</strong> a esta p.gina</li>.....<li>No se pudo encontrar el recurso solicitado.</li>.....<li>Se ha producido un error mientras se procesaba su solicitud.</li>....</ol>....<p><strong>Por favor, pruebe con alguna de las p.

Chrome Cache Entry: 98

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, Unicode text, UTF-8 text
Category:	downloaded
Size (bytes):	1410
Entropy (8bit):	4.869348620290232
Encrypted:	false
SSDEEP:	24:hY8XDLBfvVIWHDOKN3fo2kohTLmuw67aLUGtc2ghYvIpWrAkyFDuIhjQY:T/deWaKtCN67QZtcluvrbIhj/
MD5:	8893A6F8301868F838F05779EE4CDE8E
SHA1:	C52BC86C49B83FC096179D1ECACCE808F04DF3BD
SHA-256:	C9EFA289353EDA3D04A3EB7C666E1F7BFA14F3209241D99351F1CBC56902D4C7
SHA-512:	13DF6F453102099CC80D67478DBCF2E375FDF8C7141E5921D5B85578AD4BF06929073A37777F768487CA43F2AA560C5D548F4E3527CE18EE2477E6F3307B5C52
Malicious:	false
Reputation:	low
URL:	https://cargalia.com/es/favicon.ico
Preview:	<!DOCTYPE html>.<html lang="es-es" dir="ltr">.<head>..<meta charset="utf-8" />..<title>404 - Art.culo no encontrado</title>..<link href="/templates/system/css/error.css" rel="stylesheet" />.... [if lt IE 9]><script src="/media/jui/js/html5.js"></script><![endif]-->.</head>.<body>..<div class="error">...<div id="outline">...<div id="errorboxoutline">....<div id="errorboxheader">404 - Art.culo no encontrado</div>....<div id="errorboxbody">....<p><strong>No puede visitar esta p.gina debido a:</strong></p>....<ol>.....<li>Un <strong>marcador o favorito caducado</strong></li>.....<li>Un motor de b.squedas que tiene un <strong>listado caducado para este sitio</strong></li>.....<li>Una <strong>direcci.n mal escrita</strong></li>.....<li>Usted no tiene <strong>acceso</strong> a esta p.gina</li>.....<li>No se pudo encontrar el recurso solicitado.</li>.....<li>Se ha producido un error mientras se procesaba su solicitud.</li>....</ol>....<p><strong>Por favor, pruebe con alguna de las p.

Chrome Cache Entry: 99

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (63105)
Category:	dropped
Size (bytes):	63359
Entropy (8bit):	5.12221168883596
Encrypted:	false
SSDEEP:	768:hVh9K3992UNwiq3DE/NH1SHuK7Pdok8SdOFozxHQJr7K7szXlwm+pvN77hd9XO:zY2UNWDTuwLOFoVk7K7szVwF1/O
MD5:	7AE4934CE8DA0B569F4EE13F7624B52D
SHA1:	D25C3D09B71D9AC0472C8832E3F7547ECE952903
SHA-256:	F3F402B75A352F62BB0A400BBE828E760BA509D1B4A6C29C69EEBDA56C9BADDC
SHA-512:	AA0171205C9365A4AD18E1C3A204F0E7A09276606DEC7E4DCDED40A7F52924BDBB35CF5FDE9D2F6421984C454E58305BCBEC3CDC080A22DA789624E55744F92B
Malicious:	false
Reputation:	low
Preview:	"use strict";(self.webpackChunk=self.webpackChunk\|\|[]).push([[859],{38290:function(n,t,r){function i(n,t){n\|\|(console.assert(n,"Nerve - "+t),s("assert failed: ".concat(t)))}function e(n){return s("TODO: ".concat(n))}function u(){return s("to be overridden.")}function o(n){if(n="Nerve - warning: ".concat(n),console.warn(n),c){var t=new Error(n).stack;c(t)}}r.d(t,{$8:function(){return s},Lj:function(){return u},R8:function(){return o},dU:function(){return e},vA:function(){return i}});var c=null;function s(n){throw Error("Nerve - "+n)}},86230:function(n,t,r){r.d(t,{b:function(){return u},k:function(){return e}});var i=r(10529),e=function(){return function(n){void 0===n&&(n={}),u(this,n)}}();function u(n,t,r){void 0===r&&(r=!1),(0,i._0)(n,"__nerve__",t,r)}},80974:function(n,t,r){r.d(t,{AH:function(){return h},EY:function(){return w},QN:function(){return a},gu:function(){return l}});var i=r(76654),e=r(38290),u=r(86230),o=r(10529),c="Spec",s=Object.freeze({IsKeyField:!1,IsLocalField:!1,IsNum

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-19T11:15:51.334626+0100	2057333	ET PHISHING MAMBA Credential Phish Landing Page 2024-11-08	1	192.168.2.4	49795	185.66.75.112	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 19, 2024 11:15:10.269259930 CET	80	49723	217.20.58.99	192.168.2.4
Dec 19, 2024 11:15:10.269428015 CET	49723	80	192.168.2.4	217.20.58.99
Dec 19, 2024 11:15:10.462024927 CET	80	49724	217.20.58.99	192.168.2.4
Dec 19, 2024 11:15:10.462191105 CET	49724	80	192.168.2.4	217.20.58.99
Dec 19, 2024 11:15:12.436717033 CET	49723	80	192.168.2.4	217.20.58.99
Dec 19, 2024 11:15:12.436924934 CET	49724	80	192.168.2.4	217.20.58.99
Dec 19, 2024 11:15:12.558640957 CET	80	49723	217.20.58.99	192.168.2.4
Dec 19, 2024 11:15:12.558665037 CET	80	49724	217.20.58.99	192.168.2.4
Dec 19, 2024 11:15:12.932854891 CET	49675	443	192.168.2.4	173.222.162.32
Dec 19, 2024 11:15:19.323138952 CET	49737	443	192.168.2.4	142.250.181.132
Dec 19, 2024 11:15:19.323194981 CET	443	49737	142.250.181.132	192.168.2.4
Dec 19, 2024 11:15:19.323288918 CET	49737	443	192.168.2.4	142.250.181.132
Dec 19, 2024 11:15:19.323684931 CET	49737	443	192.168.2.4	142.250.181.132
Dec 19, 2024 11:15:19.323703051 CET	443	49737	142.250.181.132	192.168.2.4
Dec 19, 2024 11:15:21.031544924 CET	443	49737	142.250.181.132	192.168.2.4
Dec 19, 2024 11:15:21.031904936 CET	49737	443	192.168.2.4	142.250.181.132
Dec 19, 2024 11:15:21.031919956 CET	443	49737	142.250.181.132	192.168.2.4
Dec 19, 2024 11:15:21.033128977 CET	443	49737	142.250.181.132	192.168.2.4
Dec 19, 2024 11:15:21.033205032 CET	49737	443	192.168.2.4	142.250.181.132
Dec 19, 2024 11:15:21.034558058 CET	49737	443	192.168.2.4	142.250.181.132
Dec 19, 2024 11:15:21.034632921 CET	443	49737	142.250.181.132	192.168.2.4
Dec 19, 2024 11:15:21.088399887 CET	49737	443	192.168.2.4	142.250.181.132
Dec 19, 2024 11:15:21.088416100 CET	443	49737	142.250.181.132	192.168.2.4
Dec 19, 2024 11:15:21.135227919 CET	49737	443	192.168.2.4	142.250.181.132
Dec 19, 2024 11:15:30.731594086 CET	443	49737	142.250.181.132	192.168.2.4
Dec 19, 2024 11:15:30.731739044 CET	443	49737	142.250.181.132	192.168.2.4
Dec 19, 2024 11:15:30.731796980 CET	49737	443	192.168.2.4	142.250.181.132
Dec 19, 2024 11:15:30.918185949 CET	49737	443	192.168.2.4	142.250.181.132
Dec 19, 2024 11:15:30.918199062 CET	443	49737	142.250.181.132	192.168.2.4
Dec 19, 2024 11:15:49.064352989 CET	49794	443	192.168.2.4	185.66.75.112
Dec 19, 2024 11:15:49.064420938 CET	443	49794	185.66.75.112	192.168.2.4
Dec 19, 2024 11:15:49.064491034 CET	49794	443	192.168.2.4	185.66.75.112
Dec 19, 2024 11:15:49.065083981 CET	49795	443	192.168.2.4	185.66.75.112
Dec 19, 2024 11:15:49.065114975 CET	443	49795	185.66.75.112	192.168.2.4
Dec 19, 2024 11:15:49.065172911 CET	49795	443	192.168.2.4	185.66.75.112
Dec 19, 2024 11:15:49.065500975 CET	49795	443	192.168.2.4	185.66.75.112
Dec 19, 2024 11:15:49.065514088 CET	443	49795	185.66.75.112	192.168.2.4
Dec 19, 2024 11:15:49.065692902 CET	49794	443	192.168.2.4	185.66.75.112
Dec 19, 2024 11:15:49.065712929 CET	443	49794	185.66.75.112	192.168.2.4
Dec 19, 2024 11:15:50.475213051 CET	443	49795	185.66.75.112	192.168.2.4
Dec 19, 2024 11:15:50.475763083 CET	443	49794	185.66.75.112	192.168.2.4
Dec 19, 2024 11:15:50.488620996 CET	49794	443	192.168.2.4	185.66.75.112
Dec 19, 2024 11:15:50.488656044 CET	443	49794	185.66.75.112	192.168.2.4
Dec 19, 2024 11:15:50.488743067 CET	49795	443	192.168.2.4	185.66.75.112
Dec 19, 2024 11:15:50.488756895 CET	443	49795	185.66.75.112	192.168.2.4
Dec 19, 2024 11:15:50.489546061 CET	443	49794	185.66.75.112	192.168.2.4
Dec 19, 2024 11:15:50.489607096 CET	49794	443	192.168.2.4	185.66.75.112
Dec 19, 2024 11:15:50.489610910 CET	443	49795	185.66.75.112	192.168.2.4
Dec 19, 2024 11:15:50.489661932 CET	49795	443	192.168.2.4	185.66.75.112
Dec 19, 2024 11:15:50.514672995 CET	49795	443	192.168.2.4	185.66.75.112
Dec 19, 2024 11:15:50.514733076 CET	443	49795	185.66.75.112	192.168.2.4
Dec 19, 2024 11:15:50.515077114 CET	49794	443	192.168.2.4	185.66.75.112
Dec 19, 2024 11:15:50.515150070 CET	443	49794	185.66.75.112	192.168.2.4
Dec 19, 2024 11:15:50.515384912 CET	49795	443	192.168.2.4	185.66.75.112
Dec 19, 2024 11:15:50.515394926 CET	443	49795	185.66.75.112	192.168.2.4
Dec 19, 2024 11:15:50.556855917 CET	49794	443	192.168.2.4	185.66.75.112
Dec 19, 2024 11:15:50.556868076 CET	443	49794	185.66.75.112	192.168.2.4
Dec 19, 2024 11:15:50.557066917 CET	49795	443	192.168.2.4	185.66.75.112
Dec 19, 2024 11:15:50.605844975 CET	49794	443	192.168.2.4	185.66.75.112
Dec 19, 2024 11:15:51.334619045 CET	443	49795	185.66.75.112	192.168.2.4
Dec 19, 2024 11:15:51.334760904 CET	443	49795	185.66.75.112	192.168.2.4
Dec 19, 2024 11:15:51.334816933 CET	49795	443	192.168.2.4	185.66.75.112
Dec 19, 2024 11:15:51.336524963 CET	49795	443	192.168.2.4	185.66.75.112
Dec 19, 2024 11:15:51.336536884 CET	443	49795	185.66.75.112	192.168.2.4
Dec 19, 2024 11:15:51.336546898 CET	49795	443	192.168.2.4	185.66.75.112
Dec 19, 2024 11:15:51.336585045 CET	49795	443	192.168.2.4	185.66.75.112
Dec 19, 2024 11:15:51.337945938 CET	49794	443	192.168.2.4	185.66.75.112
Dec 19, 2024 11:15:51.379376888 CET	443	49794	185.66.75.112	192.168.2.4
Dec 19, 2024 11:15:52.025286913 CET	443	49794	185.66.75.112	192.168.2.4
Dec 19, 2024 11:15:52.025408983 CET	443	49794	185.66.75.112	192.168.2.4
Dec 19, 2024 11:15:52.025480986 CET	49794	443	192.168.2.4	185.66.75.112
Dec 19, 2024 11:15:52.025513887 CET	443	49794	185.66.75.112	192.168.2.4
Dec 19, 2024 11:15:52.025568008 CET	443	49794	185.66.75.112	192.168.2.4
Dec 19, 2024 11:15:52.025618076 CET	49794	443	192.168.2.4	185.66.75.112
Dec 19, 2024 11:15:52.026333094 CET	49794	443	192.168.2.4	185.66.75.112
Dec 19, 2024 11:15:52.026348114 CET	443	49794	185.66.75.112	192.168.2.4
Dec 19, 2024 11:15:52.046722889 CET	49796	443	192.168.2.4	185.66.75.112
Dec 19, 2024 11:15:52.046751976 CET	443	49796	185.66.75.112	192.168.2.4
Dec 19, 2024 11:15:52.046833992 CET	49796	443	192.168.2.4	185.66.75.112
Dec 19, 2024 11:15:52.047070026 CET	49796	443	192.168.2.4	185.66.75.112
Dec 19, 2024 11:15:52.047081947 CET	443	49796	185.66.75.112	192.168.2.4
Dec 19, 2024 11:15:53.454951048 CET	443	49796	185.66.75.112	192.168.2.4
Dec 19, 2024 11:15:53.455332994 CET	49796	443	192.168.2.4	185.66.75.112
Dec 19, 2024 11:15:53.455353975 CET	443	49796	185.66.75.112	192.168.2.4
Dec 19, 2024 11:15:53.456469059 CET	443	49796	185.66.75.112	192.168.2.4
Dec 19, 2024 11:15:53.456796885 CET	49796	443	192.168.2.4	185.66.75.112
Dec 19, 2024 11:15:53.456923008 CET	49796	443	192.168.2.4	185.66.75.112
Dec 19, 2024 11:15:53.456927061 CET	443	49796	185.66.75.112	192.168.2.4
Dec 19, 2024 11:15:53.456967115 CET	443	49796	185.66.75.112	192.168.2.4
Dec 19, 2024 11:15:53.500858068 CET	49796	443	192.168.2.4	185.66.75.112
Dec 19, 2024 11:15:53.988922119 CET	443	49796	185.66.75.112	192.168.2.4
Dec 19, 2024 11:15:53.988975048 CET	443	49796	185.66.75.112	192.168.2.4
Dec 19, 2024 11:15:53.989042044 CET	49796	443	192.168.2.4	185.66.75.112
Dec 19, 2024 11:15:53.989063025 CET	443	49796	185.66.75.112	192.168.2.4
Dec 19, 2024 11:15:53.989116907 CET	443	49796	185.66.75.112	192.168.2.4
Dec 19, 2024 11:15:53.989178896 CET	49796	443	192.168.2.4	185.66.75.112
Dec 19, 2024 11:15:53.989862919 CET	49796	443	192.168.2.4	185.66.75.112
Dec 19, 2024 11:15:53.989871979 CET	443	49796	185.66.75.112	192.168.2.4
Dec 19, 2024 11:15:54.028387070 CET	49797	443	192.168.2.4	185.66.75.112
Dec 19, 2024 11:15:54.028439045 CET	443	49797	185.66.75.112	192.168.2.4
Dec 19, 2024 11:15:54.028543949 CET	49797	443	192.168.2.4	185.66.75.112
Dec 19, 2024 11:15:54.028738976 CET	49797	443	192.168.2.4	185.66.75.112
Dec 19, 2024 11:15:54.028755903 CET	443	49797	185.66.75.112	192.168.2.4
Dec 19, 2024 11:15:55.436196089 CET	443	49797	185.66.75.112	192.168.2.4
Dec 19, 2024 11:15:55.476517916 CET	49797	443	192.168.2.4	185.66.75.112
Dec 19, 2024 11:15:55.476547003 CET	443	49797	185.66.75.112	192.168.2.4
Dec 19, 2024 11:15:55.477947950 CET	443	49797	185.66.75.112	192.168.2.4
Dec 19, 2024 11:15:55.479554892 CET	49797	443	192.168.2.4	185.66.75.112
Dec 19, 2024 11:15:55.479779959 CET	443	49797	185.66.75.112	192.168.2.4
Dec 19, 2024 11:15:55.479784012 CET	49797	443	192.168.2.4	185.66.75.112
Dec 19, 2024 11:15:55.527343035 CET	443	49797	185.66.75.112	192.168.2.4
Dec 19, 2024 11:15:55.541583061 CET	49797	443	192.168.2.4	185.66.75.112
Dec 19, 2024 11:15:56.265489101 CET	443	49797	185.66.75.112	192.168.2.4
Dec 19, 2024 11:15:56.265748978 CET	443	49797	185.66.75.112	192.168.2.4
Dec 19, 2024 11:15:56.266604900 CET	49797	443	192.168.2.4	185.66.75.112
Dec 19, 2024 11:15:56.266638994 CET	443	49797	185.66.75.112	192.168.2.4
Dec 19, 2024 11:15:56.266650915 CET	49797	443	192.168.2.4	185.66.75.112
Dec 19, 2024 11:15:56.266685963 CET	49797	443	192.168.2.4	185.66.75.112
Dec 19, 2024 11:15:56.267570972 CET	49798	443	192.168.2.4	185.66.75.112
Dec 19, 2024 11:15:56.267612934 CET	443	49798	185.66.75.112	192.168.2.4
Dec 19, 2024 11:15:56.267687082 CET	49798	443	192.168.2.4	185.66.75.112
Dec 19, 2024 11:15:56.267894030 CET	49798	443	192.168.2.4	185.66.75.112
Dec 19, 2024 11:15:56.267908096 CET	443	49798	185.66.75.112	192.168.2.4
Dec 19, 2024 11:15:57.678313017 CET	443	49798	185.66.75.112	192.168.2.4
Dec 19, 2024 11:15:57.678864002 CET	49798	443	192.168.2.4	185.66.75.112
Dec 19, 2024 11:15:57.678890944 CET	443	49798	185.66.75.112	192.168.2.4
Dec 19, 2024 11:15:57.680094957 CET	443	49798	185.66.75.112	192.168.2.4
Dec 19, 2024 11:15:57.680438995 CET	49798	443	192.168.2.4	185.66.75.112
Dec 19, 2024 11:15:57.680573940 CET	49798	443	192.168.2.4	185.66.75.112
Dec 19, 2024 11:15:57.680586100 CET	443	49798	185.66.75.112	192.168.2.4
Dec 19, 2024 11:15:57.680617094 CET	443	49798	185.66.75.112	192.168.2.4
Dec 19, 2024 11:15:57.728835106 CET	49798	443	192.168.2.4	185.66.75.112
Dec 19, 2024 11:15:58.579931021 CET	443	49798	185.66.75.112	192.168.2.4
Dec 19, 2024 11:15:58.580251932 CET	443	49798	185.66.75.112	192.168.2.4
Dec 19, 2024 11:15:58.580329895 CET	49798	443	192.168.2.4	185.66.75.112
Dec 19, 2024 11:15:58.580343962 CET	443	49798	185.66.75.112	192.168.2.4
Dec 19, 2024 11:15:58.580403090 CET	443	49798	185.66.75.112	192.168.2.4
Dec 19, 2024 11:15:58.580463886 CET	49798	443	192.168.2.4	185.66.75.112
Dec 19, 2024 11:15:58.581461906 CET	49798	443	192.168.2.4	185.66.75.112
Dec 19, 2024 11:15:58.581473112 CET	443	49798	185.66.75.112	192.168.2.4
Dec 19, 2024 11:16:19.246242046 CET	49832	443	192.168.2.4	142.250.181.132
Dec 19, 2024 11:16:19.246299028 CET	443	49832	142.250.181.132	192.168.2.4
Dec 19, 2024 11:16:19.246417046 CET	49832	443	192.168.2.4	142.250.181.132
Dec 19, 2024 11:16:19.246690035 CET	49832	443	192.168.2.4	142.250.181.132
Dec 19, 2024 11:16:19.246707916 CET	443	49832	142.250.181.132	192.168.2.4
Dec 19, 2024 11:16:20.937450886 CET	443	49832	142.250.181.132	192.168.2.4
Dec 19, 2024 11:16:20.937869072 CET	49832	443	192.168.2.4	142.250.181.132
Dec 19, 2024 11:16:20.937901020 CET	443	49832	142.250.181.132	192.168.2.4
Dec 19, 2024 11:16:20.938402891 CET	443	49832	142.250.181.132	192.168.2.4
Dec 19, 2024 11:16:20.938879967 CET	49832	443	192.168.2.4	142.250.181.132
Dec 19, 2024 11:16:20.938966036 CET	443	49832	142.250.181.132	192.168.2.4
Dec 19, 2024 11:16:20.994107962 CET	49832	443	192.168.2.4	142.250.181.132
Dec 19, 2024 11:16:30.639533997 CET	443	49832	142.250.181.132	192.168.2.4
Dec 19, 2024 11:16:30.639720917 CET	443	49832	142.250.181.132	192.168.2.4
Dec 19, 2024 11:16:30.639780998 CET	49832	443	192.168.2.4	142.250.181.132
Dec 19, 2024 11:16:31.389993906 CET	49832	443	192.168.2.4	142.250.181.132
Dec 19, 2024 11:16:31.390032053 CET	443	49832	142.250.181.132	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 19, 2024 11:15:15.263061047 CET	53	50918	1.1.1.1	192.168.2.4
Dec 19, 2024 11:15:15.283407927 CET	53	50832	1.1.1.1	192.168.2.4
Dec 19, 2024 11:15:17.968940020 CET	53	63675	1.1.1.1	192.168.2.4
Dec 19, 2024 11:15:19.184123993 CET	62867	53	192.168.2.4	1.1.1.1
Dec 19, 2024 11:15:19.184372902 CET	62385	53	192.168.2.4	1.1.1.1
Dec 19, 2024 11:15:19.321284056 CET	53	62867	1.1.1.1	192.168.2.4
Dec 19, 2024 11:15:19.321394920 CET	53	62385	1.1.1.1	192.168.2.4
Dec 19, 2024 11:15:24.929665089 CET	53235	53	192.168.2.4	1.1.1.1
Dec 19, 2024 11:15:24.930078983 CET	56008	53	192.168.2.4	1.1.1.1
Dec 19, 2024 11:15:27.289784908 CET	55106	53	192.168.2.4	1.1.1.1
Dec 19, 2024 11:15:27.289958000 CET	57288	53	192.168.2.4	1.1.1.1
Dec 19, 2024 11:15:28.472027063 CET	138	138	192.168.2.4	192.168.2.255
Dec 19, 2024 11:15:35.087024927 CET	53	50389	1.1.1.1	192.168.2.4
Dec 19, 2024 11:15:48.726052046 CET	56926	53	192.168.2.4	1.1.1.1
Dec 19, 2024 11:15:48.726164103 CET	57643	53	192.168.2.4	1.1.1.1
Dec 19, 2024 11:15:49.059346914 CET	53	57643	1.1.1.1	192.168.2.4
Dec 19, 2024 11:15:49.059377909 CET	53	56926	1.1.1.1	192.168.2.4
Dec 19, 2024 11:15:54.020682096 CET	53	53399	1.1.1.1	192.168.2.4
Dec 19, 2024 11:16:14.529992104 CET	53	51921	1.1.1.1	192.168.2.4
Dec 19, 2024 11:16:16.416328907 CET	53	64240	1.1.1.1	192.168.2.4

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Dec 19, 2024 11:16:30.810300112 CET	192.168.2.4	1.1.1.1	c2a0	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 19, 2024 11:15:19.184123993 CET	192.168.2.4	1.1.1.1	0xb418	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Dec 19, 2024 11:15:19.184372902 CET	192.168.2.4	1.1.1.1	0x1177	Standard query (0)	www.google.com	65	IN (0x0001)	false
Dec 19, 2024 11:15:24.929665089 CET	192.168.2.4	1.1.1.1	0xc4ac	Standard query (0)	cdn.forms.office.net	A (IP address)	IN (0x0001)	false
Dec 19, 2024 11:15:24.930078983 CET	192.168.2.4	1.1.1.1	0xf026	Standard query (0)	cdn.forms.office.net	65	IN (0x0001)	false
Dec 19, 2024 11:15:27.289784908 CET	192.168.2.4	1.1.1.1	0xda19	Standard query (0)	cdn.forms.office.net	A (IP address)	IN (0x0001)	false
Dec 19, 2024 11:15:27.289958000 CET	192.168.2.4	1.1.1.1	0x5717	Standard query (0)	cdn.forms.office.net	65	IN (0x0001)	false
Dec 19, 2024 11:15:48.726052046 CET	192.168.2.4	1.1.1.1	0x446c	Standard query (0)	cargalia.com	A (IP address)	IN (0x0001)	false
Dec 19, 2024 11:15:48.726164103 CET	192.168.2.4	1.1.1.1	0x445d	Standard query (0)	cargalia.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 19, 2024 11:15:19.321284056 CET	1.1.1.1	192.168.2.4	0xb418	No error (0)	www.google.com		142.250.181.132	A (IP address)	IN (0x0001)	false
Dec 19, 2024 11:15:19.321394920 CET	1.1.1.1	192.168.2.4	0x1177	No error (0)	www.google.com			65	IN (0x0001)	false
Dec 19, 2024 11:15:25.159908056 CET	1.1.1.1	192.168.2.4	0xf026	No error (0)	cdn.forms.office.net	cdn.forms.office.net.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2024 11:15:25.173044920 CET	1.1.1.1	192.168.2.4	0xc4ac	No error (0)	cdn.forms.office.net	cdn.forms.office.net.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2024 11:15:27.427215099 CET	1.1.1.1	192.168.2.4	0xda19	No error (0)	cdn.forms.office.net	cdn.forms.office.net.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2024 11:15:27.427386045 CET	1.1.1.1	192.168.2.4	0x5717	No error (0)	cdn.forms.office.net	cdn.forms.office.net.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2024 11:15:28.405991077 CET	1.1.1.1	192.168.2.4	0xb4b4	No error (0)	csp-afd-prod.azurefd.net	azurefd-t-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2024 11:15:28.405991077 CET	1.1.1.1	192.168.2.4	0xb4b4	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2024 11:15:28.405991077 CET	1.1.1.1	192.168.2.4	0xb4b4	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Dec 19, 2024 11:15:28.407942057 CET	1.1.1.1	192.168.2.4	0xe46f	No error (0)	csp-afd-prod.azurefd.net	azurefd-t-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2024 11:15:28.939403057 CET	1.1.1.1	192.168.2.4	0x7242	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2024 11:15:28.944541931 CET	1.1.1.1	192.168.2.4	0xa40a	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2024 11:15:35.531830072 CET	1.1.1.1	192.168.2.4	0xd1d6	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2024 11:15:35.535242081 CET	1.1.1.1	192.168.2.4	0xdc7b	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2024 11:15:49.059377909 CET	1.1.1.1	192.168.2.4	0x446c	No error (0)	cargalia.com		185.66.75.112	A (IP address)	IN (0x0001)	false
Dec 19, 2024 11:16:30.593507051 CET	1.1.1.1	192.168.2.4	0x7104	No error (0)	csp-afd-prod.azurefd.net	azurefd-t-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2024 11:16:30.593507051 CET	1.1.1.1	192.168.2.4	0x7104	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2024 11:16:30.593507051 CET	1.1.1.1	192.168.2.4	0x7104	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Dec 19, 2024 11:16:30.810204983 CET	1.1.1.1	192.168.2.4	0x2c48	No error (0)	csp-afd-prod.azurefd.net	azurefd-t-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

https:

cargalia.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49795	185.66.75.112	443	1216	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 10:15:50 UTC	789	OUT	GET /o/?c3Y9bzM2NV8xX29uZSZyYW5kPWVFczJZems9JnVpZD1VU0VSMjkxMTIwMjRVNDYxMTI5NTU=N0123N HTTP/1.1 Host: cargalia.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Referer: https://customervoice.microsoft.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-19 10:15:51 UTC	709	IN	HTTP/1.1 301 Moved Permanently Server: nginx Date: Thu, 19 Dec 2024 10:15:51 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Connection: close X-Powered-By: PHP/7.4.33 Pragma: no-cache Expires: Wed, 17 Aug 2005 00:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Set-Cookie: f66b39256cfc1ac0c6f9894655f3609d=8a27i0rfa5bvuql86j8sun90sv; path=/; secure; HttpOnly X-Content-Type-Options: nosniff Location: https://cargalia.com/es/o?c3Y9bzM2NV8xX29uZSZyYW5kPWVFczJZems9JnVpZD1VU0VSMjkxMTIwMjRVNDYxMTI5NTU=N0123N Last-Modified: Thu, 19 Dec 2024 10:15:51 GMT X-Powered-By: PleskLin

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49794	185.66.75.112	443	1216	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 10:15:51 UTC	860	OUT	GET /es/o?c3Y9bzM2NV8xX29uZSZyYW5kPWVFczJZems9JnVpZD1VU0VSMjkxMTIwMjRVNDYxMTI5NTU=N0123N HTTP/1.1 Host: cargalia.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://customervoice.microsoft.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: f66b39256cfc1ac0c6f9894655f3609d=8a27i0rfa5bvuql86j8sun90sv
2024-12-19 10:15:52 UTC	267	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 19 Dec 2024 10:15:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/7.4.33 Cache-Control: no-cache Pragma: no-cache X-Content-Type-Options: nosniff
2024-12-19 10:15:52 UTC	1422	IN	Data Raw: 35 38 32 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 73 2d 65 73 22 20 64 69 72 3d 22 6c 74 72 22 3e 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 09 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 41 72 74 c3 ad 63 75 6c 6f 20 6e 6f 20 65 6e 63 6f 6e 74 72 61 64 6f 3c 2f 74 69 74 6c 65 3e 0a 09 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 2f 74 65 6d 70 6c 61 74 65 73 2f 73 79 73 74 65 6d 2f 63 73 73 2f 65 72 72 6f 72 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 2f 3e 0a 09 09 09 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 39 5d 3e 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 6d 65 64 69 61 2f 6a 75 69 2f 6a 73 2f 68 74 6d 6c 35 2e 6a 73 22 3e 3c 2f Data Ascii: 582<!DOCTYPE html><html lang="es-es" dir="ltr"><head><meta charset="utf-8" /><title>404 - Artculo no encontrado</title><link href="/templates/system/css/error.css" rel="stylesheet" />...[if lt IE 9]><script src="/media/jui/js/html5.js"></

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49796	185.66.75.112	443	1216	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 10:15:53 UTC	705	OUT	GET /templates/system/css/error.css HTTP/1.1 Host: cargalia.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://cargalia.com/es/o?c3Y9bzM2NV8xX29uZSZyYW5kPWVFczJZems9JnVpZD1VU0VSMjkxMTIwMjRVNDYxMTI5NTU=N0123N Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: f66b39256cfc1ac0c6f9894655f3609d=8a27i0rfa5bvuql86j8sun90sv
2024-12-19 10:15:53 UTC	250	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 19 Dec 2024 10:15:53 GMT Content-Type: text/css Content-Length: 1443 Last-Modified: Tue, 19 Mar 2024 19:36:21 GMT Connection: close ETag: "65f9e935-5a3" X-Powered-By: PleskLin Accept-Ranges: bytes
2024-12-19 10:15:53 UTC	1443	IN	Data Raw: 2f 2a 2a 0a 20 2a 20 40 63 6f 70 79 72 69 67 68 74 09 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 32 30 30 35 20 2d 20 32 30 32 30 20 4f 70 65 6e 20 53 6f 75 72 63 65 20 4d 61 74 74 65 72 73 2c 20 49 6e 63 2e 20 41 6c 6c 20 72 69 67 68 74 73 20 72 65 73 65 72 76 65 64 2e 0a 20 2a 20 40 6c 69 63 65 6e 73 65 09 09 47 4e 55 20 47 65 6e 65 72 61 6c 20 50 75 62 6c 69 63 20 4c 69 63 65 6e 73 65 20 76 65 72 73 69 6f 6e 20 32 20 6f 72 20 6c 61 74 65 72 3b 20 73 65 65 20 4c 49 43 45 4e 53 45 2e 74 78 74 0a 20 2a 2f 0a 0a 2f 2a 20 53 74 61 72 74 20 43 6f 6d 6d 6f 6e 20 53 74 79 6c 65 73 20 2a 2f 0a 2a 20 7b 0a 09 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 68 65 6c 76 65 74 69 63 61 2c 20 61 72 69 61 6c 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 09 66 6f 6e 74 2d 73 69 7a Data Ascii: /** * @copyrightCopyright (C) 2005 - 2020 Open Source Matters, Inc. All rights reserved. * @licenseGNU General Public License version 2 or later; see LICENSE.txt // Start Common Styles / {font-family: helvetica, arial, sans-serif;font-siz

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49797	185.66.75.112	443	1216	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 10:15:55 UTC	732	OUT	GET /favicon.ico HTTP/1.1 Host: cargalia.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://cargalia.com/es/o?c3Y9bzM2NV8xX29uZSZyYW5kPWVFczJZems9JnVpZD1VU0VSMjkxMTIwMjRVNDYxMTI5NTU=N0123N Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: f66b39256cfc1ac0c6f9894655f3609d=8a27i0rfa5bvuql86j8sun90sv
2024-12-19 10:15:56 UTC	541	IN	HTTP/1.1 301 Moved Permanently Server: nginx Date: Thu, 19 Dec 2024 10:15:56 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Connection: close X-Powered-By: PHP/7.4.33 Pragma: no-cache Expires: Wed, 17 Aug 2005 00:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 X-Content-Type-Options: nosniff Location: https://cargalia.com/es/favicon.ico Last-Modified: Thu, 19 Dec 2024 10:15:56 GMT X-Powered-By: PleskLin

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49798	185.66.75.112	443	1216	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 10:15:57 UTC	735	OUT	GET /es/favicon.ico HTTP/1.1 Host: cargalia.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://cargalia.com/es/o?c3Y9bzM2NV8xX29uZSZyYW5kPWVFczJZems9JnVpZD1VU0VSMjkxMTIwMjRVNDYxMTI5NTU=N0123N Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: f66b39256cfc1ac0c6f9894655f3609d=8a27i0rfa5bvuql86j8sun90sv
2024-12-19 10:15:58 UTC	267	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 19 Dec 2024 10:15:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/7.4.33 Cache-Control: no-cache Pragma: no-cache X-Content-Type-Options: nosniff
2024-12-19 10:15:58 UTC	1422	IN	Data Raw: 35 38 32 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 73 2d 65 73 22 20 64 69 72 3d 22 6c 74 72 22 3e 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 09 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 41 72 74 c3 ad 63 75 6c 6f 20 6e 6f 20 65 6e 63 6f 6e 74 72 61 64 6f 3c 2f 74 69 74 6c 65 3e 0a 09 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 2f 74 65 6d 70 6c 61 74 65 73 2f 73 79 73 74 65 6d 2f 63 73 73 2f 65 72 72 6f 72 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 2f 3e 0a 09 09 09 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 39 5d 3e 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 6d 65 64 69 61 2f 6a 75 69 2f 6a 73 2f 68 74 6d 6c 35 2e 6a 73 22 3e 3c 2f Data Ascii: 582<!DOCTYPE html><html lang="es-es" dir="ltr"><head><meta charset="utf-8" /><title>404 - Artculo no encontrado</title><link href="/templates/system/css/error.css" rel="stylesheet" />...[if lt IE 9]><script src="/media/jui/js/html5.js"></

Target ID:	0
Start time:	05:15:08
Start date:	19/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	05:15:13
Start date:	19/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2056 --field-trial-handle=2016,i,1279528855948395339,5561323063681271135,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	05:15:19
Start date:	19/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "http://customervoice.microsoft.com/Pages/ResponsePage.aspx?id=N_pyUL0QJkeR_KiXHZsVlyTB1Qoy7S9IkE8Ogzl8coFUQlZDVFpDUkpSUUhUQzVRN0Q2MFNLQU1XTy4u"
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may abuse Internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality and customize aspects of Internet browsers. They can be installed directly or through a browser's app store and generally have access and permissions to everything that the browser can access.
Tactics:	Persistence
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Process: Process Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report http://customervoice.microsoft.com/Pages/ResponsePage.aspx?id=N_pyUL0QJkeR_KiXHZsVlyTB1Qoy7S9IkE8Ogzl8coFUQlZDVFpDUkpSUUhUQzVRN0Q2MFNLQU1XTy4u

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

HTML

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Networking

System Summary

Malware Analysis System Evasion

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Chrome Cache Entry: 100

Chrome Cache Entry: 101

Chrome Cache Entry: 102

Chrome Cache Entry: 103

Chrome Cache Entry: 104

Chrome Cache Entry: 105

Chrome Cache Entry: 106

Chrome Cache Entry: 71

Chrome Cache Entry: 72

Chrome Cache Entry: 73

Chrome Cache Entry: 74

Chrome Cache Entry: 75

Chrome Cache Entry: 76

Chrome Cache Entry: 77

Chrome Cache Entry: 78

Chrome Cache Entry: 79

Chrome Cache Entry: 80

Chrome Cache Entry: 81

Chrome Cache Entry: 82

Chrome Cache Entry: 83

Chrome Cache Entry: 84

Chrome Cache Entry: 85

Chrome Cache Entry: 86

Chrome Cache Entry: 87

Chrome Cache Entry: 88

Chrome Cache Entry: 89

Windows Analysis Report
http://customervoice.microsoft.com/Pages/ResponsePage.aspx?id=N_pyUL0QJkeR_KiXHZsVlyTB1Qoy7S9IkE8Ogzl8coFUQlZDVFpDUkpSUUhUQzVRN0Q2MFNLQU1XTy4u