Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
original.eml
|
SMTP mail, ASCII text, with very long lines (459), with CRLF line terminators
|
initial sample
|
||
|
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
|
data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Microsoft\FORMS\FRMCACHE.DAT
|
data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntities.bin
|
ASCII text, with very long lines (65536), with no line terminators
|
dropped
|
||
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntitiesUpdated.bin
|
ASCII text, with no line terminators
|
modified
|
||
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\BE4ABBC9-453F-4398-8C23-E3597D6566B4
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
||
|
C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-journal
|
SQLite Rollback Journal
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\msoF9BD.tmp
|
GIF image data, version 89a, 15 x 15
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\olkF075.tmp
|
HTML document, Unicode text, UTF-8 text, with very long lines (1434), with CRLF line terminators
|
dropped
|
||
|
C:\Users\user\AppData\Roaming\Microsoft\Office\MSO3072.acl
|
data
|
dropped
|
||
|
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk
|
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command
line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Aug 27 17:05:48 2024, atime=Mon Oct 2 20:46:57
2023, length=1210144, window=hide
|
dropped
|
||
|
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
|
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command
line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Aug 27 17:05:48 2024, atime=Mon Oct 2 20:46:57
2023, length=1210144, window=hide
|
dropped
|
||
|
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
|
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command
line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 09:23:19 2023, atime=Mon Oct 2 20:46:57
2023, length=1210144, window=hide
|
dropped
|
||
|
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
|
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command
line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Aug 27 17:05:48 2024, atime=Mon Oct 2 20:46:57
2023, length=1210144, window=hide
|
dropped
|
||
|
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
|
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command
line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Aug 27 17:05:48 2024, atime=Mon Oct 2 20:46:57
2023, length=1210144, window=hide
|
dropped
|
||
|
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
|
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command
line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Aug 27 17:05:48 2024, atime=Mon Oct 2 20:46:57
2023, length=1210144, window=hide
|
dropped
|
||
|
Chrome Cache Entry: 197
|
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 141866
|
dropped
|
||
|
Chrome Cache Entry: 198
|
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 3651
|
downloaded
|
||
|
Chrome Cache Entry: 204
|
HTML document, ASCII text, with very long lines (3450), with CRLF line terminators
|
downloaded
|
||
|
Chrome Cache Entry: 208
|
ASCII text, with very long lines (512)
|
downloaded
|
||
|
Chrome Cache Entry: 209
|
ASCII text, with very long lines (46090)
|
downloaded
|
||
|
Chrome Cache Entry: 211
|
ASCII text, with no line terminators
|
downloaded
|
||
|
Chrome Cache Entry: 213
|
JSON data
|
dropped
|
||
|
Chrome Cache Entry: 214
|
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 449540
|
downloaded
|
||
|
Chrome Cache Entry: 216
|
ASCII text, with no line terminators
|
downloaded
|
||
|
Chrome Cache Entry: 217
|
ASCII text, with very long lines (2054)
|
downloaded
|
||
|
Chrome Cache Entry: 219
|
ASCII text, with very long lines (65450), with CRLF line terminators
|
downloaded
|
||
|
Chrome Cache Entry: 220
|
ASCII text, with very long lines (65402)
|
dropped
|
||
|
Chrome Cache Entry: 221
|
ASCII text, with no line terminators
|
downloaded
|
||
|
Chrome Cache Entry: 224
|
HTML document, ASCII text, with very long lines (2633), with CRLF line terminators
|
downloaded
|
||
|
Chrome Cache Entry: 226
|
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 35631
|
dropped
|
||
|
Chrome Cache Entry: 227
|
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 449314
|
dropped
|
||
|
Chrome Cache Entry: 228
|
ASCII text, with very long lines (65439)
|
downloaded
|
||
|
Chrome Cache Entry: 229
|
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1555
|
downloaded
|
||
|
Chrome Cache Entry: 231
|
HTML document, Unicode text, UTF-8 text, with very long lines (23198), with CRLF line terminators
|
downloaded
|
||
|
Chrome Cache Entry: 232
|
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 113769
|
dropped
|
||
|
Chrome Cache Entry: 236
|
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 11507
|
dropped
|
||
|
Chrome Cache Entry: 237
|
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1072
|
dropped
|
||
|
Chrome Cache Entry: 239
|
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1592
|
dropped
|
||
|
Chrome Cache Entry: 242
|
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 406986
|
downloaded
|
||
|
Chrome Cache Entry: 245
|
GIF image data, version 89a, 352 x 3
|
downloaded
|
||
|
Chrome Cache Entry: 249
|
JSON data
|
dropped
|
||
|
Chrome Cache Entry: 252
|
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 981
|
downloaded
|
||
|
Chrome Cache Entry: 254
|
ASCII text, with no line terminators
|
dropped
|
||
|
Chrome Cache Entry: 257
|
ASCII text, with very long lines (12836)
|
dropped
|
||
|
Chrome Cache Entry: 259
|
ASCII text, with no line terminators
|
downloaded
|
||
|
Chrome Cache Entry: 263
|
HTML document, ASCII text, with very long lines (918)
|
downloaded
|
||
|
Chrome Cache Entry: 264
|
ASCII text, with very long lines (65462)
|
downloaded
|
||
|
Chrome Cache Entry: 267
|
SVG Scalable Vector Graphics image
|
downloaded
|
||
|
Chrome Cache Entry: 268
|
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1864
|
dropped
|
||
|
Chrome Cache Entry: 269
|
GIF image data, version 89a, 352 x 3
|
downloaded
|
||
|
Chrome Cache Entry: 270
|
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 113401
|
downloaded
|
||
|
Chrome Cache Entry: 272
|
SVG Scalable Vector Graphics image
|
dropped
|
||
|
Chrome Cache Entry: 273
|
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 56391
|
dropped
|
||
|
Chrome Cache Entry: 274
|
MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
|
dropped
|
There are 45 hidden files, click here to show them.
Domains
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
bg.microsoft.map.fastly.net
|
199.232.214.172
|
||
|
inbound-weighted.protechts.net
|
35.190.10.96
|
||
|
sni1gl.wpc.alphacdn.net
|
152.199.21.175
|
||
|
sni1gl.wpc.omegacdn.net
|
152.199.21.175
|
||
|
s-part-0017.t-0009.t-msedge.net
|
13.107.246.45
|
||
|
www.google.com
|
142.250.186.100
|
||
|
stk.hsprotect.net
|
34.107.199.61
|
||
|
s-part-0032.t-0009.t-msedge.net
|
13.107.246.60
|
||
|
s-part-0029.t-0009.t-msedge.net
|
13.107.246.57
|
||
|
nam.safelink.emails.azure.net
|
unknown
|
||
|
signup.live.com
|
unknown
|
||
|
client.hsprotect.net
|
unknown
|
||
|
identity.nel.measure.office.net
|
unknown
|
||
|
msft.hsprotect.net
|
unknown
|
||
|
aadcdn.msftauth.net
|
unknown
|
||
|
collector-pxzc5j78di.hsprotect.net
|
unknown
|
||
|
logincdn.msftauth.net
|
unknown
|
||
|
login.microsoftonline.com
|
unknown
|
||
|
fpt.live.com
|
unknown
|
There are 9 hidden domains, click here to show them.
IPs
|
IP
|
Domain
|
Country
|
Malicious
|
|
|---|---|---|---|---|
|
13.107.6.156
|
unknown
|
United States
|
||
|
51.132.193.104
|
unknown
|
United Kingdom
|
||
|
35.190.10.96
|
inbound-weighted.protechts.net
|
United States
|
||
|
13.107.246.45
|
s-part-0017.t-0009.t-msedge.net
|
United States
|
||
|
23.38.98.104
|
unknown
|
United States
|
||
|
192.168.2.18
|
unknown
|
unknown
|
||
|
13.107.246.60
|
s-part-0032.t-0009.t-msedge.net
|
United States
|
||
|
142.250.185.227
|
unknown
|
United States
|
||
|
52.167.30.171
|
unknown
|
United States
|
||
|
13.107.42.22
|
unknown
|
United States
|
||
|
20.189.173.17
|
unknown
|
United States
|
||
|
52.109.68.129
|
unknown
|
United States
|
||
|
20.190.160.14
|
unknown
|
United States
|
||
|
40.126.29.12
|
unknown
|
United States
|
||
|
52.109.32.97
|
unknown
|
United States
|
||
|
199.232.214.172
|
bg.microsoft.map.fastly.net
|
United States
|
||
|
95.101.54.113
|
unknown
|
European Union
|
||
|
23.46.239.91
|
unknown
|
United States
|
||
|
20.190.190.131
|
unknown
|
United States
|
||
|
172.217.18.110
|
unknown
|
United States
|
||
|
34.107.199.61
|
stk.hsprotect.net
|
United States
|
||
|
52.113.194.132
|
unknown
|
United States
|
||
|
64.233.177.95
|
unknown
|
United States
|
||
|
20.42.73.30
|
unknown
|
United States
|
||
|
74.125.136.94
|
unknown
|
United States
|
||
|
34.104.35.123
|
unknown
|
United States
|
||
|
1.1.1.1
|
unknown
|
Australia
|
||
|
40.126.62.132
|
unknown
|
United States
|
||
|
13.107.246.57
|
s-part-0029.t-0009.t-msedge.net
|
United States
|
||
|
142.250.186.106
|
unknown
|
United States
|
||
|
20.190.159.4
|
unknown
|
United States
|
||
|
239.255.255.250
|
unknown
|
Reserved
|
||
|
2.19.126.151
|
unknown
|
European Union
|
||
|
152.199.21.175
|
sni1gl.wpc.alphacdn.net
|
United States
|
||
|
142.250.186.142
|
unknown
|
United States
|
||
|
64.233.184.84
|
unknown
|
United States
|
||
|
142.250.186.100
|
www.google.com
|
United States
|
||
|
23.38.98.69
|
unknown
|
United States
|
There are 28 hidden IPs, click here to show them.