Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
https://c.web.de/@337550745597380876/74ahEl4NT1un_FYZa8msnw

Overview

General Information

Sample URL:https://c.web.de/@337550745597380876/74ahEl4NT1un_FYZa8msnw
Analysis ID:1500454
Infos:

Detection

Score:3
Range:0 - 100
Whitelisted:false
Confidence:80%

Signatures

Detected non-DNS traffic on DNS port
HTML body with high number of embedded SVGs detected
HTML page contains hidden javascript code
Sigma detected: Excel Network Connections
Sigma detected: Suspicious Office Outbound Connections
Stores files to the Windows start menu directory

Classification

Process Tree

  • System is w10x64_ra
  • chrome.exe (PID: 2136 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://c.web.de/@337550745597380876/74ahEl4NT1un_FYZa8msnw MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
    • chrome.exe (PID: 6732 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 --field-trial-handle=1948,i,2416684251995544226,11427346836613146946,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
    • EXCEL.EXE (PID: 7856 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\user\Downloads\57361.xlsx" MD5: 4A871771235598812032C822E6F68F19)
  • cleanup

Yara Signatures

⊘No yara matches

Sigma Signatures

Sigma detected: Excel Network Connections
Source: Network ConnectionAuthor: Christopher Peacock '@securepeacock', SCYTHE '@scythe_io', Florian Roth '@Neo23x0", Tim Shelton: Data: DestinationIp: 184.28.90.27, DestinationIsIpv6: false, DestinationPort: 443, EventID: 3, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE, Initiated: true, ProcessId: 7856, Protocol: tcp, SourceIp: 192.168.2.16, SourceIsIpv6: false, SourcePort: 53932
Sigma detected: Suspicious Office Outbound Connections
Source: Network ConnectionAuthor: X__Junior (Nextron Systems): Data: DestinationIp: 192.168.2.16, DestinationIsIpv6: false, DestinationPort: 53932, EventID: 3, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE, Initiated: true, ProcessId: 7856, Protocol: tcp, SourceIp: 184.28.90.27, SourceIsIpv6: false, SourcePort: 443

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: https://c.web.de/@337550745597380876/74ahEl4NT1un_FYZa8msnwHTTP Parser: Total embedded SVG size: 156283
Source: https://c.web.de/@337550745597380876/74ahEl4NT1un_FYZa8msnwHTTP Parser: Base64 decoded: spfgoto=/onlinespeicher_erweitern&spfportal=produkte&mc=undefined
Source: unknownHTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49746 version: TLS 1.2
Source: unknownHTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49747 version: TLS 1.2
Source: unknownHTTPS traffic detected: 52.167.17.97:443 -> 192.168.2.16:49748 version: TLS 1.2
Source: unknownHTTPS traffic detected: 20.190.159.71:443 -> 192.168.2.16:49749 version: TLS 1.2
Source: unknownHTTPS traffic detected: 40.127.169.103:443 -> 192.168.2.16:49750 version: TLS 1.2
Source: unknownHTTPS traffic detected: 20.190.159.71:443 -> 192.168.2.16:49752 version: TLS 1.2
Source: unknownHTTPS traffic detected: 4.231.128.59:443 -> 192.168.2.16:49753 version: TLS 1.2
Source: unknownHTTPS traffic detected: 4.231.128.59:443 -> 192.168.2.16:49754 version: TLS 1.2
Source: unknownHTTPS traffic detected: 51.124.78.146:443 -> 192.168.2.16:53306 version: TLS 1.2
Source: unknownHTTPS traffic detected: 51.124.78.146:443 -> 192.168.2.16:53307 version: TLS 1.2
Source: unknownHTTPS traffic detected: 51.124.78.146:443 -> 192.168.2.16:53308 version: TLS 1.2
Source: unknownHTTPS traffic detected: 51.124.78.146:443 -> 192.168.2.16:53309 version: TLS 1.2
Source: unknownHTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:53932 version: TLS 1.2
Source: unknownHTTPS traffic detected: 20.190.159.71:443 -> 192.168.2.16:53935 version: TLS 1.2
Source: unknownHTTPS traffic detected: 13.107.246.57:443 -> 192.168.2.16:53941 version: TLS 1.2
Source: unknownHTTPS traffic detected: 13.107.246.57:443 -> 192.168.2.16:53939 version: TLS 1.2
Source: unknownHTTPS traffic detected: 13.107.246.57:443 -> 192.168.2.16:53940 version: TLS 1.2
Source: unknownHTTPS traffic detected: 13.107.246.57:443 -> 192.168.2.16:53938 version: TLS 1.2
Source: unknownHTTPS traffic detected: 13.107.246.57:443 -> 192.168.2.16:53937 version: TLS 1.2
Source: unknownHTTPS traffic detected: 40.127.169.103:443 -> 192.168.2.16:53948 version: TLS 1.2
Source: excel.exeMemory has grown: Private usage: 19MB later: 71MB
Source: chrome.exeMemory has grown: Private usage: 7MB later: 30MB
Source: global trafficTCP traffic: 192.168.2.16:53929 -> 1.1.1.1:53
Source: global trafficTCP traffic: 192.168.2.16:53305 -> 1.1.1.1:53
Source: global trafficTCP traffic: 192.168.2.16:53929 -> 1.1.1.1:53
Source: global trafficTCP traffic: 192.168.2.16:53305 -> 1.1.1.1:53
Source: global trafficTCP traffic: 192.168.2.16:53929 -> 1.1.1.1:53
Source: global trafficTCP traffic: 192.168.2.16:53305 -> 1.1.1.1:53
Source: global trafficTCP traffic: 192.168.2.16:53929 -> 1.1.1.1:53
Source: global trafficTCP traffic: 192.168.2.16:53305 -> 1.1.1.1:53
Source: global trafficTCP traffic: 192.168.2.16:53929 -> 1.1.1.1:53
Source: global trafficTCP traffic: 192.168.2.16:53305 -> 1.1.1.1:53
Source: global trafficTCP traffic: 192.168.2.16:53929 -> 1.1.1.1:53
Source: global trafficTCP traffic: 192.168.2.16:53305 -> 1.1.1.1:53
Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknownTCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknownTCP traffic detected without corresponding DNS query: 52.167.17.97
Source: unknownTCP traffic detected without corresponding DNS query: 52.167.17.97
Source: unknownTCP traffic detected without corresponding DNS query: 52.167.17.97
Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknownTCP traffic detected without corresponding DNS query: 52.167.17.97
Source: unknownTCP traffic detected without corresponding DNS query: 52.167.17.97
Source: global trafficDNS traffic detected: DNS query: c.web.de
Source: global trafficDNS traffic detected: DNS query: s.uicdn.com
Source: global trafficDNS traffic detected: DNS query: dl.web.de
Source: global trafficDNS traffic detected: DNS query: uim.tifbs.net
Source: global trafficDNS traffic detected: DNS query: img.ui-portal.de
Source: global trafficDNS traffic detected: DNS query: wa.web.de
Source: global trafficDNS traffic detected: DNS query: www.google.com
Source: global trafficDNS traffic detected: DNS query: sdthumbs.ui-static.net
Source: global trafficDNS traffic detected: DNS query: img.web.de
Source: global trafficDNS traffic detected: DNS query: cgateu01we.storage-webde.de
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49741
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49740
Source: unknownNetwork traffic detected: HTTP traffic on port 53944 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49746 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49720 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 53311 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49739
Source: unknownNetwork traffic detected: HTTP traffic on port 53938 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49738
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49737
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49736
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49734
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49732
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49731
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49730
Source: unknownNetwork traffic detected: HTTP traffic on port 49732 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49728 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49749 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 53941 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 53935 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 53314 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 53308 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49729
Source: unknownNetwork traffic detected: HTTP traffic on port 49752 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49728
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49727
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49726
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49720
Source: unknownNetwork traffic detected: HTTP traffic on port 49731 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49712 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49748 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49729 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 53942 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 53313 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 53307 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49751 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49712
Source: unknownNetwork traffic detected: HTTP traffic on port 49734 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49726 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49740 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49754 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 53950 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49737 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49701
Source: unknownNetwork traffic detected: HTTP traffic on port 53948 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49727 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 53940 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49701 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 53309 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49736 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49753 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 53935
Source: unknownNetwork traffic detected: HTTP traffic on port 53945 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 53939
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 53938
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 53937
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 53932
Source: unknownNetwork traffic detected: HTTP traffic on port 53310 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 53939 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49739 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 53309
Source: unknownNetwork traffic detected: HTTP traffic on port 53946 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 53308
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 53946
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 53307
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 53945
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 53306
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 53944
Source: unknownNetwork traffic detected: HTTP traffic on port 49678 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 53948
Source: unknownNetwork traffic detected: HTTP traffic on port 49741 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 53943
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 53942
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 53941
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 53940
Source: unknownNetwork traffic detected: HTTP traffic on port 49738 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 53932 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49754
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49753
Source: unknownNetwork traffic detected: HTTP traffic on port 49673 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49752
Source: unknownNetwork traffic detected: HTTP traffic on port 49730 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49751
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49750
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 53312
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 53950
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 53311
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 53310
Source: unknownNetwork traffic detected: HTTP traffic on port 53943 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 53314
Source: unknownNetwork traffic detected: HTTP traffic on port 49747 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 53313
Source: unknownNetwork traffic detected: HTTP traffic on port 53312 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 53306 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49750 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49749
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49748
Source: unknownNetwork traffic detected: HTTP traffic on port 53937 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49747
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49746
Source: unknownHTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49746 version: TLS 1.2
Source: unknownHTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49747 version: TLS 1.2
Source: unknownHTTPS traffic detected: 52.167.17.97:443 -> 192.168.2.16:49748 version: TLS 1.2
Source: unknownHTTPS traffic detected: 20.190.159.71:443 -> 192.168.2.16:49749 version: TLS 1.2
Source: unknownHTTPS traffic detected: 40.127.169.103:443 -> 192.168.2.16:49750 version: TLS 1.2
Source: unknownHTTPS traffic detected: 20.190.159.71:443 -> 192.168.2.16:49752 version: TLS 1.2
Source: unknownHTTPS traffic detected: 4.231.128.59:443 -> 192.168.2.16:49753 version: TLS 1.2
Source: unknownHTTPS traffic detected: 4.231.128.59:443 -> 192.168.2.16:49754 version: TLS 1.2
Source: unknownHTTPS traffic detected: 51.124.78.146:443 -> 192.168.2.16:53306 version: TLS 1.2
Source: unknownHTTPS traffic detected: 51.124.78.146:443 -> 192.168.2.16:53307 version: TLS 1.2
Source: unknownHTTPS traffic detected: 51.124.78.146:443 -> 192.168.2.16:53308 version: TLS 1.2
Source: unknownHTTPS traffic detected: 51.124.78.146:443 -> 192.168.2.16:53309 version: TLS 1.2
Source: unknownHTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:53932 version: TLS 1.2
Source: unknownHTTPS traffic detected: 20.190.159.71:443 -> 192.168.2.16:53935 version: TLS 1.2
Source: unknownHTTPS traffic detected: 13.107.246.57:443 -> 192.168.2.16:53941 version: TLS 1.2
Source: unknownHTTPS traffic detected: 13.107.246.57:443 -> 192.168.2.16:53939 version: TLS 1.2
Source: unknownHTTPS traffic detected: 13.107.246.57:443 -> 192.168.2.16:53940 version: TLS 1.2
Source: unknownHTTPS traffic detected: 13.107.246.57:443 -> 192.168.2.16:53938 version: TLS 1.2
Source: unknownHTTPS traffic detected: 13.107.246.57:443 -> 192.168.2.16:53937 version: TLS 1.2
Source: unknownHTTPS traffic detected: 40.127.169.103:443 -> 192.168.2.16:53948 version: TLS 1.2
Source: classification engineClassification label: clean3.win@22/24@34/126
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXEFile created: C:\Users\user\AppData\Local\Temp\{6CA4AA6A-901C-40CE-BF79-9989D1EB488F} - OProcSessId.dat
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXEFile read: C:\Users\desktop.ini
Source: unknownProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://c.web.de/@337550745597380876/74ahEl4NT1un_FYZa8msnw
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 --field-trial-handle=1948,i,2416684251995544226,11427346836613146946,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 --field-trial-handle=1948,i,2416684251995544226,11427346836613146946,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\user\Downloads\57361.xlsx"
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\user\Downloads\57361.xlsx"
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXEKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\InProcServer32
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXEKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Common
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXEProcess information queried: ProcessInformation
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXEKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management Instrumentation1
Registry Run Keys / Startup Folder		1
Process Injection		1
Masquerading		OS Credential Dumping1
Process Discovery		Remote ServicesData from Local System2
Encrypted Channel		Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization Scripts1
Registry Run Keys / Startup Folder		1
Process Injection		LSASS Memory1
File and Directory Discovery		Remote Desktop ProtocolData from Removable Media1
Non-Application Layer Protocol		Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)1
Extra Window Memory Injection		1
Extra Window Memory Injection		Security Account Manager2
System Information Discovery		SMB/Windows Admin SharesData from Network Shared Drive2
Application Layer Protocol		Automated ExfiltrationData Encrypted for Impact

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
https://c.web.de/@337550745597380876/74ahEl4NT1un_FYZa8msnw0%Avira URL Cloudsafe

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

SourceDetectionScannerLabelLink
wa.web.de0%VirustotalBrowse
dl.web.de0%VirustotalBrowse
uim.tifbs.net0%VirustotalBrowse
img.ui-portal.de0%VirustotalBrowse
uim-tifbs.ha-cdn.de0%VirustotalBrowse
c.web.de0%VirustotalBrowse
s.uicdn.com0%VirustotalBrowse
cloud.web.de0%VirustotalBrowse
img.web.de0%VirustotalBrowse
sdthumbs.ui-static.net0%VirustotalBrowse
www.google.com0%VirustotalBrowse
cgateu01we.g-ha-web.de0%VirustotalBrowse
cgateu01we.storage-webde.de0%VirustotalBrowse
s-part-0029.t-0009.t-msedge.net0%VirustotalBrowse
s-part-0032.t-0009.t-msedge.net0%VirustotalBrowse

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

NameIPActiveMaliciousAntivirus DetectionReputation
wa.web.de
82.165.229.39
truefalseunknown
cgateu01we.g-ha-web.de
195.20.251.168
truefalseunknown
uim-tifbs.ha-cdn.de
195.20.251.111
truefalseunknown
www.google.com
142.250.185.164
truefalseunknown
sdthumbs.ui-static.net
195.20.251.162
truefalseunknown
cloud.web.de
217.72.199.4
truefalseunknown
s-part-0032.t-0009.t-msedge.net
13.107.246.60
truefalseunknown
s-part-0029.t-0009.t-msedge.net
13.107.246.57
truefalseunknown
img.web.de
unknown
unknownfalseunknown
s.uicdn.com
unknown
unknownfalseunknown
c.web.de
unknown
unknownfalseunknown
cgateu01we.storage-webde.de
unknown
unknownfalseunknown
dl.web.de
unknown
unknownfalseunknown
img.ui-portal.de
unknown
unknownfalseunknown
uim.tifbs.net
unknown
unknownfalseunknown

Contacted URLs

NameMaliciousAntivirus DetectionReputation
https://c.web.de/@337550745597380876/74ahEl4NT1un_FYZa8msnwfalse
    		unknown

    World Map of Contacted IPs

    • No. of IPs < 25%
    • 25% < No. of IPs < 50%
    • 50% < No. of IPs < 75%
    • 75% < No. of IPs

    Public IPs

    IPDomainCountryFlagASNASN NameMalicious
    52.113.194.132
    		unknownUnited States
    		8068MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
    142.250.185.68
    		unknownUnited States
    		15169GOOGLEUSfalse
    1.1.1.1
    		unknownAustralia
    		13335CLOUDFLARENETUSfalse
    34.104.35.123
    		unknownUnited States
    		15169GOOGLEUSfalse
    184.27.96.196
    		unknownUnited States
    		7016CCCH-3USfalse
    51.132.193.105
    		unknownUnited Kingdom
    		8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
    74.125.133.84
    		unknownUnited States
    		15169GOOGLEUSfalse
    13.107.246.57
    		s-part-0029.t-0009.t-msedge.netUnited States
    		8068MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
    142.250.186.163
    		unknownUnited States
    		15169GOOGLEUSfalse
    217.72.199.4
    		cloud.web.deGermany
    		8560ONEANDONE-ASBrauerstrasse48DEfalse
    195.20.251.162
    		sdthumbs.ui-static.netGermany
    		8560ONEANDONE-ASBrauerstrasse48DEfalse
    195.20.251.111
    		uim-tifbs.ha-cdn.deGermany
    		8560ONEANDONE-ASBrauerstrasse48DEfalse
    82.165.229.39
    		wa.web.deGermany
    		8560ONEANDONE-ASBrauerstrasse48DEfalse
    52.109.68.129
    		unknownUnited States
    		8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
    239.255.255.250
    		unknownReserved
    		unknownunknownfalse
    142.250.185.164
    		www.google.comUnited States
    		15169GOOGLEUSfalse
    195.20.251.168
    		cgateu01we.g-ha-web.deGermany
    		8560ONEANDONE-ASBrauerstrasse48DEfalse
    52.109.28.46
    		unknownUnited States
    		8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
    142.250.185.195
    		unknownUnited States
    		15169GOOGLEUSfalse
    184.28.90.27
    		unknownUnited States
    		16625AKAMAI-ASUSfalse
    142.250.184.206
    		unknownUnited States
    		15169GOOGLEUSfalse

    Private

    IP
    192.168.2.16

    General Information

    Joe Sandbox version:40.0.0 Tourmaline
    Analysis ID:1500454
    Start date and time:2024-08-28 13:57:44 +02:00
    Joe Sandbox product:CloudBasic
    Overall analysis duration:
    Hypervisor based Inspection enabled:false
    Report type:full
    Cookbook file name:defaultwindowsinteractivecookbook.jbs
    Sample URL:https://c.web.de/@337550745597380876/74ahEl4NT1un_FYZa8msnw
    Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
    Number of analysed new started processes analysed:16
    Number of new started drivers analysed:0
    Number of existing processes analysed:0
    Number of existing drivers analysed:0
    Number of injected processes analysed:0
    Technologies:
    • EGA enabled
    Analysis Mode:stream
    Analysis stop reason:Timeout
    Detection:CLEAN
    Classification:clean3.win@22/24@34/126

    Warnings

    • Exclude process from analysis (whitelisted): svchost.exe
    • Excluded IPs from analysis (whitelisted): 142.250.185.195, 74.125.133.84, 142.250.184.206, 34.104.35.123, 184.27.96.196, 2.19.126.163
    • Excluded domains from analysis (whitelisted): clients2.google.com, accounts.google.com, edgedl.me.gvt1.com, s.uicdn.com.edgekey.net, e5416.d.akamaiedge.net, ctldl.windowsupdate.com, clientservices.googleapis.com, img.ui-portal.de.edgekey.net, clients.l.google.com, dl.web.de.edgekey.net
    • Not all processes where analyzed, report is missing behavior information
    • Report size getting too big, too many NtCreateKey calls found.
    • Report size getting too big, too many NtQueryValueKey calls found.

    Created / dropped Files

    C:\Users\user\AppData\Local\Microsoft\Office\Features\1-7FeatureCache.txt (copy)

    Download File
    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
    File Type:data
    Category:dropped
    Size (bytes):0
    Entropy (8bit):0.0
    Encrypted:false
    SSDEEP:
    MD5:E7B95B7F3F1401DD8786963C91C74FF1
    SHA1:490735B94C9F702ECDDD41845FEA25B5A3D1CAFD
    SHA-256:07E2EB1908245939906E837A7CA8A3CFE8627CE881291D1A77292F806AE8D043
    SHA-512:CB204E2BCBFF0E8DF9E32B6AAFB3505C9F15FBA64135CD15CE6140144EDCD715C6F10DEB8F762C71DE60DDFC6E13C0DB85CA7907CBEC504557214E4619B065BF
    Malicious:false
    Reputation:unknown
    Preview:3.7.4.6.3.7.6.,.1.1.9.6.3.7.8.,.1.7.8.8.6.5.8.,.2.5.5.0.5.0.8.8.,.1.2.5.,.1.1.9.,.3.0.0.4.9.2.6.8.,.3.7.4.6.2.5.9.,.1.2.2.3.4.3.4.,.;.3.2.9.4.5.8.7.9.9.,.3.7.4.6.3.7.8.,.6.3.6.4.3.3.4.,.3.0.1.5.3.7.2.1.,.2.3.7.1.6.5.1.,.1.0.0.1.,.6.5.4.0.2.1.5.,.2.4.6.0.9.2.5.8.,.4.0.6.9.3.5.8.2.,.1.0.4.9.5.2.3.4.,.6.3.6.4.3.1.8.,.3.0.1.2.3.4.6.6.,.2.7.1.5.3.4.9.7.,.6.3.7.1.6.9.4.,.8.7.4.7.0.1.5.3.,.5.9.2.2.3.4.2.3.,.5.7.9.9.9.6.6.1.,.1.5.6.1.9.5.8.,.6.3.0.6.3.0.9.9.,.2.7.3.6.0.0.9.5.,.5.8.4.2.5.8.6.0.,.6.3.6.4.3.3.7.,.6.1.7.0.7.3.0.7.,.6.3.6.4.3.3.0.,.6.3.6.4.3.3.1.,.6.7.4.8.3.9.6.1.4.,.3.3.7.9.1.6.2.,.4.7.3.8.2.9.4.8.,.1.6.5.7.4.5.3.,.1.0.6.9.5.5.2.,.1.6.5.7.4.5.2.,.5.2.9.1.0.0.0.0.,.1.3.5.2.5.8.6.,.1.3.5.2.5.8.7.,.1.7.7.1.6.5.7.,.1.0.2.3.8.6.4.,.1.0.2.3.6.3.8.,.6.3.7.1.6.9.5.,.4.8.1.9.5.5.3.8.,.1.4.6.1.9.5.3.,.6.3.6.4.3.3.2.,.3.2.0.5.9.2.7.6.7.,.3.7.4.6.3.7.9.,.

    C:\Users\user\AppData\Local\Temp\5C2BD76B.tmp

    Download File
    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
    File Type:data
    Category:dropped
    Size (bytes):860
    Entropy (8bit):2.7137153092998956
    Encrypted:false
    SSDEEP:
    MD5:E7B95B7F3F1401DD8786963C91C74FF1
    SHA1:490735B94C9F702ECDDD41845FEA25B5A3D1CAFD
    SHA-256:07E2EB1908245939906E837A7CA8A3CFE8627CE881291D1A77292F806AE8D043
    SHA-512:CB204E2BCBFF0E8DF9E32B6AAFB3505C9F15FBA64135CD15CE6140144EDCD715C6F10DEB8F762C71DE60DDFC6E13C0DB85CA7907CBEC504557214E4619B065BF
    Malicious:false
    Reputation:unknown
    Preview:3.7.4.6.3.7.6.,.1.1.9.6.3.7.8.,.1.7.8.8.6.5.8.,.2.5.5.0.5.0.8.8.,.1.2.5.,.1.1.9.,.3.0.0.4.9.2.6.8.,.3.7.4.6.2.5.9.,.1.2.2.3.4.3.4.,.;.3.2.9.4.5.8.7.9.9.,.3.7.4.6.3.7.8.,.6.3.6.4.3.3.4.,.3.0.1.5.3.7.2.1.,.2.3.7.1.6.5.1.,.1.0.0.1.,.6.5.4.0.2.1.5.,.2.4.6.0.9.2.5.8.,.4.0.6.9.3.5.8.2.,.1.0.4.9.5.2.3.4.,.6.3.6.4.3.1.8.,.3.0.1.2.3.4.6.6.,.2.7.1.5.3.4.9.7.,.6.3.7.1.6.9.4.,.8.7.4.7.0.1.5.3.,.5.9.2.2.3.4.2.3.,.5.7.9.9.9.6.6.1.,.1.5.6.1.9.5.8.,.6.3.0.6.3.0.9.9.,.2.7.3.6.0.0.9.5.,.5.8.4.2.5.8.6.0.,.6.3.6.4.3.3.7.,.6.1.7.0.7.3.0.7.,.6.3.6.4.3.3.0.,.6.3.6.4.3.3.1.,.6.7.4.8.3.9.6.1.4.,.3.3.7.9.1.6.2.,.4.7.3.8.2.9.4.8.,.1.6.5.7.4.5.3.,.1.0.6.9.5.5.2.,.1.6.5.7.4.5.2.,.5.2.9.1.0.0.0.0.,.1.3.5.2.5.8.6.,.1.3.5.2.5.8.7.,.1.7.7.1.6.5.7.,.1.0.2.3.8.6.4.,.1.0.2.3.6.3.8.,.6.3.7.1.6.9.5.,.4.8.1.9.5.5.3.8.,.1.4.6.1.9.5.3.,.6.3.6.4.3.3.2.,.3.2.0.5.9.2.7.6.7.,.3.7.4.6.3.7.9.,.

    C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

    Download File
    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
    File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Aug 28 10:58:15 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
    Category:dropped
    Size (bytes):2673
    Entropy (8bit):3.9784762622472885
    Encrypted:false
    SSDEEP:
    MD5:3F96AF775D751D9AB9F32127CA7B83B7
    SHA1:6A77DAC9FC04BD3D0890F18531452FFBD477A98C
    SHA-256:0C605B4A8A5921102DBAFF8FD1025A00F5A53F424DC921F86293110F94980767
    SHA-512:756DAA9FDB9453F3504BB76655335FABE2C216BF8BD0C07683B7A6CC5052DDD4F13024D5280B1691DC2989D4F3C9B83839185674301DC995F3DCF361D7800294
    Malicious:false
    Reputation:unknown
    Preview:L..................F.@.. ...$+.,.....x.A...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.Y=_....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.YG_....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.YG_....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.YG_..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.YH_...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............`oR.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

    C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

    Download File
    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
    File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Aug 28 10:58:15 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
    Category:dropped
    Size (bytes):2675
    Entropy (8bit):3.993416234755619
    Encrypted:false
    SSDEEP:
    MD5:E938BA6B778E6BC11D8510ED27F7116F
    SHA1:68C6DFAD2381277A2668CC6234D65011EB16CBE8
    SHA-256:878DEBD0C6217BBDE13478E59241A8977866E4F72D57CF7B6630637252A35323
    SHA-512:76AE6523E1D6F82D47D76C27D52F611CEC17BBF3A7BDEA4192041BC7099977ECFFA0ED40C94FF9153C5824B667CD1EA0DFAB2C024490D209291AA515F7F6EA3C
    Malicious:false
    Reputation:unknown
    Preview:L..................F.@.. ...$+.,.....T.A...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.Y=_....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.YG_....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.YG_....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.YG_..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.YH_...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............`oR.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

    C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

    Download File
    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
    File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
    Category:dropped
    Size (bytes):2689
    Entropy (8bit):4.001457517403997
    Encrypted:false
    SSDEEP:
    MD5:93E448D2671B4E652E6053FC505DA69B
    SHA1:2D007A9FBFC4CFE3D25C61B65D96DFE31B0B848F
    SHA-256:750E2F9C737CD5BEC50075C7562508846C6EF8734DD7256344BBF85819D6B305
    SHA-512:FAE2B202EDF9005E77CE1FC0E33CF10374A4FA0F8C3B2C12A81A996482331053148C8D10FDA958CA40BC16C28A3F670DF0F8A401A7742C36CEFA7C185037B3D7
    Malicious:false
    Reputation:unknown
    Preview:L..................F.@.. ...$+.,.....Y.04...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.Y=_....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.YG_....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.YG_....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.YG_..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VFW.E...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............`oR.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

    C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

    Download File
    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
    File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Aug 28 10:58:15 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
    Category:dropped
    Size (bytes):2677
    Entropy (8bit):3.9937094369898274
    Encrypted:false
    SSDEEP:
    MD5:920D9F72C6E6DAAD96FDDA41F9D162CE
    SHA1:B1BB96D3CD67A5945F364E49FB3F714760EAD7E4
    SHA-256:401C49B4C0629627B50EBA5887DD513DD9CF05F8CF4C0E4BAD92A893EDFE7D43
    SHA-512:B4DB904E11BA63960E3BB34DC1DB4EC296631F1AD76426CF64C2DFB524A51A3E34BC073AED81C72D966079D561E80F312C3AE616BCA8736AF3EE74E61AEEE846
    Malicious:false
    Reputation:unknown
    Preview:L..................F.@.. ...$+.,....}..A...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.Y=_....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.YG_....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.YG_....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.YG_..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.YH_...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............`oR.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

    C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

    Download File
    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
    File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Aug 28 10:58:15 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
    Category:dropped
    Size (bytes):2677
    Entropy (8bit):3.9799055790097966
    Encrypted:false
    SSDEEP:
    MD5:E4406A9CAEFF3F6402596BB39EC3C2F7
    SHA1:8A8FD8858AD2362FD2AA1721A300B75BA96D9FB3
    SHA-256:267CE5D887ED69636323D95C90DA17EE8BE96257A66F87CC97D84BE25B05D7D0
    SHA-512:A03568FA32CD3918B6F203C51557D568BD723B7FA0667AB09473E6F5BA66D773643E8C25A16EE815115848BCBEA64E7AB36A4B2B756B62D97D6B287A2DAECFD5
    Malicious:false
    Reputation:unknown
    Preview:L..................F.@.. ...$+.,....H!.A...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.Y=_....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.YG_....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.YG_....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.YG_..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.YH_...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............`oR.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

    C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

    Download File
    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
    File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Aug 28 10:58:15 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
    Category:dropped
    Size (bytes):2679
    Entropy (8bit):3.991191830727841
    Encrypted:false
    SSDEEP:
    MD5:1191B61E4C2DB7877771B5C5084FB6FB
    SHA1:461D708DAADD8243377601712EA39F97995BAD1D
    SHA-256:42AF62A5CDCBFD605C2955836030D037E76E44B18724FE05219A301C9E31E243
    SHA-512:C29ACFD379B2D0217D553C1A4126C571A51EC9E904962E5610C045F81A08C199F2E8FBBC08F6A7BAF9F617FED6A81AD5DD9E750399428C93CD87D49264F29BC4
    Malicious:false
    Reputation:unknown
    Preview:L..................F.@.. ...$+.,.......A...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.Y=_....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.YG_....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.YG_....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.YG_..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.YH_...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............`oR.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

    C:\Users\user\Downloads\57361.xlsx (copy)

    Download File
    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
    File Type:Microsoft Excel 2007+
    Category:dropped
    Size (bytes):0
    Entropy (8bit):0.0
    Encrypted:false
    SSDEEP:
    MD5:A1B0648EF6027E125819875685A98561
    SHA1:29041F6181F644C2E1DED8CC24411F52268B6842
    SHA-256:3EBA498F18C74DBB9D3EDA4AAD1EE18DA3DD5C828AC052DA074CB6F9AC916E6E
    SHA-512:6340B559C14009A03860D0CBE0C20C142C2D4B0BE159442EFDA81B4809E212003D866A8FA4F11273A3123557D972CC549241A22BC1AD38E65E69135215A79483
    Malicious:false
    Reputation:unknown
    Preview:PK........JM.Y................xl/workbook.xml.S.n.0...+..m-^j...W........F.k...ql..wDYi...$..7of..7.Zz.`..*f.0`..\.B.c..!..g...K. f...f.ny..i}..1.........n@Q...H....1..[.`-.(..~.b.......K..F....v .$Gbo+.X.Z.B.c...3..v.e...+...x~86)e....5Z...;.H.q).Wp.p....? 4R&.!g.x.p.....o../Z!...h)c..x.FDQ.....A=.....P.>.Vtys>..(...NG.q....0f.p.1.yv..*f.....XtE...N....5.....z...2AJ.[..+..S.R.YX.I.l.....f.D....`(?.GE$......bMh...z...$r.9.. lq..-..ULR../AI...$.....1..~.M..4.D.p4...d.a4...m...M2O.......o..or...B.=.l{.A..'.......X..PK..........r...PK........JM.Y................xl/styles.xml.Y]o.0.}....B.$m'..21..T.4....V..l.M..gc.W.t[.)..|}.=..c..;]...b!.g>....`...W...1.R!.#.....Kx.|.ZR|.a......3..O.#...H...3.p.#.."ud!0...........a0..<.s%A..L.pX..=}......[n.c-..fX .....n.g..T<..p..M........j...G.r.Dz..0t.$C9.ig....#!...IPN........R[d...,Q.._W.{_...._.....<..O(.....@..H),X.....-.=x....L..Lv*.r0... 9%.Q.N.7=u....u.#.....od3.......l...M....'........0l.....

    C:\Users\user\Downloads\57361.xlsx.crdownload (copy)

    Download File
    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
    File Type:Microsoft Excel 2007+
    Category:dropped
    Size (bytes):0
    Entropy (8bit):0.0
    Encrypted:false
    SSDEEP:
    MD5:A1B0648EF6027E125819875685A98561
    SHA1:29041F6181F644C2E1DED8CC24411F52268B6842
    SHA-256:3EBA498F18C74DBB9D3EDA4AAD1EE18DA3DD5C828AC052DA074CB6F9AC916E6E
    SHA-512:6340B559C14009A03860D0CBE0C20C142C2D4B0BE159442EFDA81B4809E212003D866A8FA4F11273A3123557D972CC549241A22BC1AD38E65E69135215A79483
    Malicious:false
    Reputation:unknown
    Preview:PK........JM.Y................xl/workbook.xml.S.n.0...+..m-^j...W........F.k...ql..wDYi...$..7of..7.Zz.`..*f.0`..\.B.c..!..g...K. f...f.ny..i}..1.........n@Q...H....1..[.`-.(..~.b.......K..F....v .$Gbo+.X.Z.B.c...3..v.e...+...x~86)e....5Z...;.H.q).Wp.p....? 4R&.!g.x.p.....o../Z!...h)c..x.FDQ.....A=.....P.>.Vtys>..(...NG.q....0f.p.1.yv..*f.....XtE...N....5.....z...2AJ.[..+..S.R.YX.I.l.....f.D....`(?.GE$......bMh...z...$r.9.. lq..-..ULR../AI...$.....1..~.M..4.D.p4...d.a4...m...M2O.......o..or...B.=.l{.A..'.......X..PK..........r...PK........JM.Y................xl/styles.xml.Y]o.0.}....B.$m'..21..T.4....V..l.M..gc.W.t[.)..|}.=..c..;]...b!.g>....`...W...1.R!.#.....Kx.|.ZR|.a......3..O.#...H...3.p.#.."ud!0...........a0..<.s%A..L.pX..=}......[n.c-..fX .....n.g..T<..p..M........j...G.r.Dz..0t.$C9.ig....#!...IPN........R[d...,Q.._W.{_...._.....<..O(.....@..H),X.....-.=x....L..Lv*.r0... 9%.Q.N.7=u....u.#.....od3.......l...M....'........0l.....

    C:\Users\user\Downloads\9865efbd-ac21-42cd-b457-5bb4cab79430.tmp

    Download File
    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
    File Type:Microsoft Excel 2007+
    Category:dropped
    Size (bytes):11548
    Entropy (8bit):7.6676595623325525
    Encrypted:false
    SSDEEP:
    MD5:A1B0648EF6027E125819875685A98561
    SHA1:29041F6181F644C2E1DED8CC24411F52268B6842
    SHA-256:3EBA498F18C74DBB9D3EDA4AAD1EE18DA3DD5C828AC052DA074CB6F9AC916E6E
    SHA-512:6340B559C14009A03860D0CBE0C20C142C2D4B0BE159442EFDA81B4809E212003D866A8FA4F11273A3123557D972CC549241A22BC1AD38E65E69135215A79483
    Malicious:false
    Reputation:unknown
    Preview:PK........JM.Y................xl/workbook.xml.S.n.0...+..m-^j...W........F.k...ql..wDYi...$..7of..7.Zz.`..*f.0`..\.B.c..!..g...K. f...f.ny..i}..1.........n@Q...H....1..[.`-.(..~.b.......K..F....v .$Gbo+.X.Z.B.c...3..v.e...+...x~86)e....5Z...;.H.q).Wp.p....? 4R&.!g.x.p.....o../Z!...h)c..x.FDQ.....A=.....P.>.Vtys>..(...NG.q....0f.p.1.yv..*f.....XtE...N....5.....z...2AJ.[..+..S.R.YX.I.l.....f.D....`(?.GE$......bMh...z...$r.9.. lq..-..ULR../AI...$.....1..~.M..4.D.p4...d.a4...m...M2O.......o..or...B.=.l{.A..'.......X..PK..........r...PK........JM.Y................xl/styles.xml.Y]o.0.}....B.$m'..21..T.4....V..l.M..gc.W.t[.)..|}.=..c..;]...b!.g>....`...W...1.R!.#.....Kx.|.ZR|.a......3..O.#...H...3.p.#.."ud!0...........a0..<.s%A..L.pX..=}......[n.c-..fX .....n.g..T<..p..M........j...G.r.Dz..0t.$C9.ig....#!...IPN........R[d...,Q.._W.{_...._.....<..O(.....@..H),X.....-.=x....L..Lv*.r0... 9%.Q.N.7=u....u.#.....od3.......l...M....'........0l.....

    C:\Users\user\Downloads\~$57361.xlsx

    Download File
    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
    File Type:data
    Category:dropped
    Size (bytes):165
    Entropy (8bit):1.3520167401771568
    Encrypted:false
    SSDEEP:
    MD5:9AC4D67F6E514F452D4A1DB79CE3B2E8
    SHA1:33F8C665ECBB81275D2E49D48F2565A58A282043
    SHA-256:407E1D871964C93DBDBD4D00613CD0A9E30D3ED6352D8052C58E7A252D52FC5A
    SHA-512:018D0F54AB0AB01F27E9FB870A128F2F581A58487399DD7FB56A94EC4AAEC6874708A5AD5650F362485E45E2C6A557ED08524C5B8335F83F240E0962281A0F1A
    Malicious:false
    Reputation:unknown
    Preview:.user ..c.a.l.i. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

    Chrome Cache Entry: 176

    Download File
    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
    File Type:MS Windows icon resource - 3 icons, 48x48, 32 bits/pixel, 32x32, 32 bits/pixel
    Category:dropped
    Size (bytes):15086
    Entropy (8bit):3.397741884015131
    Encrypted:false
    SSDEEP:
    MD5:E28E217FE7CC6E04619D224FE0864660
    SHA1:259EA5C86F9153D0980B3872FC3432BE6C0A7884
    SHA-256:FC68B906543280A143EC95215F32825DB7A580B38955886D101FC1BA1DD0B6FD
    SHA-512:5FBA258D38E948EFA22700F429BA3F14FF0BD2783ACFFAB3C15FE59D4F8E464AD4E7109EAFA4E02A17B0C308246A445A94A41290EEA3B350445B7023CA89ED15
    Malicious:false
    Reputation:unknown
    Preview:......00.... ..%..6... .... ......%........ .h....6..(...0...`..... ......%............................. ........................................................................................................................................................................... ...............0...................................................................................................................................................................................0....... ........................................................................................................................................................................................... ..........................................................................................................................................................................................................................................................................................................................................

    Chrome Cache Entry: 179

    Download File
    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
    File Type:Web Open Font Format, TrueType, length 18080, version 1.0
    Category:downloaded
    Size (bytes):18080
    Entropy (8bit):7.974958276963794
    Encrypted:false
    SSDEEP:
    MD5:7D3616C7D04A9AE474875E42C4BC0496
    SHA1:4D0137DD6F1E5325EB3BA3E7BC4D577E68C75D46
    SHA-256:7676E0D97793004054C4EC3E7CBD2D98C52FABC90479B7E3D5CFBB62F4E7A5AF
    SHA-512:00D21C47C19CFDB28125B7C131295CE204A01CC0E2E4151D3C9FAEFDA3D23140C4CD2B55B45149216114CC3CD56F917D8C5160499F6EA5505E07D462127FD25A
    Malicious:false
    Reputation:unknown
    URL:https://img.ui-portal.de/ci/webde/global/fonts/web.de-sans/web.de-sans-light.woff
    Preview:wOFF......F.......wp........................FFTM............u..GDEF.............'..GPOS.......P.....>..GSUB.......2...@..(.OS/2...@...K...`tx.wcmap.............?.cvt .............D..gasp................glyf... ..4W..U.@.kBhead..>x...0...6...Ohhea..>.... ...$...vhmtx..>....<.....jlKloca..A.........a..maxp..B.... ... .0..name..B...........Aqpost..D.........7.9.webf..F...........U.x.c```d.....y......:...P....x.c`d``..b1 fb`...@...1.........x.X]l.U.=3;[.m..B.@.P)...P..%FS.E..*H).&...t.....jb...D}....kba..W7KCx..!<..C..~3.;;...3w~......;s...0^.[.t.vt..#..a..}r..`.)...U..8t..a.....2.:.J.z..Q......1..0`..Q)=.B,WCXI.%..T...N..6...5....=d.J....._._.....y..a..d..6.....C...|.H...$6)..Yv.....#.....d.<A..........y.4.O].~.bp.9..u.n.>...j.B.O_%..N..<@...Q..y.L.'.....D..?.i."y..B^%....a....X....,.....p..q.Wq..1..0#.:O3'j..sX..0UN.....<.O.>b9.Q...G...]...g.....O..f..>3.jTkyZ.m.%M...dO.[fu4.TUO.k5X..(....&...+..].r.X`.9.[.7'.v._<...T..Uc.....F..?..H%B.R*..[j.R...S.U..W.C.x..

    Chrome Cache Entry: 180

    Download File
    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
    File Type:ASCII text, with very long lines (1156)
    Category:dropped
    Size (bytes):1209
    Entropy (8bit):5.270040768591231
    Encrypted:false
    SSDEEP:
    MD5:3B781B3D1514B04D608FA13D2D953DA6
    SHA1:2E725AA49E6ED81E4C0504667C7FF459FC58A277
    SHA-256:B0183A27CEFE980ADC08F42279EF52492D3355030F82C787529854B1C0D71A67
    SHA-512:E235A62B25FAB479A47A887EBDE1B332A67A7D3D36CD07808E09497D361D1380EB930A5ECA37C42698E75158D9F1C9F963926B356AE491B23536484C90224C31
    Malicious:false
    Reputation:unknown
    Preview:(()=>{"use strict";var e,d={},i={};function a(e){var n=i[e];if(void 0!==n)return n.exports;var r=i[e]={id:e,loaded:!1,exports:{}};return d[e].call(r.exports,r,r.exports,a),r.loaded=!0,r.exports}a.m=d,e=[],a.O=(n,r,c,f)=>{if(!r){var u=1/0;for(l=0;l<e.length;l++){for(var[r,c,f]=e[l],o=!0,t=0;t<r.length;t++)(!1&f||u>=f)&&Object.keys(a.O).every(p=>a.O[p](r[t]))?r.splice(t--,1):(o=!1,f<u&&(u=f));if(o){e.splice(l--,1);var s=c();void 0!==s&&(n=s)}}return n}f=f||0;for(var l=e.length;l>0&&e[l-1][2]>f;l--)e[l]=e[l-1];e[l]=[r,c,f]},a.n=e=>{var n=e&&e.__esModule?()=>e.default:()=>e;return a.d(n,{a:n}),n},a.d=(e,n)=>{for(var r in n)a.o(n,r)&&!a.o(e,r)&&Object.defineProperty(e,r,{enumerable:!0,get:n[r]})},a.o=(e,n)=>Object.prototype.hasOwnProperty.call(e,n),a.nmd=e=>(e.paths=[],e.children||(e.children=[]),e),(()=>{var e={121:0};a.O.j=c=>0===e[c];var n=(c,f)=>{var t,s,[l,u,o]=f,v=0;if(l.some(_=>0!==e[_])){for(t in u)a.o(u,t)&&(a.m[t]=u[t]);if(o)var h=o(a)}for(c&&c(f);v<l.length;v++)a.o(e,s=l[v])&&e[s

    Chrome Cache Entry: 181

    Download File
    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
    File Type:ASCII text, with very long lines (10217)
    Category:dropped
    Size (bytes):45745
    Entropy (8bit):5.434922916810672
    Encrypted:false
    SSDEEP:
    MD5:7157132ED555035B02D8B2B48A3E8CC0
    SHA1:3B91A8BB97ADED989B2519429D17A9EB62140AA0
    SHA-256:3D553C6558753F37757FFE12F433D5FC5785E29995ACC79CF4BF648CC23A70BA
    SHA-512:59FAE09CA8DD8A53532C8691F34385337A9EDB283698F93A649FF09465A7FBDA601A1C189988457E984B94C2C8D84FD52C94D34232B641E05685E736DC59D78F
    Malicious:false
    Reputation:unknown
    Preview://tealium universal tag - utag.loader ut4.0.202406051203, Copyright 2024 Tealium.com Inc. All Rights Reserved..var utag_condload=false;window.__tealium_twc_switch=false;try{try{var LogLevel;(function(LogLevel2){LogLevel2[LogLevel2["debug"]=0]="debug";LogLevel2[LogLevel2["info"]=1]="info";LogLevel2[LogLevel2["warn"]=2]="warn";LogLevel2[LogLevel2["error"]=3]="error";LogLevel2[LogLevel2["none"]=4]="none";})(LogLevel||(LogLevel={}));var consoleAppender={debug:function(){var _a;var args=[];for(var _i=0;_i<arguments.length;_i++){args[_i]=arguments[_i];}.(_a=window.console).debug.apply(_a,args);},info:function(){var _a;var args=[];for(var _i=0;_i<arguments.length;_i++){args[_i]=arguments[_i];}.(_a=window.console).info.apply(_a,args);},warn:function(){var _a;var args=[];for(var _i=0;_i<arguments.length;_i++){args[_i]=arguments[_i];}.(_a=window.console).warn.apply(_a,args);},error:function(){var _a;var args=[];for(var _i=0;_i<arguments.length;_i++){args[_i]=arguments[_i];}.(_a=window.console).e

    Chrome Cache Entry: 182

    Download File
    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
    File Type:ASCII text, with very long lines (65536), with no line terminators
    Category:downloaded
    Size (bytes):540474
    Entropy (8bit):5.610030916826358
    Encrypted:false
    SSDEEP:
    MD5:A1E13ADE6C10A59FA83AB2AFC7EE635C
    SHA1:14E1CAA562247CB67F9359213ECF4DC91AD75130
    SHA-256:4752E672F429A09E99E15E285C05888ECA3B890AD3D4516F0F7504C31CE4BC8E
    SHA-512:8D04C4E018119673516FDC5955E93D2B608FFFE2F932F8B57A761DD11FEB80839A8FAC3541D60E322E6383F54F592F3EE6FA3D9E23977CA1C01FD4916C75EAF7
    Malicious:false
    Reputation:unknown
    URL:https://s.uicdn.com/cloudclient/webde/vendor.42ce33d6140141bf.js
    Preview:(self.webpackChunkcloud=self.webpackChunkcloud||[]).push([[502],{71410:(fe,N)=>{"use strict";N.__esModule=!0,N.features={touchevents:function(){var a=!1;return("ontouchstart"in window||window.DocumentTouch&&document instanceof DocumentTouch)&&(a=!0),a}}},55511:(fe,N,p)=>{"use strict";N.__esModule=!0;var a=p(54013);N.PERSONAL_DATA_ATTRIBUTES=["resolutionw","resolutionh","ppi","iid","hid","viewportw","viewporth","contentid","size","campaign"],N.tcf2Filter=function(l,b,D){"pakpie"===l.key&&(a.getTcfConsent("brainTracking",2)||Object.keys(b).forEach(function(S){N.PERSONAL_DATA_ATTRIBUTES.forEach(function(T){0===S.indexOf(T)&&delete b[S]})}))}},75816:(fe,N,p)=>{"use strict";N.__esModule=!0;var a=p(57112),l=p(16293),b=function(S){return a.util.createUrl(S)},D=function(S){var C=new Image(1,1);return new Promise(function(x,I){C.addEventListener("load",function(){x("load")}),C.addEventListener("error",function(){I("error")}),C.addEventListener("abort",function(){I("abort")}),C.src=S,l.logger.lo

    Chrome Cache Entry: 183

    Download File
    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
    File Type:ASCII text, with very long lines (1148)
    Category:downloaded
    Size (bytes):1189
    Entropy (8bit):5.084826061259376
    Encrypted:false
    SSDEEP:
    MD5:7AC0F0FE6BB5AC05D36D5A514EF13DEC
    SHA1:CBDE7C5AA68EF0017E253B104303DCFCA36E8FD3
    SHA-256:9577230B731D530DB1798D88829D4AB8DD1D580ACBD570EEA497125DB6E9E50B
    SHA-512:1EBAB6B4DC97F22C2C0C380765B37731EB9974A4A75D31E828B08D840C97BE015B753D72992E39B78C914BE44E319D6899FFA8BE986C015FB0BA0BA85AAD0FA2
    Malicious:false
    Reputation:unknown
    URL:https://s.uicdn.com/cloudclient/webde/assets/style/bt_webde-7ac0f0fe.css
    Preview::root{--font-weight-header: 500;--font-family-header: WebdeSans, Arial, Helvetica, sans-serif;--font-family-hero: WebdeSans, Arial, Helvetica, sans-serif}@font-face{font-family:WebdeSans;font-style:normal;font-weight:400;font-display:swap;src:url("https://img.ui-portal.de/ci/webde/global/fonts/web.de-sans/web.de-sans-light.woff") format("woff")}@font-face{font-family:WebdeSans;font-style:normal;font-weight:500;font-display:swap;src:url("https://img.ui-portal.de/ci/webde/global/fonts/web.de-sans/web.de-sans-medium.woff") format("woff")}.pos-brand-icon--default{width:36px;height:36px}.pos-brand-icon--small{width:32px;height:32px}.pos-brand-title{border-bottom:0;color:#525252;font-family:WebdeSans,sans-serif;font-weight:400;margin-left:18px;font-size:22px}.pos-brand-title--small{margin-left:16px;font-size:20px}.pos-header{border-bottom:1px solid #dadada}.pos-brand-title{border-bottom:0;color:#525252}@media screen and (min-width: 768px){.pos-brand-title{margin-left:18px}}.pos-header{border

    Chrome Cache Entry: 185

    Download File
    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
    File Type:ASCII text, with very long lines (65536), with no line terminators
    Category:dropped
    Size (bytes):216382
    Entropy (8bit):5.5884707721031655
    Encrypted:false
    SSDEEP:
    MD5:05A945B320ED2C95CE16F8E6A7C4E5A7
    SHA1:5F9778777A3F131F0EEEE71342EF62F06AE64825
    SHA-256:28436617D77ACFC81FE7626022A96AB4E259FFECA1724B887FD8630F9E72C494
    SHA-512:EDDA40C475DCE9F18B8C15493233A4CC4288F4A2CF91819A5733A16FA31206746559C3F3FCCD483FCE4A1DF6115B48BA711BB862D213EBB125247FC22AFF099B
    Malicious:false
    Reputation:unknown
    Preview:(self.webpackChunkcloud=self.webpackChunkcloud||[]).push([[461],{18955:()=>{("function"==typeof DataTransfer||"object"==typeof DataTransfer)&&"function"!=typeof DataTransfer.prototype.setDragImage&&(DataTransfer.prototype.setDragImage=(o,f,t,r)=>{const e="setdragimage-ie-dragging-"+Math.round(Math.random()*Math.pow(10,5))+"-"+Date.now(),n=["."+e,"{",'background: url("'+o.src+'") no-repeat #fff 0 0 !important;',"width: "+o.width+"px !important;","height: "+o.height+"px !important;","text-indent: -9999px !important;","border: 0 !important;","outline: 0 !important;","}","."+e+" * {","display: none !important;","}"],a=document.createElement("style");a.innerText=n.join("");const s=document.getElementsByTagName("head")[0];s.appendChild(a),r.classList.add(e),setTimeout(()=>{s.removeChild(a),r.classList.remove(e)},0)})},24050:(o,f,t)=>{"use strict";t(74124),t(50742),t(18955)},74124:()=>{"use strict";const o=globalThis;function f(C){return(o.__Zone_symbol_prefix||"__zone_symbol__")+C}const e=Ob

    Chrome Cache Entry: 189

    Download File
    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
    File Type:Unicode text, UTF-8 (with BOM) text, with very long lines (65533), with no line terminators
    Category:downloaded
    Size (bytes):135796
    Entropy (8bit):4.983984360863373
    Encrypted:false
    SSDEEP:
    MD5:F3E9E4E89CC07439EED85242D3CA98E0
    SHA1:59501E70ED04CABC7900D7E0CA61AE904BD8DAD5
    SHA-256:B5FDA04A5F4322F80EA23005B3DE6CFD2142F4C7366BF5E6D1C40639309AA8C8
    SHA-512:CA85D885AAEB6D30A7435DE6D12980B36C39A1A2CA9EA8E25B6BCEEB7A0CD9F3B86F1CCACC4B5FB56702143688D6667B8245885636A78B71E803B8694958021D
    Malicious:false
    Reputation:unknown
    URL:https://s.uicdn.com/cloudclient/webde/assets/style/cloud_blue-f3e9e4e8.css
    Preview:./*! normalize.css v3.0.3 | MIT License | github.com/necolas/normalize.css */html{font-family:sans-serif;-ms-text-size-adjust:100%;-webkit-text-size-adjust:100%}body{margin:0}article,aside,details,figcaption,figure,footer,header,hgroup,main,menu,nav,section,summary{display:block}audio,canvas,progress,video{display:inline-block;vertical-align:baseline}audio:not([controls]){display:none;height:0}[hidden],template{display:none}a{background-color:rgba(0,0,0,0)}a:active,a:hover{outline:0}abbr[title]{border-bottom:1px dotted}b,strong{font-weight:bold}dfn{font-style:italic}h1{margin:.67em 0;font-size:2em}mark{background:#ff0;color:#000}small{font-size:12px;line-height:18px;font-family:Verdana,"Helvetica Neue",Helvetica,Arial,sans-serif;color:#333}sub,sup{position:relative;font-size:75%;line-height:0;vertical-align:baseline}sup{top:-0.5em}sub{bottom:-0.25em}img{border:0}svg:not(:root){overflow:hidden}figure{margin:1em 40px}hr{height:0;box-sizing:content-box}pre{overflow:auto}code,kbd,pre,sam

    Chrome Cache Entry: 190

    Download File
    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
    File Type:JSON data
    Category:downloaded
    Size (bytes):924
    Entropy (8bit):5.686827278057004
    Encrypted:false
    SSDEEP:
    MD5:1077F4776AEBEA915EFCAC4E9B298313
    SHA1:35D5C07B0E226F1472AB9974522DD5F645AF9093
    SHA-256:16C7A883D1606D712EEB42E37AB88E4369F7E80D1CB60C46DC824C752C60D67C
    SHA-512:FAC4B8854958D019FC9C8541B178E9C0D0E719CE17883D4E7D47425A3B2C5ACD26E7E7EF09A26A81F620A78BED9D4473A5B8876FA1165337A1DBEF37B407CCCD
    Malicious:false
    Reputation:unknown
    URL:https://c.web.de/restfs/guest/@337550745597380876/share/74ahEl4NT1un_FYZa8msnw/resourceAlias/ROOT?option=download&option=open
    Preview:{"ui:link":{"downloadURI":"https://cgateu01we.storage-webde.de/cgate-we/rest/document/os-live-we/141119726133710167/1410560130512060757/57361.xlsx?x_cd=attachment&c=AASvOJ1dAAkME5NED6qAFH0AAAGRmF1giv__74ahEl4NT1un_FYZa8msnw&t=1724853516660&h=y8MHLW03dAo3PvoAh5VLQWIASao","openURI":"https://cgateu01we.storage-webde.de/cgate-we/rest/document/os-live-we/141119726133710167/1410560130512060757/57361.xlsx?x_cd=inline&c=AASvOJ1dAAkME5NED6qAFH0AAAGRmF1giv__74ahEl4NT1un_FYZa8msnw&t=1724853516660&h=y8MHLW03dAo3PvoAh5VLQWIASao"},"ui:fs":{"creationMillis":1724837354326,"size":11548,"metaETag":"AAABkZhdZZ8AAAGRmF1gig","resourceURINumeric":"../resource/1410545942372815997","lastResourceOperation":"UPLOAD","name":"57361.xlsx","contentETag":"NjvuoU9RDhWt3FvileqjQDjxvXo6MHcPccCAePGdJdg","resourceURI":"ROOT","version":408773549,"modificationMillis":1724838143391,"resourceType":"file","lastResourceOperationClient":"ONLINEOFFICE"}}

    Chrome Cache Entry: 191

    Download File
    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
    File Type:JSON data
    Category:downloaded
    Size (bytes):1212
    Entropy (8bit):5.3662714736632235
    Encrypted:false
    SSDEEP:
    MD5:E4BC978E1E38A9D921F1A52454E86DF5
    SHA1:4305979A6385AB970852408B843A5675FB9B4CBC
    SHA-256:00543C6D7CB857A2A1A183B146F28B2C6887B1A81EF7C7611C543BC5D20E1F5C
    SHA-512:0F7845CA0DEB6B8F4330745E3A1BE9EFE8C187E5967D952EB88A13F16BA8FAAACDE060B7FB83942518D269B7B325F2392EAC329FCB10083F90FC4E6046AA3B93
    Malicious:false
    Reputation:unknown
    URL:"https://c.web.de/restfs/guest/@337550745597380876/share/74ahEl4NT1un_FYZa8msnw/resourceAlias/ROOT?option=shares&option=thumbnails&option=metadata&option=props&option=displayresource&sort=resourceType-a,ui:media.visual-a,name-a&length=201&offset=0"
    Preview:{"ui:meta:document":{"tw":"795","th":"1124","dominantcolor":"fefefe","extractor":"0"},"ui:meta:user":{"createtime":"11:29:14.326","created":"2024-08-28T11:29:14.326","createdate":"2024-08-28","createdYearMonth":"2024-08"},"ui:meta:resource":{"extension":"xlsx","name":"57361","mimetype":"application/vnd.openxmlformats-officedocument.spreadsheetml.sheet"},"ui:share":{"share":[{"name":"57361.xlsx","expirationMillis":1756373962309,"ownerName":"@337550745597380876","resourcePermission":{"readable":true,"writable":false,"deletable":false,"notificationEnabled":true},"hasPin":false}]},"ui:client":{"ooeModificationMillis":"1724837355934","ooeRecentlyUsed":"y"},"ui:link":{"thumbnailURI":"https://sdthumbs.ui-static.net/t/we/NjvuoU9RDhWt3Fvileqj/AfVbpKsADVcTk1D3GYABVQ.jpg?h=qzzjc6xDLvIocNfBWOMozQ&e=1724968800"},"ui:fs":{"creationMillis":1724837354326,"size":11548,"metaETag":"AAABkZhdZZ8AAAGRmF1gig","resourceURINumeric":"../resource/1410545942372815997","lastResourceOperation":"UPLOAD","name":"5736

    Chrome Cache Entry: 192

    Download File
    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
    File Type:JSON data
    Category:downloaded
    Size (bytes):1341
    Entropy (8bit):5.339388112270269
    Encrypted:false
    SSDEEP:
    MD5:66A46B78D6968714A0748431F0C0E46A
    SHA1:EBD990914F0563FB6AEA1945AF503E63B83A1FA2
    SHA-256:6CE05ACF193622B841E1103494D740FE466C497FA544447118AFC16DF125260C
    SHA-512:DD6222BE2640341492A0E25929921509E8A65C7D70D29BAC8822FA5FB8EA2B90CF4ACC173C0F9EE821C3A2181A5EA7A504410FDAA4F61438235E7829D813108D
    Malicious:false
    Reputation:unknown
    URL:https://c.web.de/restfs/guest/@337550745597380876/share/74ahEl4NT1un_FYZa8msnw/shareinfo?option=thumbnails&option=metadata&option=displayresource&option=props
    Preview:{"guest":{"guestEMail":"!ano","expirationMillis":1756373962309,"unmountable":true,"permission":{"readable":true,"writable":false,"deletable":false,"notificationEnabled":true},"guestURI":"resourceAlias/ROOT","guestURINumeric":"resource/1410545942372815997","guestInfoURI":"shareinfo"},"name":"57361.xlsx","owner":"@337550745597380876","resource":{"ui:meta:document":{"tw":"795","th":"1124","dominantcolor":"fefefe","extractor":"0"},"ui:meta:user":{"createtime":"11:29:14.326","created":"2024-08-28T11:29:14.326","createdate":"2024-08-28","createdYearMonth":"2024-08"},"ui:meta:resource":{"extension":"xlsx","name":"57361","mimetype":"application/vnd.openxmlformats-officedocument.spreadsheetml.sheet"},"ui:client":{"ooeModificationMillis":"1724837355934","ooeRecentlyUsed":"y"},"ui:link":{"thumbnailURI":"https://sdthumbs.ui-static.net/t/we/NjvuoU9RDhWt3Fvileqj/AfVbpKsADVcTk1D3GYABVQ.jpg?h=qzzjc6xDLvIocNfBWOMozQ&e=1724968800"},"ui:fs":{"creationMillis":1724837354326,"size":11548,"metaETag":"AAABkZh

    Chrome Cache Entry: 193

    Download File
    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
    File Type:ASCII text, with very long lines (65536), with no line terminators
    Category:downloaded
    Size (bytes):1201423
    Entropy (8bit):5.564280504988678
    Encrypted:false
    SSDEEP:
    MD5:26A4D20A4C7352A536690E908C6771B9
    SHA1:48CA7296FCAE1A1A07248F84C03E41EE627B5182
    SHA-256:9A81FB77E936DD51B57A1157B8808B123618933E062F29C80A12BACCFD792257
    SHA-512:BC4A631B884479DB3742B578EEB6B5D348430E1C6472081DF8F34374A92D15D0FD7CC1C6D1B67009471A1135B78BA9F474006D83666A3472C022E6BD049DB0BF
    Malicious:false
    Reputation:unknown
    URL:https://s.uicdn.com/cloudclient/webde/main.33f8e06771efa248.js
    Preview:(self.webpackChunkcloud=self.webpackChunkcloud||[]).push([[792],{57970:(wi,Eo,Z)=>{"use strict";var Ct=Z(80436),t=Z(68559);Z(85684);var kt=Z(23715),oe=Z(46443),g=Z(60316),je=Z(50640);const To=JSON.parse('{"de":{"JANUARY":"Januar","FEBRUARY":"Februar","MARCH":"M\xe4rz","APRIL":"April","MAY":"Mai","JUNE":"Juni","JULY":"Juli","AUGUST":"August","SEPTEMBER":"September","OCTOBER":"Oktober","NOVEMBER":"November","DECEMBER":"Dezember","TODAY":"Heute","YESTERDAY":"Gestern","FOLDER_SHARED":"Alle Freigaben","FOLDER_TRASH":"Papierkorb","FOLDER_ATTACHMENT":"Neue Dateianlagen","FOLDER_SEARCH":"Suche","FOLDER_TIMELINE":"Fotos & Videos","FOLDER_LAST_EDITED":"Zuletzt bearbeitet","EMPTY_FOLDER":"Keine Dateien vorhanden","PROPERTY_TYPE":"Typ","PROPERTY_NAME":"Name","PROPERTY_SHARES":"Freigaben","PROPERTY_FILESIZE":"Gr\xf6\xdfe","PROPERTY_PARENT":"Verzeichnis","PROPERTY_MODIFICATIONMILLIS":"Ge\xe4ndert","PROPERTY_CREATIONMILLIS":"Erstellt","PROPERTY_SHARED_DATE":"Freigegeben am","PROPERTY_EXPIRATIONMILLIS

    Chrome Cache Entry: 197

    Download File
    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
    File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 300x200, components 3
    Category:downloaded
    Size (bytes):6032
    Entropy (8bit):7.502185338162214
    Encrypted:false
    SSDEEP:
    MD5:91012147F1D208743FC978837CF479DB
    SHA1:97042CAD89964DC9C494C5168654676A608AD941
    SHA-256:6626B1FEA22304A57E92D38AD731140A6DBA56D14EBF03257A11C77366AE94AA
    SHA-512:64E3D9A1B3910C398D7A4F1A15333CA3B2D71497C6D9FD0EF17D592570F6EF22A80ED00903669413390FC867166248ABE57723331DFAF5472EEED4E22F541647
    Malicious:false
    Reputation:unknown
    URL:https://sdthumbs.ui-static.net/t/we/NjvuoU9RDhWt3Fvileqj/AfVbpKsADVcTk1D3GYABVQ.jpg?h=qzzjc6xDLvIocNfBWOMozQ&e=1724968800&cmd=crop&gravity=top&width=300&height=200
    Preview:......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222........,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(.N..mus...,..%...?.>...YEqi...]...9.x..=........Lp..#..!/...?..@.u....Uu..@.........~.<.Ie.rD.X5.;d...@..../..j.........j..%W_..O.....h......J..............U.............c...........4..Uu..@.......:z+........i..._....]..-?.+........?.*....Z..W..cG.%W_..O.....h......J..............U...

    Chrome Cache Entry: 198

    Download File
    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
    File Type:ASCII text, with very long lines (60878)
    Category:dropped
    Size (bytes):64107
    Entropy (8bit):5.312226190611474
    Encrypted:false
    SSDEEP:
    MD5:1E72002807A4BC2E01F439A27E229A2D
    SHA1:BFA937100A5550CFB79A2EE9DE0D1D12A2F65675
    SHA-256:8CD3C58F9C12F731041A0DDE494601263FC377DC3D226861066C2DDE82DC5C68
    SHA-512:18EF29C4418BC2EE19DD8A8F62B138EB2E1F556770961C76750F03CC521788352936FE310FFEC895A3591AA94F8ECF3F80A6FA77851194AD5578A20FF246DBF0
    Malicious:false
    Reputation:unknown
    Preview:var TcfApi=function(e){"use strict";var t,s;e.TcfApiCommands=void 0,(t=e.TcfApiCommands||(e.TcfApiCommands={}))[t.getTCData=0]="getTCData",t[t.ping=1]="ping",t[t.addEventListener=2]="addEventListener",t[t.removeEventListener=3]="removeEventListener",t[t.updateTCString=4]="updateTCString",t[t.getTCString=5]="getTCString",t[t.getACString=6]="getACString",t[t.getPermission=7]="getPermission",t[t.getPermissionFeatures=8]="getPermissionFeatures",t[t.getTCFVersion=9]="getTCFVersion",t[t.getTCLastUpdated=10]="getTCLastUpdated",t[t.getTCStringUtil=11]="getTCStringUtil",t[t.getAppInfo=12]="getAppInfo",t[t.getConsentState=13]="getConsentState",e.PermissionFeatures=void 0,(s=e.PermissionFeatures||(e.PermissionFeatures={}))[s.publisher=0]="publisher",s[s.purpose=1]="purpose",s[s.vendor=2]="vendor",s[s.special=3]="special",s[s.brainTracking=4]="brainTracking",s[s.uimservTracking=5]="uimservTracking",s[s.agofTracking=6]="agofTracking",s[s.tgp=7]="tgp",s[s.oewaTracking=8]="oewaTracking",s[s.googleAna

    Chrome Cache Entry: 199

    Download File
    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
    File Type:HTML document, Unicode text, UTF-8 text, with very long lines (65534), with no line terminators
    Category:downloaded
    Size (bytes):176502
    Entropy (8bit):4.715386195353233
    Encrypted:false
    SSDEEP:
    MD5:60B4385140123339BEFC90E632B26294
    SHA1:705AA3D450DEB76C26817B21D767106E5627E5B8
    SHA-256:34FA0E170A392C910229BE2221725C55ED9C507A3D529E19432E553A144F42B5
    SHA-512:9320020C2850C41BAE2FD9ED1A7483EA918DD113D24797B6D5F4E7F9C43A04A1A9210F38B51118DBF8E7EDDCEA45F98EFF1CBEF58216ED947EB06E0E1CCAEE29
    Malicious:false
    Reputation:unknown
    URL:https://c.web.de/@337550745597380876/74ahEl4NT1un_FYZa8msnw
    Preview:<!doctype html><html><head><meta charset="utf-8"><title>Online-Speicher</title><meta name="viewport" content="width=device-width,initial-scale=1,maximum-scale=1"><meta name="referrer" content="origin"><meta name="robots" content="noindex"><meta property="og:type" content="website"><meta name="twitter:card" content="summary"><meta property="og:title" content="Ihr pers.nlicher Freigabelink | WEB.DE Online-Speicher"><meta name="twitter:title" content="Ihr pers.nlicher Freigabelink | WEB.DE Online-Speicher"><meta property="og:image" content="https://c.web.de/dist/assets/images/logo/webde-52ba5cfd.png"><meta name="twitter:image" content="https://c.web.de/dist/assets/images/logo/webde-52ba5cfd.png"><meta property="og:description" content="Mit diesem Link erhalten Sie Zugriff auf die mit Ihnen geteilten Daten."><meta name="twitter:description" content="Mit diesem Link erhalten Sie Zugriff auf die mit Ihnen geteilten Daten."><meta property="og:url" content="web.de"><meta name="twitter:url" c

    Static File Info

    ⊘No static file info