Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
Quarantined Messages(11).zip
|
Zip archive data, at least v4.5 to extract, compression method=deflate
|
initial sample
|
 |
|
|
C:\Users\user\AppData\Local\Microsoft\FORMS\FRMCACHE.DAT
|
data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntities.bin
|
ASCII text, with very long lines (65536), with no line terminators
|
dropped
|
||
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntitiesUpdated.bin
|
ASCII text, with no line terminators
|
dropped
|
||
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\6E4808A7-C5F0-4081-ADCE-704581E21FDC
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
||
|
C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db
|
SQLite 3.x database, last written using SQLite version 3034001, writer version 2, read version 2, file counter 2, database
pages 1, cookie 0, schema 0, largest root page 1, unknown 0 encoding, version-valid-for 2
|
dropped
|
||
|
C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-journal
|
SQLite Rollback Journal
|
dropped
|
||
|
C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-shm
|
data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-wal
|
SQLite Write-Ahead Log, version 3007000
|
dropped
|
||
|
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\KMDIZEAG\Payment_Advice_Note_Riccardo.nobile_5827096209CQDM
(002).html:Zone.Identifier (copy)
|
HTML document, ASCII text, with very long lines (64099), with CRLF line terminators
|
dropped
|
||
|
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\KMDIZEAG\Payment_Advice_Note_Riccardo.nobile_5827096209CQDM.html
|
HTML document, ASCII text, with very long lines (64099), with CRLF line terminators
|
dropped
|
||
|
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\KMDIZEAG\Payment_Advice_Note_Riccardo.nobile_5827096209CQDM.html:Zone.Identifier
|
ASCII text, with CRLF line terminators
|
dropped
|
||
|
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\KMDIZEAG\Remittance Advice note Ref63aa558c8bd19f14fba31e27f9a4ad0922560090
(389 KB).msg
|
CDFV2 Microsoft Outlook Message
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1728545332631920300_6EBA4BCF-A691-4330-98F7-B864561BD176.log
|
ASCII text, with very long lines (28727), with CRLF line terminators
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1728545332632779000_6EBA4BCF-A691-4330-98F7-B864561BD176.log
|
data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20241010T0328520416-5152.etl
|
data
|
modified
|
||
|
C:\Users\user\AppData\Local\Temp\olk986E.tmp
|
ASCII text, with CRLF line terminators
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\olk987F.tmp
|
ASCII text, with very long lines (65536), with no line terminators
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\~DF07FDEB0F92AC1124.TMP
|
data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\~DF4EAA55C3EA4B3ECE.TMP
|
data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\~DF8D57524B9BAA8A68.TMP
|
CDFV2 Microsoft Outlook Message
|
dropped
|
||
|
C:\Users\user\AppData\Roaming\Microsoft\Office\MSO3072.acl
|
data
|
modified
|
||
|
C:\Users\user\AppData\Roaming\Microsoft\Outlook\NoEmail.srs
|
Composite Document File V2 Document, Cannot read section info
|
dropped
|
||
|
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk
|
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command
line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 10 06:29:11 2024, atime=Wed Sep 27 04:28:28
2023, length=1210144, window=hide
|
dropped
|
||
|
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
|
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command
line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 10 06:29:11 2024, atime=Wed Sep 27 04:28:28
2023, length=1210144, window=hide
|
dropped
|
||
|
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
|
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command
line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28
2023, length=1210144, window=hide
|
dropped
|
||
|
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
|
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command
line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 10 06:29:11 2024, atime=Wed Sep 27 04:28:28
2023, length=1210144, window=hide
|
dropped
|
||
|
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
|
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command
line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 10 06:29:11 2024, atime=Wed Sep 27 04:28:28
2023, length=1210144, window=hide
|
dropped
|
||
|
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
|
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command
line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 10 06:29:11 2024, atime=Wed Sep 27 04:28:28
2023, length=1210144, window=hide
|
dropped
|
||
|
C:\Users\user\Documents\Outlook Files\Outlook Data File - NoEmail.pst
|
Microsoft Outlook email folder (>=2003)
|
dropped
|
||
|
C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp
|
data
|
dropped
|
||
|
Chrome Cache Entry: 80
|
ASCII text, with very long lines (32012)
|
dropped
|
||
|
Chrome Cache Entry: 82
|
MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
|
dropped
|
||
|
Chrome Cache Entry: 84
|
ASCII text, with very long lines (32065)
|
dropped
|
||
|
Chrome Cache Entry: 87
|
SVG Scalable Vector Graphics image
|
downloaded
|
||
|
Chrome Cache Entry: 89
|
ASCII text, with very long lines (50758)
|
downloaded
|
||
|
Chrome Cache Entry: 91
|
ASCII text, with very long lines (19015)
|
dropped
|
||
|
Chrome Cache Entry: 92
|
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1592
|
dropped
|
||
|
Chrome Cache Entry: 93
|
ASCII text, with very long lines (48664)
|
dropped
|
||
|
Chrome Cache Entry: 96
|
ASCII text, with very long lines (65462), with CRLF line terminators
|
downloaded
|
There are 30 hidden files, click here to show them.
URLs
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
file:///C:/Users/user/AppData/Local/Microsoft/Windows/INetCache/Content.Outlook/KMDIZEAG/Payment_Advice_Note_Riccardo.nobile_5827096209CQDM.html
|
|
||
|
http://154.12.225.163/7353914071/next.php
|
154.12.225.163
|
Domains
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
stackpath.bootstrapcdn.com
|
104.18.10.207
|
||
|
cos.sa-saopaulo.myqcloud.com
|
43.135.205.15
|
||
|
s-part-0044.t-0009.fb-t-msedge.net
|
13.107.253.72
|
||
|
code.jquery.com
|
151.101.194.137
|
||
|
cdnjs.cloudflare.com
|
104.17.25.14
|
||
|
s-part-0036.t-0009.t-msedge.net
|
13.107.246.64
|
||
|
maxcdn.bootstrapcdn.com
|
104.18.11.207
|
||
|
sni1gl.wpc.omegacdn.net
|
152.199.21.175
|
||
|
s-part-0017.t-0009.fb-t-msedge.net
|
13.107.253.45
|
||
|
www.google.com
|
142.250.186.68
|
||
|
7353914071-1323985617.cos.sa-saopaulo.myqcloud.com
|
unknown
|
||
|
aadcdn.msftauth.net
|
unknown
|
||
|
206.23.85.13.in-addr.arpa
|
unknown
|
There are 3 hidden domains, click here to show them.
IPs
|
IP
|
Domain
|
Country
|
Malicious
|
|
|---|---|---|---|---|
|
52.113.194.132
|
unknown
|
United States
|
||
|
142.250.186.68
|
www.google.com
|
United States
|
||
|
13.107.246.64
|
s-part-0036.t-0009.t-msedge.net
|
United States
|
||
|
142.250.185.67
|
unknown
|
United States
|
||
|
172.217.16.202
|
unknown
|
United States
|
||
|
104.18.10.207
|
stackpath.bootstrapcdn.com
|
United States
|
||
|
52.109.68.130
|
unknown
|
United States
|
||
|
154.12.225.163
|
unknown
|
United States
|
||
|
192.168.2.16
|
unknown
|
unknown
|
||
|
172.217.18.3
|
unknown
|
United States
|
||
|
104.18.11.207
|
maxcdn.bootstrapcdn.com
|
United States
|
||
|
43.135.205.15
|
cos.sa-saopaulo.myqcloud.com
|
Japan
|
||
|
2.19.126.151
|
unknown
|
European Union
|
||
|
239.255.255.250
|
unknown
|
Reserved
|
||
|
192.168.2.23
|
unknown
|
unknown
|
||
|
52.109.28.46
|
unknown
|
United States
|
||
|
152.199.21.175
|
sni1gl.wpc.omegacdn.net
|
United States
|
||
|
20.42.73.24
|
unknown
|
United States
|
||
|
151.101.194.137
|
code.jquery.com
|
United States
|
||
|
142.250.184.206
|
unknown
|
United States
|
||
|
52.109.76.243
|
unknown
|
United States
|
||
|
104.17.25.14
|
cdnjs.cloudflare.com
|
United States
|
||
|
66.102.1.84
|
unknown
|
United States
|
There are 13 hidden IPs, click here to show them.