Edit tour

Windows Analysis Report
original (1).eml

Overview

General Information

Sample name:	original (1).eml
Analysis ID:	1531075
MD5:	f4e0db2e195cbe3e35add52707fad3c8
SHA1:	0e0268f624ad3d0a28e7d6a37e1872f5104fbdbe
SHA256:	b5bc7c09980077e3e4de1246ca56060eea70a679cee23f5d07c7874e5560f5fd
Infos:

Detection

Score:	48
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

AI detected landing page (webpage, office document or email)

Suspicious MSG / EML detected (based on various text indicators)

Detected non-DNS traffic on DNS port

HTML body contains low number of good links

HTML page contains hidden javascript code

Queries the volume information (name, serial number etc) of a device

Sigma detected: Office Autorun Keys Modification

Stores files to the Windows start menu directory

Classification

Process Tree

System is w10x64_ra

OUTLOOK.EXE (PID: 1084 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\user\Desktop\original (1).eml" MD5: 91A5292942864110ED734005B7E005C0)

ai.exe (PID: 6956 cmdline: "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "DC5BE280-4DB2-4150-8DD8-E512165DFCD9" "7FF8D549-BCE5-48B2-B3DD-EDA1BFA53465" "1084" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx" MD5: EC652BEDD90E089D9406AFED89A8A8BD)

chrome.exe (PID: 5508 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://na4.docusign.net/Member/EmailStart.aspx?a=bac0e9bc-10f7-490d-b8e0-91c66d2fe074&etti=31&r=db8ebd13-e261-4a99-9db2-0eff576af59d MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 1444 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 --field-trial-handle=1940,i,9903106227300174513,15455825623766168201,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Sigma Signatures

Sigma detected: Office Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 , EventID: 13, EventType: SetValue, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE, ProcessId: 1084, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Addins\OneNote.OutlookAddin\1

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Phishing

Suspicious MSG / EML detected (based on various text indicators)

Source: MSG / EML

OCR Text: You don't often get email from dse na4@docusign.net. Learn why this is important @docusign declined to sign. REVIEW DOCUMENT Arnold Ryan elmontaser@kernel-ec.com declined RemittanceSlip105.pdf. As a result, the documents cannot be completed. Do Not Share This Email This email contains a secure link to Docusign. Please do not share this email, link, or access code with others. Alternate Signing Method Visit Docusign.com, click 'Access Documents', and enter the security code: BACOE9BC1 C66D2FE0747 About Docusign Sign documents electronically in just minutes. It's safe, secure, and legally binding. Whether you're in an office, at home, on-the-go -- or even across the globe -- Docusign provides a professional trusted solution for Digital Transaction Management TM Questions about the Document? If you need to modify the document or have questions about the details in the document, please reach out to the sender by emailing them directly. Stop receiving this email Report this email or read more about Declining to sign and Managing notifications. If you have trouble signing, visit "How to Sign a Document" on our Docusign Support Center, or browse our Docusign Community for more information. Download the Docusign App This message was sent to you by Arnold Ryan who is using the Docusign Electronic Signature Service. If you would rather not receive email from this sender you may contact the sender with your request.

Source: https://account.docusign.com/oauth/auth?response_type=code&scope=all%20click.manage%20me_profile%20room_forms%20room_fields%20inproductcommunication_read%20data_explorer_signing_insights%20notary_read%20notary_write%20search_read%20search_write%20webforms_manage%20dtr%20valmod_manage%20signature&client_id=2CC56DC9-4BCD-4B55-8AB0-8BA60BAE1065&redirect_uri=https%3A%2F%2Fapps.docusign.com%2Fauthenticate&state=%7B%22widgetId%22%3A%22%40ds%2Fsend%22%2C%22xsrfToken%22%3A%22mJlhMwgz2sW0v1T9UimgJTkA%2FSeDipUXXtUJbaghq1fNVyWGi3UT7zc%2Bd%2FMGahfxLe4Gs7SVRv6r2d8ilIitxlCCx3PnJlvnF5x%2Bsc%2F4%2FpjGDSRAJEl51uyGeJ8mUme5grKfcs1eO04ubbsCKoD9fqlEiw%2FHJONmaSy0XHA7%2FmM%3D%22%2C%22redirectUri%22%3A%22%2Fsend%2Fauthentication%22%7D

HTTP Parser: Number of links: 1

Source: https://na4.docusign.net/Signing/EnvelopeIsVoid.aspx?ti=293233687b784c3e92f6ba3125cbb0ef

HTTP Parser: Base64 decoded: documentElement) != 'undefined' && typeof(document.documentElement.offsetWidth) != 'undefined' && document.documentElement.offsetWidth != 0) { size = [ document.documentElement.offsetWidth, document.documentElement.offsetheight ]; } else { size = [ doc...

HTTP Parser: No <meta name="author".. found

HTTP Parser: No <meta name="copyright".. found

Source: unknown	HTTPS traffic detected: 40.126.32.133:443 -> 192.168.2.16:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.32.133:443 -> 192.168.2.16:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.16:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.16:53672 version: TLS 1.2

Source: chrome.exe

Memory has grown: Private usage: 0MB later: 29MB

Source: global traffic	TCP traffic: 192.168.2.16:53620 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:53620 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:53620 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:53620 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:53620 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:53620 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:53620 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:53620 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:53620 -> 1.1.1.1:53

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.133
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.133
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.133
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.133
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.133
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.133
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.133
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.133
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.133
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.133
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.133
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.133
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.133
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.133
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.133
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.133
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.133
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.133
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.133
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.133
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.133
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.133
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.133
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.133
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.133
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.133
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.133
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.133
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.133
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.133
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.133
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.133
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.133
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.133
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.133
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.133
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.133
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.133
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.133
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.133
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.133
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.133

Source: global traffic	DNS traffic detected: DNS query: na4.docusign.net
Source: global traffic	DNS traffic detected: DNS query: docucdn-a.akamaihd.net
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: api.mixpanel.com
Source: global traffic	DNS traffic detected: DNS query: app.docusign.com
Source: global traffic	DNS traffic detected: DNS query: apps.docusign.com
Source: global traffic	DNS traffic detected: DNS query: cdn.optimizely.com
Source: global traffic	DNS traffic detected: DNS query: telemetry.docusign.net
Source: global traffic	DNS traffic detected: DNS query: account.docusign.com

Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49693 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53687
Source: unknown	Network traffic detected: HTTP traffic on port 53630 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 53672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49693
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49692
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53630
Source: unknown	Network traffic detected: HTTP traffic on port 49692 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53672
Source: unknown	Network traffic detected: HTTP traffic on port 53687 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746

Source: unknown	HTTPS traffic detected: 40.126.32.133:443 -> 192.168.2.16:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.32.133:443 -> 192.168.2.16:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.16:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.16:53672 version: TLS 1.2

Source: classification engine

Classification label: mal48.phis.winEML@23/67@32/270

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

File created: C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

File created: C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20241010T1421440727-1084.etl

Source: unknown	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\user\Desktop\original (1).eml"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "DC5BE280-4DB2-4150-8DD8-E512165DFCD9" "7FF8D549-BCE5-48B2-B3DD-EDA1BFA53465" "1084" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://na4.docusign.net/Member/EmailStart.aspx?a=bac0e9bc-10f7-490d-b8e0-91c66d2fe074&etti=31&r=db8ebd13-e261-4a99-9db2-0eff576af59d
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 --field-trial-handle=1940,i,9903106227300174513,15455825623766168201,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "DC5BE280-4DB2-4150-8DD8-E512165DFCD9" "7FF8D549-BCE5-48B2-B3DD-EDA1BFA53465" "1084" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://na4.docusign.net/Member/EmailStart.aspx?a=bac0e9bc-10f7-490d-b8e0-91c66d2fe074&etti=31&r=db8ebd13-e261-4a99-9db2-0eff576af59d
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 --field-trial-handle=1940,i,9903106227300174513,15455825623766168201,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: apphelp.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: c2r64.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: userenv.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: msasn1.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: cryptsp.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: rsaenh.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: gpapi.dll

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{F959DBBB-3867-41F2-8E5F-3B8BEFAA81B3}\InprocServer32

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Window found: window name: SysTabControl32

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Common

Persistence and Installation Behavior

AI detected landing page (webpage, office document or email)

Source: Email	LLM: Page contains button: 'REVIEW DOCUMENT' Source: 'Email'
Source: Email	LLM: Email contains prominent button: 'review document'

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Process information queried: ProcessInformation

Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe

Queries volume information: C:\Program Files (x86)\Microsoft Office\root\Office16\AI\WordCombinedFloatieLreOnline.onnx VolumeInformation

Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Browser Extensions	1 Process Injection	1 Masquerading	OS Credential Dumping	1 Process Discovery	Remote Services	Data from Local System	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	1 DLL Side-Loading	1 Process Injection	LSASS Memory	12 System Information Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 Registry Run Keys / Startup Folder	1 Registry Run Keys / Startup Folder	1 DLL Side-Loading	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 Extra Window Memory Injection	1 Extra Window Memory Injection	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction

Name	IP	Active	Malicious	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false	unknown
cdn.optimizely.com	104.18.66.57	true	false	unknown
www.google.com	172.217.18.4	true	false	unknown
api.mixpanel.com	130.211.34.183	true	false	unknown
account.docusign.com	unknown	unknown	false	unknown
app.docusign.com	unknown	unknown	false	unknown
telemetry.docusign.net	unknown	unknown	false	unknown
na4.docusign.net	unknown	unknown	false	unknown
docucdn-a.akamaihd.net	unknown	unknown	false	unknown
apps.docusign.com	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://na4.docusign.net/Signing/EnvelopeIsVoid.aspx?ti=293233687b784c3e92f6ba3125cbb0ef	false		unknown
https://apps.docusign.com/send/authentication?force_reauth=true	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
95.100.63.156	unknown	European Union	16625	AKAMAI-ASUS	false
142.250.186.67	unknown	United States	15169	GOOGLEUS	false
104.18.66.57	cdn.optimizely.com	United States	13335	CLOUDFLARENETUS	false
130.211.34.183	api.mixpanel.com	United States	15169	GOOGLEUS	false
172.217.16.138	unknown	United States	15169	GOOGLEUS	false
20.223.9.233	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
185.81.101.86	unknown	Germany	62856	DOCUS-6-PRODUS	false
20.23.73.37	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
74.125.206.84	unknown	United States	15169	GOOGLEUS	false
185.81.100.37	unknown	Germany	62856	DOCUS-6-PRODUS	false
107.178.240.159	unknown	United States	15169	GOOGLEUS	false
162.248.184.187	unknown	United States	62856	DOCUS-6-PRODUS	false
52.109.89.19	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
162.248.184.189	unknown	United States	62856	DOCUS-6-PRODUS	false
142.250.184.206	unknown	United States	15169	GOOGLEUS	false
199.232.210.172	bg.microsoft.map.fastly.net	United States	54113	FASTLYUS	false
2.20.245.140	unknown	European Union	20940	AKAMAI-ASN1EU	false
52.113.194.132	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.250.186.35	unknown	United States	15169	GOOGLEUS	false
34.104.35.123	unknown	United States	15169	GOOGLEUS	false
1.1.1.1	unknown	Australia	13335	CLOUDFLARENETUS	false
172.217.18.4	www.google.com	United States	15169	GOOGLEUS	false
2.19.126.218	unknown	European Union	16625	AKAMAI-ASUS	false
20.223.14.216	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
185.81.101.38	unknown	Germany	62856	DOCUS-6-PRODUS	false
2.19.126.151	unknown	European Union	16625	AKAMAI-ASUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
52.109.28.48	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
51.105.71.136	unknown	United Kingdom	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false

Private

IP
192.168.2.16

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1531075
Start date and time:	2024-10-10 20:21:16 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled
Analysis Mode:	stream
Analysis stop reason:	Timeout
Sample name:	original (1).eml
Detection:	MAL
Classification:	mal48.phis.winEML@23/67@32/270
Cookbook Comments:	Found application associated with file extension: .eml

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 52.113.194.132, 95.100.63.156, 52.109.89.19, 2.19.126.151, 2.19.126.160, 199.232.210.172
Excluded domains from analysis (whitelisted): ecs.office.com, omex.cdn.office.net, fs.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, weu-azsc-000.roaming.officeapps.live.com, ctldl.windowsupdate.com, prod.roaming1.live.com.akadns.net, s-0005-office.config.skype.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, eur.roaming1.live.com.akadns.net, ecs-office.s-0005.s-msedge.net, roaming.officeapps.live.com, osiprod-weu-buff-azsc-000.westeurope.cloudapp.azure.com, s-0005.s-msedge.net, e16604.g.akamaiedge.net, ecs.office.trafficmanager.net, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, omex.cdn.office.net.akamaized.net, a1864.dscd.akamai.net
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Report size getting too big, too many NtSetValueKey calls found.
VT rate limit hit for: original (1).eml

LLM Input / Output

Input	Output
URL: Email Model: jbxai	{ "brands":["Docusign"], "text":"declined to sign. REVIEW DOCUMENT", "contains_trigger_text":true, "trigger_text":"declined to sign. REVIEW DOCUMENT", "prominent_button_name":"REVIEW DOCUMENT", "text_input_field_labels":"unknown", "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://na4.docusign.net/Signing/EnvelopeIsVoid.aspx?ti=293233687b784c3e92f6ba3125cbb0ef Model: jbxai	{ "brands":["docusign"], "text":"Envelope Unavailable The envelope you are attempting to access has been declined by . at 10/10/2024 10:09:22 AM PDT For more information, please contact the sender. Arnold Ryan Arnold Ryan elmontaser@kernel-ec.com For assistance, please visit our Support Center.", "contains_trigger_text":true, "trigger_text":"Envelope Unavailable", "prominent_button_name":"HOME", "text_input_field_labels":"unknown", "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://account.docusign.com/oauth/auth?response_type=code&scope=all%20click.manage%20me_profile%20room_forms%20room_fields%20inproductcommunication_read%20data_explorer_signing_insights%20notary_read%20notary_write%20search_read%20search_write%20webforms Model: jbxai	{ "brands":["Docusign"], "text":"Log in to Docusign Enter your email to log in. Email * Enter email NEXT Sign Up for Free", "contains_trigger_text":true, "trigger_text":"Log in to Docusign Enter your email to log in.", "prominent_button_name":"NEXT", "text_input_field_labels":["Email *"], "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://account.docusign.com/oauth/auth?response_type=code&scope=all%20click.manage%20me_profile%20room_forms%20room_fields%20inproductcommunication_read%20data_explorer_signing_insights%20notary_read%20notary_write%20search_read%20search_write%20webforms Model: jbxai	{ "phishing_score":1, "brands":"Docusign", "legit_domain":"docusign.com", "classification":"wellknown", "reasons":["The brand 'Docusign' is well-known and widely recognized.", "The URL 'account.docusign.com' is a subdomain of 'docusign.com', which is the legitimate domain for Docusign.", "There are no suspicious elements in the URL such as misspellings, extra characters, or unusual domain extensions.", "The input field 'Email ' is typical for a login or account-related page, which aligns with the subdomain 'account'."], "brand_matches":[false], "url_match":true, "brand_input":"Docusign", "input_fields":"Email "}

Created / dropped Files

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	338
Entropy (8bit):	3.4738726491832708
Encrypted:	false
SSDEEP:
MD5:	769B25ACC1D0726967CB05C44FB17066
SHA1:	E6CB7A337B120743F6B5C6A6602901CFEE34C377
SHA-256:	3EEE8E6FC0F5B5DA89A2C3C1083C532FCBE7A36C5C6B4286146E77EE82CDCE8A
SHA-512:	31CF1E5F7A97E96C682D2A3F6A5C4CBBF6D0D26A23EDBF460AF5301501DA05F75EB16B7276C294A77911E342C8333AEA19FE315F7B7D5C0ABC838CD23486759F
Malicious:	false
Reputation:	unknown
Preview:	p...... ........S&.DA...(..................................................^SZ.. .........p.........$...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.d.i.s.a.l.l.o.w.e.d.c.e.r.t.s.t.l...c.a.b...".7.4.6.7.8.7.a.3.f.0.d.9.1.:.0."...

C:\Users\user\AppData\Local\Microsoft\FORMS\FRMCACHE.DAT

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	231348
Entropy (8bit):	4.39114764226126
Encrypted:	false
SSDEEP:
MD5:	3968EC29C434A2AA50932300FFAF074A
SHA1:	2336D79F2E5789A94CD38136313CB854557594B6
SHA-256:	CB744CD4536960232A4236D566C72310E2D022DC052DF3E8FED9832ED0517F1C
SHA-512:	A6735A329185822E04B9D4A47F11C60FE44074181BB1577F4F05133579059005AA14C88BF491176D6372E5B0B4153CB9CC0F6A46978D2CE484AF961F77B813B1
Malicious:	false
Reputation:	unknown
Preview:	TH02...... .`.B9A.......SM01X...,....669A...........IPM.Activity...........h...............h............H..h..O.....-......h............H..h\cal ...pDat...h....0....O....h..S............h........_`Pk...hq.S.@...I.lw...h....H...8.Uk...0....T...............d.........2h...............k..............!h.............. h6.^.......O...#h....8.........$h........8....."h............'h..^...........1h..S.<.........0h....4....Uk../h....h.....UkH..h@...p.....O...-h .......4.O...+h5.S......O................. ..............F7..............FIPM.Activity....Form....Standard....Journal Entry...IPM.Microsoft.FolderDesign.FormsDescription................F.k..........1122110020000000.GwwMicrosoft...This form is used to create journal entries.........kf...... ..........&...........(.......(... ...@.....................................................................................................................fffffffff........wwwwwwww.p....pp..............p...............pw..............pw..DDDDO..

C:\Users\user\AppData\Local\Microsoft\FontCache\4\CatalogCacheMetaData.xml

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	XML 1.0 document, ASCII text, with very long lines (1869), with no line terminators
Category:	dropped
Size (bytes):	1869
Entropy (8bit):	5.0855310169908305
Encrypted:	false
SSDEEP:
MD5:	EB72E903368C47DC96EEFF012A8BDBEB
SHA1:	A5F26E394A83C70AB38BB54C3F0290CEDB9C8479
SHA-256:	F0003AADEDAB5B6030CD30418EF5C48927D69DB7FFCE6960F0364707716FE33F
SHA-512:	349ADF0B0D2E08A98615025D5F49A34CFF00F68B8E5CCB452603F08360234E883F458B3AE5B7ABA4B02F4EE3AADAFCDAF791A9D62EF21E241D07F3CC526455FF
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?><root><version>1</version><Count>12</Count><Resource><Id>Aptos_26215680</Id><LAT>2024-10-10T18:21:45Z</LAT><key>29939506207.ttf</key><folder>Aptos</folder><type>4</type></Resource><Resource><Id>Aptos_45876480</Id><LAT>2023-10-06T09:25:29Z</LAT><key>27160079615.ttf</key><folder>Aptos</folder><type>4</type></Resource><Resource><Id>Aptos Narrow_26215424</Id><LAT>2023-10-06T09:25:29Z</LAT><key>31558910439.ttf</key><folder>Aptos Narrow</folder><type>4</type></Resource><Resource><Id>Aptos Display_26215680</Id><LAT>2023-10-06T09:25:29Z</LAT><key>23001069669.ttf</key><folder>Aptos Display</folder><type>4</type></Resource><Resource><Id>Aptos Narrow_45876224</Id><LAT>2023-10-06T09:25:29Z</LAT><key>24153076628.ttf</key><folder>Aptos Narrow</folder><type>4</type></Resource><Resource><Id>Aptos Display_45876480</Id><LAT>2023-10-06T09:25:29Z</LAT><key>30264859306.ttf</key><folder>Aptos Display</folder><type>4</type></Resource><Resource><Id>Aptos_

C:\Users\user\AppData\Local\Microsoft\FontCache\4\Catalog\ListAll.Json

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	JSON data
Category:	dropped
Size (bytes):	521377
Entropy (8bit):	4.9084889265453135
Encrypted:	false
SSDEEP:
MD5:	C37972CBD8748E2CA6DA205839B16444
SHA1:	9834B46ACF560146DD7EE9086DB6019FBAC13B4E
SHA-256:	D4CFBB0E8B9D3E36ECE921B9B51BD37EF1D3195A9CFA1C4586AEA200EB3434A7
SHA-512:	02B4D134F84122B6EE9A304D79745A003E71803C354FB01BAF986BD15E3BA57BA5EF167CC444ED67B9BA5964FF5922C50E2E92A8A09862059852ECD9CEF1A900
Malicious:	false
Reputation:	unknown
Preview:	{"MajorVersion":4,"MinorVersion":40,"Expiration":14,"Fonts":[{"a":[4294966911],"f":"Abadi","fam":[],"sf":[{"c":[1,0],"dn":"Abadi","fs":32696,"ful":[{"lcp":983041,"lsc":"Latn","ltx":"Abadi"}],"gn":"Abadi","id":"23643452060","p":[2,11,6,4,2,1,4,2,2,4],"sub":[],"t":"ttf","u":[2147483651,0,0,0],"v":197263,"w":26215680},{"c":[1,0],"dn":"Abadi Extra Light","fs":22180,"ful":[{"lcp":983042,"lsc":"Latn","ltx":"Abadi Extra Light"}],"gn":"Abadi Extra Light","id":"17656736728","p":[2,11,2,4,2,1,4,2,2,4],"sub":[],"t":"ttf","u":[2147483651,0,0,0],"v":197263,"w":13108480}]},{"a":[4294966911],"f":"ADLaM Display","fam":[],"sf":[{"c":[536870913,0],"dn":"ADLaM Display Regular","fs":140072,"ful":[{"lcp":983040,"lsc":"Latn","ltx":"ADLaM Display"}],"gn":"ADLaM Display","id":"31965479471","p":[2,1,0,0,0,0,0,0,0,0],"sub":[],"t":"ttf","u":[2147491951,1107296330,0,0],"v":131072,"w":26215680}]},{"a":[4294966911],"f":"Agency FB","fam":[],"sf":[{"c":[536870913,0],"dn":"Agency FB Bold","fs":54372,"ful":[{"lcp":9830

C:\Users\user\AppData\Local\Microsoft\FontCache\4\PreviewFont\flat_officeFontsPreview_4_40.ttf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	TrueType Font data, 10 tables, 1st "OS/2", 7 names, Microsoft, language 0x409, \251 2018 Microsoft Corporation. All Rights Reserved.msofp_4_40RegularVersion 4.40;O365
Category:	dropped
Size (bytes):	773040
Entropy (8bit):	6.55939673749297
Encrypted:	false
SSDEEP:
MD5:	4296A064B917926682E7EED650D4A745
SHA1:	3953A6AA9100F652A6CA533C2E05895E52343718
SHA-256:	E04E41C74D6C78213BA1588BACEE64B42C0EDECE85224C474A714F39960D8083
SHA-512:	A25388DDCE58D9F06716C0F0BDF2AEFA7F68EBCA7171077533AF4A9BE99A08E3DCD8DFE1A278B7AA5DE65DA9F32501B4B0B0ECAB51F9AF0F12A3A8A75363FF2C
Malicious:	false
Reputation:	unknown
Preview:	........... OS/29....(...`cmap.s.,.......pglyf..&....\|....head2..........6hheaE.@v.......$hmtx...........@loca.U.....8...Dmaxp........... name.P+........post...<...... .........b~1_.<...........<......r......Aa...................Q....Aa....Aa.........................~...................................................3..............................MS .@.......(...Q................. ...........d...........0...J.......8.......>..........+a..#...,................................................/...K.......z...............N.........!...-...+........z.......h..%^..3...&j..+...+%..'R..+..."....................k......$A...,.......g...&...=.......X..&..............&....B..(B...............#.......j...............+...P...5...@...)..........#...)Q..................{.. ....?..'...#....N...7......<...;>.............. ]...........5......#....s.......$.......$.......^..................+...>....H.......%...7.......6.......O...V...........K......"........c...N......!...............$...&...p..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntities.bin

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	322260
Entropy (8bit):	4.000299760592446
Encrypted:	false
SSDEEP:
MD5:	CC90D669144261B198DEAD45AA266572
SHA1:	EF164048A8BC8BD3A015CF63E78BDAC720071305
SHA-256:	89C701EEFF939A44F28921FD85365ECD87041935DCD0FE0BAF04957DA12C9899
SHA-512:	16F8A8A6DCBAEAEFB88C7CFF910BCCC71B76A723CF808B810F500E28E543112C2FAE2491D4D209569BD810490EDFF564A2B084709B02963BCAF6FDF1AEEC59AC
Malicious:	false
Reputation:	unknown
Preview:	51253fe60063c31af0d295afb42228b0:v2:2:1:1590:2:8479:76bd602437550e98c9043d06a55186ab7d95dea5a0e935a599f73e62a8c9b158e0afcb19351f6c353940c06a38172b94d18c02cf92bb8a80184eccca0392b259ab3e71dae73e491c7941997cb36ad4a198661f622dad478d840f66d530a0dde78acea3367f91fff62fbb3dc18faff0c708ad30edef5bea8b22c5fd782b770d8993386eaa784fd19a3c3e1db3b537b1a94d3d4fbd46f8df8fddf6d16611969fe0a97c50e0f3ac24750c93257cf5c161184aa7385800c87d803b339632a3d8ec7fe17a0afd83ce9e9d0e3f7b8d579637928a811f1f7e6d1887df2ddc7d4f752c4d600235e426c92c7bf8a1362f95457998cc0e5d4261f0efa4fada0f866dbcefb407dacab7a2914e91c2f08200f38c2d9d621962145b1464b0f204b326118a53ecdcab22bff005fdd5257c99a6dc51ac0600a49f2ef782396987e78c08b846dad5db55e8ccefffc64863bc2c3e90b95a09d25d0814a848c98fe01a82d4e30e6682dd546e12c45ca0d280a45295ab4bd632dafb070edfdc3c9e38313d5aeb195972986f8011b66817028fd8c78b67a0ac7e780eecc3fb6a31f5a025b8a9a3db278a98c0696aeaac739b18688b0f9c7d751bba02cc5f4e41853fb119b3c0c915059aaa92971244a1989124f12881ca88e6410df70b793a2c3a736ff4

C:\Users\user\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntitiesUpdated.bin

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	10
Entropy (8bit):	2.6464393446710157
Encrypted:	false
SSDEEP:
MD5:	26909962800867E96E7538FF225D2A53
SHA1:	6AA355D8ECC79FCEE51E315690BD7E7D5DF75192
SHA-256:	24C55151562D4E869F6E521F405D6C76A91716E174243D1F78493525A8F109AB
SHA-512:	03EFE7A6B344DCEABC5984AA68D2242E39BA07E9E9D8F819BB7F9C2B19EC24E88BFDD54CD17B3A58E4197A5C8D7B8CB67968C61F9B4E4E46BF056C4DDC264CCA
Malicious:	false
Reputation:	unknown
Preview:	1728584508

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	SQLite 3.x database, last written using SQLite version 3034001, writer version 2, read version 2, file counter 2, database pages 1, cookie 0, schema 0, largest root page 1, unknown 0 encoding, version-valid-for 2
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	0.09304735440217722
Encrypted:	false
SSDEEP:
MD5:	D0DE7DB24F7B0C0FE636B34E253F1562
SHA1:	6EF2957FDEDDC3EB84974F136C22E39553287B80
SHA-256:	B6DC74E4A39FFA38ED8C93D58AADEB7E7A0674DAC1152AF413E9DA7313ADE6ED
SHA-512:	42D00510CD9771CE63D44991EA10C10C8FBCF69DF08819D60B7F8E7B0F9B1D385AE26912C847A024D1D127EC098904784147218869AE8D2050BCE9B306DB2DDE
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................K.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-journal

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	4616
Entropy (8bit):	0.13784977103055013
Encrypted:	false
SSDEEP:
MD5:	C9F4F80A711D4BE617AFE64B28AFA717
SHA1:	DFFFA6D25AFC1220EEF774AF03E4BDD74F755FC9
SHA-256:	FD3D731B6491879F249D1B4B2372552FCFBB84B6E6A8907732F0824D3CC96068
SHA-512:	DC69827426084F3E72EAA081DF0344827D949CFD7ABF59DA018D990158392E7DDF41191C8E89EF6A9F9A26AE0212FBA599E598B455BD56BB3499CAED972515C0
Malicious:	false
Reputation:	unknown
Preview:	.... .c.....5.e.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................SQLite format 3......@ ..........................................................................K.................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-shm

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.04495055541749482
Encrypted:	false
SSDEEP:
MD5:	0C90B905497D7D38839B30A6A5D2DF6D
SHA1:	E5E69C8A547763D90350658FA16CB0A8B8C37819
SHA-256:	D077A443A3E4447C9F84C987D940BC853511556E44883C2C9CAFF7528E01F245
SHA-512:	44326FF44B79384540302F7A0FA2E494605AEC124C501886C616D9FC3FE4084CDCDE7AC2CEB2F5E316050392FB22172C5E26D255369941C324C477260D334C48
Malicious:	false
Reputation:	unknown
Preview:	..-.....................ga..f.6.=..R)W.&.`n..d...-.....................ga..f.6.=..R)W.&.`n..d.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-wal

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	modified
Size (bytes):	45352
Entropy (8bit):	0.39551907027369887
Encrypted:	false
SSDEEP:
MD5:	7FC21BA1797B7A780CA2603EC838AC5F
SHA1:	B45D104F9F61EC07C1931ED5449EF40D6041BBDD
SHA-256:	DDCC400D27DAC93FDF0A0B1FAE77D39198F2D4FF3F635920A8B5FFF35E008C3C
SHA-512:	32E0115C99F91039E8DB85915AA103ED5CFABA96C48077D8D3563C1F0EED1B01BC6DA487CB5267F75BF760AC338907546BC7E56188AD5923643D081618977CD2
Malicious:	false
Reputation:	unknown
Preview:	7....-..........=..R)W....P...G........=..R)W..HR.B^aSQLite format 3......@ ..........................................................................K.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{D9F95C05-CBFE-4448-8EB6-752D35897D1F}.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	12572
Entropy (8bit):	4.016882704610113
Encrypted:	false
SSDEEP:
MD5:	DB38405D2F87867BB72764DC00BA00B3
SHA1:	923F1F5B425EEC5E4F7E8ADCEBB293C3160CC4AD
SHA-256:	C6FF97205A1B3EBDF240FE588FA83F375FEA473D8074D6EA1A140F9B7BB4D8B0
SHA-512:	675746AB112D961E1C613728F2E71819BFEEF4783BD700028FAD6E066DD7C5D2BA463DA1C16F23FD6A3E35623DBB7FFFEDE26DA0F59D9620D5F130495C687D41
Malicious:	false
Reputation:	unknown
Preview:	......Y.o.u. .d.o.n.'.t. .o.f.t.e.n. .g.e.t. .e.m.a.i.l. .f.r.o.m. .d.s.e._.n.a.4.@.d.o.c.u.s.i.g.n...n.e.t... .H.Y.P.E.R.L.I.N.K. .".h.t.t.p.s.:././.a.k.a...m.s./.L.e.a.r.n.A.b.o.u.t.S.e.n.d.e.r.I.d.e.n.t.i.f.i.c.a.t.i.o.n."...................................................................................................................................................................................................................................................................................................................................@...B..............................................................................................................................................................................................................................................................................................................................................................................$.a$.*...$..$.If........!v..h.#v....:V.......t.....6......5.......4........4.....

C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1728584504943197800_40569FE3-431E-4839-B2E0-E56988338FE8.log

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	ASCII text, with very long lines (28756), with CRLF line terminators
Category:	dropped
Size (bytes):	20971520
Entropy (8bit):	0.18088294896967436
Encrypted:	false
SSDEEP:
MD5:	758DE567C0F8EF8EDBF8A013C9CEBAE5
SHA1:	8A7E14B056C974E43BC4D28910DB6527BCC5A310
SHA-256:	4527420C2E13CF947132BC2647E2EC4017946128FA70B44BB77C0489A20436F3
SHA-512:	CF53FD7E94BFDE0ABE719BD553F092144D9CF39F26FD69F86804336CFB235C2F8CF6CFB213697D1F36D2C0891C2EBB3FC58BF7B4E75472E71FB05B238E8058EE
Malicious:	false
Reputation:	unknown
Preview:	Timestamp.Process.TID.Area.Category.EventID.Level.Message.Correlation..10/10/2024 18:21:44.980.OUTLOOK (0x43C).0x1AC.Microsoft Outlook.Telemetry Event.b7vzq.Medium.SendEvent {"EventName":"Office.Text.GDIAssistant.HandleCallback","Flags":30962256044949761,"InternalSequenceNumber":25,"Time":"2024-10-10T18:21:44.980Z","Contract":"Office.System.Activity","Activity.CV":"459WQB5DOUiy4OVpiDOP6A.4.11","Activity.Duration":17,"Activity.Count":1,"Activity.AggMode":0,"Activity.Success":true,"Data.GdiFamilyName":"","Data.CloudFontStatus":6,"Data.CloudFontTypes":256}...10/10/2024 18:21:44.996.OUTLOOK (0x43C).0x1AC.Microsoft Outlook.Telemetry Event.b7vzq.Medium.SendEvent {"EventName":"Office.Text.ResourceClient.Deserialize","Flags":30962256044949761,"InternalSequenceNumber":27,"Time":"2024-10-10T18:21:44.996Z","Contract":"Office.System.Activity","Activity.CV":"459WQB5DOUiy4OVpiDOP6A.4.12","Activity.Duration":10880,"Activity.Count":1,"Activity.AggMode":0,"Activity.Success":true,"Data.JsonFileMajorVers

C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1728584504943970400_40569FE3-431E-4839-B2E0-E56988338FE8.log

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	20971520
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	8F4E33F3DC3E414FF94E5FB6905CBA8C
SHA1:	9674344C90C2F0646F0B78026E127C9B86E3AD77
SHA-256:	CD52D81E25F372E6FA4DB2C0DFCEB59862C1969CAB17096DA352B34950C973CC
SHA-512:	7FB91E868F3923BBD043725818EF3A5D8D08EBF1059A18AC0FE07040D32EEBA517DA11515E6A4AFAEB29BCC5E0F1543BA2C595B0FE8E6167DDC5E6793EDEF5BB
Malicious:	false
Reputation:	unknown
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20241010T1421440727-1084.etl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	modified
Size (bytes):	106496
Entropy (8bit):	4.456090264770682
Encrypted:	false
SSDEEP:
MD5:	76A5000582A6BBD0877482CEBB3AE9A5
SHA1:	C8FA3304F74D766E097F2E1FEFAD37F98E6DB4A4
SHA-256:	70BC4FEC29FE7F7B5FC2559B3209589758B24008E6E580A73CE7CBA7ECBC39DF
SHA-512:	2B9AB0E1B7BDC5F55BDF7159397EC0B8BF04E4304C7BA626DCF45A2CABC4988B62CB478CBB782A3B246C866DAE67BE030E52A56C858D1A25AA09286ACA2D21D9
Malicious:	false
Reputation:	unknown
Preview:	............................................................................^.......<...o..BA...................eJ..............Zb..2...................................,...@.t.z.r.e.s...d.l.l.,.-.1.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.1.1.1.............................................................1^.Y..........o..BA...........v.2._.O.U.T.L.O.O.K.:.4.3.c.:.6.7.5.e.9.2.c.5.e.c.4.3.4.a.9.5.8.b.d.1.6.9.0.9.1.4.1.e.5.d.4.7...C.:.\.U.s.e.r.s.\.c.a.l.i.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.O.u.t.l.o.o.k. .L.o.g.g.i.n.g.\.O.U.T.L.O.O.K._.1.6._.0._.1.6.8.2.7._.2.0.1.3.0.-.2.0.2.4.1.0.1.0.T.1.4.2.1.4.4.0.7.2.7.-.1.0.8.4...e.t.l.........P.P.....<...o..BA...........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Office\MSO3072.acl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	30
Entropy (8bit):	1.2389205950315936
Encrypted:	false
SSDEEP:
MD5:	6C081078A81C12CA419385B25CF3AB7F
SHA1:	2F87330B2AA3C483F319FAEA07A1F926151DE48D
SHA-256:	5D5425F0CBE319198ED204F9B2B1C0BB7C78E209ECD9E0AEC9A4E6DAB235698F
SHA-512:	339A79D0A8EDF28F4829FAB1548A6B396DEA54703C5A853A52074209B4FC366B0C247A94D83CB6782714E475462AEA0D9CC2781F80A4D81F2B1EEE9E8F9CAEAE
Malicious:	false
Reputation:	unknown
Preview:	..............................

C:\Users\user\AppData\Roaming\Microsoft\Outlook\NoEmail.srs

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.6694686421969782
Encrypted:	false
SSDEEP:
MD5:	79A01E9444345EBE9C195139DFDE9E4E
SHA1:	7053086D98395A3D0F36169354AD564A9E483DFB
SHA-256:	51BDE4159ED7FEE8A704A6BAC27F4454291BE1844114CA7CAC63DC6620ADD064
SHA-512:	0548B8878D2835E07F9C263D0E85A20D5ED41B59F719B5C1324E3018E7592BD423D3730D7A1B5AD8D0E4746E475B89317D7E55684D2B044E868E2F35B98C269B
Malicious:	true
Reputation:	unknown
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 10 17:22:02 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2673
Entropy (8bit):	3.98441113674915
Encrypted:	false
SSDEEP:
MD5:	FCB221D4E415B21D5720C49653176FF1
SHA1:	D5E065D98BD9FE1F5DFECD16C229E83A51502BCD
SHA-256:	9900BBECA3718F0A7AAD5B2B9738D677949FC44E9C0BFBB23C48B36C7B55176A
SHA-512:	0E9BFF20171CF5507A0E0FB12FC2D3523CF3795806A9F1E7DE062A1CF093449C1EBDF206E1BB37EF2FD5FF1DD68FC79CB681E5AA5016577FFB089DBE8E77C531
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,....&.pMA...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IJY......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VJY......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VJY......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VJY............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VJY............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............e.9.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 10 17:22:02 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2675
Entropy (8bit):	3.9998499874203457
Encrypted:	false
SSDEEP:
MD5:	B8E413125E1279D714BD8FB38B792EF2
SHA1:	9B3CB7DE87E9720AD8AF5F75AE51FB2106CF4CB4
SHA-256:	9C6C23AC18F36E837B4186CB4EE1C8CE7ECA98BA9E862451C26B46041E93ACA0
SHA-512:	D14DAEE61ABF262D918F5AD2792F624486E2A6DF1E7986640A1EF8ECDAFABA3737E9C5989250B7AF604CDC11FFE60ACE05E48C9F896F14FA51A6186BEC5B9494
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,......\MA...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IJY......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VJY......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VJY......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VJY............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VJY............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............e.9.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2689
Entropy (8bit):	4.00862685317433
Encrypted:	false
SSDEEP:
MD5:	577844007396C0DD8234B2BC0841C862
SHA1:	996DA8AD16A7BBE090240D89CFCB8B1C494752CC
SHA-256:	606BE05A43A0FF6904A3F3E05771AC0E1404C3246532C17917CACFC209AC75FB
SHA-512:	7133C5569F69EEDB208DCA5A86093B6271FBB2ED7675EBC9AD0C3E8338D41FEEBF2CA70B30EC6CB6BD3DED815D9D60A0C7CDC6ABF91DD36BA854DD515DF5AD2D
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.....Y.04...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IJY......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VJY......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VJY......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VJY............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VFW.E...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............e.9.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 10 17:22:02 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9991038181272502
Encrypted:	false
SSDEEP:
MD5:	A0B56E382ADBEE374B1629A6DE3AA7EE
SHA1:	5A72C5B78F3BAD49AFE62A6DEB7E386CD9DE51EC
SHA-256:	2D28C4A4A70334639865CE2AD276CE64209693A316D2627D765894EB6F33BA5B
SHA-512:	040CFDBD47AC013E7F87E084F66AF0C568581C45E8595117B7E61DF649032E2692EAC58B42B28591FC9A5A5D8CB2A70228CE3BDC70F384F8FB344CDB47BF0898
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,......SMA...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IJY......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VJY......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VJY......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VJY............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VJY............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............e.9.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 10 17:22:02 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.987396153434767
Encrypted:	false
SSDEEP:
MD5:	3942C058D5339C3E3735A0D197DB3EC7
SHA1:	49CCF8B05FFB10C91A7D62FE6EDCF33D64A13D51
SHA-256:	0829348168C9FD9B5E8C012A8FE915E77F2006D189505B6A01D27D1C9E976CFA
SHA-512:	F57492A0CE88D788527C52EDCC5EE0D38491053D977700107E0333B9B943B445D15494D4C5CB89216068CB16E182A0355CF018E492FF19E364135FC545BE7932
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,......eMA...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IJY......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VJY......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VJY......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VJY............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VJY............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............e.9.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 10 17:22:02 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.996027190256
Encrypted:	false
SSDEEP:
MD5:	B5651A5752C1090E8FF7FA6F7B8C4479
SHA1:	2AD12BFDA01168C0517303DC31FE5B80E192D3A2
SHA-256:	0FBBD7AD6F0C2C3DDA94F8EF84AD20A78566542A42469FAE68EC2B26BF09144D
SHA-512:	0F1D2FE22732BA40876951F5933A3AAC06D1F411250ED0FFEC717A9943EB75BE5FD5F523B56C860A874A8726F8B40ECDFBD83F322E2C799937D54CB2ACF16623
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.....FDMA...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IJY......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VJY......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VJY......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VJY............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VJY............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............e.9.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\Documents\Outlook Files\Outlook Data File - NoEmail.pst

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	Microsoft Outlook email folder (>=2003)
Category:	dropped
Size (bytes):	271360
Entropy (8bit):	4.124974411887599
Encrypted:	false
SSDEEP:
MD5:	B6BF3FF6D6D981623878CE44D5D98584
SHA1:	7AF67DC8AC7FDD2B8056F548766937F05C032056
SHA-256:	3ADBA600B23809640440262CE83262B2CD1DB358F1F0ECE085A772D280A2A25B
SHA-512:	02D129B1CD6E32535AFCC61A7329D76D372527C8BE44A388C68401DA731C44561103B354D1DC955E8D87538CE939F9BE06B7E6F561E8B04BA3D72FCF203F86E7
Malicious:	true
Reputation:	unknown
Preview:	!BDN....SM......\...m...........L.......e................@...........@...@...................................@...........................................................................$.......D......@...............<...............J...........................................................................................................................................................................................................................................................................................d........^...3......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	5.574837209262351
Encrypted:	false
SSDEEP:
MD5:	EC8D276DB7CCF9C1DDE277C840C0D297
SHA1:	E1D83C7C6D793B943DA570A74473ED44CBD63F67
SHA-256:	8FD3A5FD4F24B748E7D425B1D565B01FE079DF907A5CC589F23E9AABBA0B3141
SHA-512:	03C4BC59C5097F2FF7C77140EB9D452C889F90DE26A81DA7E32842DC407B3CA4254DDC90A3BBB4EBB0791758A59D28A30241626EA92DA7D12E538B07084C8A12
Malicious:	true
Reputation:	unknown
Preview:	..U.0...v.......<....k.BA........D............#.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................a....D......[..P0...w.......<....k.BA........B............#.........................................................................................................................................................................................................................................................................................................................................................................................................

Chrome Cache Entry: 176

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (13479), with CRLF line terminators
Category:	downloaded
Size (bytes):	13579
Entropy (8bit):	5.27337657330958
Encrypted:	false
SSDEEP:
MD5:	2779F5D2F1F22353C726240E530016CC
SHA1:	2B3F380F212C8C64E79DB1F47FA25C114AFE6FBB
SHA-256:	16496529F57AC8915F194E00479B04AF942C33D7897BCFD9A55DD072BBEC1411
SHA-512:	14F4E6DB8D21EFA0A01DFE6AC5C6941807B3DA8875864D736476D480167A9C7B02E60E8BE19CC2F9526B3027684661F5B11D36D3A9D44096DF86B120AF8904E6
Malicious:	false
Reputation:	unknown
URL:	https://na4.docusign.net/Signing/client_scripts/jQuery/jquery-migrate-3.4.1.min.js
Preview:	/! jQuery Migrate v3.4.1 \| (c) OpenJS Foundation and other contributors \| jquery.org/license /.."undefined"==typeof jQuery.migrateMute&&(jQuery.migrateMute=!0),function(t){"use strict";"function"==typeof define&&define.amd?define(["jquery"],function(e){return t(e,window)}):"object"==typeof module&&module.exports?module.exports=t(require("jquery"),window):t(jQuery,window)}(function(s,n){"use strict";function e(e){return 0<=function(e,t){for(var r=/^(\d+)\.(\d+)\.(\d+)/,n=r.exec(e)\|\|[],o=r.exec(t)\|\|[],a=1;a<=3;a++){if(+o[a]<+n[a])return 1;if(+n[a]<+o[a])return-1}return 0}(s.fn.jquery,e)}s.migrateVersion="3.4.1";var t=Object.create(null);s.migrateDisablePatches=function(){for(var e=0;e<arguments.length;e++)t[arguments[e]]=!0},s.migrateEnablePatches=function(){for(var e=0;e<arguments.length;e++)delete t[arguments[e]]},s.migrateIsPatchEnabled=function(e){return!t[e]},n.console&&n.console.log&&(s&&e("3.0.0")&&!e("5.0.0")\|\|n.console.log("JQMIGRATE: jQuery 3.x-4.x REQUIRED"),s.migrateWarning

Chrome Cache Entry: 177

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format, CFF, length 34820, version 0.0
Category:	downloaded
Size (bytes):	34820
Entropy (8bit):	7.982902826695778
Encrypted:	false
SSDEEP:
MD5:	FD117C9EB999E35D64BE1515D5B2192D
SHA1:	B0FAE4091AC17A28C47AF531A9D5B73B4C35F6BD
SHA-256:	553582BE8A5D2779D1A9E9C3A6698FD4D365E01353D8876A7204DB68FCD1D12D
SHA-512:	24D51DBAFDE7E5B7B1486BA3800BC8ECBAF369A2D28BBBF15096C723DC565247F9B956E8D0F28EDB535313E1B26934DFC30AF0AF700B8CB57F02926B889B2177
Malicious:	false
Reputation:	unknown
URL:	https://docucdn-a.akamaihd.net/production/1ds/widgets/@ds/signing/24.9.37-2/fonts/maven-pro/MavenPro-Regular.woff
Preview:	wOFFOTTO...........<........................CFF ......S....{..."FFTM............Z...GDEF..X4....... ....GPOS..Xt..-....DiP}7GSUB..XT... ... l.t.OS/2.......I...`.[.8cmap.......\|....#G..head...0...3...6.h..hhea...d.......$....hmtx.......Q...X.xm.maxp..............P.name.......=...1.E.Lpost........... .j.fx.c`d```d8R!.0...+.7.....\|Y...o.....v...``....MM...x.c`d``../.H.....1.F..............P.....x.c`b..8.....u..1...<.f........p...).,fp`P...._......u05..X.......,......x.m.1O.@....aP.......K.B.N..&.......^...\......G../.Dc....{....\.......c.....p...u.c.W..q....q...2...gY.g.k.8...w.u.c...9n.Vu.7q..1...[.H.`...6..p."@...L.&.X....Cfg.I}..+..[.4G.q..>..Yn.4Y..v.....[...L...~.I..Rh.......Q%..Qh...u...8.N....q.c......z.9.9.....&/O...h..mR=..........ljr.. ......T....Sw`....x.c```f.`..F..8..1..,..........P..a)........L..(.(H).)().)X).QTz..........@....1.AU.+H(.UZBU2.................n...}.`...V=X.`.I...Q8.z....#..A.L.,.l...\.<.\|...B.".b...R.2.r...J.*.j...Z.:.z...F.&.f...

Chrome Cache Entry: 179

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (42039), with LF, NEL line terminators
Category:	downloaded
Size (bytes):	3530096
Entropy (8bit):	5.65662991266059
Encrypted:	false
SSDEEP:
MD5:	C47DBDC38B3426489FE6326C05821CEE
SHA1:	7FA5D598CBD4257E03D7FC8C07DC3DC01D311878
SHA-256:	B9E4FF80EB003823303EBA5AD40E8BF71E031E13335E1B4F9F95CF748ED5F9F5
SHA-512:	26889BE0B96C3EC132F683FCAB90DF6FDE10C235B6E53468E11F7065C10CF8C77B136DEC1F4EA7AFC00378E08C393BF4050EAC82E1BA47615EDC9305B6BB63CC
Malicious:	false
Reputation:	unknown
URL:	https://account.docusign.com/ReactApp/dist/bundle.js?version=24.3.200.20763
Preview:	/! For license information please see bundle.js.LICENSE.txt /.!function(){var t,e,n,r,o={17635:function(t,e,n){var r=n(73053);t.exports=r},9645:function(t,e,n){var r=n(90297);t.exports=r},79858:function(t,e,n){var r=n(50145);t.exports=r},6013:function(t,e,n){var r=n(97103);t.exports=r},95716:function(t,e,n){var r=n(5034);t.exports=r},5569:function(t,e,n){var r=n(29528);t.exports=r},60550:function(t,e,n){var r=n(95270);t.exports=r},16986:function(t,e,n){var r=n(90700);t.exports=r},14728:function(t,e,n){var r=n(86416);t.exports=r},33169:function(t,e,n){var r=n(45546);t.exports=r},83136:function(t,e,n){var r=n(60971);t.exports=r},57559:function(t,e,n){var r=n(4506);t.exports=r},84192:function(t,e,n){var r=n(44637);t.exports=r},54221:function(t,e,n){var r=n(66268);t.exports=r},40497:function(t,e,n){var r=n(55356);t.exports=r},73329:function(t,e,n){var r=n(54322);t.exports=r},32253:function(t,e,n){var r=n(93386);t.exports=r},49634:function(t,e,n){var r=n(22564);t.exports=r},95939:function

Chrome Cache Entry: 180

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	3896
Entropy (8bit):	4.786686051422741
Encrypted:	false
SSDEEP:
MD5:	855476199961A10981ADCA7432CEC048
SHA1:	7995725A0CAC73EB6A2A1B5A8D5B162DBF47988E
SHA-256:	6DD60FAA0E35F2DFE342C452ED414A084D384D11793BD0F0EB03C2B1C6F1405C
SHA-512:	A9E61582FA18BCC1DD57DE8A7C194BAB0D6F733897F541A6E13B94906ADC115D65004F5A2649919FA8B8545F0C67C9313A14EAEAF42C34F630DA13CD38E17994
Malicious:	false
Reputation:	unknown
URL:	https://docucdn-a.akamaihd.net/olive/images/2.63.0/global-assets/ds-logo-inverse.svg
Preview:	<?xml version="1.0" encoding="utf-8"?>. Generator: Adobe Illustrator 28.1.0, SVG Export Plug-In . SVG Version: 6.00 Build 0) -->.<svg version="1.1" id="Layer_1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px".. viewBox="0 0 1200 241.4" style="enable-background:new 0 0 1200 241.4;" xml:space="preserve">.<style type="text/css">...st0{fill:#FFFFFF;}...st1{fill:#4C00FF;}...st2{fill:#FF5252;}.</style>.<g>..<g>...<g>....<path class="st0" d="M1169.2,109.7v78.7h-28.9v-73.5c0-17.9-7.7-27.9-22.7-27.9s-24.9,10.5-27.7,28.1c-0.8,4.2-1,10.7-1,24.4.....v48.8H1060v-125h25.6c0.1,1.1,0.7,12.3,0.7,13c0,0.9,1.1,1.4,1.8,0.8c10.6-8.4,22.3-16.2,38.6-16.2.....C1153.5,60.9,1169.2,79,1169.2,109.7z"/>....<path class="st0" d="M1013.4,63.4l-0.9,14.3c-0.1,0.9-1.2,1.4-1.8,0.8c-3.5-3.3-16.4-17.5-38.3-17.5c-31.4,0-54.5,27.1-54.5,63.9.....l0,0c0,37.3,22.9,64.5,54.5,64.5c21.1,0,34-13.7,36.4-16.7c0.7-0.8,2-0.3,2,0.7c-0.3,3.8-0.8,13.3-4,21.4.....c-4,10.2-13,19.7-31.1,19.7

Chrome Cache Entry: 181

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (544)
Category:	dropped
Size (bytes):	11440
Entropy (8bit):	5.360613902337515
Encrypted:	false
SSDEEP:
MD5:	61699B70CF57ABE63FDF5F4007D36EC1
SHA1:	6C05189CC2D08BB2A7609C002F0675C9C670D362
SHA-256:	229BBF4D0E7488209564152C6723497F1AC3934136CA1684233D2FA88FA4146F
SHA-512:	AA5CC8794B5383B781A6611A4B5D8D660C73E766186551799B28FCF668C911EB0177FA04F543EC60E5F64005F3BCE019604BD0A2129D718F33284D3689F5C398
Malicious:	false
Reputation:	unknown
Preview:	/** @license React v17.0.2. * react.production.min.js. . Copyright (c) Facebook, Inc. and its affiliates.. . This source code is licensed under the MIT license found in the. * LICENSE file in the root directory of this source tree.. */.(function(){'use strict';(function(c,x){"object"===typeof exports&&"undefined"!==typeof module?x(exports):"function"===typeof define&&define.amd?define(["exports"],x):(c=c\|\|self,x(c.React={}))})(this,function(c){function x(a){if(null===a\|\|"object"!==typeof a)return null;a=Y&&a[Y]\|\|a["@@iterator"];return"function"===typeof a?a:null}function y(a){for(var b="https://reactjs.org/docs/error-decoder.html?invariant="+a,e=1;e<arguments.length;e++)b+="&args[]="+encodeURIComponent(arguments[e]);return"Minified React error #"+.a+"; visit "+b+" for the full message or use the non-minified dev environment for full errors and additional helpful warnings."}function v(a,b,e){this.props=a;this.context=b;this.refs=Z;this.updater=e\|\|aa}function ba(){}function K(a,b,e

Chrome Cache Entry: 182

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	32
Entropy (8bit):	4.202819531114783
Encrypted:	false
SSDEEP:
MD5:	034382B161C0E0D57F4551AB2A364633
SHA1:	CA82E7949B7450871C11B6924A0307D6FFE51CB0
SHA-256:	8D8802B33957424700F5386511BD85B1745219E05162A333C4BDBEEC083CE3E6
SHA-512:	6359D87E28108A96755EFC5E4EEEA4D1CA2CAF0A3493CDEC2D0824528A208FE187075DC26E0570B487665DDD7FE1AACA754AEDD9BC0B0BC800A248AB9B9F3417
Malicious:	false
Reputation:	unknown
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISEAk2V9J8E6A9GhIFDYOoWz0=?alt=proto
Preview:	ChUKEw2DqFs9GgQICRgBGgQIZBgCIAE=

Chrome Cache Entry: 183

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1251)
Category:	dropped
Size (bytes):	1288
Entropy (8bit):	5.208465995642918
Encrypted:	false
SSDEEP:
MD5:	B19F11286F124B9178FEC64A60FB0913
SHA1:	06F179DF826A6ABC1800CDB7862F638B34C18636
SHA-256:	935D79278AAEBA9C7925F5233635981E53330070AD5DE9BDF47AF72352B2A660
SHA-512:	1CD79F99BCC34E6E86488F78E3F12A20F34B9724B1CFD608BDCE5EB6BE6A3DD378EBBA74F2CDFC1B9B0BC1DE840989B0E617927E4574F0697295EC0C05F2724E
Malicious:	false
Reputation:	unknown
Preview:	!function(){function e(e,r){return(r\|\|"")+" (SystemJS Error#"+e+" https://github.com/systemjs/systemjs/blob/main/docs/errors.md#"+e+")"}!function(r){function t(){throw Error(e(5,"AMD require not supported."))}var n=["require","exports","module"];r.define=function(r,o,s){var i,u,f="string"==typeof r,l=f?r:null,a=f?o:r,d=f?s:o;if(Array.isArray(a))i=a,u=d;else if("object"==typeof a)i=[],u=function(){return a};else{if("function"!=typeof a)throw Error(e(9,"Invalid call to AMD define()"));i=n,u=a}var c=function(e,r){function n(e){u.push((function(r){i[e]=r.__useDefault?r.default:r}))}for(var o={},s={exports:o},i=[],u=[],f=0,l=0;l<e.length;l++){var a=e[l],d=u.length;"require"===a?(i[l]=t,f++):"module"===a?(i[l]=s,f++):"exports"===a?(i[l]=o,f++):n(l),f&&(e[d]=a)}f&&(e.length-=f);var c=r;return[e,function(e){return e({default:o,__useDefault:!0}),{setters:u,execute:function(){var r=c.apply(o,i);void 0!==r&&(s.exports=r),e(s.exports),e("default",s.exports)}}}]}(i,u);f?(System.registerRegistry?(Sy

Chrome Cache Entry: 184

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	788
Entropy (8bit):	4.9019698351522845
Encrypted:	false
SSDEEP:
MD5:	CB4FD3AF4DEEBD7277FCD75A576BF633
SHA1:	71A7BC5DE0F92581F2A9F8DCED86578E01B4856C
SHA-256:	F6C29AE65E37D866FEFB836DB488C4D044414798EC995B2B69CD067949938DD9
SHA-512:	1507C60248859484296F0CF5D1D0AB73BA4B2522A8D05C37773E45AE57C381BFC1FBFC1E38C2F1EE4DB626C1E4AF8C973B38FAD6C5FD74A4423FD78CFEE47E85
Malicious:	false
Reputation:	unknown
URL:	https://docucdn-a.akamaihd.net/production/1ds/widgets/@ds/signing/24.9.37-2/css/font-faces.css?cs=7aa34814
Preview:	/ mix ins /..list-no-style {. list-style: none;. padding-left: 0;.}.@font-face {. font-family: 'Maven Pro';. src: url('../fonts/maven-pro/MavenPro-Regular.eot');. src: url('../fonts/maven-pro/MavenPro-Regular.eot?#iefix') format('embedded-opentype'), url('../fonts/maven-pro/MavenPro-Regular.woff') format('woff'), url('../fonts/maven-pro/MavenPro-Regular.ttf') format('truetype');. font-weight: normal;. font-style: normal;.}.@font-face {. font-family: 'Maven Pro';. src: url('../fonts/maven-pro/MavenPro-Bold.eot');. src: url('../fonts/maven-pro/MavenPro-Bold.eot?#iefix') format('embedded-opentype'), url('../fonts/maven-pro/MavenPro-Bold.woff') format('woff'), url('../fonts/maven-pro/MavenPro-Bold.ttf') format('truetype');. font-weight: bold;. font-style: normal;.}.

Chrome Cache Entry: 185

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with CRLF line terminators
Category:	downloaded
Size (bytes):	1103
Entropy (8bit):	4.966187896639915
Encrypted:	false
SSDEEP:
MD5:	3DF93052C874FAB3C7D48B4E25B927A2
SHA1:	D71DB5B307735280048C30D2B693B2FDF20D647E
SHA-256:	8A062190DACEF122BE3BDC0411D765F75C1C9CE63CD5A3E51AD53857A1FFEBAD
SHA-512:	39B135A6465C82CE5122F5BB0BA0F9E9CFB557ACC9E20DCE83EE62BC6AF4905E8668B3E5EA2460935865E58C45A46EF2D5463AB239FF780C43355909677AC8B7
Malicious:	false
Reputation:	unknown
URL:	https://account.docusign.com/ReactApp/src/vendor/html-domparser.js
Preview:	/.. DOMParser HTML extension.. * 2019-11-13.. .. By Eli Grey, http://eligrey.com.. * Public domain... * NO WARRANTY EXPRESSED OR IMPLIED. USE AT YOUR OWN RISK... /..../! @source https://gist.github.com/1129031 /../global document, DOMParser/....(function (DOMParser) {.. "use strict";.... var DOMParser_proto = DOMParser.prototype;.. var real_parseFromString = DOMParser_proto.parseFromString;.... // Firefox/Opera/IE throw errors on unsupported types.. try {.. // WebKit returns null on unsupported types.. if (new DOMParser().parseFromString("", "text/html")) {.. // text/html parsing is natively supported.. return;.. }.. } catch (ex) {}.... DOMParser_proto.parseFromString = function (markup, type) {.. if (/^\stext\/html\s*(?:;\|$)/i.test(type)) {.. var doc = document.implementation.createHTMLDocument("");.. doc.documentElement.innerHTML = markup;.. return doc;.. } else

Chrome Cache Entry: 187

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (60845), with LF, NEL line terminators
Category:	dropped
Size (bytes):	1828336
Entropy (8bit):	5.677591259503499
Encrypted:	false
SSDEEP:
MD5:	2E17527F2464F14613F599EB46A1AEB2
SHA1:	31AE815F68DD2805E7FD96BD538C2A66A7D49D11
SHA-256:	E1F02FFCB17EEB267BC8A13E6BB21E32E44994ACAE4C1CE5374843866BE13FAC
SHA-512:	6D878DB16BCBEB165EB7C25727DFD4A66F01217841B60B2870277B5223D1AE64CAE0DE551C5A27CC4E8CDCE4DFADC37EB16DDA6E59DC157F53006791E0BD1C21
Malicious:	false
Reputation:	unknown
Preview:	/! For license information please see 1ds-bundle.js.LICENSE.txt /.System.register(["React","emotionReact","ReactDOM"],(function(e,t){var n={},r={},o={};return Object.defineProperty(n,"__esModule",{value:!0}),{setters:[function(e){Object.keys(e).forEach((function(t){n[t]=e[t]}))},function(e){r.ClassNames=e.ClassNames,r.Global=e.Global,r.css=e.css,r.jsx=e.jsx,r.keyframes=e.keyframes},function(e){o.createPortal=e.createPortal,o.default=e.default,o.flushSync=e.flushSync,o.unstable_batchedUpdates=e.unstable_batchedUpdates}],execute:function(){e(function(){var e={19558:function(e,t,n){const r=n(7547).R;t.s=function(e){if(e\|\|(e=1),!n.y.meta\|\|!n.y.meta.url)throw console.error("__system_context__",n.y),Error("systemjs-webpack-interop was provided an unknown SystemJS context. Expected context.meta.url, but none was provided");n.p=r(n.y.meta.url,e)}},7547:function(e,t,n){t.R=function(e,t){var n=document.createElement("a");n.href=e;for(var r="/"===n.pathname[0]?n.pathname:"/"+n.pathname,o=0,a=r.

Chrome Cache Entry: 188

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	369019
Entropy (8bit):	5.471884287546806
Encrypted:	false
SSDEEP:
MD5:	D458B68730A7330653700489333A7837
SHA1:	4059AECA1D0B99AEC8006B37A927F09D9C0E794D
SHA-256:	430725B95468277DCBCCC27E08E3D873276C0082737310B0B1AD330392511847
SHA-512:	E363C4D2B77EC19DA13577ED94CEFC0527A1206CDECCD790BB38A18810AF504077095C47BEC4A117CEB0056C1039137134836504FBAAEEB1B859684D89354716
Malicious:	false
Reputation:	unknown
Preview:	!function(e,a){"object"==typeof exports&&"undefined"!=typeof module?module.exports=a():"function"==typeof define&&define.amd?define(a):e.moment=a()}(this,function(){"use strict";var E;function M(){return E.apply(null,arguments)}function F(e){return e instanceof Array\|\|"[object Array]"===Object.prototype.toString.call(e)}function z(e){return null!=e&&"[object Object]"===Object.prototype.toString.call(e)}function l(e,a){return Object.prototype.hasOwnProperty.call(e,a)}function N(e){if(Object.getOwnPropertyNames)return 0===Object.getOwnPropertyNames(e).length;for(var a in e)if(l(e,a))return;return 1}function d(e){return void 0===e}function J(e){return"number"==typeof e\|\|"[object Number]"===Object.prototype.toString.call(e)}function R(e){return e instanceof Date\|\|"[object Date]"===Object.prototype.toString.call(e)}function C(e,a){for(var t=[],s=e.length,n=0;n<s;++n)t.push(a(e[n],n));return t}function I(e,a){for(var t in a)l(a,t)&&(e[t]=a[t]);return l(a,"toString")&&(e.toString=a.toString),

Chrome Cache Entry: 189

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	119869
Entropy (8bit):	4.18401975910281
Encrypted:	false
SSDEEP:
MD5:	ECE7A224F69AB2205D90900589AE1D05
SHA1:	3D861B816A5DA892C8A88D5755A5537C036239DE
SHA-256:	FFA8C6A4CE199BFD9E32B05E0E4DECE330C6A577FB3A0E8518291619C658C486
SHA-512:	EEF4BDD54AF95BE42224FFE605BB627293DAEA0C58A50B328ACC8B56040C81FDCB5EC8406F56856FC617A552E4D6DD28BB892467666889D27F03EE8BFCD16D7B
Malicious:	false
Reputation:	unknown
Preview:	/. DocuSign modified version of Mixpanel JS Library v2.2.1. * $initial_referer and $referer have been removed, as not to send any senstive information. * $initial_referring_domain and referring_domain have been retained.. . Mixpanel JS Library v2.2.1. . . * Copyright 2012, Mixpanel, Inc. All Rights Reserved. * http://mixpanel.com/. . Includes portions of Underscore.js. * http://documentcloud.github.com/underscore/. * (c) 2011 Jeremy Ashkenas, DocumentCloud Inc.. * Released under the MIT License.. /..// ==ClosureCompiler==.// @compilation_level ADVANCED_OPTIMIZATIONS.// @output_file_name mixpanel-2.2.min.js.// ==/ClosureCompiler==../.Will export window.mixpanel./../.SIMPLE STYLE GUIDE:..this.x == public function.this._x == internal - only use within this file.this.__x == private - only use within the class..Globals should be all caps./.(function(mixpanel) {. /. * Saved references to long variable names, so that closure compiler can. * minimize file size.. */. var

Chrome Cache Entry: 190

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65472)
Category:	downloaded
Size (bytes):	970238
Entropy (8bit):	5.509718517634857
Encrypted:	false
SSDEEP:
MD5:	027FBB6A5A630EEB715A792DE31698FA
SHA1:	EA7FF86C2354FA00A37B9EBC908C04D98DF0BAEC
SHA-256:	644128D36AC5474E6EAE6D87300AB474D46824EEF21C97F49CE7D521B59A6122
SHA-512:	FC777BB29BBC322D2D06D81126B62D4D90C997FEBF5C6A595A4D060A919D4B4442E63FE15A5B6C4507B089987A26915A58DD04FA28CE3C1FB99FDCC0A9A40F03
Malicious:	false
Reputation:	unknown
URL:	https://docucdn-a.akamaihd.net/production/1ds-app/1538750/js/bundle.js
Preview:	/! For license information please see bundle.js.LICENSE.txt /.System.register(["React","ReactDOM","dsUi","lodash","lottie","emotionStyled","emotionReact","optimizelySdk"],(function(e,t){var r={},n={},o={},a={},i={},s={},c={},u={};return Object.defineProperty(r,"__esModule",{value:!0}),Object.defineProperty(i,"__esModule",{value:!0}),{setters:[function(e){Object.keys(e).forEach((function(t){r[t]=e[t]}))},function(e){n.render=e.render},function(e){o.Button=e.Button,o.DocuSignLogo=e.DocuSignLogo,o.HeaderContext=e.HeaderContext,o.Image=e.Image,o.InkDocuSignTheme=e.InkDocuSignTheme,o.ProgressCircle=e.ProgressCircle,o.Theme=e.Theme,o.useHeaderContext=e.useHeaderContext},function(e){a.extend=e.extend,a.has=e.has,a.isEmpty=e.isEmpty,a.isNil=e.isNil,a.isNull=e.isNull,a.isNumber=e.isNumber,a.isObject=e.isObject,a.isObjectLike=e.isObjectLike,a.merge=e.merge,a.once=e.once,a.template=e.template},function(e){Object.keys(e).forEach((function(t){i[t]=e[t]}))},function(e){s.default=e.default},functio

Chrome Cache Entry: 191

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65468)
Category:	dropped
Size (bytes):	7298632
Entropy (8bit):	5.43338593857772
Encrypted:	false
SSDEEP:
MD5:	2F06DC68F2202F97984D403E89FE5B7C
SHA1:	8D095FB8C60B29E041D033CD5FBE0CF014F05CDD
SHA-256:	834DEB082F06EF80BFCB351BB68223E98CAFE62350963EF63B7044E822EB3CD1
SHA-512:	6E1B0AD48546D4767D1E38AB7E423D253C927C01209ED9C55EAF120F6B93B89A5847B6B388F440AD8DA58BF9935E4E3A7673DCED8775C349E81DFAC3D322753D
Malicious:	false
Reputation:	unknown
Preview:	/! For license information please see 1ds-bundle.js.LICENSE.txt /.System.register(["React","jQuery","lodash","1dsContext","moment","ReactDOM","dsUi","emotionStyled","emotionReact","MomentTimezone","RTK"],(function(e,t){var n={},r={},i={},o={},a={},l={},s={},u={},c={},d={},p={};return Object.defineProperty(n,"__esModule",{value:!0}),Object.defineProperty(r,"__esModule",{value:!0}),Object.defineProperty(i,"__esModule",{value:!0}),Object.defineProperty(l,"__esModule",{value:!0}),Object.defineProperty(s,"__esModule",{value:!0}),{setters:[function(e){Object.keys(e).forEach((function(t){n[t]=e[t]}))},function(e){Object.keys(e).forEach((function(t){r[t]=e[t]}))},function(e){Object.keys(e).forEach((function(t){i[t]=e[t]}))},function(e){o.platformProps=e.platformProps},function(e){a.default=e.default},function(e){Object.keys(e).forEach((function(t){l[t]=e[t]}))},function(e){Object.keys(e).forEach((function(t){s[t]=e[t]}))},function(e){u.default=e.default},function(e){c.css=e.css,c.jsx=e.jsx},

Chrome Cache Entry: 198

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 29516, version 1.0
Category:	downloaded
Size (bytes):	29516
Entropy (8bit):	7.993944632054563
Encrypted:	true
SSDEEP:
MD5:	5D66C3D97D4F69A2B3527E3997CBB66B
SHA1:	94EF4F31C1A1CD780A172EDFBF9E3DE61697EF5A
SHA-256:	1BF53B33743C5C45D6C944815F74CBF58B228806858FB6E3A0B86C1204F4BE06
SHA-512:	FEB229CF976DC037130CE7E7A6C0E32FA8BD0C63382B0FFAD82E4448767B88F8C17C431055BF834AF6A5E92E2D34A6EC7432AFDABCEA9FAE867517613AFD3621
Malicious:	false
Reputation:	unknown
URL:	https://docucdn-a.akamaihd.net/olive/fonts/2.8.0/DSIndigo-Regular.woff2
Preview:	wOF2......sL......b...r.........................?FFTM..6...l..t.`..V...e.....\..V.....6.$..(. ..Z..3..p[sDq....2.r...n....%2...z..q.Te-;@..%..I......;......{...Rk...@...HG.)G...8.U.x2.q.qZ.../....6".tQw..YVg9V.k.b.)...j.x..D4L_(.Y0.....k(.w...#U.. .;F.T8..j.v.x..p.:$-[o-.W.~~...{.u..3...)..J.<w..M.V.(a.......;..7g.,X.fu...............i.]..@..Y.[x......!....lG....a"...Nd../.k.V...Q...(.BPe.S.E...C$.........W....L.2.%.2.+O..D..TV...h"T.h/N!....,.gaX.....%...x..r.,.Zz....-...f^.T..sZ..e.Ed.8N....%:./...B...m3......E@A...#.....#.}.~.f,2..3.o_..wX.U.uRI...`i...../D.../~.3.......W..#....U2.r.2.u.B.{.]r"rP{M....V.........LhNU=..{L.......'.U...].0.`...$...4Y..RN...E/........i..<@Y.....:...X.-...R.]..@z...(....p...Y.....").N=...!....,..]D....Z.......o........N.y......g.t..1f#.........o.Y;.y..{...G.......K......>/.,.d.....NU.>7v..KQ....J..l..{w.FH..&..!..?4.q...1wY..7..RJ):..a....<..*..G.M.m..k......."Vhq..xsk...M\|...o..d.....w......F.(..(..(..(..(..(..(::

Chrome Cache Entry: 200

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with CRLF line terminators
Category:	downloaded
Size (bytes):	4739
Entropy (8bit):	4.736490039075709
Encrypted:	false
SSDEEP:
MD5:	4B86605C4B80FA75342703878E7DFF13
SHA1:	6EF59F904C58E88B3E143BA3DA464AFE63FDC188
SHA-256:	2F186CDFA13B6CA51F69D44BAC8A7D5B69E1D5409A68D21F5768A87C6DFDB3A1
SHA-512:	B493241426AB5A1B75D1455720E84AB27A2B7E176FDF782ECB14B26004F5553FD306DCAE14C17CE788891FDBCAE9A32A5E22CB187C6BCE66486B89A0E5028AD9
Malicious:	false
Reputation:	unknown
URL:	https://na4.docusign.net/Signing/StyleSheets/Framework.css
Preview:	/-----------------------/..../* needs brackets to swallow error on dev /..{..}..../ This file contains the styles needed for the 2014 rebrand /..html {.. / Prevent font suserng in landscape while allowing user zoom /.. / Use 100% here, NEVER none. See http://blog.55minutes.com/2012/04/iphone-text-resizing/ /.. -webkit-text-size-adjust: 100%;..}..body {.. margin: 0;.. background-image: none;.. background-color: #EAEAEA;.. font-family: "Helvetica Neue", Arial, sans-serif !important;..}...Header {.. display: none;..}...scroll-area {.. position: absolute;.. overflow: auto;.. overflow-x: hidden;.. top: 0;.. left: 0;.. right: 0;.. bottom: 0;.. min-width: 1024px;..}...scroll-area, .Border.scroll-area {.. overflow-x: auto;..}...scroll-container {.. border-bottom: none;.. position: static;..}...clear {.. clear: both;..}..../ site content - centered w/ max-width and padding */...site-content {.. margin: 0 auto;.. max-wid

Chrome Cache Entry: 204

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (11376)
Category:	dropped
Size (bytes):	11428
Entropy (8bit):	5.335967924702627
Encrypted:	false
SSDEEP:
MD5:	263A02B3285662A30500AF32571A7C68
SHA1:	0F19791D1E09302FE2A4A12E431DF087558905CF
SHA-256:	82F17FCEDEB6942EE87C4C49EE2F00CA3BA104FC0FFDDBC27A117B8F3F3733BC
SHA-512:	C2470037CCE2AA7112A94B0444A5E61AFC5FA8ECE6469A4D7B20991EED63488304325BA275FF5719FCC63FAE5DA7EA221004DC4AAB71BDAA9DEEB80BDB9C0850
Malicious:	false
Reputation:	unknown
Preview:	!function(e,t){"object"==typeof exports&&"undefined"!=typeof module?module.exports=t(require("react"),require("@emotion/react")):"function"==typeof define&&define.amd?define(["react","@emotion/react"],t):(e="undefined"!=typeof globalThis?globalThis:e\|\|self).emotionStyled=t(e.React,e.emotionReact)}(this,(function(e,t){"use strict";function r(e){if(e&&e.__esModule)return e;var t=Object.create(null);return e&&Object.keys(e).forEach((function(r){if("default"!==r){var n=Object.getOwnPropertyDescriptor(e,r);Object.defineProperty(t,r,n.get?n:{enumerable:!0,get:function(){return e[r]}})}})),t.default=e,Object.freeze(t)}var n=r(e);function i(){return(i=Object.assign?Object.assign.bind():function(e){for(var t=1;t<arguments.length;t++){var r=arguments[t];for(var n in r)Object.prototype.hasOwnProperty.call(r,n)&&(e[n]=r[n])}return e}).apply(this,arguments)}function o(e){var t=Object.create(null);return function(r){return void 0===t[r]&&(t[r]=e(r)),t[r]}}var a=/^((children\|dangerouslySetInnerHTML\|k

Chrome Cache Entry: 209

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (64565)
Category:	dropped
Size (bytes):	106664
Entropy (8bit):	5.513060934868727
Encrypted:	false
SSDEEP:
MD5:	0B566ED33659BCF90D3D54200B977210
SHA1:	4034717AD02B5C4D3594A064CC7A2F1CAF68435F
SHA-256:	D4B5565350F5FBEF18E49BDBF2C9C1C5FC85327B7452992F433A1D6BE463FD24
SHA-512:	C8E4806193831E417D5CE770F51D964B023E4E28BBB601023671056AE30B364254C7DB0B6D0025E2BE6508F47323D71EC98CD390AE371008D2FCD7A46E94D7BB
Malicious:	false
Reputation:	unknown
Preview:	!function(e,t){"object"==typeof exports&&"undefined"!=typeof module?t(exports):"function"==typeof define&&define.amd?define(["exports"],t):t((e=e\|\|self).optimizelySdk={})}(this,(function(e){"use strict";./! **************************************************************************. Copyright (c) Microsoft Corporation... Permission to use, copy, modify, and/or distribute this software for any. purpose with or without fee is hereby granted... THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH. REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY. AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,. INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM. LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR. OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR. PERFORMANCE OF THIS SOFTWARE.. ***********************

Chrome Cache Entry: 214

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	720092
Entropy (8bit):	5.01736563945962
Encrypted:	false
SSDEEP:
MD5:	B4B08E03B726275D78C8857FB4C19E5F
SHA1:	23C5587DAD099469B961F9543CA0522A32D413F8
SHA-256:	A337B1FCA31722D4F42F5A5F6FA90EE5D8706F43E6ECE11730CB928252E46C58
SHA-512:	F0C66D74E949EC0C0AF6980E2FD9C6BC1B4BA3D43DEA09CA35814EB93AE0910A7F4A38D4461258D738D59EF7DD2C67215CFDECE7679DC5126F81CF3B0EDA0724
Malicious:	false
Reputation:	unknown
URL:	https://docucdn-a.akamaihd.net/production/1ds/widgets/@ds/send/1.1.591-7/translations/locale-en.json
Preview:	{. " Add New Gateway": " Add New Gateway",. " Additionally, paper usage habits and manufacturing processes can change over time, and DocuSign reserves the right to periodically update the assumptions used to estimate the environmental impact from using DocuSign.s products, which may increase or decrease the environmental savings estimates presented.": " Additionally, paper usage habits and manufacturing processes can change over time, and Docusign reserves the right to periodically update the assumptions used to estimate the environmental impact from using Docusign.s products, which may increase or decrease the environmental savings estimates presented.",. " Paper usage habits and manufacturing processes can change over time, and DocuSign reserves the right to periodically update the assumptions used to estimate the environmental impacts from using DocuSign.s products, which may increase or decrease the environmental impact estimates presented.": " Paper usage habits and manuf

Chrome Cache Entry: 215

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	4.241202481433726
Encrypted:	false
SSDEEP:
MD5:	9E576E34B18E986347909C29AE6A82C6
SHA1:	532C767978DC2B55854B3CA2D2DF5B4DB221C934
SHA-256:	88BDF5AF090328963973990DE427779F9C4DF3B8E1F5BADC3D972BAC3087006D
SHA-512:	5EF6DCFFD93434D45760888BF4B95FF134D53F34DA9DC904AD3C5EBEDC58409073483F531FEA4233869ED3EC75F38B022A70B2E179A5D3A13BDB10AB5C46B124
Malicious:	false
Reputation:	unknown
Preview:	{"Message":"The requested resource does not support http method 'GET'."}

Chrome Cache Entry: 216

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 31436, version 1.0
Category:	downloaded
Size (bytes):	31436
Entropy (8bit):	7.993250168057893
Encrypted:	true
SSDEEP:
MD5:	BA0E987E564CD3409E9D6F690D641F55
SHA1:	1C2684BD20C775B7497796C2FA66AD4943F6B824
SHA-256:	346CFD3DF3DBB80D08655AE396A413F66CBCCFCF201EAE36A6403DCF7ED372BC
SHA-512:	DFBA7D6B8114C9DD1A3288E053F6E7C18A1909F6CBBDF35E46B1972E15497D1C35FE1007FC90CAF111D20AB036D9E1C73C15EDD7B2BF24F24CA4A2A36EBA571D
Malicious:	false
Reputation:	unknown
URL:	https://docucdn-a.akamaihd.net/olive/fonts/2.8.0/DSIndigo-Semibold.woff2
Preview:	wOF2......z.......jl..zc........................?FFTM..6...H..t.`..V.(..e.....l..).....6.$..(. ..4..3..M[WL.....{(HD.!..:.jV;\.......vy.b.a.us.f..j........{.I..%.%....H.j.v.n.53sP....CI..D.^.>`Jdb.y.. .E.L...I....I...vD.c. .VD..S.f..x.E....v!...k...b.../.....;...s..T..Y~....~N7m...P.wv..t.....K\|.(...b...h..~.....m..{\|......SdU.RI._M.......s...,wW.0.~..P...F1Q..Umt..LP..#.'...........3.......BL..4.\....qL&\.o"...[.A.0..+.r.b...s.y.Y..d..o...KOa.M..Dk..u.?XS..J.i.7..6..)B..W.].....P.......K)q.f.._.Xy.~....>.Cn#G681..jb....3u........I..;....CBI....Tb.T....5.Z...jFi9~.'.1.g.M.h<.S....:[..m.3g...,.DQ.A..i..j.T@.E...1u.....X.s._.s.....'.......O....`,...y@......U/a.!.......T.[.0.'`..l(....h.Z..$...m4..h...*._..@...;!=......ZM.TP.......^N.T..p.!.4@.(m...~._....{..&.85j...Q#f...)......................j. t.s]..m..&.^.G...2.........<..(..(..(..(..(..h4..F..._vx...g....P...PU/`...L<..RJ)..i.+3..p.A.+[....=.X...........B...../.(..X........T.U...3M..]....&

Chrome Cache Entry: 217

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (9001)
Category:	dropped
Size (bytes):	9088
Entropy (8bit):	5.161435742238895
Encrypted:	false
SSDEEP:
MD5:	F9B6B3F7037626B03C1DADBFBA330183
SHA1:	E9BBA73F547960A283E1F72E0BCDA140AA543254
SHA-256:	0D1D511787B20CD4A38CD4DE9841CC7EAC6A5B6B53F9C56C7C41B0C480568C88
SHA-512:	EF5D1F0CDC0E52CAD2CE1532DC8F6945F70305461BD1B6FDD1891661E9BB32D1A5CA2DE999AB3C7BAD5B83D1BF300CC2FF0631B9947B6D15E85C3582D5D614EC
Malicious:	false
Reputation:	unknown
Preview:	/* import-map-overrides@3.1.2 */.!function(){"use strict";function e(e,r){(null==r\|\|r>e.length)&&(r=e.length);for(var t=0,n=Array(r);t<r;t++)n[t]=e[t];return n}function r(r,t){return function(e){if(Array.isArray(e))return e}(r)\|\|function(e,r){var t=null==e?null:"undefined"!=typeof Symbol&&e[Symbol.iterator]\|\|e["@@iterator"];if(null!=t){var n,o,a,i,c=[],s=!0,l=!1;try{if(a=(t=t.call(e)).next,0===r){if(Object(t)!==t)return;s=!1}else for(;!(s=(n=a.call(t)).done)&&(c.push(n.value),c.length!==r);s=!0);}catch(e){l=!0,o=e}finally{try{if(!s&&null!=t.return&&(i=t.return(),Object(i)!==i))return}finally{if(l)throw o}}return c}}(r,t)\|\|function(r,t){if(r){if("string"==typeof r)return e(r,t);var n={}.toString.call(r).slice(8,-1);return"Object"===n&&r.constructor&&(n=r.constructor.name),"Map"===n\|\|"Set"===n?Array.from(r):"Arguments"===n\|\|/^(?:Ui\|I)nt(?:8\|16\|32)(?:Clamped)?Array$/.test(n)?e(r,t):void 0}}(r,t)\|\|function(){throw new TypeError("Invalid attempt to destructure non-iterable instance.\nIn ord

Chrome Cache Entry: 219

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	326
Entropy (8bit):	6.860674885804344
Encrypted:	false
SSDEEP:
MD5:	AFE00DB89CE086B91A541C227EDBF136
SHA1:	961B2EE6FB39C4D515BDC49EC1BA688B0916F104
SHA-256:	E11827C678AF8519E702F364E525AC34509CAD49F8D839677E089949EDDA060E
SHA-512:	85F265A917E83BA92FEDB2152FBFADA273FCFF2937A85B080641307FD2E61D0138493162883E016796C9F68062A01D79DA60F546EFC2CB1FB4078760EB3451F0
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....pHYs.................sRGB.........gAMA......a.....IDATx.....0...Uq...UP.\|..v.K.>.O`.$.[.B....'pvJ}..B..P.h...I.!.rs.%.$....O"r!.I.m....J..........U.. ..F[.....j4<...6.b6.T!x..Y..]..;._.,..........K.F..b.~.$..M.......M....,...i....*.z...x8."C.r.{.2~.~........x...B.G.6.....IEND.B`.

Chrome Cache Entry: 223

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	25
Entropy (8bit):	3.7834651896016465
Encrypted:	false
SSDEEP:
MD5:	24D8974B3B95A5A5A4747FC798070FDE
SHA1:	A549CDB26BF65097074DDF4FCE9122F8B4A9D3CB
SHA-256:	6EF58EAD8D29240E62BC1A305EDFFE1D121C637B83BFFBD10D5AE03162CB9EEC
SHA-512:	B381F2B25D9DE66E4D9EE5FB24B426A741B58CA4414947A54DB78FA45157EF6758E40FE48BD649FA39B47E80A13216F8AE8FD210B31EF8736131EB43894504CB
Malicious:	false
Reputation:	unknown
URL:	https://apps.docusign.com/api/send/__settings?IS_ONE_DS_MODE=true
Preview:	{"Error":"Not logged in"}

Chrome Cache Entry: 224

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (12153)
Category:	downloaded
Size (bytes):	12220
Entropy (8bit):	5.230181143898618
Encrypted:	false
SSDEEP:
MD5:	3A75D0B367A05C24480A029775C2D7FB
SHA1:	8F2AFF26FD42B2AC4B58CD4EC0ED16B9914D17E6
SHA-256:	E0C2B97CE4FB80AD9FCFEBD4E6CA9E480D35580EF91E7B5838D11BFB4EE4BE95
SHA-512:	4EDE837B6701B93FF71E38AB1FCBBF27F9A4B651BB645C5EEFE83B21D98AA69935E45E80C731F5A09882833BD7CA21FF6E74AA6B9686E527D55E5251634DEFEA
Malicious:	false
Reputation:	unknown
URL:	https://docucdn-a.akamaihd.net/production/1ds/libs/systemjs/6.14.0/dist/system.min.js
Preview:	/!. SystemJS 6.14.0. */.!function(){function e(e,t){return(t\|\|"")+" (SystemJS Error#"+e+" https://github.com/systemjs/systemjs/blob/main/docs/errors.md#"+e+")"}function t(e,t){if(-1!==e.indexOf("\\")&&(e=e.replace(j,"/")),"/"===e[0]&&"/"===e[1])return t.slice(0,t.indexOf(":")+1)+e;if("."===e[0]&&("/"===e[1]\|\|"."===e[1]&&("/"===e[2]\|\|2===e.length&&(e+="/"))\|\|1===e.length&&(e+="/"))\|\|"/"===e[0]){var n,r=t.slice(0,t.indexOf(":")+1);if(n="/"===t[r.length+1]?"file:"!==r?(n=t.slice(r.length+2)).slice(n.indexOf("/")+1):t.slice(8):t.slice(r.length+("/"===t[r.length])),"/"===e[0])return t.slice(0,t.length-n.length-1)+e;for(var i=n.slice(0,n.lastIndexOf("/")+1)+e,o=[],s=-1,u=0;u<i.length;u++)-1!==s?"/"===i[u]&&(o.push(i.slice(s,u+1)),s=-1):"."===i[u]?"."!==i[u+1]\|\|"/"!==i[u+2]&&u+2!==i.length?"/"===i[u+1]\|\|u+1===i.length?u+=1:s=u:(o.pop(),u+=2):s=u;return-1!==s&&o.push(i.slice(s)),t.slice(0,t.length-n.length)+o.join("")}}function n(e,n){return t(e,n)\|\|(-1!==e.indexOf(":")?e:t("./"+e,n))}funct

Chrome Cache Entry: 225

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65446), with CRLF line terminators
Category:	downloaded
Size (bytes):	89797
Entropy (8bit):	5.291128696884303
Encrypted:	false
SSDEEP:
MD5:	954F70F07F05742168ADCEBA796DDA72
SHA1:	EDF8A6A066F201B1FFAD32C585BD79C9982D4433
SHA-256:	4DA87C258ECA460D39CDB0F6158CBF69AF539D05A1D14F1BC011518511D02228
SHA-512:	66EE57172810E0002C308C1FD5FC008C1C64573602627CA0313D97742D830C72BB7D26DD3B069E1835C5E3D6F8721F856809EB9CCEF18CE8934FF7758F645717
Malicious:	false
Reputation:	unknown
URL:	https://na4.docusign.net/Signing/client_scripts/jQuery/jquery-3.6.4.min.js
Preview:	/! jQuery v3.6.4 \| (c) OpenJS Foundation and other contributors \| jquery.org/license /..!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery requires a window with a document");return t(e)}:t(e)}("undefined"!=typeof window?window:this,function(C,e){"use strict";var t=[],r=Object.getPrototypeOf,s=t.slice,g=t.flat?function(e){return t.flat.call(e)}:function(e){return t.concat.apply([],e)},u=t.push,i=t.indexOf,n={},o=n.toString,y=n.hasOwnProperty,a=y.toString,l=a.call(Object),v={},m=function(e){return"function"==typeof e&&"number"!=typeof e.nodeType&&"function"!=typeof e.item},x=function(e){return null!=e&&e===e.window},E=C.document,c={type:!0,src:!0,nonce:!0,noModule:!0};function b(e,t,n){var r,i,o=(n=n\|\|E).createElement("script");if(o.text=e,t)for(r in c)(i=t[r]\|\|t.getAttribute&&t.getAttribute(r))&&o.setAttribute(r,i);n.head.appendChild(o).parentNode.removeChild(o)}func

Chrome Cache Entry: 226

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65451)
Category:	downloaded
Size (bytes):	89476
Entropy (8bit):	5.2896589255084425
Encrypted:	false
SSDEEP:
MD5:	DC5E7F18C8D36AC1D3D4753A87C98D0A
SHA1:	C8E1C8B386DC5B7A9184C763C88D19A346EB3342
SHA-256:	F7F6A5894F1D19DDAD6FA392B2ECE2C5E578CBF7DA4EA805B6885EB6985B6E3D
SHA-512:	6CB4F4426F559C06190DF97229C05A436820D21498350AC9F118A5625758435171418A022ED523BAE46E668F9F8EA871FEAB6AFF58AD2740B67A30F196D65516
Malicious:	false
Reputation:	unknown
URL:	https://docucdn-a.akamaihd.net/production/1ds/libs/jquery/3.5.1/dist/jquery.min.js
Preview:	/! jQuery v3.5.1 \| (c) JS Foundation and other contributors \| jquery.org/license /.!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery requires a window with a document");return t(e)}:t(e)}("undefined"!=typeof window?window:this,function(C,e){"use strict";var t=[],r=Object.getPrototypeOf,s=t.slice,g=t.flat?function(e){return t.flat.call(e)}:function(e){return t.concat.apply([],e)},u=t.push,i=t.indexOf,n={},o=n.toString,v=n.hasOwnProperty,a=v.toString,l=a.call(Object),y={},m=function(e){return"function"==typeof e&&"number"!=typeof e.nodeType},x=function(e){return null!=e&&e===e.window},E=C.document,c={type:!0,src:!0,nonce:!0,noModule:!0};function b(e,t,n){var r,i,o=(n=n\|\|E).createElement("script");if(o.text=e,t)for(r in c)(i=t[r]\|\|t.getAttribute&&t.getAttribute(r))&&o.setAttribute(r,i);n.head.appendChild(o).parentNode.removeChild(o)}function w(e){return null==e?e+"":"o

Chrome Cache Entry: 227

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	3728
Entropy (8bit):	4.718277261919778
Encrypted:	false
SSDEEP:
MD5:	EC396047518A7FEF11D53D1B4F6BE65B
SHA1:	E3BEC4CDAF5567641517A23019ADBFA2328B0A7F
SHA-256:	8F77CFC832517C619BC1B8D82A6A478EE18D97442B4C78B006B0286CEC91E1A8
SHA-512:	34AD62B5CC5EE5C950F340D65800102AE1CD06D34D24A611E7AC2CB9F23308AC96AC669D3B226C258DC6F862D985030EC3D5BB29609ECFEDF34E14F8F48529EB
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8"?>. Generator: Adobe Illustrator 28.1.0, SVG Export Plug-In . SVG Version: 6.00 Build 0) -->.<svg version="1.1" id="Layer_1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px".. viewBox="0 0 1200 241.4" style="enable-background:new 0 0 1200 241.4;" xml:space="preserve">.<style type="text/css">...st0{fill:#4C00FF;}...st1{fill:#FF5252;}.</style>.<g>..<g>...<g>....<path d="M1169.2,109.7v78.7h-28.9v-73.5c0-17.9-7.7-27.9-22.7-27.9s-24.9,10.5-27.7,28.1c-0.8,4.2-1,10.7-1,24.4v48.8H1060v-125.....h25.6c0.1,1.1,0.7,12.3,0.7,13c0,0.9,1.1,1.4,1.8,0.8c10.6-8.4,22.3-16.2,38.6-16.2C1153.5,60.9,1169.2,79,1169.2,109.7z"/>....<path d="M1013.4,63.4l-0.9,14.3c-0.1,0.9-1.2,1.4-1.8,0.8c-3.5-3.3-16.4-17.5-38.3-17.5c-31.4,0-54.5,27.1-54.5,63.9l0,0.....c0,37.3,22.9,64.5,54.5,64.5c21.1,0,34-13.7,36.4-16.7c0.7-0.8,2-0.3,2,0.7c-0.3,3.8-0.8,13.3-4,21.4c-4,10.2-13,19.7-31.1,19.7.....c-14.9,0-28.1-5.7-40.6-17.9L920,217.3c13.7,15.5,35

Chrome Cache Entry: 228

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 5 icons, 16x16, 32 bits/pixel, 24x24, 32 bits/pixel
Category:	downloaded
Size (bytes):	27198
Entropy (8bit):	2.459230633161204
Encrypted:	false
SSDEEP:
MD5:	1904FDCB027ED618D24601BFE5121096
SHA1:	3384FA317742DD9B6D6C8995AB6B0131579311B3
SHA-256:	300AD21B2AFE161BE399D3C4034131DEEF4FC22A9BE39FA70AC3716295DAFDB9
SHA-512:	3E9D51836FEB63D18D2B05592F80A8B79FF627DD2E1F50C68520D4C180647E7A12E6B73BFA081CD368D5C43F13AAE69696E071F0B191701E17A13E7E7197E766
Malicious:	false
Reputation:	unknown
URL:	https://apps.docusign.com/favicon.ico?v=2
Preview:	............ .h...V......... ......... .... .....F...00.... ..%......00.... ..%...D..(....... ..... ...........................L...L...L...L...L...L...L...L...L...L...L...L...K...............L...L...L...L...L...L...L...L...L...L...L...L...J...............L...L...L...L...L...L...L...L...L...L...L...L...J...............L...L...L...L...L...M...M...M...M...M...M...M...L...............L...L...L...L...:...&...&...&...&...&.z.#.k.f.RT.cRR."__..TT....L...L...L...M.w.#.........................&&v.SS..RR..RR.EQQ....L...L...L...M.v.#.........................&&v.SS..RR..RR..SS.,..L...L...L...M.v.#.........................&&v.SS..RR..RR..RR....L...L...L...M.v.#.........................((\|.SS..RR..RR..RR....L...L...L...M.v.#.......................3.CC..SS..RR..RR..RR....L...L...L...M.v.#...................3.BB..SS..RR..RR..RR..RR....L...L...L...L.k.i.%&v.&&v.&&v.((\|.CC..SS..RR..RR..RR..RR..RR..............UT..RR..SS..SS..SS..SS..SS..RR..RR..RR..RR..RR..RR..............TT..RR..RR..RR..RR..RR..RR..RR

Chrome Cache Entry: 229

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	2940
Entropy (8bit):	4.174861243509924
Encrypted:	false
SSDEEP:
MD5:	55ACF27E6B517AF140D1C9FB147E31E8
SHA1:	FD74318612D950AE56B82776D4507A703E2745EF
SHA-256:	769113EED5ABF2BB8E472A29D439CC73CA6BCCFA82E3D8F0B36D6F7D9FD740B6
SHA-512:	EF85F9034DE1D6F0C04E7DD24F9743D39D63D2273884C1F46F744D4514E25569F07A7E7D9DBD8F644F6AE0B80E383C91954629356BFFFEC06746947645008826
Malicious:	false
Reputation:	unknown
URL:	https://docucdn-a.akamaihd.net/olive/images/2.72.0/global-assets/ds-logo-default.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 1200 241.4" xml:space="preserve">. <g>. <g>. <g>. <path d="M1169.2 109.7v78.7h-28.9v-73.5c0-17.9-7.7-27.9-22.7-27.9s-24.9 10.5-27.7 28.1c-.8 4.2-1 10.7-1 24.4v48.8H1060v-125h25.6c.1 1.1.7 12.3.7 13 0 .9 1.1 1.4 1.8.8 10.6-8.4 22.3-16.2 38.6-16.2 26.8 0 42.5 18.1 42.5 48.8zm-155.8-46.3-.9 14.3c-.1.9-1.2 1.4-1.8.8-3.5-3.3-16.4-17.5-38.3-17.5-31.4 0-54.5 27.1-54.5 63.9 0 37.3 22.9 64.5 54.5 64.5 21.1 0 34-13.7 36.4-16.7.7-.8 2-.3 2 .7-.3 3.8-.8 13.3-4 21.4-4 10.2-13 19.7-31.1 19.7-14.9 0-28.1-5.7-40.6-17.9L920 217.3c13.7 15.5 35.3 24.2 58.8 24.2 37.8 0 60.5-25.9 60.5-68.2V63.4h-25.9zm-34.8 99.8c-18.7 0-31.9-16.2-31.9-38.3S959.9 87 978.6 87s31.9 15.7 31.9 37.9c-.1 22.2-13.3 38.3-31.9 38.3zm-121.1-11.9c0 23.7-19.9 39.6-49.1 39.6-22.9 0-43.3-8.9-55.5-21.6l9.5-22.6c9.2 8.3 24 20.2 45.1 20.2 14.7 0 23.2-6.5 23.2-14.7 0-9.5-11.7-12-25.7-14.7-19.9-4.2-46.3-11-46.3-38.1 0-22.7 18.4-38.3 45.6-38.3 20.9 0 38.9 8 51.3 18.4l-14.2 19

Chrome Cache Entry: 230

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format, CFF, length 33752, version 0.0
Category:	downloaded
Size (bytes):	33752
Entropy (8bit):	7.984139047245452
Encrypted:	false
SSDEEP:
MD5:	4DE7535F6F5DF8D5437C21C068DDB0EC
SHA1:	3553204B4624CA41CF1C4F3BD9B37D8C968CBA23
SHA-256:	8F6A520A392FF62149E5FC5AA87BFAB9B3816CD6010D4D4FCA194E8683CA498B
SHA-512:	E2A9B45F69BD1CBCF0D5F3710BECFACF6A28AF0A9FD034262F6AF4803628DADCE4C2FCC385758F88130AB68D362F3694ED786D0971CF7FD7E8FAF6CD1C2860DE
Malicious:	false
Reputation:	unknown
URL:	https://docucdn-a.akamaihd.net/production/1ds/widgets/@ds/signing/24.9.37-2/fonts/maven-pro/MavenPro-Bold.woff
Preview:	wOFFOTTO...........x........................CFF ......Om......FFTM...h........Z...GDEF..T........ ....GPOS..TH..-....DiP}7GSUB..T(... ... l.t.OS/2.......H...`...Ccmap.......\|....#G..head...0...3...6....hhea...d... ...$.U.>hmtx.......Q...X.Xl7maxp..............P.name.......4....N...post........... .j.fx.c`d```d8...l<..W.n...8..2.F.../..)...:..&.(..v...x.c`d``../........g.2.EP.5.......P.....x.c`b.......u..1...<.f........p...).,fP`P...._....N.u05..X.@r.L.GP..x.m.1O.A.....(...XL...K....+.[...-..@.A....6..K...e#.x..\|.......^.p..PzV...s...=7q.O..z..+.xn.R=Q.....m.Y.......s..><........6n..c.lq@..klPC.....!".,AJ.`N.e.&.L....F..7g..&..w<.J...P..M-..@.Q.Kz.yn.)dRg...B..J...v:....gR.vFC..N.2....PF0..=.)V.,..{..LY.g"...;9..]p..2n!f....IW67..a.%.mO..-......iXax.c```f.`..F..8..1..,..........P..a)........L..(.(H).)().)X).QTz..........@....1.AU.+H(.UZBU2.................n...}.`...V=X.`.I...Q8.z....#..A.L.,.l...\.<.\|...B.".b...R.2.r...J..j...Z.:.z...F.&.f...V.6.v...N...n...

Chrome Cache Entry: 231

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	780925
Entropy (8bit):	4.121014646987528
Encrypted:	false
SSDEEP:
MD5:	A6604ABAADCF1A25A434A312AE70E0ED
SHA1:	E78CCA5BE7631D49BA661E7F328F5D98D7E5E22D
SHA-256:	1202C7B0881D7C5ABF572B1008B0361CF485298DDA5734A77B7919ECD809D06B
SHA-512:	28223E7D1DDB51B39C534642DD471A3F008BB8EE4B124BA469605875D9A12CF5E0A403D627C8FAA492E64C8EADF42318733138602AD6650FF0AD9CFF26CC82F8
Malicious:	false
Reputation:	unknown
Preview:	!function(M,z){"use strict";"object"==typeof module&&module.exports?module.exports=z(require("moment")):"function"==typeof define&&define.amd?define(["moment"],z):z(M.moment)}(this,function(O){"use strict";void 0===O.version&&O.default&&(O=O.default);var z,W={},A={},c={},d={},R={},M=(O&&"string"==typeof O.version\|\|C("Moment Timezone requires Moment.js. See https://momentjs.com/timezone/docs/#/use-it/browser/"),O.version.split(".")),b=+M[0],p=+M[1];function q(M){return 96<M?M-87:64<M?M-29:M-48}function o(M){var z=0,b=M.split("."),p=b[0],O=b[1]\|\|"",A=1,c=0,b=1;for(45===M.charCodeAt(0)&&(b=-(z=1));z<p.length;z++)c=60c+q(p.charCodeAt(z));for(z=0;z<O.length;z++)A/=60,c+=q(O.charCodeAt(z))A;return cb}function a(M){for(var z=0;z<M.length;z++)M[z]=o(M[z])}function L(M,z){for(var b=[],p=0;p<z.length;p++)b[p]=M[z[p]];return b}function n(M){for(var M=M.split("\|"),z=M[2].split(" "),b=M[3].split(""),p=M[4].split(" "),O=(a(z),a(b),a(p),p),A=b.length,c=0;c<A;c++)O[c]=Math.round((O[c-1]\|\|0)+6e4O[c

Chrome Cache Entry: 232

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	738424
Entropy (8bit):	5.11004055726938
Encrypted:	false
SSDEEP:
MD5:	2102FBD6A799A867F042C4B539C0DF35
SHA1:	496FB94229196EAE58261350D79E7175C093095D
SHA-256:	615D39DFEDBCF5E0BFB1567AA47EAED089C339A0F133CB62047DF8AE803B3E0F
SHA-512:	3EB4C7E0320EB0C3008D363D79D36B6872D41021821A2008357D5623E4810E93852A6F333559F8137DEE9A204FDF5581B45C67DCFEAB20972BD756C587552BE0
Malicious:	false
Reputation:	unknown
URL:	https://cdn.optimizely.com/datafiles/9wASB3TCXLP9uzH7yCozg.json
Preview:	{"accountId":"275532918","projectId":"29011260228","revision":"4517","attributes":[{"id":"29203910403","key":"mobileDeviceType"},{"id":"29204130694","key":"accountIdGuid"},{"id":"29204300637","key":"enableAutoTaggingTextFields"},{"id":"29208030502","key":"isMobile"},{"id":"29208780506","key":"showSimplifiedMeerkatWelcomeModal"},{"id":"29214280412","key":"accountPlan"},{"id":"29217880479","key":"allowDocGenDocuments"},{"id":"29221090492","key":"accountId"},{"id":"29221550511","key":"distinctId"},{"id":"29225700425","key":"isOneDsMode"},{"id":"29231920400","key":"isSigningBrandingEnabled"},{"id":"29233190584","key":"isUserFirstSender"},{"id":"29234070431","key":"paymentMethod"},{"id":"29237650418","key":"planName"},{"id":"29240790491","key":"isSimplifiedSendingAccount"},{"id":"29241130383","key":"userCreationDateInEpochSeconds"},{"id":"29243190978","key":"isPowerFormEnabled"},{"id":"29247640716","key":"isDesktop"},{"id":"29248510293","key":"browserVersion"},{"id":"29250550570","key":"day

Chrome Cache Entry: 234

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	900
Entropy (8bit):	5.345449428555976
Encrypted:	false
SSDEEP:
MD5:	17A782F04369CC79F490A976243511F6
SHA1:	84622E41838BDCD204EE2CFAD064B4BA58D0B5D5
SHA-256:	500168AD65BAE9FC7D865A3A98704346E4313BEDFA401F50EBB24AFFBFFB71CB
SHA-512:	EA715C41758D9735C22FFF73CDD58CFBBECD6EF4F424E2380103D9D61E4B21A314DD51F8359211CBFC9AF5DFBFB8CF20FA00B1093C8F9F34C413A43CC82FF7CE
Malicious:	false
Reputation:	unknown
URL:	https://docucdn-a.akamaihd.net/olive/images/2.64.0/global-assets/ds-icons-favicon-default-64x64.svg
Preview:	<?xml version="1.0" encoding="utf-8"?>. Generator: Adobe Illustrator 28.1.0, SVG Export Plug-In . SVG Version: 6.00 Build 0) -->.<svg version="1.1" id="Layer_1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px".. viewBox="0 0 64 64" style="enable-background:new 0 0 64 64;" xml:space="preserve">.<style type="text/css">...st0{fill:#4C00FF;}...st1{fill:#FF5252;}.</style>.<g>..<path class="st0" d="M46.1,46.1v16.3c0,0.9-0.7,1.6-1.6,1.6H1.6C0.7,64,0,63.3,0,62.4v-43c0-0.9,0.7-1.6,1.6-1.6h16.3v26.6...c0,0.9,0.7,1.6,1.6,1.6L46.1,46.1L46.1,46.1z"/>..<path class="st1" d="M64,23c0,13.8-8,23-17.9,23.1V28.8c0-0.5-0.2-1-0.6-1.3l-9-9c-0.3-0.3-0.8-0.6-1.3-0.6H17.9V1.6...c0-0.9,0.7-1.6,1.6-1.6h24.2C55.2,0,64,9.3,64,23z"/>..<path d="M45.5,27.4c0.3,0.3,0.6,0.8,0.6,1.3v17.4L19.5,46c-0.9,0-1.6-0.7-1.6-1.6V17.9h17.3c0.5,0,1,0.2,1.3,0.6L45.5,27.4z"/>.</g>.</svg>.

Chrome Cache Entry: 236

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 31644, version 1.0
Category:	downloaded
Size (bytes):	31644
Entropy (8bit):	7.993065566948634
Encrypted:	true
SSDEEP:
MD5:	89C979CFF1EBCBD06171DCD15927EB3A
SHA1:	DDFB17DA64F896EA2682BEC12499ED9D8F65F69D
SHA-256:	F2C05D1D723BD31646C2C5ADB65C29F317FEAB778A02511FBDCBC180853CA042
SHA-512:	AD58C49E307E87D94BCD1AD7DD7D729B752817DC2451D5869A7ECB652622FDC0BE51C4BAA263747D986898756D6B178570BA9AC839AF748FA808DC9B7CECED9E
Malicious:	false
Reputation:	unknown
URL:	https://docucdn-a.akamaihd.net/olive/fonts/2.8.0/DSIndigo-Medium.woff2
Preview:	wOF2......{.......k...{1........................?FFTM..6...H..t.`..V.$..e.....$..S.....6.$..(. .. ..3..3[.M...iWu.........~s..`..ws.m...ao..B..U..g.............vl.1B...jf......).ir...Hi.y]Zwp0./QH...V%G.q.....p....f.M.\|.4.\.#....7..S.{Q,8sQ..E.J...e.K.i...z...w.j.Q.h..I.})...E-.mjw.~1.7p.\|...[...v[.y^.G......q.........,Mydu9..~._hF~..j...#.........j.~..w.k..j......LR..G+r..d.?!\.Mf.Sg...a.,...D_....`.{=./...........}...T.m.?.6.2`H.5.........=...}.JRI".D.1$..P).xrM.8?O.\|...R.TP..P.pX..W..U.Wi.]...t.......h6...l.-...R.EY....C...T...X1s.f....`..%.Q..CEf.......hu.{.........'".i.Q.....-.......T@.l.f^\|...\|...1....h...[..u...!.Q.....t...P......^8b....=...q.{6g.,b.....C!4B...m4..,z...4NB...2.C.......n.@..Jo.>).ULf........7U..#.-...TYx-...MH?.Q.....DpM.....3H..L..^......T.km....:.@.X...z....qosW..t.t.K..g(5.#4x..n.Z..d/$..i.....(..(..(..(..(.v.y.;..(...h4...n. .9. ...CC._k..R..x.}QY;..{..."%..EJ.A7qi....<C...&....m19..+..(-@../ P...X.._..O

Chrome Cache Entry: 237

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 1 x 40, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2829
Entropy (8bit):	7.868258116113502
Encrypted:	false
SSDEEP:
MD5:	B2252B382FED5AF47285BAB381174D81
SHA1:	1C77AB3F63683027970BF336FB76A9359241723E
SHA-256:	A37EC680B077FF592541DCE614916B425B705253210CFD96F74119EB25C9EC17
SHA-512:	08FA558916CB18DC48296CBDB456A4F78F441B0BA6DA7FB65378FF6944CE42E5B592E8C416403FAAC11DCB6FEFCAE6D81674E5617AE9536949F6D9690BF94E57
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.......(.....?..w....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

Chrome Cache Entry: 238

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (53570), with LF, NEL line terminators
Category:	downloaded
Size (bytes):	9529575
Entropy (8bit):	5.5952906280856
Encrypted:	false
SSDEEP:
MD5:	3FC37C2769107705CEF146AF405BF96D
SHA1:	C68C04A1B91B3A637F9ADE8348F331AD819907B6
SHA-256:	BEC70A79D28FB7B0EE4D158C081F7E4D2B70EA916E1167C47BE51CC526594419
SHA-512:	13AE0B53A99CE21F289F2E7C433D878214048572CE7AEDE1AF39BCC629EBCF6211EF8F3A3165F2EFC23AAE44F26CFBC6210E73D9DE2FC4F515CE87D63126B0D9
Malicious:	false
Reputation:	unknown
URL:	https://docucdn-a.akamaihd.net/production/1ds/widgets/@ds/send/1.1.591-7/js/1ds-bundle.js
Preview:	/! For license information please see 1ds-bundle.js.LICENSE.txt /.System.register(["React","dsUi","emotionReact","lodash","MomentTimezone","ReactDOM","jQuery","1dsContext","RTK","optimizelySdk","@ds/prepare","emotionStyled","lottie","moment"],(function(e,t){var r={},n={},o={},a={},i={},c={},s={},l={},u={},d={},f={},p={},h={},A={};return Object.defineProperty(r,"__esModule",{value:!0}),Object.defineProperty(n,"__esModule",{value:!0}),Object.defineProperty(o,"__esModule",{value:!0}),Object.defineProperty(a,"__esModule",{value:!0}),Object.defineProperty(c,"__esModule",{value:!0}),Object.defineProperty(l,"__esModule",{value:!0}),Object.defineProperty(u,"__esModule",{value:!0}),Object.defineProperty(d,"__esModule",{value:!0}),Object.defineProperty(f,"__esModule",{value:!0}),Object.defineProperty(p,"__esModule",{value:!0}),Object.defineProperty(h,"__esModule",{value:!0}),Object.defineProperty(A,"__esModule",{value:!0}),{setters:[function(e){Object.keys(e).forEach((function(t){r[t]=e[t]}))}

Chrome Cache Entry: 239

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	297575
Entropy (8bit):	5.2604088919827845
Encrypted:	false
SSDEEP:
MD5:	F7AE0655327ACEC0655AD9B76C63D2EB
SHA1:	78B75DBD246F67F3670AAC94148D754BD9226204
SHA-256:	2D268324CFD8A41242D6534932E6066F9B769CD5FFBBF6650BA3E804913E2FBE
SHA-512:	5C2B6173F5B33DF6BEA1AE3D6774C8E8C50AFF396A77AECAC3244BF7F475F73EAE32A04DBAFF2212727C1561D41408C2EACAEBF30DC531903DD537E7EB44FFF5
Malicious:	false
Reputation:	unknown
Preview:	"undefined"!=typeof navigator&&function(t,e){"object"==typeof exports&&"undefined"!=typeof module?module.exports=e():"function"==typeof define&&define.amd?define(e):(t="undefined"!=typeof globalThis?globalThis:t\|\|self).lottie=e()}(this,(function(){"use strict";var svgNS="http://www.w3.org/2000/svg",locationHref="",_useWebWorker=!1,initialDefaultFrame=-999999,setWebWorker=function(t){_useWebWorker=!!t},getWebWorker=function(){return _useWebWorker},setLocationHref=function(t){locationHref=t},getLocationHref=function(){return locationHref};function createTag(t){return document.createElement(t)}function extendPrototype(t,e){var r,i,s=t.length;for(r=0;r<s;r+=1)for(var a in i=t[r].prototype)Object.prototype.hasOwnProperty.call(i,a)&&(e.prototype[a]=i[a])}function getDescriptor(t,e){return Object.getOwnPropertyDescriptor(t,e)}function createProxyFunction(t){function e(){}return e.prototype=t,e}var audioControllerFactory=function(){function t(t){this.audios=[],this.audioFactory=t,this._volume=

Chrome Cache Entry: 242

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (4143)
Category:	dropped
Size (bytes):	73015
Entropy (8bit):	5.342744191670081
Encrypted:	false
SSDEEP:
MD5:	9BECC40FB1D85D21D0CA38E2F7069511
SHA1:	AE854B04025DB8B7F48FDD6DEDF41E77EAE44394
SHA-256:	A9705DFC47C0763380D851AB1801BE6F76019F6B67E40E9B873F8B4A0603F7A9
SHA-512:	585374E3CE3AB1D28C20FE4B28DA6131A5B353B629332094DB8E5EB4ADE0FF601161B3CAF546F5F1E1BE96353DEAA29109687EAAE098EF279F4A6964430D4035
Malicious:	false
Reputation:	unknown
Preview:	/*. @license. * Lodash <https://lodash.com/>. * Copyright OpenJS Foundation and other contributors <https://openjsf.org/>. * Released under MIT license <https://lodash.com/license>. * Based on Underscore.js 1.8.3 <http://underscorejs.org/LICENSE>. * Copyright Jeremy Ashkenas, DocumentCloud and Investigative Reporters & Editors. */.(function(){function n(n,t,r){switch(r.length){case 0:return n.call(t);case 1:return n.call(t,r[0]);case 2:return n.call(t,r[0],r[1]);case 3:return n.call(t,r[0],r[1],r[2])}return n.apply(t,r)}function t(n,t,r,e){for(var u=-1,i=null==n?0:n.length;++u<i;){var o=n[u];t(e,o,r(o),n)}return e}function r(n,t){for(var r=-1,e=null==n?0:n.length;++r<e&&t(n[r],r,n)!==!1;);return n}function e(n,t){for(var r=null==n?0:n.length;r--&&t(n[r],r,n)!==!1;);return n}function u(n,t){for(var r=-1,e=null==n?0:n.length;++r<e;)if(!t(n[r],r,n))return!1;.return!0}function i(n,t){for(var r=-1,e=null==n?0:n.length,u=0,i=[];++r<e;){var o=n[r];t(o,r,n)&&(i[u++]=o)}return i}function o(n

Chrome Cache Entry: 246

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (39333)
Category:	dropped
Size (bytes):	41250
Entropy (8bit):	5.183527329664333
Encrypted:	false
SSDEEP:
MD5:	B3701731126CAD753F53DEAF4102AAB7
SHA1:	480095368F80E5454C25A1721C4210C572A5A682
SHA-256:	A03231D7D912303E69E3F69631193CA527A0052B80D4067FCB02A8AAC1FCAEF5
SHA-512:	0F5586E0E1848C0D29D0DF68EFFD8036D22ECE1C7880049E03A5561A1FF9FAA4139002310A8D84C8B13EFEE8613BA47DDC8CBF609B73E4EB34437CF0BA954B04
Malicious:	false
Reputation:	unknown
Preview:	(function (global, factory) {..typeof exports === 'object' && typeof module !== 'undefined' ? factory(exports) :..typeof define === 'function' && define.amd ? define(['exports'], factory) :..(global = typeof globalThis !== 'undefined' ? globalThis : global \|\| self, factory(global.RTK = {}));.})(this, (function (exports) { 'use strict';...var t,e,n,r=undefined&&undefined.__extends\|\|(t=function(e,n){return t=Object.setPrototypeOf\|\|{__proto__:[]}instanceof Array&&function(t,e){t.__proto__=e;}\|\|function(t,e){for(var n in e)Object.prototype.hasOwnProperty.call(e,n)&&(t[n]=e[n]);},t(e,n)},function(e,n){if("function"!=typeof n&&null!==n)throw new TypeError("Class extends value "+String(n)+" is not a constructor or null");function r(){this.constructor=e;}t(e,n),e.prototype=null===n?Object.create(n):(r.prototype=n.prototype,new r);}),o=undefined&&undefined.__generator\|\|function(t,e){var n,r,o,i,u={label:0,sent:function(){if(1&o[0])throw o[1];return o[1]},trys:[],ops:[]};return i={next:c(0),thro

Chrome Cache Entry: 247

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (605)
Category:	downloaded
Size (bytes):	120585
Entropy (8bit):	5.370923647345209
Encrypted:	false
SSDEEP:
MD5:	23BFE7E99565EE8F34AFD63C06F4C24B
SHA1:	BF08B8AD1AD73C12A7C9CB211926CE23A861DB07
SHA-256:	9DB33292007AB6C38527B39D5663E976A305564E19B2A5A8713EA2B2C00F505D
SHA-512:	F6318DAF93E2C1EF27CCB2D84E4F10AC430F7E3194D29C7CD066332995318BB96609FAC18EDC827355799244B9BF1570C0807B429CDCED4C4B890C5F00DDF477
Malicious:	false
Reputation:	unknown
URL:	https://docucdn-a.akamaihd.net/production/1ds/libs/react-dom/17.0.2/umd/react-dom.production.min.js
Preview:	/** @license React v17.0.2. * react-dom.production.min.js. . Copyright (c) Facebook, Inc. and its affiliates.. . This source code is licensed under the MIT license found in the. * LICENSE file in the root directory of this source tree.. /.(function(){/. Modernizr 3.0.0pre (Custom Build) \| MIT.*/.'use strict';(function(M,ha){"object"===typeof exports&&"undefined"!==typeof module?ha(exports,require("react")):"function"===typeof define&&define.amd?define(["exports","react"],ha):(M=M\|\|self,ha(M.ReactDOM={},M.React))})(this,function(M,ha){function m(a){for(var b="https://reactjs.org/docs/error-decoder.html?invariant="+a,c=1;c<arguments.length;c++)b+="&args[]="+encodeURIComponent(arguments[c]);return"Minified React error #"+a+"; visit "+b+" for the full message or use the non-minified dev environment for full errors and additional helpful warnings."}.function Ta(a,b){gb(a,b);gb(a+"Capture",b)}function gb(a,b){Ib[a]=b;for(a=0;a<b.length;a++)zf.add(b[a])}function li(a){if(Af.call(Bf,a)

Chrome Cache Entry: 248

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (21307)
Category:	dropped
Size (bytes):	21358
Entropy (8bit):	5.4283862144165616
Encrypted:	false
SSDEEP:
MD5:	AAB8E29C0C03B2AE6C11244BC192EE92
SHA1:	42A29D40AD549DFE628DED7164CA416496EE4B94
SHA-256:	CB9C2F10EB5532E2C3A8CE7C98B11E097246D13F82907D623C0827B59CAFA392
SHA-512:	884CFDCD65579D98C61890FE0D374A4018BCB872FB4C78DD77BC5078A94D995455A062829E47FDD92A5BEF289D3BD48340A9781185DB104F0D7B20A34877BDAB
Malicious:	false
Reputation:	unknown
Preview:	!function(e,t){"object"==typeof exports&&"undefined"!=typeof module?t(exports,require("react")):"function"==typeof define&&define.amd?define(["exports","react"],t):t((e="undefined"!=typeof globalThis?globalThis:e\|\|self).emotionReact={},e.React)}(this,(function(e,t){"use strict";function r(e){if(e&&e.__esModule)return e;var t=Object.create(null);return e&&Object.keys(e).forEach((function(r){if("default"!==r){var n=Object.getOwnPropertyDescriptor(e,r);Object.defineProperty(t,r,n.get?n:{enumerable:!0,get:function(){return e[r]}})}})),t.default=e,Object.freeze(t)}var n=r(t);var a=function(){function e(e){var t=this;this._insertTag=function(e){var r;r=0===t.tags.length?t.insertionPoint?t.insertionPoint.nextSibling:t.prepend?t.container.firstChild:t.before:t.tags[t.tags.length-1].nextSibling,t.container.insertBefore(e,r),t.tags.push(e)},this.isSpeedy=void 0===e.speedy\|\|e.speedy,this.tags=[],this.ctr=0,this.nonce=e.nonce,this.key=e.key,this.container=e.container,this.prepend=e.prepend,this.in

Static File Info

General

File type:	SMTP mail, ASCII text, with very long lines (459), with CRLF line terminators
Entropy (8bit):	6.080173229581621
TrID:	E-Mail message (Var. 1) (20512/2) 100.00%
File name:	original (1).eml
File size:	85'460 bytes
MD5:	f4e0db2e195cbe3e35add52707fad3c8
SHA1:	0e0268f624ad3d0a28e7d6a37e1872f5104fbdbe
SHA256:	b5bc7c09980077e3e4de1246ca56060eea70a679cee23f5d07c7874e5560f5fd
SHA512:	7fbc3d2792d6de81876b03b5feae75ffcdaa632b1c9a06b837fe437ea6d80115134571299692afa9f2baa7532a6a8b6375ed54ed92d711144fa2255691ecc0b9
SSDEEP:	1536:tXSl7Q2s/foxyYam5Zu2015hKyPfsszMIFKPj46iM:tXAO7m5Zu2UXjF4ziM
TLSH:	2E838E4743813639C8D5A098703777BB32F065AB1EF1248D993ABEF62A85CF534E624D
File Content Preview:	Return-Path: <lynda.jarrett@us.tel.com>..Received: from APC01-PSA-obe.outbound.protection.outlook.com (mail-psaapc01on2043.outbound.protection.outlook.com [40.107.255.43]).. by inbound-smtp.us-east-1.amazonaws.com with SMTP id ehshjgncjk9p4j3o8ck5h8pkde52

Static Mail

General

Subject:	[Phish Alert]Declined: ACH/EFT Deposited , Please review and sign
From:	lynda.jarrett@us.tel.com
To:	telgreport.phishing@tel.com, db882d80-4f03-4511-be8c-78fdfd0ad442@phisher.knowbe4.com
Cc:
BCC:
Date:	Thu, 10 Oct 2024 17:56:49 +0000
Communications:	You don't often get email from dse_na4@docusign.net. Learn why this is important<https://aka.ms/LearnAboutSenderIdentification> [DocuSign] [https://NA4.docusign.net/member/Images/email/docVoid-white.png] . declined to sign. REVIEW DOCUMENT <https://na4.docusign.net/Member/EmailStart.aspx?a=bac0e9bc-10f7-490d-b8e0-91c66d2fe074&etti=31&r=db8ebd13-e261-4a99-9db2-0eff576af59d> Arnold Ryan elmontaser@kernel-ec.com . declined RemittanceSlip105.pdf. As a result, the documents cannot be completed. Do Not Share This Email This email contains a secure link to Docusign. Please do not share this email, link, or access code with others. Alternate Signing Method Visit Docusign.com, click 'Access Documents', and enter the security code: BAC0E9BC10F7490DB8E091C66D2FE0747 About Docusign Sign documents electronically in just minutes. It's safe, secure, and legally binding. Whether you're in an office, at home, on-the-go -- or even across the globe -- Docusign provides a professional trusted solution for Digital Transaction Management(tm). Questions about the Document? If you need to modify the document or have questions about the details in the document, please reach out to the sender by emailing them directly. Stop receiving this email Report this email<https://protect.docusign.net/report-abuse?e=AUtomjpFak9GlbPL0zFFi112S2HojOdJLlT4psdsiMtAsK5whZ0260YJ_fdipxz8PNSJQZ6TMr7CgqgZlvgycxfPNeldsUYiSx4fn383USQjH3GTHAFXpkliqjGWWWt8CvAqmidzolf6PZyUCC-klKBHT3jIcNQRIa4OI9CoXTq6u7qh4mi8CHIdpz02nfSPpCIsA3-FIv4p-oqGcwo47QWONyu9c9du3vpyN9Ph9du-QjPS3tzpHGuV93sxMmRNccHllRKtqWiPhkcOoOqNTsita2dMh2EkQHxJAhBGNNvVNIYj4o0fyeapbjwSHYFZExFbCY_4-SsOg-uGGNSl78Ax0bDyNa_YB9Zi-FEidWR84pXh6L7qtHgNCuv9eiFIYtYAFWNw3jOrWQnyh8_Yep70Bx2wyy9GnDFMCtEwEVFb9Fjzu3Ny9-dDmy2KIunkEg&lang=en> or read more about Declining to sign<https://support.docusign.com/en/guides/Declining-to-sign-DocuSign-Signer-Guide> and Managing notifications<https://support.docusign.com/en/articles/How-do-I-manage-my-email-notifications>. If you have trouble signing, visit "How to Sign a Document<https://support.docusign.com/s/articles/How-do-I-sign-a-DocuSign-document-Basic-Signing?language=en_US&utm_campaign=GBL_XX_DBU_UPS_2211_SignNotificationEmailFooter&utm_medium=product&utm_source=postsend>" on our Docusign Support Center<https://support.docusign.com/>, or browse our Docusign Community<https://community.docusign.com/esignature-111?utm_campaign=GBL_US_PRD_AWA_2405_CommunityCTA&utm_medium=email&utm_source=postsend> for more information. [https://docucdn-a.akamaihd.net/olive/images/2.62.0/global-assets/email-templates/icon-download-app.png]Download the Docusign App <https://www.docusign.com/features-and-benefits/mobile?utm_campaign=GBL_XX_DBU_UPS_2211_SignNotificationEmailFooter&utm_medium=product&utm_source=postsend> This message was sent to you by Arnold Ryan who is using the Docusign Electronic Signature Service. If you would rather not receive email from this sender you may contact the sender with your request.
Attachments:	phish_alert_iocp_v1.10.14.eml

Headers

Key	Value
Return-Path	<lynda.jarrett@us.tel.com>
Received	from SEZPR03MB7248.apcprd03.prod.outlook.com ([fe80::e10a:3fd:faf3:8fb2]) by SEZPR03MB7248.apcprd03.prod.outlook.com ([fe80::e10a:3fd:faf3:8fb2%5]) with mapi id 15.20.8048.017; Thu, 10 Oct 2024 17:56:49 +0000
Received-SPF	pass (spfCheck: domain of us.tel.com designates 40.107.255.43 as permitted sender) client-ip=40.107.255.43; envelope-from=lynda.jarrett@us.tel.com; helo=APC01-PSA-obe.outbound.protection.outlook.com;
Authentication-Results	amazonses.com; spf=pass (spfCheck: domain of us.tel.com designates 40.107.255.43 as permitted sender) client-ip=40.107.255.43; envelope-from=lynda.jarrett@us.tel.com; helo=APC01-PSA-obe.outbound.protection.outlook.com; dkim=pass header.i=@us.tel.com; dmarc=pass header.from=us.tel.com;
X-SES-RECEIPT	AEFBQUFBQUFBQUFGMloxcEdMRUhpUkdvVjN4ZGEwNFQydXlBTkhCV25FeU1YZkN0U3dyS21EVExJcEF0c2I0Wnk1L0ZFOUFaM1dLZ3JuTXRiMEtGV2ZVTTNVUkdOZlBUcS9iWnhJc2ZVMTF3ck1lS2FJaXlwN0xoZFkxRXpGQ3dwbG82UEdESzRZRnVVZnFCdmluWGtMSVRUbExRdUs5YWhUaVpTNm9mci9lS2QzWnhsK1hLYjZPSXlXTmptQWYrNUMzbVdkcHZVdXpqcEtNOG5KYWdKRGtHOElONFFyd3dhWE9oZ0prdktGYlpMUm1OVlo3aml4emZXNWhmN29HdThtdUFkc0FCVDFiaUVSSldCUkVkRnNrQy9jRXRrWFQ4T1BQTTZuZHM1enRlbC9EeW5pN3dTYm9OSHBwYzZHSmEyRUdsampDelRYS009
X-SES-DKIM-SIGNATURE	a=rsa-sha256; q=dns/txt; b=bJ/seC6YjxtVQcNgAsGVNU+ZIsR86IX3lapmpJwsjJKxWaaV79B9uleBYmVSUHI7eV3MJA+eVUJR7zTHG+2pVAurWYziRY5hqICFqZu6wPvZvYTLgVRYJDSzC/G6w6UqkteEVZCRd2RTnORQ0pgsQKCARy3ROPIayuGGuT40/fs=; c=relaxed/simple; s=ug7nbtf4gccmlpwj322ax3p6ow6yfsug; d=amazonses.com; t=1728583019; v=1; bh=iDT3iidjlqn+RD46EGIDdQv/XcaXlDRWO6U+OolRT94=; h=From:To:Cc:Bcc:Subject:Date:Message-ID:MIME-Version:Content-Type:X-SES-RECEIPT;
ARC-Seal	i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=ujk97Twu+4/n9dXKKOy6ThDwG9xPBTeBYTjPFNgbIJbzRAoBLYek2qKDIaN9MMFYKjw7PUUyBzkhJNoPORIqgjewcUYs9/LIDet+w4j1NJJpdXbVzMmxyDePlBaZ8ElMdn74w789mWpymuBi5enurg53UDwU0dqRMrT1b3AnLFBzomyWKd690TE6rOouQJqxwv5boYBcHYbS1eAGeaNqFKXeHZi7AqOIgJPawgeofEHalYUc9cBZUQ6IrVR76jTnFsb7Kr9tWUsQegp8GJhxEq/DkkWwRa/GRn3XWYhQoSsheR9SX8kFhVTySa19xtrioDkxiivm8uQGa6eqq+5NhQ==
ARC-Message-Signature	i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=yJtjSd0r9+zpAXMx5fJEZ7zZBGyJeGwY5erZl8Ui75A=; b=PnLX8KLvlOAkH6SmpPOwUNVQMnn8wvIXjkIgJVKTGLdarM/dRJSPoyG0yGGQh085Sd5KIUORrkAaAO6DhCJ6gonLmT8DNVF22vPiUvKCfnOKY0LFJPFum5NeQlVa9fij9etS3hDKh2XenDKZEp7bfEC26rFf+SgLv0nOIQmnFjpSCYbD2diIUGLahu8jXmzjettF4RuPocfk+H4TlkWW1uaXKWTd9KJg6xDGfxkuOfr3W3ZHtVt5/Zoqxd82+iBB2Pyr2srYCS4LAfft9ALOiSBTReZpCNaODblBEYwKu4oZ20suP7+FvKVrq/Cf7iRdxxjcP88fd1kR45Q3Ljbqyw==
ARC-Authentication-Results	i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=us.tel.com; dmarc=pass action=none header.from=us.tel.com; dkim=pass header.d=us.tel.com; arc=none
DKIM-Signature	v=1; a=rsa-sha256; c=relaxed/relaxed; d=us.tel.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=yJtjSd0r9+zpAXMx5fJEZ7zZBGyJeGwY5erZl8Ui75A=; b=gNcF65iEioDy1Gez8/p0WK9uiZxNCIwWqjcb7DV6kiBuneV0zSDuW7C0UvriOup0TdkluDNvh/bLynjc18Of2nFvjweVoC7XZ5mKlccoCdYDrZHXUFNC5Zw7UigUvJGU8r5qAE/buRQXwe+H7JCQJeGCp1GtUDmaZZ/oftvxpVg=
From	lynda.jarrett@us.tel.com
To	telgreport.phishing@tel.com, db882d80-4f03-4511-be8c-78fdfd0ad442@phisher.knowbe4.com
Subject	[Phish Alert]Declined: ACH/EFT Deposited , Please review and sign
Thread-Topic	[Phish Alert]Declined: ACH/EFT Deposited , Please review and sign
Thread-Index	AQHbGzczNddXX9JWsECjxKjXbsXu27KARRrg
Date	Thu, 10 Oct 2024 17:56:49 +0000
Message-ID	<SEZPR03MB7248F753A3F7A842706226BFDE782@SEZPR03MB7248.apcprd03.prod.outlook.com>
References	<c1eec34791f34cf09ffce4e262275217@docusign.net>
In-Reply-To	<c1eec34791f34cf09ffce4e262275217@docusign.net>
Accept-Language	en-US
Content-Language	en-US
X-MS-Has-Attach	yes
X-MS-TNEF-Correlator
authentication-results	dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=us.tel.com;
x-ms-publictraffictype	Email
x-ms-traffictypediagnostic	SEZPR03MB7248:EE_\|JH0PR03MB8618:EE_
x-ms-office365-filtering-correlation-id	75687c63-d195-4c7c-f52f-08dce954ea33
x-ms-exchange-senderadcheck	1
x-ms-exchange-antispam-relay	0
x-microsoft-antispam	BCL:0;ARA:13230040\|366016\|376014\|69100299015\|1800799024\|38070700018\|3613699012;
x-microsoft-antispam-message-info	zeuab6ZfbxCd6/SddJhg6h5GB+AzrSHbF0zLB/g+PVGckCQFo1Gx2rcxCp1bgdSskGAymvdbfklqkHoU926Nn3JcdMj6e0c1sfjplGsdcUlLPRyAZK+K5eW0yhhZPf35vVgYdKPZmaTo7DFNXNCHmsNHb2FZTck/Rfn3zaXBEEsKeH1prUFLElZ8HMLxo2Q/XlF/RRIGXOy9HTE4wVq4F76s1XyfvXnuRPEGnKnyzqbiJzDsrhjAwZlKjEWbsN9ajIwuSRXOAWjRIJQo6iN6MzGLXM0B/5NygC1DnnEsXgZz90ztD7rGOfjk8EJVsqQ4bm6yyfCTGp/UgNKhb4VTF/LwMj8QElKKx32UXhiwE0gl2IiJA4oNavIjqaSVWJct5GZXEuu9FLwDXUVj9gsyPRgkTSnPN5f24JG2VRFDTRuE6Y+uGkQht4FhbII5LeUvWEY/bg1+q7fUAoGRqJThG/Wnq4j+MqRKmGznjNzsI6ebK3O1uq5uVIjAq/1xSuaw82LIMMdE1SBRM2J/l9dFOSixBiCCVdxeQLDoLrfi+fMwgdOFnLt7anU0jthHfxPZEwGCRNM/ydZtdQmt3VlmESag5NW7r8HkG5rsoPgwuc1SfBTHPoqgD+G/3J62/AVaz2FJ4dhDFEu5HQRmSXbP7khDRdgLslhhvaHNSXiVIbeWdxha5LoRsaQWVWVCB3OVeZ6IZZtmGhFArt8es46co/jq3UsOMKxe4Gv/UqcHEJhoIieyOmwV1gcxUrQXrsc7JOt2qcvtgGH/ndv6pz95hedHWZUtcaLxs85VkzOafqdAGaiCGkyHTvrFjNi2TrD2A7tMq5k9uA69zADtU6Fxfhy9rjaxaMSIoUsGSbhJmr0MSBI5c7n1lA/WRIIFIYLFPrcZVMWnFhYzuBwCFhxyAB8Tq7m4IxPWKny820WjXyU268u45ooFZZWPCj53MCQt1WdhPlTVWjiivnk9G4Aj99pbYAOcEMXd6eDZSUw9OEnDltOyYv+Oo7xRccBURl1H7m/LO0e9oIYHZOVEnMDx5WShbvZpaj5k0lQgH58iaianM1w1CZllTVda9XSFr5hfortGPrkQf5HElfGDaDi8E8HM/DA41U+fYGlZrVRalLZhkHi6ncbExBZxl7p3EqnqvncpX1dxQMriUw9Ui9vWzgJ2S/8D9Tu2l0Rm6zFhAKJomPXZRuV6DJvf5gbRUZmYd8le4hCsSCvWWJeT0Q9BCeDlN4+lwXwiX1BaEnqiKuvqxbQYhYL6Tudj5rK/m4H8
x-forefront-antispam-report	CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:SEZPR03MB7248.apcprd03.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(366016)(376014)(69100299015)(1800799024)(38070700018)(3613699012);DIR:OUT;SFP:1101;
x-ms-exchange-antispam-messagedata-chunkcount	1
x-ms-exchange-antispam-messagedata-0	Tx6dz/Go9u3UAwULXQsj28e0ZqXEkehdRsBTioGWMm1s1/l93rp0bvQ0hiUy0j1/O0o5jNAOuQsSugp+YzKphCdel3EAYlVHMei9U77So0oD5ShJYYI7lqeRBYTtWvHeVWDYPTCG4qld8O74BpPj6wWN7hsy2W/uLvvXCyQ42f3VVt8bSRm8gMJNdb+YwNbmPoIYibwJrnfPtdryy4DC38LXzSVNRSwO+G8rwmc8VFG3RSlD53Cw6oc13L/NXQcic6PGfkAloPTEp31M45tN1WP2dqeqyHp673KYV7RpIpbQCO+29FTCmXTHrSRkuctnNcdI7rCG5kQCLj1Be6rUYm/+DLBvEY8mHcv6UluBlLa34mWncA/dxrUCpkH70WJMjCtHLbD0h+wRQK5Hm53bQjr7bGta1h3mPI8Wn851AAsSZ3C2jArRiuzLMjMr+6SDLhLMkNMAkiZdo4TJPv3ZSQv90NePB28i/Evrt656yPhjPIArJtno4pJ1QXBi0+dYyx0gQcRijjRcGoqU9W3mnA2gQzM754ZLnPuobof64lFt93ALF9ciddboObnwpVd7X/K8iciqbg7eHzlOhf6NDxps57iCnX4B9XG2GZS4jawE6NtYGyPQEPuZCGsbj3GgEuD/Wl8lAv/n5nmtgWnE5Ag+EA9PXHg3o1f9J0+SLWjIZfWjs0OZ/BqwDo5JzWfnDERBfUYNXPuAz6Uw00CiOYs8ByBZPDCa2r23sd3kO9ub9AgoCSN2mqn82YR+iAMeaCnqVxcbtNOMhhOJz15r+aeewunTifkDP/OCQrP+9yHCzqcjEeqElqkTb6Q+3KZXLXuICk8Uaf3k5M/QZxBAtFoluKaaBTdWwNviepGDLMtE5mnoB1gpzvpyIOIW1jhf8B6UJlsAG/fSBMRbPlTsxOiOBOWaIKyGxj7DashrANR1Z/pR8TL6ByBZ7ZHOilOq31REqjC94cKbdR2TBbx6uMAK2FEQxqMVEvHDi/rb+BTUef4k3rgET6dlTe/kFpsKUYiz/4fDpT4zigjkMFL1c55JcqWMf01/C1m7B+rC5zWB893kCBTmSpfYB3+yIwWaZ3WQ9Um/g91/CLjXRqtYQGDthuGixGA1j9Htu4bDEI0tYU83YtAKFsuGkNxiqJQnlvp7bk8ONSdQ1UQDZxgO50GNgsDdYR0e+bVkKZclGpPSleegcIstd6LDVYpWZnADIzHsUtYYWyRGVGYNngE++/vfEKTCc9ayPlvUFhqx2GE+ZVKemUoWsOlxi435up5Bi+2UTsR2j6gyApmEPIWioWWp7By3yYWCYEHtiIrKuPdvHWshatrsDoD+MTbGspqMK21HagoyWMXJ4gI0Y+vloPyN0yQOI6VEaCrRUHETC/H23xoslNQSLCcUZzpiYmkrTrG4TGmxfJgJljc9bSnpuoFZ3y4pB8g3SxKQwNPezHLpkPOuLxFy6LjM8cqk3bD19OW6sLaDqvBLO13zxlxGgJnYabL6elK1g1oPpAdnl9Fteg/6YSTbkVAVAraAHlIPes6BFiDf1UH01ZCddK/SquBbnnwMdV35w1l3Fk7HQw182uD6ZtgqOn+nyRW7LZNbtieL2jz3oCQTWRJOBPoM3w==
Content-Type	multipart/mixed; boundary="_004_SEZPR03MB7248F753A3F7A842706226BFDE782SEZPR03MB7248apcp_"
MIME-Version	1.0
X-OriginatorOrg	us.tel.com
X-MS-Exchange-CrossTenant-AuthAs	Internal
X-MS-Exchange-CrossTenant-AuthSource	SEZPR03MB7248.apcprd03.prod.outlook.com
X-MS-Exchange-CrossTenant-Network-Message-Id	75687c63-d195-4c7c-f52f-08dce954ea33
X-MS-Exchange-CrossTenant-originalarrivaltime	10 Oct 2024 17:56:49.5393 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader	Hosted
X-MS-Exchange-CrossTenant-id	8c433003-a081-4dfb-a631-100526250b1a
X-MS-Exchange-CrossTenant-mailboxtype	HOSTED
X-MS-Exchange-CrossTenant-userprincipalname	HyYfeTi0Ja00pwHUAWndXQoJn+l+hMQpsrHzwD+h0EP2iF25YH6wUSvUKbpfRqIdt5cBTPd8bsS1fNAiV4iAKgS7rtlKdZCNq+ZJ2kwHozA=
X-MS-Exchange-Transport-CrossTenantHeadersStamped	JH0PR03MB8618

File Icon


Icon Hash:	46070c0a8e0c67d6

Description:	Adversaries may abuse Internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality and customize aspects of Internet browsers. They can be installed directly or through a browser's app store and generally have access and permissions to everything that the browser can access.
Tactics:	Persistence
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Process: Process Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report original (1).eml

Overview

General Information

Detection

Signatures

Classification

Process Tree

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Software Vulnerabilities

Networking

System Summary

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

LLM Input / Output

Created / dropped Files

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

C:\Users\user\AppData\Local\Microsoft\FORMS\FRMCACHE.DAT

C:\Users\user\AppData\Local\Microsoft\FontCache\4\CatalogCacheMetaData.xml

C:\Users\user\AppData\Local\Microsoft\FontCache\4\Catalog\ListAll.Json

C:\Users\user\AppData\Local\Microsoft\FontCache\4\PreviewFont\flat_officeFontsPreview_4_40.ttf

C:\Users\user\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntities.bin

C:\Users\user\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntitiesUpdated.bin

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-journal

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-shm

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-wal

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{D9F95C05-CBFE-4448-8EB6-752D35897D1F}.tmp

C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1728584504943197800_40569FE3-431E-4839-B2E0-E56988338FE8.log

C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1728584504943970400_40569FE3-431E-4839-B2E0-E56988338FE8.log

C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20241010T1421440727-1084.etl

C:\Users\user\AppData\Roaming\Microsoft\Office\MSO3072.acl

C:\Users\user\AppData\Roaming\Microsoft\Outlook\NoEmail.srs

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

C:\Users\user\Documents\Outlook Files\Outlook Data File - NoEmail.pst

C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp

Chrome Cache Entry: 176

Chrome Cache Entry: 177

Chrome Cache Entry: 179

Chrome Cache Entry: 180

Chrome Cache Entry: 181

Chrome Cache Entry: 182

Chrome Cache Entry: 183

Windows Analysis Report
original (1).eml