Edit tour

Windows Analysis Report
DOCUMENTS.msg

Overview

General Information

Sample name:	DOCUMENTS.msg
Analysis ID:	1546390
MD5:	05e0c0f362769520ddb637a58e1c7ff8
SHA1:	b22ab6ac565334cd876708fc1e7211a7adc4fbbf
SHA256:	65e776a8081d4b94dab31accae8653f722310495fc6e5e3a254b82d1e4652094
Infos:

Detection

HTMLPhisher

Score:	64
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Yara detected BlockedWebSite

AI detected landing page (webpage, office document or email)

AI detected potential phishing Email

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

Queries the volume information (name, serial number etc) of a device

Sigma detected: Office Autorun Keys Modification

Stores files to the Windows start menu directory

Suricata IDS alerts with low severity for network traffic

Classification

Process Tree

System is w10x64_ra

OUTLOOK.EXE (PID: 5076 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /f "C:\Users\user\Desktop\DOCUMENTS.msg" MD5: 91A5292942864110ED734005B7E005C0)

ai.exe (PID: 1824 cmdline: "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "EB4F3FE8-396F-43DF-82CA-D00C96AB837A" "9BD6E947-83E8-46E0-907E-2DB8A4A5C80B" "5076" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx" MD5: EC652BEDD90E089D9406AFED89A8A8BD)

chrome.exe (PID: 6896 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fparrots-run-fjh.craft.me%2FkKsdDph47M82kH&data=05%7C02%7Cclubb%40audits.ga.gov%7C7868b433ade34c8449f408dcf9de2f4a%7C3ba88d1570d44b838474db703319c2a0%7C0%7C0%7C638659979887700847%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=bpVMMJuyI8Eg2vUj%2BK862VkxX6I5AHOsDuFcDZCvmRA%3D&reserved=0 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 5920 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2092 --field-trial-handle=1996,i,5602081774264852813,10793832898396863703,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7028 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fparrots-run-fjh.craft.me%2FkKsdDph47M82kH&data=05%7C02%7Cclubb%40audits.ga.gov%7C7868b433ade34c8449f408dcf9de2f4a%7C3ba88d1570d44b838474db703319c2a0%7C0%7C0%7C638659979887700847%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=bpVMMJuyI8Eg2vUj%2BK862VkxX6I5AHOsDuFcDZCvmRA%3D&reserved=0 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 4532 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2008 --field-trial-handle=1996,i,11601669098928197994,496886325698099544,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
dropped/chromecache_71	JoeSecurity_BlockedWebSite	Yara detected BlockedWebSite	Joe Security

HTML

Source	Rule	Description	Author	Strings
0.1.pages.csv	JoeSecurity_BlockedWebSite	Yara detected BlockedWebSite	Joe Security
0.0.pages.csv	JoeSecurity_BlockedWebSite	Yara detected BlockedWebSite	Joe Security

Sigma Signatures

Sigma detected: Office Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 , EventID: 13, EventType: SetValue, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE, ProcessId: 5076, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Addins\OneNote.OutlookAddin\1

Suricata Signatures

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-31T20:42:17.892643+0100	2022930	1	A Network Trojan was detected	172.202.163.200	443	192.168.2.16	49707	TCP
2024-10-31T20:42:56.005995+0100	2022930	1	A Network Trojan was detected	172.202.163.200	443	192.168.2.16	49725	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fparrots-run-fjh.craft.me%2FkKsdDph47M82kH&data=05%7C02%7Cclubb%40audits.ga.gov%7C7868b433ade34c8449f408dcf9de2f4a%7C3ba88d1570d44b838474db703319c2a0%7C0%7C0%7C638659979887700847%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=bpVMMJuyI8Eg2vUj%2BK862VkxX6I5AHOsDuFcDZCvmRA%3D&reserved=0

SlashNext: Label: Credential Stealing type: Phishing & Social Engineering

Phishing

Yara detected BlockedWebSite

Source: Yara match	File source: 0.1.pages.csv, type: HTML
Source: Yara match	File source: 0.0.pages.csv, type: HTML
Source: Yara match	File source: dropped/chromecache_71, type: DROPPED

Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.16:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.16:49725 version: TLS 1.2

Source: Joe Sandbox View	IP Address: 239.255.255.250 239.255.255.250
Source: Joe Sandbox View	IP Address: 104.47.64.28 104.47.64.28
Source: Joe Sandbox View	IP Address: 104.47.65.28 104.47.65.28

Source: Joe Sandbox View

JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4

Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 172.202.163.200:443 -> 192.168.2.16:49707
Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 172.202.163.200:443 -> 192.168.2.16:49725

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.20
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.20
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.20
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.20
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.20
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.20
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.20
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203

Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=cPS6YSs6uELSgFu&MD=zHkmzDgs HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /?url=https%3A%2F%2Fparrots-run-fjh.craft.me%2FkKsdDph47M82kH&data=05%7C02%7Cclubb%40audits.ga.gov%7C7868b433ade34c8449f408dcf9de2f4a%7C3ba88d1570d44b838474db703319c2a0%7C0%7C0%7C638659979887700847%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=bpVMMJuyI8Eg2vUj%2BK862VkxX6I5AHOsDuFcDZCvmRA%3D&reserved=0 HTTP/1.1Host: gcc02.safelinks.protection.outlook.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /?url=https%3A%2F%2Fparrots-run-fjh.craft.me%2FkKsdDph47M82kH&data=05%7C02%7Cclubb%40audits.ga.gov%7C7868b433ade34c8449f408dcf9de2f4a%7C3ba88d1570d44b838474db703319c2a0%7C0%7C0%7C638659979887700847%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=bpVMMJuyI8Eg2vUj%2BK862VkxX6I5AHOsDuFcDZCvmRA%3D&reserved=0 HTTP/1.1Host: gcc02.safelinks.protection.outlook.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /Content/Scripts/safelinksv2.css HTTP/1.1Host: gcc02.safelinks.protection.outlook.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fparrots-run-fjh.craft.me%2FkKsdDph47M82kH&data=05%7C02%7Cclubb%40audits.ga.gov%7C7868b433ade34c8449f408dcf9de2f4a%7C3ba88d1570d44b838474db703319c2a0%7C0%7C0%7C638659979887700847%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=bpVMMJuyI8Eg2vUj%2BK862VkxX6I5AHOsDuFcDZCvmRA%3D&reserved=0Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /Content/Scripts/site.js HTTP/1.1Host: gcc02.safelinks.protection.outlook.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fparrots-run-fjh.craft.me%2FkKsdDph47M82kH&data=05%7C02%7Cclubb%40audits.ga.gov%7C7868b433ade34c8449f408dcf9de2f4a%7C3ba88d1570d44b838474db703319c2a0%7C0%7C0%7C638659979887700847%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=bpVMMJuyI8Eg2vUj%2BK862VkxX6I5AHOsDuFcDZCvmRA%3D&reserved=0Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /Content/images/cross.png HTTP/1.1Host: gcc02.safelinks.protection.outlook.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fparrots-run-fjh.craft.me%2FkKsdDph47M82kH&data=05%7C02%7Cclubb%40audits.ga.gov%7C7868b433ade34c8449f408dcf9de2f4a%7C3ba88d1570d44b838474db703319c2a0%7C0%7C0%7C638659979887700847%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=bpVMMJuyI8Eg2vUj%2BK862VkxX6I5AHOsDuFcDZCvmRA%3D&reserved=0Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /Content/Scripts/site.js HTTP/1.1Host: gcc02.safelinks.protection.outlook.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /Content/images/cross.png HTTP/1.1Host: gcc02.safelinks.protection.outlook.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=cPS6YSs6uELSgFu&MD=zHkmzDgs HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com

Source: global traffic	DNS traffic detected: DNS query: gcc02.safelinks.protection.outlook.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com

Source: chromecache_71.7.dr	String found in binary or memory: https://gcc02.safelinks.protection.outlook.com
Source: DOCUMENTS.msg	String found in binary or memory: https://gcc02.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.gatrees.org%2F
Source: ~WRS{8C055AAB-CA7E-404A-B267-FFC966B27AC3}.tmp.0.dr	String found in binary or memory: https://gcc02.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.gatrees.org%2F&data=05%7C02%7Cc
Source: DOCUMENTS.msg, ~WRS{8C055AAB-CA7E-404A-B267-FFC966B27AC3}.tmp.0.dr	String found in binary or memory: https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fparrots-run-fjh.craft.me%2FkKsdDph
Source: chromecache_71.7.dr	String found in binary or memory: https://parrots-run-fjh.craft.me/kKsdDph47M82kH

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 49698 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49698
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724

Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.16:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.16:49725 version: TLS 1.2

Source: classification engine

Classification label: mal64.phis.winMSG@24/30@7/5

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

File created: C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

File created: C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20241031T1542060815-5076.etl

Jump to behavior

Source: unknown	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /f "C:\Users\user\Desktop\DOCUMENTS.msg"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "EB4F3FE8-396F-43DF-82CA-D00C96AB837A" "9BD6E947-83E8-46E0-907E-2DB8A4A5C80B" "5076" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fparrots-run-fjh.craft.me%2FkKsdDph47M82kH&data=05%7C02%7Cclubb%40audits.ga.gov%7C7868b433ade34c8449f408dcf9de2f4a%7C3ba88d1570d44b838474db703319c2a0%7C0%7C0%7C638659979887700847%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=bpVMMJuyI8Eg2vUj%2BK862VkxX6I5AHOsDuFcDZCvmRA%3D&reserved=0
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fparrots-run-fjh.craft.me%2FkKsdDph47M82kH&data=05%7C02%7Cclubb%40audits.ga.gov%7C7868b433ade34c8449f408dcf9de2f4a%7C3ba88d1570d44b838474db703319c2a0%7C0%7C0%7C638659979887700847%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=bpVMMJuyI8Eg2vUj%2BK862VkxX6I5AHOsDuFcDZCvmRA%3D&reserved=0
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2092 --field-trial-handle=1996,i,5602081774264852813,10793832898396863703,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2008 --field-trial-handle=1996,i,11601669098928197994,496886325698099544,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "EB4F3FE8-396F-43DF-82CA-D00C96AB837A" "9BD6E947-83E8-46E0-907E-2DB8A4A5C80B" "5076" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fparrots-run-fjh.craft.me%2FkKsdDph47M82kH&data=05%7C02%7Cclubb%40audits.ga.gov%7C7868b433ade34c8449f408dcf9de2f4a%7C3ba88d1570d44b838474db703319c2a0%7C0%7C0%7C638659979887700847%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=bpVMMJuyI8Eg2vUj%2BK862VkxX6I5AHOsDuFcDZCvmRA%3D&reserved=0	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fparrots-run-fjh.craft.me%2FkKsdDph47M82kH&data=05%7C02%7Cclubb%40audits.ga.gov%7C7868b433ade34c8449f408dcf9de2f4a%7C3ba88d1570d44b838474db703319c2a0%7C0%7C0%7C638659979887700847%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=bpVMMJuyI8Eg2vUj%2BK862VkxX6I5AHOsDuFcDZCvmRA%3D&reserved=0	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2092 --field-trial-handle=1996,i,5602081774264852813,10793832898396863703,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2008 --field-trial-handle=1996,i,11601669098928197994,496886325698099544,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: c2r64.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: gpapi.dll	Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{F959DBBB-3867-41F2-8E5F-3B8BEFAA81B3}\InprocServer32

Jump to behavior

Source: Google Drive.lnk.5.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.5.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.5.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.5.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.5.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.5.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Window found: window name: SysTabControl32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Common

Jump to behavior

Persistence and Installation Behavior

AI detected landing page (webpage, office document or email)

Source: Email	LLM: Page contains button: 'View PDF' Source: 'Email'
Source: Email	LLM: Email contains prominent button: 'view pdf'

AI detected potential phishing Email

Source: Email

LLM: Detected potential phishing email: The email is sent to 'Undisclosed recipients' which is a common phishing tactic to hide mass distribution

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe

Queries volume information: C:\Program Files (x86)\Microsoft Office\root\Office16\AI\WordCombinedFloatieLreOnline.onnx VolumeInformation

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	2 Browser Extensions	1 Process Injection	1 Masquerading	OS Credential Dumping	1 Process Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	1 DLL Side-Loading	1 Process Injection	LSASS Memory	12 System Information Discovery	Remote Desktop Protocol	Data from Removable Media	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 Registry Run Keys / Startup Folder	1 Registry Run Keys / Startup Folder	1 DLL Side-Loading	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fparrots-run-fjh.craft.me%2FkKsdDph47M82kH&data=05%7C02%7Cclubb%40audits.ga.gov%7C7868b433ade34c8449f408dcf9de2f4a%7C3ba88d1570d44b838474db703319c2a0%7C0%7C0%7C638659979887700847%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=bpVMMJuyI8Eg2vUj%2BK862VkxX6I5AHOsDuFcDZCvmRA%3D&reserved=0	100%	SlashNext	Credential Stealing type: Phishing & Social Engineering

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
gcc02.safelinks.eop-tm2.outlook.com	104.47.64.28	true	false	unknown
www.google.com	172.217.16.132	true	false	unknown
gcc02.safelinks.protection.outlook.com	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fparrots-run-fjh.craft.me%2FkKsdDph47M82kH&data=05%7C02%7Cclubb%40audits.ga.gov%7C7868b433ade34c8449f408dcf9de2f4a%7C3ba88d1570d44b838474db703319c2a0%7C0%7C0%7C638659979887700847%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=bpVMMJuyI8Eg2vUj%2BK862VkxX6I5AHOsDuFcDZCvmRA%3D&reserved=0	true	SlashNext: Credential Stealing type: Phishing & Social Engineering	unknown
https://gcc02.safelinks.protection.outlook.com/Content/Scripts/safelinksv2.css	false		unknown
https://gcc02.safelinks.protection.outlook.com/Content/Scripts/site.js	false		unknown
https://gcc02.safelinks.protection.outlook.com/Content/images/cross.png	false		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://gcc02.safelinks.protection.outlook.com	chromecache_71.7.dr	false	unknown
https://parrots-run-fjh.craft.me/kKsdDph47M82kH	chromecache_71.7.dr	false	unknown
https://gcc02.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.gatrees.org%2F&data=05%7C02%7Cc	~WRS{8C055AAB-CA7E-404A-B267-FFC966B27AC3}.tmp.0.dr	false	unknown
https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fparrots-run-fjh.craft.me%2FkKsdDph	DOCUMENTS.msg, ~WRS{8C055AAB-CA7E-404A-B267-FFC966B27AC3}.tmp.0.dr	false	unknown
https://gcc02.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.gatrees.org%2F	DOCUMENTS.msg	false	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
239.255.255.250	unknown	Reserved	unknown	unknown	false
104.47.64.28	gcc02.safelinks.eop-tm2.outlook.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
104.47.65.28	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
172.217.16.132	www.google.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.16

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1546390
Start date and time:	2024-10-31 20:41:38 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 18s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	DOCUMENTS.msg
Detection:	MAL
Classification:	mal64.phis.winMSG@24/30@7/5
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .msg

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, SIHClient.exe, SgrmBroker.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 52.113.194.132, 52.111.236.35, 52.111.236.34, 52.111.236.32, 52.111.236.33, 52.182.143.215, 142.250.184.195, 142.250.185.78, 74.125.206.84, 34.104.35.123, 142.250.185.99, 142.250.185.163
Excluded domains from analysis (whitelisted): onedscolprdcus22.centralus.cloudapp.azure.com, ecs.office.com, fs.microsoft.com, accounts.google.com, slscr.update.microsoft.com, clientservices.googleapis.com, s-0005-office.config.skype.com, mobile.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com, ecs-office.s-0005.s-msedge.net, prod1.naturallanguageeditorservice.osi.office.net.akadns.net, nleditor.osi.office.net, clients2.google.com, prod-eu-resolver.naturallanguageeditorservice.osi.office.net.akadns.net, edgedl.me.gvt1.com, s-0005.s-msedge.net, ecs.office.trafficmanager.net, clients.l.google.com, mobile.events.data.trafficmanager.net
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
VT rate limit hit for: DOCUMENTS.msg

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
239.255.255.250	oZ7nac01Em.exe	Get hash	malicious	Stealc, Vidar	Browse
	Proposal From Wachler & Associates PC.pdf	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	http://amtso.eicar.org/PotentiallyUnwanted.exe	Get hash	malicious	Unknown	Browse
	http://amtso.eicar.org/PotentiallyUnwanted.exe	Get hash	malicious	Unknown	Browse
	El9HaBFrFM.exe	Get hash	malicious	Blank Grabber	Browse
	https://www.miroslavska.com/pvt/language-prefs?return_url=https:///alrbanyon.com/..&lng=en&return_url=/plain-flange_red.thick./dn-800/glatter-flansch-dn-800:813x20-pn-10-id-8195-mm	Get hash	malicious	HTMLPhisher	Browse
	original.eml	Get hash	malicious	Mamba2FA	Browse
	https://fcs-aero.com/ilsmart/marketplace/inventory/#ksunya.chan@yogiproducts.com	Get hash	malicious	HTMLPhisher	Browse
	https://s3.timeweb.cloud/d2247a8d-ceb09c71-57ee-4411-a590-e4de8ca5cf86/Contract/contract.htm#andrew.wise@arrowbank.com	Get hash	malicious	HTMLPhisher	Browse
104.47.64.28	(No subject) - 2024-10-31T090531.704.eml	Get hash	malicious	Unknown	Browse
	Access Audits -System #6878.msg	Get hash	malicious	HTMLPhisher	Browse
	(No subject) (100).eml	Get hash	malicious	Tycoon2FA	Browse
	(No subject) (93).eml	Get hash	malicious	HTMLPhisher	Browse
	(No subject) (92).eml	Get hash	malicious	Unknown	Browse
	(No subject) (89).eml	Get hash	malicious	HTMLPhisher	Browse
	(No subject) (87).eml	Get hash	malicious	HTMLPhisher	Browse
	https://memakers-my.sharepoint.com/:f:/p/saeed/EuiMdoZoPpVNthIaEwKAedkBDFKyUdriWNhHe2RDzQxMdQ?e=5hQMeB&xsdata=MDV8MDJ8cGhlcm1hbkBidXJiYW5rY2EuZ292fDU4NDFjYjVhMjQzNDQ2YjU2ODZmMDhkY2Q3ZjZlNzZlfDY0OGRhZTMxMTgyYjRkYTI5OWVmMjU4MWFiOGU4YmVhfDB8MHw2Mzg2MjI3MDI2NDY5MTMzMDB8VW5rbm93bnxUV0ZwYkdac2IzZDhleUpXSWpvaU1DNHdMakF3TURBaUxDSlFJam9pVjJsdU16SWlMQ0pCVGlJNklrMWhhV3dpTENKWFZDSTZNbjA9fDQwMDAwfHx8&sdata=STFxSjJFWXZ2WnFoSWJsSml1L3V4emhPdHNVTmE5OWJmbjZsSDRKcjlyND0%3d	Get hash	malicious	HTMLPhisher	Browse
	(No subject) (82).eml	Get hash	malicious	Unknown	Browse
	[VM]_ New message in mailbox 2145 from _WATERBOARDS_ ..eml	Get hash	malicious	Unknown	Browse
104.47.65.28	Access Audits -System #6878.msg	Get hash	malicious	HTMLPhisher	Browse
	(No subject) (90).eml	Get hash	malicious	Unknown	Browse
	(No subject) (89).eml	Get hash	malicious	HTMLPhisher	Browse
	(No subject) (72).eml	Get hash	malicious	Unknown	Browse
	(No subject) (60).eml	Get hash	malicious	HTMLPhisher	Browse
	(No subject) (53).eml	Get hash	malicious	Unknown	Browse
	(No subject) (50).eml	Get hash	malicious	Unknown	Browse
	https://naatsihwp-my.sharepoint.com/:w:/g/personal/jodie_naatsihwp_org_au/Edt9QgU4WchFkzsysfjUqRYBtCY1xbWi-QqcZStxuCuHSA?e=VULAwM&xsdata=MDV8MDJ8amVubmlmZXIuYm9uaG9tZUBiaWEuZ292fDhhNDUwMWUzYjFlZDQ2Y2VhZjM4MDhkY2I3YjgxMGFifDA2OTNiNWJhNGIxODRkN2I5MzQxZjMyZjQwMGE1NDk0fDB8MHw2Mzg1ODcyNDg0NTg5OTY3NzN8VW5rbm93bnxUV0ZwYkdac2IzZDhleUpXSWpvaU1DNHdMakF3TURBaUxDSlFJam9pVjJsdU16SWlMQ0pCVGlJNklrMWhhV3dpTENKWFZDSTZNbjA9fDYwMDAwfHx8&sdata=dnVxOEVGZEZPSGZxOXA2VTg5cjVhdzRjbnZ4bi9EZ1ExMmRQMDhGc1dBST0%3d&clickparams=eyAiWC1BcHBOYW1lIiA6ICJNaWNyb3NvZnQgT3V0bG9vayIsICJYLUFwcFZlcnNpb24iIDogIjE2LjAuMTc2MjguMjAxODgiLCAiT1MiIDogIldpbmRvd3MiIH0%3D&CT=1723128099484&OR=Outlook-Body&CID=105B1456-7270-4DC7-9A69-06C4F6528AF5&wdLOR=cB591A482-0A5C-483B-995F-86112B427CD5	Get hash	malicious	HTMLPhisher	Browse
	https://naatsihwp-my.sharepoint.com/:w:/g/personal/jodie_naatsihwp_org_au/Edt9QgU4WchFkzsysfjUqRYBtCY1xbWi-QqcZStxuCuHSA?e=VULAwM&xsdata=MDV8MDJ8amVubmlmZXIuYm9uaG9tZUBiaWEuZ292fDhhNDUwMWUzYjFlZDQ2Y2VhZjM4MDhkY2I3YjgxMGFifDA2OTNiNWJhNGIxODRkN2I5MzQxZjMyZjQwMGE1NDk0fDB8MHw2Mzg1ODcyNDg0NTg5OTY3NzN8VW5rbm93bnxUV0ZwYkdac2IzZDhleUpXSWpvaU1DNHdMakF3TURBaUxDSlFJam9pVjJsdU16SWlMQ0pCVGlJNklrMWhhV3dpTENKWFZDSTZNbjA9fDYwMDAwfHx8&sdata=dnVxOEVGZEZPSGZxOXA2VTg5cjVhdzRjbnZ4bi9EZ1ExMmRQMDhGc1dBST0=&clickparams=eyAiWC1BcHBOYW1lIiA6ICJNaWNyb3NvZnQgT3V0bG9vayIsICJYLUFwcFZlcnNpb24iIDogIjE2LjAuMTc2MjguMjAxODgiLCAiT1MiIDogIldpbmRvd3MiIH0=&CT=1723128099484&OR=Outlook-Body&CID=105B1456-7270-4DC7-9A69-06C4F6528AF5&wdLOR=cB591A482-0A5C-483B-995F-86112B427CD5	Get hash	malicious	HTMLPhisher	Browse
	(No subject) (43).eml	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
gcc02.safelinks.eop-tm2.outlook.com	(No subject) - 2024-10-31T090531.704.eml	Get hash	malicious	Unknown	Browse	104.47.64.28
	Access Audits -System #6878.msg	Get hash	malicious	HTMLPhisher	Browse	104.47.64.28
	(No subject) (100).eml	Get hash	malicious	Tycoon2FA	Browse	104.47.64.28
	(No subject) (93).eml	Get hash	malicious	HTMLPhisher	Browse	104.47.64.28
	(No subject) (92).eml	Get hash	malicious	Unknown	Browse	104.47.64.28
	(No subject) (90).eml	Get hash	malicious	Unknown	Browse	104.47.65.28
	(No subject) (89).eml	Get hash	malicious	HTMLPhisher	Browse	104.47.65.28
	(No subject) (87).eml	Get hash	malicious	HTMLPhisher	Browse	104.47.64.28
	https://memakers-my.sharepoint.com/:f:/p/saeed/EuiMdoZoPpVNthIaEwKAedkBDFKyUdriWNhHe2RDzQxMdQ?e=5hQMeB&xsdata=MDV8MDJ8cGhlcm1hbkBidXJiYW5rY2EuZ292fDU4NDFjYjVhMjQzNDQ2YjU2ODZmMDhkY2Q3ZjZlNzZlfDY0OGRhZTMxMTgyYjRkYTI5OWVmMjU4MWFiOGU4YmVhfDB8MHw2Mzg2MjI3MDI2NDY5MTMzMDB8VW5rbm93bnxUV0ZwYkdac2IzZDhleUpXSWpvaU1DNHdMakF3TURBaUxDSlFJam9pVjJsdU16SWlMQ0pCVGlJNklrMWhhV3dpTENKWFZDSTZNbjA9fDQwMDAwfHx8&sdata=STFxSjJFWXZ2WnFoSWJsSml1L3V4emhPdHNVTmE5OWJmbjZsSDRKcjlyND0%3d	Get hash	malicious	HTMLPhisher	Browse	104.47.64.28
	(No subject) (82).eml	Get hash	malicious	Unknown	Browse	104.47.64.28

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
MICROSOFT-CORP-MSN-AS-BLOCKUS	file.exe	Get hash	malicious	Stealc, Vidar	Browse	20.75.60.91
	El9HaBFrFM.exe	Get hash	malicious	Blank Grabber	Browse	20.157.217.118
	original.eml	Get hash	malicious	Mamba2FA	Browse	104.47.75.220
	(No subject) - 2024-10-31T090531.704.eml	Get hash	malicious	Unknown	Browse	104.47.64.28
	Fw Message from Kevin - Update on Coles Supply Chain Modernisation 31-10-24.eml	Get hash	malicious	Unknown	Browse	52.113.194.132
	https://t.ly/4Nq2x	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	13.107.253.44
	Update-KB4890-x86.exe	Get hash	malicious	Unknown	Browse	52.101.73.31
	http://djaahaf.r.af.d.sendibt2.com	Get hash	malicious	Unknown	Browse	150.171.28.10
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	20.96.153.111
	http://3d1.gmobb.jp/dcm299ccyag4e/gov/	Get hash	malicious	Phisher	Browse	20.33.55.12
MICROSOFT-CORP-MSN-AS-BLOCKUS	file.exe	Get hash	malicious	Stealc, Vidar	Browse	20.75.60.91
	El9HaBFrFM.exe	Get hash	malicious	Blank Grabber	Browse	20.157.217.118
	original.eml	Get hash	malicious	Mamba2FA	Browse	104.47.75.220
	(No subject) - 2024-10-31T090531.704.eml	Get hash	malicious	Unknown	Browse	104.47.64.28
	Fw Message from Kevin - Update on Coles Supply Chain Modernisation 31-10-24.eml	Get hash	malicious	Unknown	Browse	52.113.194.132
	https://t.ly/4Nq2x	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	13.107.253.44
	Update-KB4890-x86.exe	Get hash	malicious	Unknown	Browse	52.101.73.31
	http://djaahaf.r.af.d.sendibt2.com	Get hash	malicious	Unknown	Browse	150.171.28.10
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	20.96.153.111
	http://3d1.gmobb.jp/dcm299ccyag4e/gov/	Get hash	malicious	Phisher	Browse	20.33.55.12

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	oZ7nac01Em.exe	Get hash	malicious	Stealc, Vidar	Browse	172.202.163.200 184.28.90.27
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	172.202.163.200 184.28.90.27
	http://amtso.eicar.org/PotentiallyUnwanted.exe	Get hash	malicious	Unknown	Browse	172.202.163.200 184.28.90.27
	http://amtso.eicar.org/PotentiallyUnwanted.exe	Get hash	malicious	Unknown	Browse	172.202.163.200 184.28.90.27
	El9HaBFrFM.exe	Get hash	malicious	Blank Grabber	Browse	172.202.163.200 184.28.90.27
	https://www.miroslavska.com/pvt/language-prefs?return_url=https:///alrbanyon.com/..&lng=en&return_url=/plain-flange_red.thick./dn-800/glatter-flansch-dn-800:813x20-pn-10-id-8195-mm	Get hash	malicious	HTMLPhisher	Browse	172.202.163.200 184.28.90.27
	SecuriteInfo.com.Win32.MalwareX-gen.14673.11544.exe	Get hash	malicious	Unknown	Browse	172.202.163.200 184.28.90.27
	https://0nmdby.data--8.co.uk/oGRApYgs	Get hash	malicious	Unknown	Browse	172.202.163.200 184.28.90.27
	https://usps.com-trackrsm.top/l	Get hash	malicious	Unknown	Browse	172.202.163.200 184.28.90.27
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	172.202.163.200 184.28.90.27

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	231348
Entropy (8bit):	4.386331990550396
Encrypted:	false
SSDEEP:	1536:PqYL5Dgsw/YVTFOHfgs1oNcAz79ysQqt2nqdyqoQTPrcm0Fvnt9yMu6hewYK2jyR:p1g+RagZmiGu2VqoQbrt0FvCUl0KnjX
MD5:	9D0DC29C7AFF281B909AAD87D6AED743
SHA1:	E20EEC9E8950E32BDE8D85DC458CD1306ACB9455
SHA-256:	D4ACB3366CE7810228E81944C605FC2A00D10CF4624B73BA7A47419CD9A81CB1
SHA-512:	B11B3F63E254624CF483D8B1DB529DFD9E47B347ADE42A6EEAE01A530C721FA5CEA21880D5CD8E884706D2C71C79BE271E27AD038BD7FDFF53CA8683CA23F6E3
Malicious:	false
Reputation:	low
Preview:	TH02...... ...6..+......SM01X...,.....*..+..........IPM.Activity...........h...............h............H..h...............h.........?..H..h\cal ...pDat...h....0.........h:..............h........_`Pk...h....@...I.lw...h....H...8.Uk...0....T...............d.........2h...............k1.......E.G...!h.............. h.o............#h....8.........$h.?......8....."hxS7......R7...'h..............1h:...<.........0h....4....Uk../h....h.....UkH..hxF..p.........-h .......4.....+h................... ...... ..............F7..............FIPM.Activity....Form....Standard....Journal Entry...IPM.Microsoft.FolderDesign.FormsDescription................F.k..........1122110020000000....Microsoft...This form is used to create journal entries.........kf...... ..........&...........(.......(... ...@.....................................................................................................................fffffffff........wwwwwwww.p....pp..............p...............pw..............pw..DDDDO..

C:\Users\user\AppData\Local\Microsoft\FontCache\4\CatalogCacheMetaData.xml

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	XML 1.0 document, ASCII text, with very long lines (1869), with no line terminators
Category:	dropped
Size (bytes):	1869
Entropy (8bit):	5.087582652101596
Encrypted:	false
SSDEEP:	48:cG75dylxdyjdSyrudnzyZSyrenzyMJdyBkSyrdnzyr1nzyvASy/dyO:lEbEjdbqd2Zb622Embx2R2vAb/EO
MD5:	528DD527178F39E836B4FA9027D71D98
SHA1:	F7455E4C38381A20BD8009EBDD8B1C1CECF778DC
SHA-256:	65AF4B6F6B3D2D1F9EB90B801E4C9BE5811EE7F9E5E7CB63FC0DF101BA92FAB2
SHA-512:	5A0555F62AF9E32A2C0B40D1CC63D7C0D81B7296EF0BAE69F5041356223D06B75DB5F511B233DE89514759A2CAB005CAE6CF8A47D3746076CA86E36AC7B9736C
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?><root><version>1</version><Count>12</Count><Resource><Id>Aptos_26215680</Id><LAT>2024-10-31T19:42:07Z</LAT><key>29939506207.ttf</key><folder>Aptos</folder><type>4</type></Resource><Resource><Id>Aptos_45876480</Id><LAT>2024-10-31T19:42:07Z</LAT><key>27160079615.ttf</key><folder>Aptos</folder><type>4</type></Resource><Resource><Id>Aptos Narrow_26215424</Id><LAT>2023-10-06T09:25:29Z</LAT><key>31558910439.ttf</key><folder>Aptos Narrow</folder><type>4</type></Resource><Resource><Id>Aptos Display_26215680</Id><LAT>2023-10-06T09:25:29Z</LAT><key>23001069669.ttf</key><folder>Aptos Display</folder><type>4</type></Resource><Resource><Id>Aptos Narrow_45876224</Id><LAT>2023-10-06T09:25:29Z</LAT><key>24153076628.ttf</key><folder>Aptos Narrow</folder><type>4</type></Resource><Resource><Id>Aptos Display_45876480</Id><LAT>2023-10-06T09:25:29Z</LAT><key>30264859306.ttf</key><folder>Aptos Display</folder><type>4</type></Resource><Resource><Id>Aptos_

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-shm

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.045422466276247804
Encrypted:	false
SSDEEP:	3:Gtlxtjlg2rzDfHGlxtjlg2rzDfHz1R9//8l1lvlll1lllwlvlllglbelDbllAlla:GtPHfmPHfj9X01PH4l942wU
MD5:	77C077435C74E87BC25C4730709AC372
SHA1:	8A36BEAFC482A5584DE0108A45E4B2FEA8F7CC37
SHA-256:	C111B071123A752E9A78DA584EC6519218156DB507741FD3CD4B4A8CBBE48D81
SHA-512:	A86813C624B5FF12F5CC9D9D75CCC424D8F99F2CE436A6EAA876FAA0913B737D31A75DAB3C1CA0441DE47A06C5E22436AB7C9ABB86067685554620447DF5B650
Malicious:	false
Reputation:	low
Preview:	..-.........................n....P...{QV4.V..."...-.........................n....P...{QV4.V...".........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-wal

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	modified
Size (bytes):	49472
Entropy (8bit):	0.4841108891665901
Encrypted:	false
SSDEEP:	48:DN0Q1VCUll7DYMUzO8VFDYMo8BO8VFDYML:93dll4bjVGUjVGC
MD5:	F673D717F58EA632380B41FC46B3D98F
SHA1:	6813BCA6D2FAAA1F2F084630D5D41445656E057A
SHA-256:	AB10CE5D4B6C63C75E93606D28CBBE9EAF44963CC28AFC16354424C560996096
SHA-512:	D8A82DA86E4D3FEA90C13BBC34B44131235EEEC1F1E1D8905DAC1CCA2413B220FEBCB616441C4C45CD5CF34D9087C3E4334C99951C8C0E2AE3461801823EB414
Malicious:	false
Reputation:	low
Preview:	7....-...........P...{QV..S............P...{QV.=..*.WrSQLite format 3......@ .......................................................................... .............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\B6B5786E.dat

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	PNG image data, 170 x 226, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	29346
Entropy (8bit):	7.969591321070631
Encrypted:	false
SSDEEP:	768:r1ajvjRmVBBmOhVLjQbXJjpgFaqZ1KKWX:rU7IVBBBmJjpgFj1KHX
MD5:	D5C7B601585AFE1CF379EFC5E0727515
SHA1:	8D03AC0C573A74EEA6CF5EF973E8AAE8CED1B541
SHA-256:	C5F9A89D8FA123DC46B52E3E79AB6C6D13385848F74BABBCF65C5DF12F8C4F54
SHA-512:	F7D72E3E6259E7B64F65B8FFD2BDBD439ADCED295974D4A6ACD06A35FCC560615368CED3435A9D51923E56BA0C417FB845C6B286058DA7D7897D0612D25F3AC4
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR..............}\... .IDATx^..`TE.O .)..{.E.....W.(bo...EE,.{...........{....i..>w...-.H.......-sg.9s.{...b)n....b..:.W....... 8(Z....E7.W.....8(Z....E7.W.....8(Z....E7.W2?@....<>G.m.4c.>W....>..[.}N.8v..NS.....z....-....w....f.w..\...v.=..x.....{.CLi.H.&.....R^.d.AY.:...O.C0......#.K.ql....H........./K...g.&..j.......... V..Qq.%.%..^...._U...Gh..TN...\|.RB..x.=].w.....S9....C.a.Qy.....G.g......x......Z.<.r.. .t.X..T....H.........s.>^.B.\yA...8&.O~..B=.D.u..}..r...uU\..,.UnV..?.{S..k..<.@..r........=K.....i..v.n\..\...;......N...L..k......w.@.{.p..m....g...Y.\Ge...@._z.?.h.:...\<...f.@d..@.......M..B......>T..hY...i......r.....8...I.L..r..\.....H...9..6......R.........R....u...%.........hW.....y..0....g...:.7...@.1(..;....3.g..A..\|W.!...Q..Y.....`(....>f<..,..7m....C.{r=....@J.r.?T.......SV....q....{.....zF.k4<@xB.......^.5.P...y.....C...4..1Q...B#!....k...H.!..T....*.F.Z..........8...h....:.2...............@...W.....>}..y.[

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{8C055AAB-CA7E-404A-B267-FFC966B27AC3}.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	7316
Entropy (8bit):	3.4331373158950367
Encrypted:	false
SSDEEP:	96:Xn/KScdGGJEfmmlUZImEKUz/p+ERgggggD3qcBwPRh3uNmq:X/7cdwmcnmgBB66X3ym
MD5:	18E2190720A6E4D478D9E71113911DC2
SHA1:	15458BE246D048303BC02CBF5B81F79B86A12B5A
SHA-256:	F643D6DDE3AF999C0E77D7794EA52B44AFB1C0444A48C4953F48F2A7BAC10395
SHA-512:	3100EAAE66CDF67B4C87205C8B8681829A24E5448C6EDDA25B0A447E96ED41BD056C2DC27C19A3EB35D1844E44615F86B9D50941132C17B5A3D1349BEE5D1F6E
Malicious:	false
Reputation:	low
Preview:	....C.A.U.T.I.O.N.:. .......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................:...>...................x...z...\|...~...............................................................................................................................................................................................................................................................................................................................................................*...$..$.If........!v..h.#v....:V.......t.....6......5.......4........4........a........

C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1730403726992491800_837DD3A1-8A76-44B8-8607-F648CBDD8E40.log

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	ASCII text, with very long lines (28769), with CRLF line terminators
Category:	dropped
Size (bytes):	20971520
Entropy (8bit):	0.1796940344842835
Encrypted:	false
SSDEEP:	1536:GMVbWs4msThDUfojuu+AN1H/dHDd4j82wB63gygJpaRkayiPMiZTVjbFhExbuGAW:2s49JUfTqts6MzCh
MD5:	502EE9FF5676CDB4C9A609CD1A1DCBEC
SHA1:	94A318B1EDAD0DDBF5F3F26DE05925D16A4875B1
SHA-256:	62151E3602B564BC41B500D6AC43B67CFAE588F7A505EB1900BBF09FA8C29D06
SHA-512:	8FE193927791BB820F301B4A4A00F254FCD4E1EB064B5091D03CD9D191E6EF6FB1F8F307426B1A69198BB1339ABD82A74608F1559FFE9C5D8E96A999C53A070E
Malicious:	false
Preview:	Timestamp.Process.TID.Area.Category.EventID.Level.Message.Correlation..10/31/2024 19:42:07.039.OUTLOOK (0x13D4).0x100C.Microsoft Outlook.Telemetry Event.b7vzq.Medium.SendEvent {"EventName":"Office.Text.GDIAssistant.HandleCallback","Flags":30962256044949761,"InternalSequenceNumber":26,"Time":"2024-10-31T19:42:07.039Z","Contract":"Office.System.Activity","Activity.CV":"odN9g3aKuESGB/ZIy92OQA.4.11","Activity.Duration":11,"Activity.Count":1,"Activity.AggMode":0,"Activity.Success":true,"Data.GdiFamilyName":"","Data.CloudFontStatus":6,"Data.CloudFontTypes":256}...10/31/2024 19:42:07.055.OUTLOOK (0x13D4).0x100C.Microsoft Outlook.Telemetry Event.b7vzq.Medium.SendEvent {"EventName":"Office.Text.ResourceClient.Deserialize","Flags":30962256044949761,"InternalSequenceNumber":28,"Time":"2024-10-31T19:42:07.055Z","Contract":"Office.System.Activity","Activity.CV":"odN9g3aKuESGB/ZIy92OQA.4.12","Activity.Duration":10205,"Activity.Count":1,"Activity.AggMode":0,"Activity.Success":true,"Data.JsonFileMajor

C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1730403726993545800_837DD3A1-8A76-44B8-8607-F648CBDD8E40.log

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	20971520
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	8F4E33F3DC3E414FF94E5FB6905CBA8C
SHA1:	9674344C90C2F0646F0B78026E127C9B86E3AD77
SHA-256:	CD52D81E25F372E6FA4DB2C0DFCEB59862C1969CAB17096DA352B34950C973CC
SHA-512:	7FB91E868F3923BBD043725818EF3A5D8D08EBF1059A18AC0FE07040D32EEBA517DA11515E6A4AFAEB29BCC5E0F1543BA2C595B0FE8E6167DDC5E6793EDEF5BB
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20241031T1542060815-5076.etl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	94208
Entropy (8bit):	4.456302614086532
Encrypted:	false
SSDEEP:	768:mzjOQr6QzS4A4kCI3hNyvXnL7FAQBAFfRK8vtao3raO+xpe2u6Uav62+YECK4R4V:5H4R49NnB0TX1Tk
MD5:	367AED18B7A315B1BFC7D0E151501F34
SHA1:	D64E7A65553E34A8D695207F2971FAC83F5C06A9
SHA-256:	10F9959F4B4332BB7152BE3FE8D04E6480CC746AF47FA5F3EA161E1F6425F2C5
SHA-512:	D6A1B1A3F8A4997BE39D41902924F2356B6D387512A5ADE5670B2F09011BEA15E634F928206CCC2CA22BE8566A376DD7BA9F28982F1B58C6807B2B6AE9E22272
Malicious:	false
Preview:	............................................................................`................+..................eJ..............Zb..2...................................,...@.t.z.r.e.s...d.l.l.,.-.1.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.1.1.1...........................................................px.}.Y...............+..........v.2._.O.U.T.L.O.O.K.:.1.3.d.4.:.1.2.a.7.8.0.3.8.4.0.0.6.4.b.3.5.b.6.b.9.e.3.4.9.d.3.a.7.4.e.7.3...C.:.\.U.s.e.r.s.\.c.a.l.i.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.O.u.t.l.o.o.k. .L.o.g.g.i.n.g.\.O.U.T.L.O.O.K._.1.6._.0._.1.6.8.2.7._.2.0.1.3.0.-.2.0.2.4.1.0.3.1.T.1.5.4.2.0.6.0.8.1.5.-.5.0.7.6...e.t.l.......P.P..............+..........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DF8052E1DC085B131C.TMP

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	163840
Entropy (8bit):	0.44425581748612913
Encrypted:	false
SSDEEP:	192:gQmh3gD93KtMoapvJ3YSpgHgTSApOrAcn4f5sgDNsvSNgiXHWQOoWNh/:gQmM3Ka1px30HVs64f5jDNcliXHOo
MD5:	8109C4FDF05BC6300253FFF525779C9F
SHA1:	D94D514B9F4791A637E6C6D73200D6BC5B7CE1D4
SHA-256:	55D0C28E8124C029DD0CD47F00A639E15271A8410932C4E73F846D23757744E6
SHA-512:	D8D1D613E731D6FE3A72060ECE723863050B039A2B27D4A75F4CECEE439819F381F5775053C7D98E0A15035AB12349BD1FC4612808A7F64C4DE4864C32BF751B
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Office\MSO3072.acl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	30
Entropy (8bit):	1.2389205950315936
Encrypted:	false
SSDEEP:	3:His7v:Cs7
MD5:	7A0CD65F73306CD914841C20105D07DE
SHA1:	3BE093F1320BDFAD335DD26C770AD0EFF00C9E42
SHA-256:	A84F61DD0DB85E27A939A33FD200907B63345F8B9C509E09D604C2AEC6EE9B4B
SHA-512:	075BF433F74A20C09652649EBA0F1A5D7B0B892D3E8B711E163550A433D72DC7C974F08B0175250C42E80E761A3A723E1DD417A64DFC9A06D66904A602E297E7
Malicious:	false
Preview:	..............................

C:\Users\user\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	14
Entropy (8bit):	2.699513850319966
Encrypted:	false
SSDEEP:	3:QGiWlG:QGbY
MD5:	C5A12EA2F9C2D2A79155C1BC161C350C
SHA1:	75004B4B6C6C4EE37BE7C3FD7EE4AF4A531A1B1A
SHA-256:	61EC0DAA23CBC92167446DADEFB919D86E592A31EBBD0AB56E64148EBF82152D
SHA-512:	B3D5AF7C4A9CB09D27F0522671503654D06891740C36D3089BB5CB21E46AB235B0FA3DC2585A383B9F89F5C6DAE78F49F72B0AD58E6862DE39F440C4D6FF460B
Malicious:	false
Preview:	..c.a.l.i.....

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 31 18:42:19 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2673
Entropy (8bit):	3.982302818356348
Encrypted:	false
SSDEEP:	48:8adxT5ppwHRidAKZdA1FehwiZUklqehBy+3:80nsey
MD5:	565CA39D3C7864C45377EB03A313C95E
SHA1:	8D7236803AE32FD54D325FAF5D460B6572D33964
SHA-256:	5C99B145EF361504FDD97907F1FE442969F00767BB68E1A1429E2B52122FED34
SHA-512:	9589BCADAC66FB07E21B9F9941F6649DB25C36E11B375EEBD57D6B82573D47DD7BD35765848FBD2A0877F81DEA1120992D4CB8724A41FEB97CF1164BCE29535D
Malicious:	false
Preview:	L..................F.@.. ...$+.,......V..+..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I_Y9.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V_YI.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V_YI.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V_YI............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V_YJ............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........}f.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 31 18:42:19 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2675
Entropy (8bit):	3.9951452211762577
Encrypted:	false
SSDEEP:	48:8mdxT5ppwHRidAKZdA1seh/iZUkAQkqehOy+2:8wnC9Qny
MD5:	12A79F596A6FAA1EE517BA57A805D53E
SHA1:	219B7E7567E7CE97D0184A2EF8113AB99E773C3F
SHA-256:	142571645A910D7203CF6098F47404596D7FEAE6DBEBF2C2874CD5660B2D1664
SHA-512:	FD9ED2123693DD5E2C4900DF5A7ECBD8999302446F47888F703F9BD677A9A138FB74F9527CE4F6CA015ECE3CA2DEE7CADE49C04F5034601DE767617540D690B8
Malicious:	false
Preview:	L..................F.@.. ...$+.,......E..+..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I_Y9.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V_YI.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V_YI.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V_YI............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V_YJ............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........}f.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2689
Entropy (8bit):	4.00641171154888
Encrypted:	false
SSDEEP:	48:8GdxT5pAHRidAKZdA14meh7sFiZUkmgqeh7scy+BX:8QnUnay
MD5:	C9B7EB24EBB5B80AB50C04F37C6AFB83
SHA1:	AAA1D44C86A498047212E71427B38E0EFE12C8D7
SHA-256:	5CB52694C7AAC31C72D6E74184EFD42BC6349B5CAA3F31AC7BD30179E1EBB2E3
SHA-512:	512FF102591ECC29681A1B3CEAFB75D8BF0DEE400CC5B225AEBE08DFC29D717CB7759653EB8F972F3FA58A0AB0C101802D669F960337872B40117098B1A8D9EC
Malicious:	false
Preview:	L..................F.@.. ...$+.,.....Y.04...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I_Y9.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V_YI.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V_YI.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V_YI............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VFW.E...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........}f.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 31 18:42:19 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.996975598712598
Encrypted:	false
SSDEEP:	48:8xdxT5ppwHRidAKZdA1TehDiZUkwqehCy+R:8FnZEy
MD5:	81040E9CD73D6975287F2F18FD060E35
SHA1:	A4C09F33CC48F1C49ADF612F713BEE150924F803
SHA-256:	889B9227709A34478673296A2107FAA581DC6B081F6F1ADB82C0DF3161B5437B
SHA-512:	C9286E774E9270DC6595C9DBF28B9F32DC4642CC429261506A4107D96E073F462694CE37F8CA0830D7DD97A1D749916A632A60721028FE3BC0A82CD362E460F7
Malicious:	false
Preview:	L..................F.@.. ...$+.,......?..+..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I_Y9.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V_YI.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V_YI.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V_YI............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V_YJ............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........}f.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 31 18:42:19 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.984546228635181
Encrypted:	false
SSDEEP:	48:8YdxT5ppwHRidAKZdA1dehBiZUk1W1qehoy+C:8+nJ9Iy
MD5:	E00830E66261283EFB8DA495D1FADF6C
SHA1:	F429426479609F68F2F3FD01CF5EA4157DC3FB28
SHA-256:	117E1A042FFB75490169AC2C66C69D2CA94EF2CDABFC71C3997FEBC687B704E3
SHA-512:	16546A887F91C9D6199A5A2614602F68BA2F2E683508991A20E8E97E50D3D36B2613E41BFDE53ECDC12DC054C5C2EA4AF58224746E713283E40ACBECA0D339ED
Malicious:	false
Preview:	L..................F.@.. ...$+.,....9.O..+..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I_Y9.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V_YI.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V_YI.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V_YI............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V_YJ............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........}f.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 31 18:42:19 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.9962384494283154
Encrypted:	false
SSDEEP:	48:8YdxT5ppwHRidAKZdA1duTeehOuTbbiZUk5OjqehOuTbay+yT+:8+nxTfTbxWOvTbay7T
MD5:	EF13FCD5EA4AC6AC71AD38FB35834085
SHA1:	81942B3E9EA527524D3BC1EEC9A8CE40BB35CF5E
SHA-256:	D2130868069A81F2FF0463DA52D5E94C6AD793EA8E3E5D6BA944833C15328CC0
SHA-512:	0093D9A271DB16D7F7933C7ABECFBAE41266A28018F95DF977EB13608AD4FE857958BA1FC86D6AD15060C15203A7AE3767F895643CD15225F4D2B0B8F05E797A
Malicious:	false
Preview:	L..................F.@.. ...$+.,......6..+..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I_Y9.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V_YI.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V_YI.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V_YI............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V_YJ............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........}f.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\Documents\Outlook Files\Outlook Data File - NoEmail.pst

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	Microsoft Outlook email folder (>=2003)
Category:	dropped
Size (bytes):	271360
Entropy (8bit):	1.302443355364916
Encrypted:	false
SSDEEP:	768:S6Qc9K8zkg/I8OTyqNTTCCq8injvnBaoG2chBf38BUTIZ:FlkfXpT+/njv6vf3eNZ
MD5:	83C9334F3A7FCF3080A6662BC1A8DF2C
SHA1:	44B5377EAD49DEF9D6D29FA04CD11CCDD73B4B47
SHA-256:	2A770F23D4C506B8A2818E95E3386EB69CE361A87FE3783E39A5DEDC2F7D5EAE
SHA-512:	0F8B3C05BBE12B8813CDAE2CC6CFD8BD2DE2458ECF292BD593D9E68E20C076CFDCAD7EC19468AB6ED000F13EE0250D0ECBED6C70B3B444FE54602BDDFB2DE6C6
Malicious:	true
Preview:	!BDN..7.SM......\...............7.......T................@...........@...@...................................@...........................................................................$.......D......@S..............3...............6....................................................................................................................................................................................................................................................................................................w... ......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	1.0240003179783974
Encrypted:	false
SSDEEP:	384:OjTIXJFDeHjqHcsyOdId7bW5y5g47E1RUIr:CTIZFKicZOKbJiv
MD5:	1718025457E06D4F80162996C87F92D8
SHA1:	836D40865FA7378BC64671B15CD000834397A5A5
SHA-256:	84E6450FB5B9D19E9045FFFD926E667E1CA1A711EBE67EDDF9AC3A16A6C294A5
SHA-512:	20C2F9916C50339325E4FA1BB9CDD80F92168A46C6ED3E974EF6D3E54EB82E729E14EE4E9AB503CE23E0B9D4EFF73E2E94A490A5E8E28D1EB19F6320DCB54603
Malicious:	true
Preview:	.C^.C...Q...........G....+....................#.!BDN..7.SM......\...............7.......T................@...........@...@...................................@...........................................................................$.......D......@S..............3...............6....................................................................................................................................................................................................................................................................................................w... ..G....+.......B............#.........................................................................................................................................................................................................................................................................................................................................................................................................

Chrome Cache Entry: 66

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1588
Entropy (8bit):	5.174121809218917
Encrypted:	false
SSDEEP:	48:9pZigAOvzbYdvG2AumPBqykF1KdpwGFKcjeA5mkxofP:piFVmPBq/OI9GGP
MD5:	3AF1FDB9A3F664A6683D212F4787733A
SHA1:	59063D49B723A1988236C8D39C2804C6EBC5FF95
SHA-256:	A9CE4840FF0D613B456081DEA64E46EB717A1F8BFA5AFB05D3BD058F294E416C
SHA-512:	F8872E0C875BE6037C14480630E461FC1ADFA2049DB03BAE5D8CB6B320A2C084D4B266AEB02E24009B4BA84821E216690CA875B165164447FE8329B48C9E261F
Malicious:	false
Preview:	window.onload = function OnLoadHandler(){...if (window.history.length <= 1) {....document.getElementById("close").style.display = "none";...}..}....var theme = null;..try {.. (function (URLSearchParams, str) {.. if (!new URLSearchParams(window.location.search).get(str)){....throw URLSearchParams;...}....var urlParams = new URLSearchParams(window.location.search);....if (urlParams.has(str)){.....theme = String(urlParams.get(str));....}.. }(URLSearchParams, "theme"));..} catch(URLSearchParams){...var params = {}...var parts = window.location.search.substring(1).split('&');...for (var i = 0; i < parts.length; i++) {....var val = parts[i].split('=');....if (!val[0]) continue;....params[val[0]] = val[1] \|\| true;...}...theme = params["theme"];...}....// Load theme specific css..if (theme === "dark"){...AddCSS("Safelinksv2-dark.css");..}..else if (theme === "contrast"){...AddCSS("Safelinksv2-highcontrast.css")..}....// Add CSS based on theme..function AddCSS(fileName){... var ss = docume

Chrome Cache Entry: 67

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with CRLF line terminators
Category:	downloaded
Size (bytes):	3932
Entropy (8bit):	5.202197618496175
Encrypted:	false
SSDEEP:	96:W1nWD5QBnuxm32TPv1YyZvtcpcJcLCmzYzMz4ChX5xQFMXpSgfsHjrAwn:MmmqvWCiLfxpSgfsHjrAwn
MD5:	BBAD95C4A0BE4E5775B7D5B409FBF602
SHA1:	FAD598750B15C207DFEF6E1FEA3C072BAEAC2B66
SHA-256:	41F78D15AE18C36B84C819D9AF3511C342C180F0ABA8F91DC1CCF4046B56B308
SHA-512:	4006994F240E4DAB7134F1B716E51E4FFC0DD495EAF3269165FB0C27D89B2F19063AF17086553B39507199D62DBCD8BA6F07F34770BCAF15C40CF5EF06419631
Malicious:	false
URL:	https://gcc02.safelinks.protection.outlook.com/Content/Scripts/safelinksv2.css
Preview:	@charset "UTF-8";../* CSS Document */....body{...margin:0px;...padding:0px;..}....div{.. text-align:left;..}....#recommendation_container{...width:100%;..}....#icon img {...margin-left: 40px;...margin-top: 45px;..}....#url {height: 32px;..background-color: #f4f4f4;..margin-left: 40px;..margin-right: 40px;..margin-bottom: 20px;..margin-top: 0px;..font-family: Segoe, "Segoe UI", "DejaVu Sans", "Trebuchet MS", Verdana, "sans-serif";..display: inline-block;..}....#url p {...margin:4px 12px;..}......#close {height: 32px;..background-color: #0078d7;..margin-left: 40px;..margin-right:40px;..margin-top:20px;..padding: 4px 12px 8px 12px;..font-family: Segoe, "Segoe UI", "DejaVu Sans", "Trebuchet MS", Verdana, "sans-serif";..width: auto;..display: inline-block;..color: #fff;..border: 0;...font-size:100%;..}....#text {...margin-left:40px;...margin-right: 40px;...margin-top: 0px;...font-family: Segoe, "Segoe UI", "DejaVu Sans", "Trebuchet MS", Verdana, "sans-serif";..}....#tips {...margin-left:

Chrome Cache Entry: 68

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with CRLF line terminators
Category:	downloaded
Size (bytes):	1588
Entropy (8bit):	5.174121809218917
Encrypted:	false
SSDEEP:	48:9pZigAOvzbYdvG2AumPBqykF1KdpwGFKcjeA5mkxofP:piFVmPBq/OI9GGP
MD5:	3AF1FDB9A3F664A6683D212F4787733A
SHA1:	59063D49B723A1988236C8D39C2804C6EBC5FF95
SHA-256:	A9CE4840FF0D613B456081DEA64E46EB717A1F8BFA5AFB05D3BD058F294E416C
SHA-512:	F8872E0C875BE6037C14480630E461FC1ADFA2049DB03BAE5D8CB6B320A2C084D4B266AEB02E24009B4BA84821E216690CA875B165164447FE8329B48C9E261F
Malicious:	false
URL:	https://gcc02.safelinks.protection.outlook.com/Content/Scripts/site.js
Preview:	window.onload = function OnLoadHandler(){...if (window.history.length <= 1) {....document.getElementById("close").style.display = "none";...}..}....var theme = null;..try {.. (function (URLSearchParams, str) {.. if (!new URLSearchParams(window.location.search).get(str)){....throw URLSearchParams;...}....var urlParams = new URLSearchParams(window.location.search);....if (urlParams.has(str)){.....theme = String(urlParams.get(str));....}.. }(URLSearchParams, "theme"));..} catch(URLSearchParams){...var params = {}...var parts = window.location.search.substring(1).split('&');...for (var i = 0; i < parts.length; i++) {....var val = parts[i].split('=');....if (!val[0]) continue;....params[val[0]] = val[1] \|\| true;...}...theme = params["theme"];...}....// Load theme specific css..if (theme === "dark"){...AddCSS("Safelinksv2-dark.css");..}..else if (theme === "contrast"){...AddCSS("Safelinksv2-highcontrast.css")..}....// Add CSS based on theme..function AddCSS(fileName){... var ss = docume

Chrome Cache Entry: 69

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 186 x 200, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	25664
Entropy (8bit):	4.972505404550475
Encrypted:	false
SSDEEP:	384:OXE05KiOBf35OPGJulcJBzzdtKUmpZKfWve:E35Ki7PGJNJBZOpZKeve
MD5:	FF4FEDB556605288FEC259EE6B8D5981
SHA1:	BBC525AB65E54999044F14FF8F31CF25EEDB7754
SHA-256:	2809B6F62DC341D238F02C33C7347A7BA714F10B6F075BDD39A1CD7C68CE9807
SHA-512:	9EAE6F8D1822A1EF91B909B0D6A8826BFB323BD34FA76FBF0A2DCA99B5F580BA09173ECD2068F393979EBAE248BF5FF1FC592C5D43D5EEB33E0EC6DDE93E8349
Malicious:	false
Preview:	.PNG........IHDR............._..;....pHYs...%...%.IR$....OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

Chrome Cache Entry: 70

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 186 x 200, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	25664
Entropy (8bit):	4.972505404550475
Encrypted:	false
SSDEEP:	384:OXE05KiOBf35OPGJulcJBzzdtKUmpZKfWve:E35Ki7PGJNJBZOpZKeve
MD5:	FF4FEDB556605288FEC259EE6B8D5981
SHA1:	BBC525AB65E54999044F14FF8F31CF25EEDB7754
SHA-256:	2809B6F62DC341D238F02C33C7347A7BA714F10B6F075BDD39A1CD7C68CE9807
SHA-512:	9EAE6F8D1822A1EF91B909B0D6A8826BFB323BD34FA76FBF0A2DCA99B5F580BA09173ECD2068F393979EBAE248BF5FF1FC592C5D43D5EEB33E0EC6DDE93E8349
Malicious:	false
URL:	https://gcc02.safelinks.protection.outlook.com/Content/images/cross.png
Preview:	.PNG........IHDR............._..;....pHYs...%...%.IR$....OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

Chrome Cache Entry: 71

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (2218), with CRLF line terminators
Category:	downloaded
Size (bytes):	4344
Entropy (8bit):	5.780776502185136
Encrypted:	false
SSDEEP:	96:qE6+QqdSoK6WzVDE7b6T8QgtiHwEwpwPg2:V6XiS/zWHC8DswE+wPD
MD5:	6B9532BE437F543E5B240578AA724A9A
SHA1:	16D713FD063F97D7A8C66EBEE1AF76AFAEB68189
SHA-256:	0BBE6D52DA98BE213BBBE4BB678C9B88BDEEF6BF3572827B1DFFA639343824B8
SHA-512:	E8D455386F0CE0B447835345387A57E05EB68836A7D369EF768D04DD263ACA5D31235F3FD0C7CC80E35802AB9CC676654863378496574E156CBEC85442E09C60
Malicious:	false
URL:	https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fparrots-run-fjh.craft.me%2FkKsdDph47M82kH&data=05%7C02%7Cclubb%40audits.ga.gov%7C7868b433ade34c8449f408dcf9de2f4a%7C3ba88d1570d44b838474db703319c2a0%7C0%7C0%7C638659979887700847%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=bpVMMJuyI8Eg2vUj%2BK862VkxX6I5AHOsDuFcDZCvmRA%3D&reserved=0
Preview:	<!doctype html>..<html>..<head>.. <meta charset="UTF-8">.. <title>Microsoft Defender for Office 365</title>.. <meta name="referrer" content="same-origin" />.. <meta name="robots" content="noindex,nofollow" />.. <link rel="icon" href="data:,">.... <base href="https://gcc02.safelinks.protection.outlook.com">.... <link href="/Content/Scripts/safelinksv2.css" rel="stylesheet" />.. <script src="/Content/Scripts/site.js" type="text/javascript"></script>..</head>..<body>.. <div id="header_container_blocked">.. <div id="header">.. <div id="icon"><img src="/Content/images/cross.png" alt="" height="100" width="94"></div>.. <h1>.. This website is classified as malicious... </h1>.. </div>.. </div>.. <div id="recommendation_container">.. <div id="recommendation">.. <h2>Opening this website might not be safe.</h2>.. <div id="url">.. <p>.. <

Static File Info

General

File type:	CDFV2 Microsoft Outlook Message
Entropy (8bit):	5.071454374816
TrID:	Outlook Message (71009/1) 58.92% Outlook Form Template (41509/1) 34.44% Generic OLE2 / Multistream Compound File (8008/1) 6.64%
File name:	DOCUMENTS.msg
File size:	164'864 bytes
MD5:	05e0c0f362769520ddb637a58e1c7ff8
SHA1:	b22ab6ac565334cd876708fc1e7211a7adc4fbbf
SHA256:	65e776a8081d4b94dab31accae8653f722310495fc6e5e3a254b82d1e4652094
SHA512:	f149d0606c4da7ada723c3668a877d9f22c06b66b3b8e525d1ce7e31716b8e532344c442c5eac4365ee67d08581f0cec47faa57e974891e93d9043d5e56f6ca4
SSDEEP:	3072:hxj1NlBIIQp/cbrBvlrTeqdiOibj960jEnaZZmQv/T5jk7IVXsVM4H:hLBIIQRyJqs0ZmYQIVGb
TLSH:	78F3752139FA121AF273AF754BE25097893AFD636E15D95F2141330E0672A41DCA2F3B
File Content Preview:	........................>......................................................................................................................................................................................................................................

Static Mail

General

Subject:	DOCUMENTS
From:	Dan Chan <dchan@GFC.STATE.GA.US>
To:	Undisclosed recipients:;
Cc:
BCC:
Date:	Thu, 31 Oct 2024 19:59:42 +0100
Communications:	CAUTION: This email originated from outside of the organization. Do not click links or open attachments unless you recognize the sender and know the content is safe. Dan Chan has shared a PDF Document with you. View PDF <https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fparrots-run-fjh.craft.me%2FkKsdDph47M82kH&data=05%7C02%7Cclubb%40audits.ga.gov%7C7868b433ade34c8449f408dcf9de2f4a%7C3ba88d1570d44b838474db703319c2a0%7C0%7C0%7C638659979887700847%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=bpVMMJuyI8Eg2vUj%2BK862VkxX6I5AHOsDuFcDZCvmRA%3D&reserved=0> This file has been shared successfully. Thanks. <https://gcc02.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.gatrees.org%2F&data=05%7C02%7Cclubb%40audits.ga.gov%7C7868b433ade34c8449f408dcf9de2f4a%7C3ba88d1570d44b838474db703319c2a0%7C0%7C0%7C638659979887727314%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=aibYWBmKUyDWWay4L9G8AHLY%2FB89cEJSEXRwG8Mq8Ow%3D&reserved=0> Dan Chan IT Programmer/Meteorologist Georgia Forestry Commission 478-342-0150 dchan@gfc.state.ga.us <mailto:dchan@gfc.state.ga.us> 6835 James B Rivers Drive, Stone Mountain, GA 30083 www.gatrees.org <https://gcc02.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.gatrees.org%2F&data=05%7C02%7Cclubb%40audits.ga.gov%7C7868b433ade34c8449f408dcf9de2f4a%7C3ba88d1570d44b838474db703319c2a0%7C0%7C0%7C638659979887743724%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=mG%2FD0sr7iQF%2Feadox4bIHIAXN9QDje%2BxXCOTNiG2CrA%3D&reserved=0>
Attachments:	image001.png

Headers

Key	Value
Received	from SA1PR09MB7519.namprd09.prod.outlook.com
(2603	10b6:930:d4::12) with Microsoft SMTP Server (version=TLS1_2,
HTTPS; Thu, 31 Oct 2024 18	59:48 +0000
ARC-Seal	i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none;
ARC-Message-Signature	i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;
h=From	Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;
ARC-Authentication-Results	i=1; mx.microsoft.com 1; spf=pass
by PH0PR09MB11743.namprd09.prod.outlook.com (2603	10b6:510:2c1::20) with
2024 18	59:43 +0000
Transport; Thu, 31 Oct 2024 18	59:45 +0000
Authentication-Results	spf=pass (sender IP is 40.107.199.21)
Received-SPF	Pass (protection.outlook.com: domain of GFC.STATE.GA.US
15.20.8114.16 via Frontend Transport; Thu, 31 Oct 2024 18	59:44 +0000
DKIM-Signature	v=1; a=rsa-sha256; c=relaxed/relaxed;
by PH8PR09MB10112.namprd09.prod.outlook.com (2603	10b6:510:18c::6) with
([fe80	:8957:8481:9861:687f%6]) with mapi id 15.20.8114.020; Thu, 31 Oct 2024
18	59:43 +0000
From	Dan Chan <dchan@GFC.STATE.GA.US>
Subject	DOCUMENTS
Thread-Topic	DOCUMENTS
Thread-Index	AdsrxvWTCN2DwbElToyxpbVDPXi9Qw==
Date	Thu, 31 Oct 2024 18:59:42 +0000
Message-ID	<SA1PR09MB751939354CD5BB2B16DFE888A1552@SA1PR09MB7519.namprd09.prod.outlook.com>
Accept-Language	en-US
Content-Language	en-US
X-MS-Has-Attach	yes
X-MS-TNEF-Correlator	Authentication-Results-Original: dkim=none (message not signed)
x-ms-traffictypediagnostic	SA1PR09MB7519:EE_\|PH8PR09MB10112:EE_\|DS4PEPF00000170:EE_\|PH0PR09MB11743:EE_\|DS0PR09MB11169:EE_
X-MS-Office365-Filtering-Correlation-Id	7868b433-ade3-4c84-49f4-08dcf9de2f4a
x-ms-exchange-senderadcheck	1
x-ms-exchange-antispam-relay	0
X-Microsoft-Antispam-Untrusted	BCL:0;ARA:13230040\|366016\|41320700013\|1800799024\|7416014\|8096899003\|38070700018\|105050200037;
X-Microsoft-Antispam-Message-Info-Original	=?us-ascii?Q?GBjLbnyGNv3GPtIvh8Zn1KshamgfWZ1V5weJbYIFc+LVEsH/b8+Q71O8N5pK?=
X-Forefront-Antispam-Report-Untrusted	CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:SA1PR09MB7519.namprd09.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(366016)(41320700013)(1800799024)(7416014)(8096899003)(38070700018)(105050200037);DIR:OUT;SFP:1101;
X-MS-Exchange-AntiSpam-MessageData-Original-ChunkCount	1
X-MS-Exchange-AntiSpam-MessageData-Original-0	=?us-ascii?Q?RPVyV17R3OlV5/tkUJSUXkHVGT2XbviFJktgG2uI2n3fFzLPBSaBMN399Qrf?=
Content-Type	multipart/related;
MIME-Version	1.0
X-MS-Exchange-Transport-CrossTenantHeadersStamped	PH0PR09MB11743
To	Undisclosed recipients:;
Return-Path	dchan@GFC.STATE.GA.US
X-MS-Exchange-Organization-ExpirationStartTime	31 Oct 2024 18:59:45.1221
X-MS-Exchange-Organization-ExpirationStartTimeReason	OriginalSubmit
X-MS-Exchange-Organization-ExpirationInterval	1:00:00:00.0000000
X-MS-Exchange-Organization-ExpirationIntervalReason	OriginalSubmit
X-MS-Exchange-Organization-Network-Message-Id	7868b433-ade3-4c84-49f4-08dcf9de2f4a
X-EOPAttributedMessage	0
X-EOPTenantAttributedMessage	3ba88d15-70d4-4b83-8474-db703319c2a0:0
X-MS-Exchange-Organization-MessageDirectionality	Incoming
X-MS-Exchange-Transport-CrossTenantHeadersStripped	DS4PEPF00000170.namprd09.prod.outlook.com
X-MS-Exchange-Transport-CrossTenantHeadersPromoted	DS4PEPF00000170.namprd09.prod.outlook.com
X-MS-PublicTrafficType	Email
X-MS-Exchange-Organization-AuthSource	DS4PEPF00000170.namprd09.prod.outlook.com
X-MS-Exchange-Organization-AuthAs	Anonymous
X-MS-Office365-Filtering-Correlation-Id-Prvs	9ff75a89-022c-4663-526f-08dcf9de2dea
X-MS-Exchange-AtpMessageProperties	SA\|SL
X-MS-Exchange-Organization-SCL	1
X-Microsoft-Antispam	BCL:0;ARA:13230040\|35042699022\|8096899003\|4076899003\|105050200037;
X-Forefront-Antispam-Report	CIP:40.107.199.21;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:CH1PR09CU001.outbound.protection.outlook.com;PTR:mail-northcentralusazon11011021.outbound.protection.outlook.com;CAT:NONE;SFS:(13230040)(35042699022)(8096899003)(4076899003)(105050200037);DIR:INB;
X-MS-Exchange-CrossTenant-OriginalArrivalTime	31 Oct 2024 18:59:44.9659
X-MS-Exchange-CrossTenant-Network-Message-Id	7868b433-ade3-4c84-49f4-08dcf9de2f4a
X-MS-Exchange-CrossTenant-Id	3ba88d15-70d4-4b83-8474-db703319c2a0
X-MS-Exchange-CrossTenant-AuthSource	DS4PEPF00000170.namprd09.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs	Anonymous
X-MS-Exchange-CrossTenant-FromEntityHeader	Internet
X-MS-Exchange-Transport-EndToEndLatency	00:00:03.6345411
X-MS-Exchange-Processed-By-BccFoldering	15.20.8114.015
X-Microsoft-Antispam-Mailbox-Delivery	ucf:0;jmr:0;auth:0;dest:I;ENG:(910001)(944506478)(944626604)(920097)(930097)(140003)(1420198);
X-Microsoft-Antispam-Message-Info	=?us-ascii?Q?Rold46DcUVDoacyYHchAqyEm6fyYvTn6HFaGGkY36w03ScJpaPX/alUS76al?=
date	Thu, 31 Oct 2024 19:59:42 +0100

File Icon


Icon Hash:	c4e1928eacb280a2

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-31T20:42:17.892643+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	172.202.163.200	443	192.168.2.16	49707	TCP
2024-10-31T20:42:56.005995+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	172.202.163.200	443	192.168.2.16	49725	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 31, 2024 20:42:10.603019953 CET	49673	443	192.168.2.16	204.79.197.203
Oct 31, 2024 20:42:10.905735016 CET	49673	443	192.168.2.16	204.79.197.203
Oct 31, 2024 20:42:11.513731956 CET	49673	443	192.168.2.16	204.79.197.203
Oct 31, 2024 20:42:12.718750000 CET	49673	443	192.168.2.16	204.79.197.203
Oct 31, 2024 20:42:13.072921038 CET	49698	443	192.168.2.16	20.190.160.20
Oct 31, 2024 20:42:13.073029041 CET	49698	443	192.168.2.16	20.190.160.20
Oct 31, 2024 20:42:13.077869892 CET	443	49698	20.190.160.20	192.168.2.16
Oct 31, 2024 20:42:13.077886105 CET	443	49698	20.190.160.20	192.168.2.16
Oct 31, 2024 20:42:13.077923059 CET	443	49698	20.190.160.20	192.168.2.16
Oct 31, 2024 20:42:13.077943087 CET	443	49698	20.190.160.20	192.168.2.16
Oct 31, 2024 20:42:13.078664064 CET	443	49698	20.190.160.20	192.168.2.16
Oct 31, 2024 20:42:13.471525908 CET	443	49698	20.190.160.20	192.168.2.16
Oct 31, 2024 20:42:13.471539974 CET	443	49698	20.190.160.20	192.168.2.16
Oct 31, 2024 20:42:13.471549988 CET	443	49698	20.190.160.20	192.168.2.16
Oct 31, 2024 20:42:13.471678972 CET	49698	443	192.168.2.16	20.190.160.20
Oct 31, 2024 20:42:13.471894979 CET	443	49698	20.190.160.20	192.168.2.16
Oct 31, 2024 20:42:13.471905947 CET	443	49698	20.190.160.20	192.168.2.16
Oct 31, 2024 20:42:13.471915960 CET	443	49698	20.190.160.20	192.168.2.16
Oct 31, 2024 20:42:13.471925020 CET	443	49698	20.190.160.20	192.168.2.16
Oct 31, 2024 20:42:13.471952915 CET	443	49698	20.190.160.20	192.168.2.16
Oct 31, 2024 20:42:13.471977949 CET	49698	443	192.168.2.16	20.190.160.20
Oct 31, 2024 20:42:13.471977949 CET	49698	443	192.168.2.16	20.190.160.20
Oct 31, 2024 20:42:13.472019911 CET	49698	443	192.168.2.16	20.190.160.20
Oct 31, 2024 20:42:13.472527027 CET	443	49698	20.190.160.20	192.168.2.16
Oct 31, 2024 20:42:13.472537994 CET	443	49698	20.190.160.20	192.168.2.16
Oct 31, 2024 20:42:13.472589016 CET	49698	443	192.168.2.16	20.190.160.20
Oct 31, 2024 20:42:14.093633890 CET	49689	80	192.168.2.16	192.229.211.108
Oct 31, 2024 20:42:15.131735086 CET	49673	443	192.168.2.16	204.79.197.203
Oct 31, 2024 20:42:16.779186964 CET	49707	443	192.168.2.16	172.202.163.200
Oct 31, 2024 20:42:16.779217005 CET	443	49707	172.202.163.200	192.168.2.16
Oct 31, 2024 20:42:16.779278040 CET	49707	443	192.168.2.16	172.202.163.200
Oct 31, 2024 20:42:16.780978918 CET	49707	443	192.168.2.16	172.202.163.200
Oct 31, 2024 20:42:16.780991077 CET	443	49707	172.202.163.200	192.168.2.16
Oct 31, 2024 20:42:16.876777887 CET	49708	443	192.168.2.16	184.28.90.27
Oct 31, 2024 20:42:16.876828909 CET	443	49708	184.28.90.27	192.168.2.16
Oct 31, 2024 20:42:16.876905918 CET	49708	443	192.168.2.16	184.28.90.27
Oct 31, 2024 20:42:16.877728939 CET	49708	443	192.168.2.16	184.28.90.27
Oct 31, 2024 20:42:16.877753019 CET	443	49708	184.28.90.27	192.168.2.16
Oct 31, 2024 20:42:17.548911095 CET	443	49707	172.202.163.200	192.168.2.16
Oct 31, 2024 20:42:17.549079895 CET	49707	443	192.168.2.16	172.202.163.200
Oct 31, 2024 20:42:17.550452948 CET	49707	443	192.168.2.16	172.202.163.200
Oct 31, 2024 20:42:17.550463915 CET	443	49707	172.202.163.200	192.168.2.16
Oct 31, 2024 20:42:17.550873041 CET	443	49707	172.202.163.200	192.168.2.16
Oct 31, 2024 20:42:17.601752043 CET	49707	443	192.168.2.16	172.202.163.200
Oct 31, 2024 20:42:17.640804052 CET	49707	443	192.168.2.16	172.202.163.200
Oct 31, 2024 20:42:17.687330961 CET	443	49707	172.202.163.200	192.168.2.16
Oct 31, 2024 20:42:17.748079062 CET	443	49708	184.28.90.27	192.168.2.16
Oct 31, 2024 20:42:17.748210907 CET	49708	443	192.168.2.16	184.28.90.27
Oct 31, 2024 20:42:17.752424002 CET	49708	443	192.168.2.16	184.28.90.27
Oct 31, 2024 20:42:17.752439022 CET	443	49708	184.28.90.27	192.168.2.16
Oct 31, 2024 20:42:17.752890110 CET	443	49708	184.28.90.27	192.168.2.16
Oct 31, 2024 20:42:17.793754101 CET	49708	443	192.168.2.16	184.28.90.27
Oct 31, 2024 20:42:17.891441107 CET	443	49707	172.202.163.200	192.168.2.16
Oct 31, 2024 20:42:17.891496897 CET	443	49707	172.202.163.200	192.168.2.16
Oct 31, 2024 20:42:17.891506910 CET	443	49707	172.202.163.200	192.168.2.16
Oct 31, 2024 20:42:17.891524076 CET	443	49707	172.202.163.200	192.168.2.16
Oct 31, 2024 20:42:17.891550064 CET	443	49707	172.202.163.200	192.168.2.16
Oct 31, 2024 20:42:17.891576052 CET	49707	443	192.168.2.16	172.202.163.200
Oct 31, 2024 20:42:17.891591072 CET	443	49707	172.202.163.200	192.168.2.16
Oct 31, 2024 20:42:17.891618013 CET	49707	443	192.168.2.16	172.202.163.200
Oct 31, 2024 20:42:17.891896009 CET	49707	443	192.168.2.16	172.202.163.200
Oct 31, 2024 20:42:17.892407894 CET	443	49707	172.202.163.200	192.168.2.16
Oct 31, 2024 20:42:17.892522097 CET	443	49707	172.202.163.200	192.168.2.16
Oct 31, 2024 20:42:17.892548084 CET	49707	443	192.168.2.16	172.202.163.200
Oct 31, 2024 20:42:17.896250010 CET	49707	443	192.168.2.16	172.202.163.200
Oct 31, 2024 20:42:17.940751076 CET	49707	443	192.168.2.16	172.202.163.200
Oct 31, 2024 20:42:17.940779924 CET	443	49707	172.202.163.200	192.168.2.16
Oct 31, 2024 20:42:17.940804958 CET	49707	443	192.168.2.16	172.202.163.200
Oct 31, 2024 20:42:17.940812111 CET	443	49707	172.202.163.200	192.168.2.16
Oct 31, 2024 20:42:17.943042994 CET	49708	443	192.168.2.16	184.28.90.27
Oct 31, 2024 20:42:17.987332106 CET	443	49708	184.28.90.27	192.168.2.16
Oct 31, 2024 20:42:18.192646980 CET	443	49708	184.28.90.27	192.168.2.16
Oct 31, 2024 20:42:18.192733049 CET	443	49708	184.28.90.27	192.168.2.16
Oct 31, 2024 20:42:18.192810059 CET	49708	443	192.168.2.16	184.28.90.27
Oct 31, 2024 20:42:18.222604036 CET	49708	443	192.168.2.16	184.28.90.27
Oct 31, 2024 20:42:18.222634077 CET	443	49708	184.28.90.27	192.168.2.16
Oct 31, 2024 20:42:18.222649097 CET	49708	443	192.168.2.16	184.28.90.27
Oct 31, 2024 20:42:18.222656965 CET	443	49708	184.28.90.27	192.168.2.16
Oct 31, 2024 20:42:18.488212109 CET	49710	443	192.168.2.16	104.47.65.28
Oct 31, 2024 20:42:18.488307953 CET	443	49710	104.47.65.28	192.168.2.16
Oct 31, 2024 20:42:18.488384962 CET	49710	443	192.168.2.16	104.47.65.28
Oct 31, 2024 20:42:18.544606924 CET	49710	443	192.168.2.16	104.47.65.28
Oct 31, 2024 20:42:18.544650078 CET	443	49710	104.47.65.28	192.168.2.16
Oct 31, 2024 20:42:18.617008924 CET	49714	443	192.168.2.16	184.28.90.27
Oct 31, 2024 20:42:18.617050886 CET	443	49714	184.28.90.27	192.168.2.16
Oct 31, 2024 20:42:18.617125034 CET	49714	443	192.168.2.16	184.28.90.27
Oct 31, 2024 20:42:18.617465973 CET	49714	443	192.168.2.16	184.28.90.27
Oct 31, 2024 20:42:18.617475033 CET	443	49714	184.28.90.27	192.168.2.16
Oct 31, 2024 20:42:18.777158976 CET	49678	443	192.168.2.16	20.189.173.10
Oct 31, 2024 20:42:19.079807997 CET	49678	443	192.168.2.16	20.189.173.10
Oct 31, 2024 20:42:19.378453016 CET	443	49710	104.47.65.28	192.168.2.16
Oct 31, 2024 20:42:19.378848076 CET	49710	443	192.168.2.16	104.47.65.28
Oct 31, 2024 20:42:19.378912926 CET	443	49710	104.47.65.28	192.168.2.16
Oct 31, 2024 20:42:19.380084991 CET	443	49710	104.47.65.28	192.168.2.16
Oct 31, 2024 20:42:19.380167961 CET	49710	443	192.168.2.16	104.47.65.28
Oct 31, 2024 20:42:19.382482052 CET	49710	443	192.168.2.16	104.47.65.28
Oct 31, 2024 20:42:19.382560968 CET	443	49710	104.47.65.28	192.168.2.16
Oct 31, 2024 20:42:19.382992029 CET	49710	443	192.168.2.16	104.47.65.28
Oct 31, 2024 20:42:19.383011103 CET	443	49710	104.47.65.28	192.168.2.16
Oct 31, 2024 20:42:19.427762985 CET	49710	443	192.168.2.16	104.47.65.28
Oct 31, 2024 20:42:19.490928888 CET	443	49714	184.28.90.27	192.168.2.16
Oct 31, 2024 20:42:19.491023064 CET	49714	443	192.168.2.16	184.28.90.27
Oct 31, 2024 20:42:19.493751049 CET	49714	443	192.168.2.16	184.28.90.27
Oct 31, 2024 20:42:19.493762016 CET	443	49714	184.28.90.27	192.168.2.16
Oct 31, 2024 20:42:19.494013071 CET	443	49714	184.28.90.27	192.168.2.16
Oct 31, 2024 20:42:19.495445013 CET	49714	443	192.168.2.16	184.28.90.27
Oct 31, 2024 20:42:19.539338112 CET	443	49714	184.28.90.27	192.168.2.16
Oct 31, 2024 20:42:19.681788921 CET	49678	443	192.168.2.16	20.189.173.10
Oct 31, 2024 20:42:19.755954027 CET	443	49714	184.28.90.27	192.168.2.16
Oct 31, 2024 20:42:19.756017923 CET	443	49714	184.28.90.27	192.168.2.16
Oct 31, 2024 20:42:19.756081104 CET	49714	443	192.168.2.16	184.28.90.27
Oct 31, 2024 20:42:19.756746054 CET	49714	443	192.168.2.16	184.28.90.27
Oct 31, 2024 20:42:19.756746054 CET	49714	443	192.168.2.16	184.28.90.27
Oct 31, 2024 20:42:19.756767988 CET	443	49714	184.28.90.27	192.168.2.16
Oct 31, 2024 20:42:19.756778002 CET	443	49714	184.28.90.27	192.168.2.16
Oct 31, 2024 20:42:19.770490885 CET	443	49710	104.47.65.28	192.168.2.16
Oct 31, 2024 20:42:19.770512104 CET	443	49710	104.47.65.28	192.168.2.16
Oct 31, 2024 20:42:19.770585060 CET	49710	443	192.168.2.16	104.47.65.28
Oct 31, 2024 20:42:19.770647049 CET	443	49710	104.47.65.28	192.168.2.16
Oct 31, 2024 20:42:19.770706892 CET	49710	443	192.168.2.16	104.47.65.28
Oct 31, 2024 20:42:19.771256924 CET	49710	443	192.168.2.16	104.47.65.28
Oct 31, 2024 20:42:19.771301031 CET	443	49710	104.47.65.28	192.168.2.16
Oct 31, 2024 20:42:19.771389008 CET	49710	443	192.168.2.16	104.47.65.28
Oct 31, 2024 20:42:19.772296906 CET	49715	443	192.168.2.16	104.47.64.28
Oct 31, 2024 20:42:19.772325993 CET	443	49715	104.47.64.28	192.168.2.16
Oct 31, 2024 20:42:19.772380114 CET	49715	443	192.168.2.16	104.47.64.28
Oct 31, 2024 20:42:19.772659063 CET	49715	443	192.168.2.16	104.47.64.28
Oct 31, 2024 20:42:19.772679090 CET	443	49715	104.47.64.28	192.168.2.16
Oct 31, 2024 20:42:19.784760952 CET	49716	443	192.168.2.16	104.47.64.28
Oct 31, 2024 20:42:19.784799099 CET	443	49716	104.47.64.28	192.168.2.16
Oct 31, 2024 20:42:19.784904957 CET	49716	443	192.168.2.16	104.47.64.28
Oct 31, 2024 20:42:19.785041094 CET	49717	443	192.168.2.16	104.47.64.28
Oct 31, 2024 20:42:19.785070896 CET	443	49717	104.47.64.28	192.168.2.16
Oct 31, 2024 20:42:19.785131931 CET	49717	443	192.168.2.16	104.47.64.28
Oct 31, 2024 20:42:19.785263062 CET	49716	443	192.168.2.16	104.47.64.28
Oct 31, 2024 20:42:19.785278082 CET	443	49716	104.47.64.28	192.168.2.16
Oct 31, 2024 20:42:19.785439968 CET	49717	443	192.168.2.16	104.47.64.28
Oct 31, 2024 20:42:19.785454035 CET	443	49717	104.47.64.28	192.168.2.16
Oct 31, 2024 20:42:19.937778950 CET	49673	443	192.168.2.16	204.79.197.203
Oct 31, 2024 20:42:20.641299009 CET	443	49717	104.47.64.28	192.168.2.16
Oct 31, 2024 20:42:20.641622066 CET	49717	443	192.168.2.16	104.47.64.28
Oct 31, 2024 20:42:20.641640902 CET	443	49717	104.47.64.28	192.168.2.16
Oct 31, 2024 20:42:20.643110991 CET	443	49717	104.47.64.28	192.168.2.16
Oct 31, 2024 20:42:20.643202066 CET	49717	443	192.168.2.16	104.47.64.28
Oct 31, 2024 20:42:20.643734932 CET	49717	443	192.168.2.16	104.47.64.28
Oct 31, 2024 20:42:20.643811941 CET	443	49717	104.47.64.28	192.168.2.16
Oct 31, 2024 20:42:20.643930912 CET	49717	443	192.168.2.16	104.47.64.28
Oct 31, 2024 20:42:20.643951893 CET	443	49717	104.47.64.28	192.168.2.16
Oct 31, 2024 20:42:20.645785093 CET	443	49716	104.47.64.28	192.168.2.16
Oct 31, 2024 20:42:20.646074057 CET	49716	443	192.168.2.16	104.47.64.28
Oct 31, 2024 20:42:20.646095991 CET	443	49716	104.47.64.28	192.168.2.16
Oct 31, 2024 20:42:20.646471977 CET	443	49716	104.47.64.28	192.168.2.16
Oct 31, 2024 20:42:20.646840096 CET	49716	443	192.168.2.16	104.47.64.28
Oct 31, 2024 20:42:20.646915913 CET	443	49716	104.47.64.28	192.168.2.16
Oct 31, 2024 20:42:20.646975994 CET	49716	443	192.168.2.16	104.47.64.28
Oct 31, 2024 20:42:20.667754889 CET	443	49715	104.47.64.28	192.168.2.16
Oct 31, 2024 20:42:20.667974949 CET	49715	443	192.168.2.16	104.47.64.28
Oct 31, 2024 20:42:20.667988062 CET	443	49715	104.47.64.28	192.168.2.16
Oct 31, 2024 20:42:20.669059038 CET	443	49715	104.47.64.28	192.168.2.16
Oct 31, 2024 20:42:20.669136047 CET	49715	443	192.168.2.16	104.47.64.28
Oct 31, 2024 20:42:20.669429064 CET	49715	443	192.168.2.16	104.47.64.28
Oct 31, 2024 20:42:20.669496059 CET	443	49715	104.47.64.28	192.168.2.16
Oct 31, 2024 20:42:20.669684887 CET	49715	443	192.168.2.16	104.47.64.28
Oct 31, 2024 20:42:20.669701099 CET	443	49715	104.47.64.28	192.168.2.16
Oct 31, 2024 20:42:20.684820890 CET	49717	443	192.168.2.16	104.47.64.28
Oct 31, 2024 20:42:20.687339067 CET	443	49716	104.47.64.28	192.168.2.16
Oct 31, 2024 20:42:20.700800896 CET	49716	443	192.168.2.16	104.47.64.28
Oct 31, 2024 20:42:20.716779947 CET	49715	443	192.168.2.16	104.47.64.28
Oct 31, 2024 20:42:20.816839933 CET	443	49716	104.47.64.28	192.168.2.16
Oct 31, 2024 20:42:20.816864967 CET	443	49716	104.47.64.28	192.168.2.16
Oct 31, 2024 20:42:20.816917896 CET	49716	443	192.168.2.16	104.47.64.28
Oct 31, 2024 20:42:20.816937923 CET	443	49716	104.47.64.28	192.168.2.16
Oct 31, 2024 20:42:20.816981077 CET	49716	443	192.168.2.16	104.47.64.28
Oct 31, 2024 20:42:20.818031073 CET	49716	443	192.168.2.16	104.47.64.28
Oct 31, 2024 20:42:20.818070889 CET	443	49716	104.47.64.28	192.168.2.16
Oct 31, 2024 20:42:20.818130016 CET	49716	443	192.168.2.16	104.47.64.28
Oct 31, 2024 20:42:20.826623917 CET	49719	443	192.168.2.16	104.47.64.28
Oct 31, 2024 20:42:20.826662064 CET	443	49719	104.47.64.28	192.168.2.16
Oct 31, 2024 20:42:20.826720953 CET	49719	443	192.168.2.16	104.47.64.28
Oct 31, 2024 20:42:20.826965094 CET	49719	443	192.168.2.16	104.47.64.28
Oct 31, 2024 20:42:20.826976061 CET	443	49719	104.47.64.28	192.168.2.16
Oct 31, 2024 20:42:20.840769053 CET	443	49715	104.47.64.28	192.168.2.16
Oct 31, 2024 20:42:20.840790987 CET	443	49715	104.47.64.28	192.168.2.16
Oct 31, 2024 20:42:20.840861082 CET	49715	443	192.168.2.16	104.47.64.28
Oct 31, 2024 20:42:20.840873003 CET	443	49715	104.47.64.28	192.168.2.16
Oct 31, 2024 20:42:20.841520071 CET	49715	443	192.168.2.16	104.47.64.28
Oct 31, 2024 20:42:20.841550112 CET	443	49715	104.47.64.28	192.168.2.16
Oct 31, 2024 20:42:20.841672897 CET	49715	443	192.168.2.16	104.47.64.28
Oct 31, 2024 20:42:20.877533913 CET	49720	443	192.168.2.16	104.47.65.28
Oct 31, 2024 20:42:20.877587080 CET	443	49720	104.47.65.28	192.168.2.16
Oct 31, 2024 20:42:20.877666950 CET	49720	443	192.168.2.16	104.47.65.28
Oct 31, 2024 20:42:20.877906084 CET	49720	443	192.168.2.16	104.47.65.28
Oct 31, 2024 20:42:20.877934933 CET	443	49720	104.47.65.28	192.168.2.16
Oct 31, 2024 20:42:20.891787052 CET	49678	443	192.168.2.16	20.189.173.10
Oct 31, 2024 20:42:21.360291004 CET	443	49717	104.47.64.28	192.168.2.16
Oct 31, 2024 20:42:21.360341072 CET	443	49717	104.47.64.28	192.168.2.16
Oct 31, 2024 20:42:21.360409975 CET	49717	443	192.168.2.16	104.47.64.28
Oct 31, 2024 20:42:21.360423088 CET	443	49717	104.47.64.28	192.168.2.16
Oct 31, 2024 20:42:21.360481977 CET	49717	443	192.168.2.16	104.47.64.28
Oct 31, 2024 20:42:21.360487938 CET	443	49717	104.47.64.28	192.168.2.16
Oct 31, 2024 20:42:21.360564947 CET	443	49717	104.47.64.28	192.168.2.16
Oct 31, 2024 20:42:21.360627890 CET	49717	443	192.168.2.16	104.47.64.28
Oct 31, 2024 20:42:21.361260891 CET	49717	443	192.168.2.16	104.47.64.28
Oct 31, 2024 20:42:21.361279964 CET	443	49717	104.47.64.28	192.168.2.16
Oct 31, 2024 20:42:21.670288086 CET	443	49719	104.47.64.28	192.168.2.16
Oct 31, 2024 20:42:21.670571089 CET	49719	443	192.168.2.16	104.47.64.28
Oct 31, 2024 20:42:21.670584917 CET	443	49719	104.47.64.28	192.168.2.16
Oct 31, 2024 20:42:21.671720028 CET	443	49719	104.47.64.28	192.168.2.16
Oct 31, 2024 20:42:21.671783924 CET	49719	443	192.168.2.16	104.47.64.28
Oct 31, 2024 20:42:21.672090054 CET	49719	443	192.168.2.16	104.47.64.28
Oct 31, 2024 20:42:21.672148943 CET	443	49719	104.47.64.28	192.168.2.16
Oct 31, 2024 20:42:21.672223091 CET	49719	443	192.168.2.16	104.47.64.28
Oct 31, 2024 20:42:21.672240973 CET	443	49719	104.47.64.28	192.168.2.16
Oct 31, 2024 20:42:21.717776060 CET	49719	443	192.168.2.16	104.47.64.28
Oct 31, 2024 20:42:21.722832918 CET	443	49720	104.47.65.28	192.168.2.16
Oct 31, 2024 20:42:21.723026037 CET	49720	443	192.168.2.16	104.47.65.28
Oct 31, 2024 20:42:21.723050117 CET	443	49720	104.47.65.28	192.168.2.16
Oct 31, 2024 20:42:21.724090099 CET	443	49720	104.47.65.28	192.168.2.16
Oct 31, 2024 20:42:21.724143028 CET	49720	443	192.168.2.16	104.47.65.28
Oct 31, 2024 20:42:21.724400043 CET	49720	443	192.168.2.16	104.47.65.28
Oct 31, 2024 20:42:21.724461079 CET	443	49720	104.47.65.28	192.168.2.16
Oct 31, 2024 20:42:21.724502087 CET	49720	443	192.168.2.16	104.47.65.28
Oct 31, 2024 20:42:21.764786005 CET	49720	443	192.168.2.16	104.47.65.28
Oct 31, 2024 20:42:21.764803886 CET	443	49720	104.47.65.28	192.168.2.16
Oct 31, 2024 20:42:21.812782049 CET	49720	443	192.168.2.16	104.47.65.28
Oct 31, 2024 20:42:21.882818937 CET	443	49720	104.47.65.28	192.168.2.16
Oct 31, 2024 20:42:21.882839918 CET	443	49720	104.47.65.28	192.168.2.16
Oct 31, 2024 20:42:21.882910967 CET	49720	443	192.168.2.16	104.47.65.28
Oct 31, 2024 20:42:21.882925034 CET	443	49720	104.47.65.28	192.168.2.16
Oct 31, 2024 20:42:21.883865118 CET	49720	443	192.168.2.16	104.47.65.28
Oct 31, 2024 20:42:21.883909941 CET	443	49720	104.47.65.28	192.168.2.16
Oct 31, 2024 20:42:21.884061098 CET	443	49720	104.47.65.28	192.168.2.16
Oct 31, 2024 20:42:21.884113073 CET	49720	443	192.168.2.16	104.47.65.28
Oct 31, 2024 20:42:21.884128094 CET	49720	443	192.168.2.16	104.47.65.28
Oct 31, 2024 20:42:21.984220028 CET	443	49719	104.47.64.28	192.168.2.16
Oct 31, 2024 20:42:21.984240055 CET	443	49719	104.47.64.28	192.168.2.16
Oct 31, 2024 20:42:21.984249115 CET	443	49719	104.47.64.28	192.168.2.16
Oct 31, 2024 20:42:21.984261990 CET	443	49719	104.47.64.28	192.168.2.16
Oct 31, 2024 20:42:21.984292984 CET	443	49719	104.47.64.28	192.168.2.16
Oct 31, 2024 20:42:21.984347105 CET	49719	443	192.168.2.16	104.47.64.28
Oct 31, 2024 20:42:21.984365940 CET	443	49719	104.47.64.28	192.168.2.16
Oct 31, 2024 20:42:21.984409094 CET	49719	443	192.168.2.16	104.47.64.28
Oct 31, 2024 20:42:21.984409094 CET	49719	443	192.168.2.16	104.47.64.28
Oct 31, 2024 20:42:21.985663891 CET	443	49719	104.47.64.28	192.168.2.16
Oct 31, 2024 20:42:21.985697031 CET	443	49719	104.47.64.28	192.168.2.16
Oct 31, 2024 20:42:21.985773087 CET	49719	443	192.168.2.16	104.47.64.28
Oct 31, 2024 20:42:21.985785007 CET	443	49719	104.47.64.28	192.168.2.16
Oct 31, 2024 20:42:21.985882998 CET	49719	443	192.168.2.16	104.47.64.28
Oct 31, 2024 20:42:21.986057043 CET	49719	443	192.168.2.16	104.47.64.28
Oct 31, 2024 20:42:21.986088037 CET	443	49719	104.47.64.28	192.168.2.16
Oct 31, 2024 20:42:21.986197948 CET	49719	443	192.168.2.16	104.47.64.28
Oct 31, 2024 20:42:21.992830038 CET	49721	443	192.168.2.16	104.47.65.28
Oct 31, 2024 20:42:21.992861032 CET	443	49721	104.47.65.28	192.168.2.16
Oct 31, 2024 20:42:21.992969990 CET	49721	443	192.168.2.16	104.47.65.28
Oct 31, 2024 20:42:21.993314981 CET	49721	443	192.168.2.16	104.47.65.28
Oct 31, 2024 20:42:21.993326902 CET	443	49721	104.47.65.28	192.168.2.16
Oct 31, 2024 20:42:22.832334995 CET	443	49721	104.47.65.28	192.168.2.16
Oct 31, 2024 20:42:22.837990046 CET	49721	443	192.168.2.16	104.47.65.28
Oct 31, 2024 20:42:22.838009119 CET	443	49721	104.47.65.28	192.168.2.16
Oct 31, 2024 20:42:22.839133024 CET	443	49721	104.47.65.28	192.168.2.16
Oct 31, 2024 20:42:22.839198112 CET	49721	443	192.168.2.16	104.47.65.28
Oct 31, 2024 20:42:22.842005968 CET	49721	443	192.168.2.16	104.47.65.28
Oct 31, 2024 20:42:22.842073917 CET	443	49721	104.47.65.28	192.168.2.16
Oct 31, 2024 20:42:22.842307091 CET	49721	443	192.168.2.16	104.47.65.28
Oct 31, 2024 20:42:22.842314005 CET	443	49721	104.47.65.28	192.168.2.16
Oct 31, 2024 20:42:22.891788006 CET	49721	443	192.168.2.16	104.47.65.28
Oct 31, 2024 20:42:23.142827988 CET	443	49721	104.47.65.28	192.168.2.16
Oct 31, 2024 20:42:23.142874002 CET	443	49721	104.47.65.28	192.168.2.16
Oct 31, 2024 20:42:23.142879963 CET	443	49721	104.47.65.28	192.168.2.16
Oct 31, 2024 20:42:23.142909050 CET	443	49721	104.47.65.28	192.168.2.16
Oct 31, 2024 20:42:23.142921925 CET	443	49721	104.47.65.28	192.168.2.16
Oct 31, 2024 20:42:23.142927885 CET	49721	443	192.168.2.16	104.47.65.28
Oct 31, 2024 20:42:23.142934084 CET	443	49721	104.47.65.28	192.168.2.16
Oct 31, 2024 20:42:23.142952919 CET	443	49721	104.47.65.28	192.168.2.16
Oct 31, 2024 20:42:23.142981052 CET	49721	443	192.168.2.16	104.47.65.28
Oct 31, 2024 20:42:23.142996073 CET	49721	443	192.168.2.16	104.47.65.28
Oct 31, 2024 20:42:23.143793106 CET	443	49721	104.47.65.28	192.168.2.16
Oct 31, 2024 20:42:23.143825054 CET	443	49721	104.47.65.28	192.168.2.16
Oct 31, 2024 20:42:23.143862963 CET	49721	443	192.168.2.16	104.47.65.28
Oct 31, 2024 20:42:23.143868923 CET	443	49721	104.47.65.28	192.168.2.16
Oct 31, 2024 20:42:23.143933058 CET	49721	443	192.168.2.16	104.47.65.28
Oct 31, 2024 20:42:23.144064903 CET	443	49721	104.47.65.28	192.168.2.16
Oct 31, 2024 20:42:23.144130945 CET	443	49721	104.47.65.28	192.168.2.16
Oct 31, 2024 20:42:23.144186020 CET	49721	443	192.168.2.16	104.47.65.28
Oct 31, 2024 20:42:23.144609928 CET	49721	443	192.168.2.16	104.47.65.28
Oct 31, 2024 20:42:23.144629002 CET	443	49721	104.47.65.28	192.168.2.16
Oct 31, 2024 20:42:23.240720987 CET	49680	80	192.168.2.16	192.229.211.108
Oct 31, 2024 20:42:23.245433092 CET	49724	443	192.168.2.16	172.217.16.132
Oct 31, 2024 20:42:23.245474100 CET	443	49724	172.217.16.132	192.168.2.16
Oct 31, 2024 20:42:23.245614052 CET	49724	443	192.168.2.16	172.217.16.132
Oct 31, 2024 20:42:23.245829105 CET	49724	443	192.168.2.16	172.217.16.132
Oct 31, 2024 20:42:23.245843887 CET	443	49724	172.217.16.132	192.168.2.16
Oct 31, 2024 20:42:23.302850962 CET	49678	443	192.168.2.16	20.189.173.10
Oct 31, 2024 20:42:23.542787075 CET	49680	80	192.168.2.16	192.229.211.108
Oct 31, 2024 20:42:24.139642000 CET	443	49724	172.217.16.132	192.168.2.16
Oct 31, 2024 20:42:24.139945984 CET	49724	443	192.168.2.16	172.217.16.132
Oct 31, 2024 20:42:24.139969110 CET	443	49724	172.217.16.132	192.168.2.16
Oct 31, 2024 20:42:24.141027927 CET	443	49724	172.217.16.132	192.168.2.16
Oct 31, 2024 20:42:24.141100883 CET	49724	443	192.168.2.16	172.217.16.132
Oct 31, 2024 20:42:24.142000914 CET	49724	443	192.168.2.16	172.217.16.132
Oct 31, 2024 20:42:24.142061949 CET	443	49724	172.217.16.132	192.168.2.16
Oct 31, 2024 20:42:24.146825075 CET	49680	80	192.168.2.16	192.229.211.108
Oct 31, 2024 20:42:24.194785118 CET	49724	443	192.168.2.16	172.217.16.132
Oct 31, 2024 20:42:24.194794893 CET	443	49724	172.217.16.132	192.168.2.16
Oct 31, 2024 20:42:24.242770910 CET	49724	443	192.168.2.16	172.217.16.132
Oct 31, 2024 20:42:25.361872911 CET	49680	80	192.168.2.16	192.229.211.108
Oct 31, 2024 20:42:27.772083044 CET	49680	80	192.168.2.16	192.229.211.108
Oct 31, 2024 20:42:28.105942011 CET	49678	443	192.168.2.16	20.189.173.10
Oct 31, 2024 20:42:29.543806076 CET	49673	443	192.168.2.16	204.79.197.203
Oct 31, 2024 20:42:32.575825930 CET	49680	80	192.168.2.16	192.229.211.108
Oct 31, 2024 20:42:34.160664082 CET	443	49724	172.217.16.132	192.168.2.16
Oct 31, 2024 20:42:34.160731077 CET	443	49724	172.217.16.132	192.168.2.16
Oct 31, 2024 20:42:34.160947084 CET	49724	443	192.168.2.16	172.217.16.132
Oct 31, 2024 20:42:34.747430086 CET	49724	443	192.168.2.16	172.217.16.132
Oct 31, 2024 20:42:34.747451067 CET	443	49724	172.217.16.132	192.168.2.16
Oct 31, 2024 20:42:37.711946011 CET	49678	443	192.168.2.16	20.189.173.10
Oct 31, 2024 20:42:42.181912899 CET	49680	80	192.168.2.16	192.229.211.108
Oct 31, 2024 20:42:54.973870993 CET	49725	443	192.168.2.16	172.202.163.200
Oct 31, 2024 20:42:54.973915100 CET	443	49725	172.202.163.200	192.168.2.16
Oct 31, 2024 20:42:54.974024057 CET	49725	443	192.168.2.16	172.202.163.200
Oct 31, 2024 20:42:54.974416971 CET	49725	443	192.168.2.16	172.202.163.200
Oct 31, 2024 20:42:54.974438906 CET	443	49725	172.202.163.200	192.168.2.16
Oct 31, 2024 20:42:55.739727974 CET	443	49725	172.202.163.200	192.168.2.16
Oct 31, 2024 20:42:55.739917994 CET	49725	443	192.168.2.16	172.202.163.200
Oct 31, 2024 20:42:55.741082907 CET	49725	443	192.168.2.16	172.202.163.200
Oct 31, 2024 20:42:55.741115093 CET	443	49725	172.202.163.200	192.168.2.16
Oct 31, 2024 20:42:55.741369009 CET	443	49725	172.202.163.200	192.168.2.16
Oct 31, 2024 20:42:55.745666027 CET	49725	443	192.168.2.16	172.202.163.200
Oct 31, 2024 20:42:55.787365913 CET	443	49725	172.202.163.200	192.168.2.16
Oct 31, 2024 20:42:56.003838062 CET	443	49725	172.202.163.200	192.168.2.16
Oct 31, 2024 20:42:56.003860950 CET	443	49725	172.202.163.200	192.168.2.16
Oct 31, 2024 20:42:56.003901958 CET	443	49725	172.202.163.200	192.168.2.16
Oct 31, 2024 20:42:56.003983021 CET	49725	443	192.168.2.16	172.202.163.200
Oct 31, 2024 20:42:56.004033089 CET	443	49725	172.202.163.200	192.168.2.16
Oct 31, 2024 20:42:56.004087925 CET	49725	443	192.168.2.16	172.202.163.200
Oct 31, 2024 20:42:56.004089117 CET	49725	443	192.168.2.16	172.202.163.200
Oct 31, 2024 20:42:56.005790949 CET	443	49725	172.202.163.200	192.168.2.16
Oct 31, 2024 20:42:56.005825043 CET	443	49725	172.202.163.200	192.168.2.16
Oct 31, 2024 20:42:56.005861998 CET	49725	443	192.168.2.16	172.202.163.200
Oct 31, 2024 20:42:56.005880117 CET	443	49725	172.202.163.200	192.168.2.16
Oct 31, 2024 20:42:56.005898952 CET	443	49725	172.202.163.200	192.168.2.16
Oct 31, 2024 20:42:56.005908012 CET	49725	443	192.168.2.16	172.202.163.200
Oct 31, 2024 20:42:56.005934000 CET	49725	443	192.168.2.16	172.202.163.200
Oct 31, 2024 20:42:56.006803989 CET	49725	443	192.168.2.16	172.202.163.200
Oct 31, 2024 20:42:56.006840944 CET	443	49725	172.202.163.200	192.168.2.16
Oct 31, 2024 20:42:56.006885052 CET	49725	443	192.168.2.16	172.202.163.200
Oct 31, 2024 20:42:56.006900072 CET	443	49725	172.202.163.200	192.168.2.16
Oct 31, 2024 20:42:56.128819942 CET	49697	80	192.168.2.16	93.184.221.240
Oct 31, 2024 20:42:56.128896952 CET	49699	80	192.168.2.16	93.184.221.240
Oct 31, 2024 20:42:56.134304047 CET	80	49697	93.184.221.240	192.168.2.16
Oct 31, 2024 20:42:56.134438992 CET	49697	80	192.168.2.16	93.184.221.240
Oct 31, 2024 20:42:56.135432959 CET	80	49699	93.184.221.240	192.168.2.16
Oct 31, 2024 20:42:56.135543108 CET	49699	80	192.168.2.16	93.184.221.240

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 31, 2024 20:42:18.438045025 CET	62772	53	192.168.2.16	1.1.1.1
Oct 31, 2024 20:42:18.439929962 CET	54969	53	192.168.2.16	1.1.1.1
Oct 31, 2024 20:42:18.440087080 CET	58292	53	192.168.2.16	1.1.1.1
Oct 31, 2024 20:42:18.457782030 CET	53	54969	1.1.1.1	192.168.2.16
Oct 31, 2024 20:42:18.457869053 CET	53	58292	1.1.1.1	192.168.2.16
Oct 31, 2024 20:42:18.459418058 CET	53	62772	1.1.1.1	192.168.2.16
Oct 31, 2024 20:42:18.497921944 CET	53	50919	1.1.1.1	192.168.2.16
Oct 31, 2024 20:42:19.800708055 CET	53	61853	1.1.1.1	192.168.2.16
Oct 31, 2024 20:42:20.856981039 CET	63388	53	192.168.2.16	1.1.1.1
Oct 31, 2024 20:42:20.857203007 CET	61561	53	192.168.2.16	1.1.1.1
Oct 31, 2024 20:42:20.875268936 CET	53	63388	1.1.1.1	192.168.2.16
Oct 31, 2024 20:42:20.876750946 CET	53	61561	1.1.1.1	192.168.2.16
Oct 31, 2024 20:42:23.236696005 CET	51164	53	192.168.2.16	1.1.1.1
Oct 31, 2024 20:42:23.237144947 CET	53672	53	192.168.2.16	1.1.1.1
Oct 31, 2024 20:42:23.243613958 CET	53	51164	1.1.1.1	192.168.2.16
Oct 31, 2024 20:42:23.244071960 CET	53	53672	1.1.1.1	192.168.2.16
Oct 31, 2024 20:42:36.810678005 CET	53	60358	1.1.1.1	192.168.2.16
Oct 31, 2024 20:42:55.657134056 CET	53	65188	1.1.1.1	192.168.2.16

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 31, 2024 20:42:18.438045025 CET	192.168.2.16	1.1.1.1	0xe5c8	Standard query (0)	gcc02.safelinks.protection.outlook.com	A (IP address)	IN (0x0001)	false
Oct 31, 2024 20:42:18.439929962 CET	192.168.2.16	1.1.1.1	0x32fd	Standard query (0)	gcc02.safelinks.protection.outlook.com	A (IP address)	IN (0x0001)	false
Oct 31, 2024 20:42:18.440087080 CET	192.168.2.16	1.1.1.1	0x7b44	Standard query (0)	gcc02.safelinks.protection.outlook.com	65	IN (0x0001)	false
Oct 31, 2024 20:42:20.856981039 CET	192.168.2.16	1.1.1.1	0xbf40	Standard query (0)	gcc02.safelinks.protection.outlook.com	A (IP address)	IN (0x0001)	false
Oct 31, 2024 20:42:20.857203007 CET	192.168.2.16	1.1.1.1	0x5b34	Standard query (0)	gcc02.safelinks.protection.outlook.com	65	IN (0x0001)	false
Oct 31, 2024 20:42:23.236696005 CET	192.168.2.16	1.1.1.1	0xb0c0	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Oct 31, 2024 20:42:23.237144947 CET	192.168.2.16	1.1.1.1	0x2ed4	Standard query (0)	www.google.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 31, 2024 20:42:18.457782030 CET	1.1.1.1	192.168.2.16	0x32fd	No error (0)	gcc02.safelinks.protection.outlook.com	gcc02.safelinks.eop-tm2.outlook.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 31, 2024 20:42:18.457782030 CET	1.1.1.1	192.168.2.16	0x32fd	No error (0)	gcc02.safelinks.eop-tm2.outlook.com		104.47.64.28	A (IP address)	IN (0x0001)	false
Oct 31, 2024 20:42:18.457782030 CET	1.1.1.1	192.168.2.16	0x32fd	No error (0)	gcc02.safelinks.eop-tm2.outlook.com		104.47.65.28	A (IP address)	IN (0x0001)	false
Oct 31, 2024 20:42:18.457869053 CET	1.1.1.1	192.168.2.16	0x7b44	No error (0)	gcc02.safelinks.protection.outlook.com	gcc02.safelinks.eop-tm2.outlook.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 31, 2024 20:42:18.459418058 CET	1.1.1.1	192.168.2.16	0xe5c8	No error (0)	gcc02.safelinks.protection.outlook.com	gcc02.safelinks.eop-tm2.outlook.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 31, 2024 20:42:18.459418058 CET	1.1.1.1	192.168.2.16	0xe5c8	No error (0)	gcc02.safelinks.eop-tm2.outlook.com		104.47.65.28	A (IP address)	IN (0x0001)	false
Oct 31, 2024 20:42:18.459418058 CET	1.1.1.1	192.168.2.16	0xe5c8	No error (0)	gcc02.safelinks.eop-tm2.outlook.com		104.47.64.28	A (IP address)	IN (0x0001)	false
Oct 31, 2024 20:42:20.875268936 CET	1.1.1.1	192.168.2.16	0xbf40	No error (0)	gcc02.safelinks.protection.outlook.com	gcc02.safelinks.eop-tm2.outlook.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 31, 2024 20:42:20.875268936 CET	1.1.1.1	192.168.2.16	0xbf40	No error (0)	gcc02.safelinks.eop-tm2.outlook.com		104.47.65.28	A (IP address)	IN (0x0001)	false
Oct 31, 2024 20:42:20.875268936 CET	1.1.1.1	192.168.2.16	0xbf40	No error (0)	gcc02.safelinks.eop-tm2.outlook.com		104.47.64.28	A (IP address)	IN (0x0001)	false
Oct 31, 2024 20:42:20.876750946 CET	1.1.1.1	192.168.2.16	0x5b34	No error (0)	gcc02.safelinks.protection.outlook.com	gcc02.safelinks.eop-tm2.outlook.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 31, 2024 20:42:23.243613958 CET	1.1.1.1	192.168.2.16	0xb0c0	No error (0)	www.google.com		172.217.16.132	A (IP address)	IN (0x0001)	false
Oct 31, 2024 20:42:23.244071960 CET	1.1.1.1	192.168.2.16	0x2ed4	No error (0)	www.google.com			65	IN (0x0001)	false

HTTP Request Dependency Graph

slscr.update.microsoft.com

gcc02.safelinks.protection.outlook.com

fs.microsoft.com

https:

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.16	49707	172.202.163.200	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 19:42:17 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=cPS6YSs6uELSgFu&MD=zHkmzDgs HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-10-31 19:42:17 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 42e662da-651d-4e0a-978a-f44449ccf214 MS-RequestId: efcd4e22-ed3c-48e4-9d2b-8819c8c77eff MS-CV: AauVBNLXUEa/RFtG.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Thu, 31 Oct 2024 19:42:17 GMT Connection: close Content-Length: 24490
2024-10-31 19:42:17 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-10-31 19:42:17 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.16	49708	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 19:42:17 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-10-31 19:42:18 UTC	467	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF70) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-neu-z1 Cache-Control: public, max-age=162204 Date: Thu, 31 Oct 2024 19:42:18 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.16	49710	104.47.65.28	443	5920	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 19:42:19 UTC	1047	OUT	GET /?url=https%3A%2F%2Fparrots-run-fjh.craft.me%2FkKsdDph47M82kH&data=05%7C02%7Cclubb%40audits.ga.gov%7C7868b433ade34c8449f408dcf9de2f4a%7C3ba88d1570d44b838474db703319c2a0%7C0%7C0%7C638659979887700847%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=bpVMMJuyI8Eg2vUj%2BK862VkxX6I5AHOsDuFcDZCvmRA%3D&reserved=0 HTTP/1.1 Host: gcc02.safelinks.protection.outlook.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-31 19:42:19 UTC	538	IN	HTTP/1.1 200 OK Cache-Control: private Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/10.0 X-AspNetMvc-Version: 4.0 X-SL-GetUrlReputation-Verdict: Bad X-Robots-Tag: noindex, nofollow X-AspNet-Version: 4.0.30319 X-ServerName: DM3GCC02WS019 X-ServerVersion: 15.20.8114.020 X-ServerLat: 229 X-SafeLinks-Tracking-Id: 47fc5b91-c8a4-43ef-fd0e-08dcf9e421c9 X-Powered-By: ASP.NET X-Content-Type-Options: nosniff X-UA-Compatible: IE=Edge Date: Thu, 31 Oct 2024 19:42:19 GMT Connection: close Content-Length: 4300
2024-10-31 19:42:19 UTC	4300	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 4d 69 63 72 6f 73 6f 66 74 20 44 65 66 65 6e 64 65 72 20 66 6f 72 20 4f 66 66 69 63 65 20 33 36 35 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 65 66 65 72 72 65 72 22 20 63 6f 6e 74 65 6e 74 3d 22 73 61 6d 65 2d 6f 72 69 67 69 6e 22 20 2f 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 2c 6e 6f 66 6f 6c 6c 6f 77 22 20 2f 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 2c Data Ascii: <!doctype html><html><head> <meta charset="UTF-8"> <title>Microsoft Defender for Office 365</title> <meta name="referrer" content="same-origin" /> <meta name="robots" content="noindex,nofollow" /> <link rel="icon" href="data:,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.16	49714	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 19:42:19 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-10-31 19:42:19 UTC	515	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=162260 Date: Thu, 31 Oct 2024 19:42:19 GMT Content-Length: 55 Connection: close X-CID: 2
2024-10-31 19:42:19 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.16	49717	104.47.64.28	443	5920	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 19:42:20 UTC	1047	OUT	GET /?url=https%3A%2F%2Fparrots-run-fjh.craft.me%2FkKsdDph47M82kH&data=05%7C02%7Cclubb%40audits.ga.gov%7C7868b433ade34c8449f408dcf9de2f4a%7C3ba88d1570d44b838474db703319c2a0%7C0%7C0%7C638659979887700847%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=bpVMMJuyI8Eg2vUj%2BK862VkxX6I5AHOsDuFcDZCvmRA%3D&reserved=0 HTTP/1.1 Host: gcc02.safelinks.protection.outlook.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-31 19:42:21 UTC	538	IN	HTTP/1.1 200 OK Cache-Control: private Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/10.0 X-AspNetMvc-Version: 4.0 X-SL-GetUrlReputation-Verdict: Bad X-Robots-Tag: noindex, nofollow X-AspNet-Version: 4.0.30319 X-ServerName: BL0GCC02WS903 X-ServerVersion: 15.20.8114.014 X-ServerLat: 355 X-SafeLinks-Tracking-Id: cc89de85-f35c-4cf6-ccb3-08dcf9e4228c X-Powered-By: ASP.NET X-Content-Type-Options: nosniff X-UA-Compatible: IE=Edge Date: Thu, 31 Oct 2024 19:42:20 GMT Connection: close Content-Length: 4344
2024-10-31 19:42:21 UTC	4344	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 4d 69 63 72 6f 73 6f 66 74 20 44 65 66 65 6e 64 65 72 20 66 6f 72 20 4f 66 66 69 63 65 20 33 36 35 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 65 66 65 72 72 65 72 22 20 63 6f 6e 74 65 6e 74 3d 22 73 61 6d 65 2d 6f 72 69 67 69 6e 22 20 2f 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 2c 6e 6f 66 6f 6c 6c 6f 77 22 20 2f 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 2c Data Ascii: <!doctype html><html><head> <meta charset="UTF-8"> <title>Microsoft Defender for Office 365</title> <meta name="referrer" content="same-origin" /> <meta name="robots" content="noindex,nofollow" /> <link rel="icon" href="data:,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.16	49716	104.47.64.28	443	5920	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 19:42:20 UTC	972	OUT	GET /Content/Scripts/safelinksv2.css HTTP/1.1 Host: gcc02.safelinks.protection.outlook.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fparrots-run-fjh.craft.me%2FkKsdDph47M82kH&data=05%7C02%7Cclubb%40audits.ga.gov%7C7868b433ade34c8449f408dcf9de2f4a%7C3ba88d1570d44b838474db703319c2a0%7C0%7C0%7C638659979887700847%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=bpVMMJuyI8Eg2vUj%2BK862VkxX6I5AHOsDuFcDZCvmRA%3D&reserved=0 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-31 19:42:20 UTC	466	IN	HTTP/1.1 200 OK Content-Type: text/css Last-Modified: Tue, 29 Oct 2024 09:17:02 GMT Accept-Ranges: bytes ETag: "0bb5a50e329db1:0" Server: Microsoft-IIS/10.0 X-ServerName: BL0GCC02WS022 X-ServerVersion: 15.20.8114.020 X-ServerLat: 1 X-SafeLinks-Tracking-Id: 8fb256ad-7efa-44fe-cf2f-08dcf9e4228d X-Powered-By: ASP.NET X-Content-Type-Options: nosniff X-UA-Compatible: IE=Edge Date: Thu, 31 Oct 2024 19:42:20 GMT Connection: close Content-Length: 3932
2024-10-31 19:42:20 UTC	3932	IN	Data Raw: 40 63 68 61 72 73 65 74 20 22 55 54 46 2d 38 22 3b 0d 0a 2f 2a 20 43 53 53 20 44 6f 63 75 6d 65 6e 74 20 2a 2f 0d 0a 0d 0a 62 6f 64 79 7b 0d 0a 09 6d 61 72 67 69 6e 3a 30 70 78 3b 0d 0a 09 70 61 64 64 69 6e 67 3a 30 70 78 3b 0d 0a 7d 0d 0a 0d 0a 64 69 76 7b 0d 0a 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 6c 65 66 74 3b 0d 0a 7d 0d 0a 0d 0a 23 72 65 63 6f 6d 6d 65 6e 64 61 74 69 6f 6e 5f 63 6f 6e 74 61 69 6e 65 72 7b 0d 0a 09 77 69 64 74 68 3a 31 30 30 25 3b 0d 0a 7d 0d 0a 0d 0a 23 69 63 6f 6e 20 69 6d 67 20 7b 0d 0a 09 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 34 30 70 78 3b 0d 0a 09 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 34 35 70 78 3b 0d 0a 7d 0d 0a 0d 0a 23 75 72 6c 20 7b 68 65 69 67 68 74 3a 20 33 32 70 78 3b 0d 0a 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f Data Ascii: @charset "UTF-8";/* CSS Document */body{margin:0px;padding:0px;}div{ text-align:left;}#recommendation_container{width:100%;}#icon img {margin-left: 40px;margin-top: 45px;}#url {height: 32px;background-co

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.16	49715	104.47.64.28	443	5920	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 19:42:20 UTC	950	OUT	GET /Content/Scripts/site.js HTTP/1.1 Host: gcc02.safelinks.protection.outlook.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fparrots-run-fjh.craft.me%2FkKsdDph47M82kH&data=05%7C02%7Cclubb%40audits.ga.gov%7C7868b433ade34c8449f408dcf9de2f4a%7C3ba88d1570d44b838474db703319c2a0%7C0%7C0%7C638659979887700847%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=bpVMMJuyI8Eg2vUj%2BK862VkxX6I5AHOsDuFcDZCvmRA%3D&reserved=0 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-31 19:42:20 UTC	480	IN	HTTP/1.1 200 OK Content-Type: application/javascript Last-Modified: Sun, 27 Oct 2024 09:28:30 GMT Accept-Ranges: bytes ETag: "0b39b955228db1:0" Server: Microsoft-IIS/10.0 X-ServerName: BL0GCC02WS027 X-ServerVersion: 15.20.8114.015 X-ServerLat: 0 X-SafeLinks-Tracking-Id: 2ccc3bae-5e92-4037-8b7a-08dcf9e42290 X-Powered-By: ASP.NET X-Content-Type-Options: nosniff X-UA-Compatible: IE=Edge Date: Thu, 31 Oct 2024 19:42:20 GMT Connection: close Content-Length: 1588
2024-10-31 19:42:20 UTC	1588	IN	Data Raw: 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 20 3d 20 66 75 6e 63 74 69 6f 6e 20 4f 6e 4c 6f 61 64 48 61 6e 64 6c 65 72 28 29 7b 0d 0a 09 69 66 20 28 77 69 6e 64 6f 77 2e 68 69 73 74 6f 72 79 2e 6c 65 6e 67 74 68 20 3c 3d 20 31 29 20 7b 0d 0a 09 09 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 22 63 6c 6f 73 65 22 29 2e 73 74 79 6c 65 2e 64 69 73 70 6c 61 79 20 3d 20 22 6e 6f 6e 65 22 3b 0d 0a 09 7d 0d 0a 7d 0d 0a 0d 0a 76 61 72 20 74 68 65 6d 65 20 3d 20 6e 75 6c 6c 3b 0d 0a 74 72 79 20 7b 0d 0a 20 20 28 66 75 6e 63 74 69 6f 6e 20 28 55 52 4c 53 65 61 72 63 68 50 61 72 61 6d 73 2c 20 73 74 72 29 20 7b 0d 0a 20 20 20 20 69 66 20 28 21 6e 65 77 20 55 52 4c 53 65 61 72 63 68 50 61 72 61 6d 73 28 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f Data Ascii: window.onload = function OnLoadHandler(){if (window.history.length <= 1) {document.getElementById("close").style.display = "none";}}var theme = null;try { (function (URLSearchParams, str) { if (!new URLSearchParams(window.locatio

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.16	49719	104.47.64.28	443	5920	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 19:42:21 UTC	1011	OUT	GET /Content/images/cross.png HTTP/1.1 Host: gcc02.safelinks.protection.outlook.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fparrots-run-fjh.craft.me%2FkKsdDph47M82kH&data=05%7C02%7Cclubb%40audits.ga.gov%7C7868b433ade34c8449f408dcf9de2f4a%7C3ba88d1570d44b838474db703319c2a0%7C0%7C0%7C638659979887700847%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=bpVMMJuyI8Eg2vUj%2BK862VkxX6I5AHOsDuFcDZCvmRA%3D&reserved=0 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-31 19:42:21 UTC	468	IN	HTTP/1.1 200 OK Content-Type: image/png Last-Modified: Tue, 29 Oct 2024 09:09:58 GMT Accept-Ranges: bytes ETag: "077a153e229db1:0" Server: Microsoft-IIS/10.0 X-ServerName: BL0GCC02WS021 X-ServerVersion: 15.20.8114.020 X-ServerLat: 0 X-SafeLinks-Tracking-Id: dfe5f945-0a7f-4a92-5394-08dcf9e4232a X-Powered-By: ASP.NET X-Content-Type-Options: nosniff X-UA-Compatible: IE=Edge Date: Thu, 31 Oct 2024 19:42:21 GMT Connection: close Content-Length: 25664
2024-10-31 19:42:21 UTC	15916	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 ba 00 00 00 c8 08 06 00 00 00 5f e4 fb 3b 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 0a 4f 69 43 43 50 50 68 6f 74 6f 73 68 6f 70 20 49 43 43 20 70 72 6f 66 69 6c 65 00 00 78 da 9d 53 67 54 53 e9 16 3d f7 de f4 42 4b 88 80 94 4b 6f 52 15 08 20 52 42 8b 80 14 91 26 2a 21 09 10 4a 88 21 a1 d9 15 51 c1 11 45 45 04 1b c8 a0 88 03 8e 8e 80 8c 15 51 2c 0c 8a 0a d8 07 e4 21 a2 8e 83 a3 88 8a ca fb e1 7b a3 6b d6 bc f7 e6 cd fe b5 d7 3e e7 ac f3 9d b3 cf 07 c0 08 0c 96 48 33 51 35 80 0c a9 42 1e 11 e0 83 c7 c4 c6 e1 e4 2e 40 81 0a 24 70 00 10 08 b3 64 21 73 fd 23 01 00 f8 7e 3c 3c 2b 22 c0 07 be 00 01 78 d3 0b 08 00 c0 4d 9b c0 30 1c 87 ff 0f ea 42 99 5c 01 80 84 01 c0 74 91 38 4b Data Ascii: PNGIHDR_;pHYs%%IR$OiCCPPhotoshop ICC profilexSgTS=BKKoR RB&*!J!QEEQ,!{k>H3Q5B.@$pd!s#~<<+"xM0B\t8K
2024-10-31 19:42:21 UTC	9748	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.16	49720	104.47.65.28	443	5920	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 19:42:21 UTC	385	OUT	GET /Content/Scripts/site.js HTTP/1.1 Host: gcc02.safelinks.protection.outlook.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-31 19:42:21 UTC	479	IN	HTTP/1.1 200 OK Content-Type: application/javascript Last-Modified: Wed, 30 Oct 2024 09:57:32 GMT Accept-Ranges: bytes ETag: "0e2923b22adb1:0" Server: Microsoft-IIS/10.0 X-ServerName: DM3GCC02WS030 X-ServerVersion: 15.20.8114.023 X-ServerLat: 1 X-SafeLinks-Tracking-Id: 998c1741-3753-4068-aca2-08dcf9e4232d X-Powered-By: ASP.NET X-Content-Type-Options: nosniff X-UA-Compatible: IE=Edge Date: Thu, 31 Oct 2024 19:42:21 GMT Connection: close Content-Length: 1588
2024-10-31 19:42:21 UTC	1588	IN	Data Raw: 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 20 3d 20 66 75 6e 63 74 69 6f 6e 20 4f 6e 4c 6f 61 64 48 61 6e 64 6c 65 72 28 29 7b 0d 0a 09 69 66 20 28 77 69 6e 64 6f 77 2e 68 69 73 74 6f 72 79 2e 6c 65 6e 67 74 68 20 3c 3d 20 31 29 20 7b 0d 0a 09 09 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 22 63 6c 6f 73 65 22 29 2e 73 74 79 6c 65 2e 64 69 73 70 6c 61 79 20 3d 20 22 6e 6f 6e 65 22 3b 0d 0a 09 7d 0d 0a 7d 0d 0a 0d 0a 76 61 72 20 74 68 65 6d 65 20 3d 20 6e 75 6c 6c 3b 0d 0a 74 72 79 20 7b 0d 0a 20 20 28 66 75 6e 63 74 69 6f 6e 20 28 55 52 4c 53 65 61 72 63 68 50 61 72 61 6d 73 2c 20 73 74 72 29 20 7b 0d 0a 20 20 20 20 69 66 20 28 21 6e 65 77 20 55 52 4c 53 65 61 72 63 68 50 61 72 61 6d 73 28 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f Data Ascii: window.onload = function OnLoadHandler(){if (window.history.length <= 1) {document.getElementById("close").style.display = "none";}}var theme = null;try { (function (URLSearchParams, str) { if (!new URLSearchParams(window.locatio

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.16	49721	104.47.65.28	443	5920	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 19:42:22 UTC	386	OUT	GET /Content/images/cross.png HTTP/1.1 Host: gcc02.safelinks.protection.outlook.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-31 19:42:23 UTC	468	IN	HTTP/1.1 200 OK Content-Type: image/png Last-Modified: Wed, 30 Oct 2024 10:01:54 GMT Accept-Ranges: bytes ETag: "01553bfb22adb1:0" Server: Microsoft-IIS/10.0 X-ServerName: DM3GCC02WS033 X-ServerVersion: 15.20.8114.023 X-ServerLat: 0 X-SafeLinks-Tracking-Id: 565d8c23-9f20-4502-6f49-08dcf9e423dd X-Powered-By: ASP.NET X-Content-Type-Options: nosniff X-UA-Compatible: IE=Edge Date: Thu, 31 Oct 2024 19:42:21 GMT Connection: close Content-Length: 25664
2024-10-31 19:42:23 UTC	15916	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 ba 00 00 00 c8 08 06 00 00 00 5f e4 fb 3b 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 0a 4f 69 43 43 50 50 68 6f 74 6f 73 68 6f 70 20 49 43 43 20 70 72 6f 66 69 6c 65 00 00 78 da 9d 53 67 54 53 e9 16 3d f7 de f4 42 4b 88 80 94 4b 6f 52 15 08 20 52 42 8b 80 14 91 26 2a 21 09 10 4a 88 21 a1 d9 15 51 c1 11 45 45 04 1b c8 a0 88 03 8e 8e 80 8c 15 51 2c 0c 8a 0a d8 07 e4 21 a2 8e 83 a3 88 8a ca fb e1 7b a3 6b d6 bc f7 e6 cd fe b5 d7 3e e7 ac f3 9d b3 cf 07 c0 08 0c 96 48 33 51 35 80 0c a9 42 1e 11 e0 83 c7 c4 c6 e1 e4 2e 40 81 0a 24 70 00 10 08 b3 64 21 73 fd 23 01 00 f8 7e 3c 3c 2b 22 c0 07 be 00 01 78 d3 0b 08 00 c0 4d 9b c0 30 1c 87 ff 0f ea 42 99 5c 01 80 84 01 c0 74 91 38 4b Data Ascii: PNGIHDR_;pHYs%%IR$OiCCPPhotoshop ICC profilexSgTS=BKKoR RB&*!J!QEEQ,!{k>H3Q5B.@$pd!s#~<<+"xM0B\t8K
2024-10-31 19:42:23 UTC	9748	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.16	49725	172.202.163.200	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 19:42:55 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=cPS6YSs6uELSgFu&MD=zHkmzDgs HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-10-31 19:42:56 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "vic+p1MiJJ+/WMnK08jaWnCBGDfvkGRzPk9f8ZadQHg=_1440" MS-CorrelationId: e7452586-0baf-4a92-95f5-aa1fe987c321 MS-RequestId: 6e2d45fb-2d66-486d-968e-86022212b8d0 MS-CV: 6ydM1etwpk2H2NJt.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Thu, 31 Oct 2024 19:42:55 GMT Connection: close Content-Length: 30005
2024-10-31 19:42:56 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 8d 2b 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 5b 49 00 00 14 00 00 00 00 00 10 00 8d 2b 00 00 a8 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 72 4d 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 fe f6 51 be 21 2b 72 4d 43 4b ed 7c 05 58 54 eb da f6 14 43 49 37 0a 02 d2 b9 86 0e 41 52 a4 1b 24 a5 bb 43 24 44 18 94 90 92 52 41 3a 05 09 95 ee 54 b0 00 91 2e e9 12 10 04 11 c9 6f 10 b7 a2 67 9f bd cf 3e ff b7 ff b3 bf 73 ed e1 9a 99 f5 c6 7a d7 bb de f5 3e cf fd 3c f7 dc 17 4a 1a 52 e7 41 a8 97 1e 14 f4 e5 25 7d f4 05 82 82 c1 20 30 08 06 ba c3 05 02 11 7f a9 c1 ff d2 87 5c 1e f4 ed 65 8e 7a 1f f6 0a 40 03 1d 7b f9 83 2c 1c 2f db b8 3a 39 3a 58 38 ba 73 5e Data Ascii: MSCF+D[I+IdrMenvironment.cabQ!+rMCK\|XTCI7AR$C$DRA:T.og>sz><JRA%} 0\ez@{,/:9:X8s^
2024-10-31 19:42:56 UTC	14181	IN	Data Raw: 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 20 50 43 41 20 32 30 31 30 30 1e 17 0d 32 33 31 30 31 32 31 39 30 37 32 35 5a 17 0d 32 35 30 31 31 30 31 39 30 37 32 35 5a 30 81 d2 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 2d 30 2b 06 03 55 04 0b 13 24 4d 69 63 72 6f Data Ascii: UUS10UWashington10URedmond10UMicrosoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100231012190725Z250110190725Z010UUS10UWashington10URedmond10UMicrosoft Corporation1-0+U$Micro

Target ID:	0
Start time:	15:42:06
Start date:	31/10/2024
Path:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /f "C:\Users\user\Desktop\DOCUMENTS.msg"
Imagebase:	0xe10000
File size:	34'446'744 bytes
MD5 hash:	91A5292942864110ED734005B7E005C0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	15:42:07
Start date:	31/10/2024
Path:	C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "EB4F3FE8-396F-43DF-82CA-D00C96AB837A" "9BD6E947-83E8-46E0-907E-2DB8A4A5C80B" "5076" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
Imagebase:	0x7ff614ba0000
File size:	710'048 bytes
MD5 hash:	EC652BEDD90E089D9406AFED89A8A8BD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	15:42:16
Start date:	31/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fparrots-run-fjh.craft.me%2FkKsdDph47M82kH&data=05%7C02%7Cclubb%40audits.ga.gov%7C7868b433ade34c8449f408dcf9de2f4a%7C3ba88d1570d44b838474db703319c2a0%7C0%7C0%7C638659979887700847%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=bpVMMJuyI8Eg2vUj%2BK862VkxX6I5AHOsDuFcDZCvmRA%3D&reserved=0
Imagebase:	0x7ff7f9810000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	15:42:16
Start date:	31/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fparrots-run-fjh.craft.me%2FkKsdDph47M82kH&data=05%7C02%7Cclubb%40audits.ga.gov%7C7868b433ade34c8449f408dcf9de2f4a%7C3ba88d1570d44b838474db703319c2a0%7C0%7C0%7C638659979887700847%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=bpVMMJuyI8Eg2vUj%2BK862VkxX6I5AHOsDuFcDZCvmRA%3D&reserved=0
Imagebase:	0x7ff7f9810000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	15:42:16
Start date:	31/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2092 --field-trial-handle=1996,i,5602081774264852813,10793832898396863703,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff7f9810000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	15:42:16
Start date:	31/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2008 --field-trial-handle=1996,i,11601669098928197994,496886325698099544,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff7f9810000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may abuse Internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality and customize aspects of Internet browsers. They can be installed directly or through a browser's app store and generally have access and permissions to everything that the browser can access.
Tactics:	Persistence
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Process: Process Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report DOCUMENTS.msg

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Dropped Files

HTML

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Networking

System Summary

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\FORMS\FRMCACHE.DAT

C:\Users\user\AppData\Local\Microsoft\FontCache\4\CatalogCacheMetaData.xml

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-shm

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-wal

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\B6B5786E.dat

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{8C055AAB-CA7E-404A-B267-FFC966B27AC3}.tmp

C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1730403726992491800_837DD3A1-8A76-44B8-8607-F648CBDD8E40.log

C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1730403726993545800_837DD3A1-8A76-44B8-8607-F648CBDD8E40.log

C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20241031T1542060815-5076.etl

C:\Users\user\AppData\Local\Temp\~DF8052E1DC085B131C.TMP

C:\Users\user\AppData\Roaming\Microsoft\Office\MSO3072.acl

C:\Users\user\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

C:\Users\user\Documents\Outlook Files\Outlook Data File - NoEmail.pst

Windows Analysis Report
DOCUMENTS.msg