Edit tour

Windows Analysis Report
https://www.attemplate.com/gcc/24f1e58b-b088-4195-ba46-839e73aec371/406eb232-0f42-45b3-8f82-5ddbf95d3c28/4526622a-5e47-4913-897d-b139c3f50e94/attachment?id=T3JlSlFGWnFzWFRVUk1mQzVwN1d5V3BvT0lIMGd1MmFSTncyMDRDRXRKY1dLWnk0bmZKanUwWkxaU0JRa1VvOGZhTkloMFNSY24vUTU3cFB2eGJmY090ZVc1ZUc0MHdldWRuVFdSWEtLem5U

Overview

General Information

Sample URL:	https://www.attemplate.com/gcc/24f1e58b-b088-4195-ba46-839e73aec371/406eb232-0f42-45b3-8f82-5ddbf95d3c28/4526622a-5e47-4913-897d-b139c3f50e94/attachment?id=T3JlSlFGWnFzWFRVUk1mQzVwN1d5V3BvT0lIMGd1MmFS
Analysis ID:	1417024
Infos:

Detection

Score:	48
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Sigma detected: Suspicious Office Outbound Connections

Stores files to the Windows start menu directory

Uses insecure TLS / SSL version for HTTPS connection

Classification

Process Tree

System is w10x64

chrome.exe (PID: 6604 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 5584 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 --field-trial-handle=2152,i,3891293424011689669,8113640929626892547,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

WINWORD.EXE (PID: 3716 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\user\Downloads\New Document.Docx" /o "" MD5: 1A0C2C2E7D9C4BC18E91604E9B0C7678)

chrome.exe (PID: 1772 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://www.attemplate.com/gcc/24f1e58b-b088-4195-ba46-839e73aec371/406eb232-0f42-45b3-8f82-5ddbf95d3c28/4526622a-5e47-4913-897d-b139c3f50e94/attachment?id=T3JlSlFGWnFzWFRVUk1mQzVwN1d5V3BvT0lIMGd1MmFSTncyMDRDRXRKY1dLWnk0bmZKanUwWkxaU0JRa1VvOGZhTkloMFNSY24vUTU3cFB2eGJmY090ZVc1ZUc0MHdldWRuVFdSWEtLem5UV3VXTlozS0kwTGpGTDNTT0d0SHAveERBQjJFUUNPTUhqWDY3MVJlZzhiSG14ZjVqMmdjNlVUMjh1NXpwazZLblFjeHdDQlBxblJwaVNKY1R6WUp6YnlhaHo5dTRpRFZUY2w2SGQwRW9oNzNXTFJ5MjdQN090UzNtWHIwZDVVK21OV095NHRLT0plZ29TT3EweVdZaDlhUW9lK2lmOWtpOUlmTFRYL3pDSVZzRCt2WEFBbjQyNVRQTDBoRE9IK1NXbmM3UndCdjk2dUg5QVF3MnRodGN3V2NjSCt1ZXZVbzR4VUt5dnEzcFhzOGRkRGUvYWROemJ4NDNHRkJLejRtU01ISmpOYVpEbi9GdUlJUFliMGQ1MHFBaHJCYnQzWWhMTExQcUtUU0RzQT09" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Sigma Signatures

Sigma detected: Suspicious Office Outbound Connections

Source: Network Connection

Author: X__Junior (Nextron Systems): Data: DestinationIp: 192.168.2.5, DestinationIsIpv6: false, DestinationPort: 49717, EventID: 3, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE, Initiated: true, ProcessId: 3716, Protocol: tcp, SourceIp: 52.127.117.164, SourceIsIpv6: false, SourcePort: 443

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: https://www.attemplate.com/gcc/24f1e58b-b088-4195-ba46-839e73aec371/406eb232-0f42-45b3-8f82-5ddbf95d3c28/4526622a-5e47-4913-897d-b139c3f50e94/attachment?id=T3JlSlFGWnFzWFRVUk1mQzVwN1d5V3BvT0lIMGd1MmFSTncyMDRDRXRKY1dLWnk0bmZKanUwWkxaU0JRa1VvOGZhTkloMFNSY24vUTU3cFB2eGJmY090ZVc1ZUc0MHdldWRuVFdSWEtLem5UV3VXTlozS0kwTGpGTDNTT0d0SHAveERBQjJFUUNPTUhqWDY3MVJlZzhiSG14ZjVqMmdjNlVUMjh1NXpwazZLblFjeHdDQlBxblJwaVNKY1R6WUp6YnlhaHo5dTRpRFZUY2w2SGQwRW9oNzNXTFJ5MjdQN090UzNtWHIwZDVVK21OV095NHRLT0plZ29TT3EweVdZaDlhUW9lK2lmOWtpOUlmTFRYL3pDSVZzRCt2WEFBbjQyNVRQTDBoRE9IK1NXbmM3UndCdjk2dUg5QVF3MnRodGN3V2NjSCt1ZXZVbzR4VUt5dnEzcFhzOGRkRGUvYWROemJ4NDNHRkJLejRtU01ISmpOYVpEbi9GdUlJUFliMGQ1MHFBaHJCYnQzWWhMTExQcUtUU0RzQT09

Avira URL Cloud: detection malicious, Label: phishing

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49731 version: TLS 1.0

Source: unknown	HTTPS traffic detected: 23.221.242.90:443 -> 192.168.2.5:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.221.242.90:443 -> 192.168.2.5:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.127.117.164:443 -> 192.168.2.5:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.221.242.90:443 -> 192.168.2.5:49725 version: TLS 1.2

Source: winword.exe

Memory has grown: Private usage: 1MB later: 88MB

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49731 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90

Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /24f1e58b-b088-4195-ba46-839e73aec371/406eb232-0f42-45b3-8f82-5ddbf95d3c28%5C406eb232-0f42-45b3-8f82-5ddbf95d3c28-1041a756-24e9-47c4-b810-4490b2b7211d-0-attachmentImageContent.jpg?sv=2019-02-02&sr=b&sig=kHNF08XtwU3Aekfrnctycl3BWvDdRxJNmA4wSdkLPSg%3D&se=2024-04-27T20%3A21%3A59Z&sp=r HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/4.0 (compatible; ms-office; MSOffice 16)Host: attacksimgcc10sa.blob.core.usgovcloudapi.net
Source: global traffic	HTTP traffic detected: GET /fs/4.38/flatFontAssets.pkg HTTP/1.1Connection: Keep-AliveContent-Type: application/octet-streamAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Word 16.0.16827; Pro)Host: fs.microsoft.com

Source: unknown

DNS traffic detected: queries for: www.attemplate.com

Source: unknown

HTTP traffic detected: POST /threshold/xls.aspx HTTP/1.1Origin: https://www.bing.comReferer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/InitAccept: */*Accept-Language: en-CHContent-type: text/xmlX-Agent-DeviceId: 01000A410900D492X-BM-CBT: 1696428841X-BM-DateFormat: dd/MM/yyyyX-BM-DeviceDimensions: 784x984X-BM-DeviceDimensionsLogical: 784x984X-BM-DeviceScale: 100X-BM-DTZ: 120X-BM-Market: CHX-BM-Theme: 000000;0078d7X-BM-WindowsFlights: FX:117B9872,FX:119E26AD,FX:11C0E96C,FX:11C6E5C2,FX:11C7EB6A,FX:11C9408A,FX:11C940DB,FX:11CB9A9F,FX:11CB9AC1,FX:11CC111C,FX:11D5BFCD,FX:11DF5B12,FX:11DF5B75,FX:1240931B,FX:124B38D0,FX:127FC878,FX:1283FFE8,FX:12840617,FX:128979F9,FX:128EBD7E,FX:129135BB,FX:129E053F,FX:12A74DB5,FX:12AB734D,FX:12B8450E,FX:12BD6E73,FX:12C3331B,FX:12C7D66EX-Device-ClientSession: DB0AFB19004F47BC80E5208C7478FF22X-Device-isOptin: falseX-Device-MachineId: {92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A}X-Device-OSSKU: 48X-Device-Touch: falseX-DeviceID: 01000A410900D492X-MSEdge-ExternalExp: d-thshld39,d-thshld42,d-thshld77,d-thshld78,staticshX-MSEdge-ExternalExpType: JointCoordX-PositionerType: DesktopX-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUIX-Search-CortanaAvailableCapabilities: NoneX-Search-SafeSearch: ModerateX-Search-TimeZone: Bias=-60; DaylightBias=-60; TimeZoneKeyName=W. Europe Standard TimeX-UserAgeClass: UnknownAccept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: www.bing.comContent-Length: 2484Connection: Keep-AliveCache-Control: no-cacheCookie: MUID=2F4E96DB8B7049E59AD4484C3C00F7CF; _SS=SID=1A6DEABB468B65843EB5F91B47916435&CPID=1711632100038&AC=1&CPH=d1a4eb75; _EDGE_S=SID=1A6DEABB468B65843EB5F91B47916435; SRCHUID=V=2&GUID=3D32B8AC657C4AD781A584E283227995&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20231004; SRCHHPGUSR=SRCHLANG=en&IPMH=986d886c&IPMID=1696428841029&HV=1696428756; CortanaAppUID=5A290E2CC4B523E2D8B5E2E3E4CB7CB7; MUIDB=2F4E96DB8B7049E59AD4484C3C00F7CF

Source: 57C8EDB95DF3F0AD4EE2DC2B8CFD41570.4.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab
Source: ~WRS{4AC6F734-BB7D-4D58-981A-8DACD066BC33}.tmp.4.dr	String found in binary or memory: https://attacksimgcc10sa.blob.core.usgovcloudapi.net/24f1e58b-b088-4195-ba46-839e73aec371/406eb232-0

Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 --field-trial-handle=2152,i,3891293424011689669,8113640929626892547,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://www.attemplate.com/gcc/24f1e58b-b088-4195-ba46-839e73aec371/406eb232-0f42-45b3-8f82-5ddbf95d3c28/4526622a-5e47-4913-897d-b139c3f50e94/attachment?id=T3JlSlFGWnFzWFRVUk1mQzVwN1d5V3BvT0lIMGd1MmFSTncyMDRDRXRKY1dLWnk0bmZKanUwWkxaU0JRa1VvOGZhTkloMFNSY24vUTU3cFB2eGJmY090ZVc1ZUc0MHdldWRuVFdSWEtLem5UV3VXTlozS0kwTGpGTDNTT0d0SHAveERBQjJFUUNPTUhqWDY3MVJlZzhiSG14ZjVqMmdjNlVUMjh1NXpwazZLblFjeHdDQlBxblJwaVNKY1R6WUp6YnlhaHo5dTRpRFZUY2w2SGQwRW9oNzNXTFJ5MjdQN090UzNtWHIwZDVVK21OV095NHRLT0plZ29TT3EweVdZaDlhUW9lK2lmOWtpOUlmTFRYL3pDSVZzRCt2WEFBbjQyNVRQTDBoRE9IK1NXbmM3UndCdjk2dUg5QVF3MnRodGN3V2NjSCt1ZXZVbzR4VUt5dnEzcFhzOGRkRGUvYWROemJ4NDNHRkJLejRtU01ISmpOYVpEbi9GdUlJUFliMGQ1MHFBaHJCYnQzWWhMTExQcUtUU0RzQT09"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\user\Downloads\New Document.Docx" /o ""
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 --field-trial-handle=2152,i,3891293424011689669,8113640929626892547,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\user\Downloads\New Document.Docx" /o ""	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: New Document.LNK.4.dr	LNK file: ..\..\..\..\..\Downloads\New Document.Docx

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	1 Process Injection	1 Masquerading	OS Credential Dumping	1 Process Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	1 File and Directory Discovery	Remote Desktop Protocol	Data from Removable Media	3 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Extra Window Memory Injection	1 Extra Window Memory Injection	Security Account Manager	1 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Name	IP	Active	Malicious	Reputation
blob.bg8azfstr01a.store.core.usgovcloudapi.net	52.127.117.164	true	false	high
www.google.com	142.251.167.104	true	false	high
fp2e7a.wpc.phicdn.net	192.229.211.108	true	false	unknown
windowsupdatebg.s.llnwi.net	69.164.0.128	true	false	unknown
attacksimgcc10sa.blob.core.usgovcloudapi.net	unknown	unknown	false	high
www.attemplate.com	unknown	unknown	false	unknown

IP	Domain	Country	ASN	ASN Name	Malicious
142.251.167.104	www.google.com	United States	15169	GOOGLEUS	false
52.127.117.164	blob.bg8azfstr01a.store.core.usgovcloudapi.net	United States	8070	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
23.221.242.90	unknown	United States	8612	TISCALI-IT	false

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1417024
Start date and time:	2024-03-28 14:21:09 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 16s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://www.attemplate.com/gcc/24f1e58b-b088-4195-ba46-839e73aec371/406eb232-0f42-45b3-8f82-5ddbf95d3c28/4526622a-5e47-4913-897d-b139c3f50e94/attachment?id=T3JlSlFGWnFzWFRVUk1mQzVwN1d5V3BvT0lIMGd1MmFSTncyMDRDRXRKY1dLWnk0bmZKanUwWkxaU0JRa1VvOGZhTkloMFNSY24vUTU3cFB2eGJmY090ZVc1ZUc0MHdldWRuVFdSWEtLem5UV3VXTlozS0kwTGpGTDNTT0d0SHAveERBQjJFUUNPTUhqWDY3MVJlZzhiSG14ZjVqMmdjNlVUMjh1NXpwazZLblFjeHdDQlBxblJwaVNKY1R6WUp6YnlhaHo5dTRpRFZUY2w2SGQwRW9oNzNXTFJ5MjdQN090UzNtWHIwZDVVK21OV095NHRLT0plZ29TT3EweVdZaDlhUW9lK2lmOWtpOUlmTFRYL3pDSVZzRCt2WEFBbjQyNVRQTDBoRE9IK1NXbmM3UndCdjk2dUg5QVF3MnRodGN3V2NjSCt1ZXZVbzR4VUt5dnEzcFhzOGRkRGUvYWROemJ4NDNHRkJLejRtU01ISmpOYVpEbi9GdUlJUFliMGQ1MHFBaHJCYnQzWWhMTExQcUtUU0RzQT09
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	13
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal48.win@20/248@6/5
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 4770 bytes, 1 file, at 0x2c +A "disallowedcert.stl", number 1, 1 datablock, 0x1 compression
Category:	dropped
Size (bytes):	4770
Entropy (8bit):	7.946747821604857
Encrypted:	false
SSDEEP:	96:9/nBu64pydcvOHRUfu0xK1bQYMRSRNoYmxYvk56sHMZhh4m:9/nBuP2cGxUfu6K1bpWJ6vfh4m
MD5:	1BFE591A4FE3D91B03CDF26EAACD8F89
SHA1:	719C37C320F518AC168C86723724891950911CEA
SHA-256:	9CF94355051BF0F4A45724CA20D1CC02F76371B963AB7D1E38BD8997737B13D8
SHA-512:	02F88DA4B610678C31664609BCFA9D61DB8D0B0617649981AF948F670F41A6207B4EC19FECCE7385A24E0C609CBBF3F2B79A8ACAF09A03C2C432CC4DCE75E9DB
Malicious:	false
Reputation:	low
Preview:	MSCF............,...................O.................2Wqh .disallowedcert.stl....^K...CK.wTS...:.w.K'.C0T.....Bh.{....C.)......Y@...(..).R."E..D^6........u....\|f~3...o.3. ..SPK.k.o#...."{-.U..P........:..aPr.@.d......Dy.h.....)..:...!./\A.....A<I_<$...q.h..........'.....7....H...@`T..K.S.%...Y4..R.....`.....-....D...(..b..-c."...G.=.dx..S+..2.a.E....d.L...77J...c.[..@..iT&..^78..g....NW6.Ek..FY.F........cNt.O...R..........D...... k........J.y...z.d...;.9_t...].@....yw..}.x....d.t..`f\K..;\|.h.X...4/.;.xT......q>.0...<...3...X..L$.&.,b.....\V....\......G..O..@..H3.....t..J..).x.?.{[..G>.7...<...^Q..z..Gw9P..d....i].n%K}.z..2.Py...A..s...z..@...4..........4.....Y.d..._Z.5.s..fl.C..#.K{9^.E...k..z.Ma..G.(.....5g. ...}.t.#4....$;.,....S@fs....k......u .^2.#_...I........;.......w..P...UCY...$;.S._\|.x..dK...[i..q..^.l..A.?.....'N.. .L.l......m.*.+f#]............A.;.....Z..rIt....RW....Kr1e=8.=.z:Oi.z.d..r..C_......o...]j.N;.s....3@3.dgrv.

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Mar 28 12:21:55 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9742966776027187
Encrypted:	false
SSDEEP:	48:8DldLjTLLLDfHdidAKZdA19ehwiZUklqehekJy+3:8D3/P7/Yy
MD5:	5F20AAEACE4F53D781D0E5370E2E6189
SHA1:	49728176067F8AF87466EF1628A0990EF3B4EC4E
SHA-256:	17EC642116E3FDC05B9FD7234C1581B2177C92A83426A544104EA7B4883CB844
SHA-512:	B70036A032FA3D584D25C4262A2C96C6F085319FFFAC2BCBA049564D12E71A01AA041E692AB9ACD0BBBB8FCF19B30500D7136B8354654E48002012B6B6DE2360
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....~ab.....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I\|X.j....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V\|X.j....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V\|X.j....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V\|X.j..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V\|X.j...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........l.\......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 28, 2024 14:21:54.024594069 CET	53	57265	1.1.1.1	192.168.2.5
Mar 28, 2024 14:21:54.025696993 CET	53	61552	1.1.1.1	192.168.2.5
Mar 28, 2024 14:21:54.623025894 CET	53	49708	1.1.1.1	192.168.2.5
Mar 28, 2024 14:21:55.731542110 CET	58791	53	192.168.2.5	1.1.1.1
Mar 28, 2024 14:21:55.731750965 CET	60703	53	192.168.2.5	1.1.1.1
Mar 28, 2024 14:21:57.419480085 CET	61475	53	192.168.2.5	1.1.1.1
Mar 28, 2024 14:21:57.419656992 CET	61823	53	192.168.2.5	1.1.1.1
Mar 28, 2024 14:21:57.515186071 CET	53	61823	1.1.1.1	192.168.2.5
Mar 28, 2024 14:21:57.515261889 CET	53	61475	1.1.1.1	192.168.2.5
Mar 28, 2024 14:22:04.124393940 CET	55436	53	192.168.2.5	1.1.1.1
Mar 28, 2024 14:22:04.300308943 CET	53	55436	1.1.1.1	192.168.2.5
Mar 28, 2024 14:22:06.042758942 CET	49833	53	192.168.2.5	1.1.1.1
Mar 28, 2024 14:22:11.984024048 CET	53	60632	1.1.1.1	192.168.2.5
Mar 28, 2024 14:22:30.818612099 CET	53	57065	1.1.1.1	192.168.2.5
Mar 28, 2024 14:22:53.179761887 CET	53	63516	1.1.1.1	192.168.2.5
Mar 28, 2024 14:22:54.265409946 CET	53	58120	1.1.1.1	192.168.2.5

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Mar 28, 2024 14:21:55.844825029 CET	1.1.1.1	192.168.2.5	0x6d85	No error (0)	www.attemplate.com	astprod.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 28, 2024 14:21:55.844825029 CET	1.1.1.1	192.168.2.5	0x6d85	No error (0)	astprod.azurefd.net	azurefd-t-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 28, 2024 14:21:55.859061956 CET	1.1.1.1	192.168.2.5	0x350	No error (0)	www.attemplate.com	astprod.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 28, 2024 14:21:55.859061956 CET	1.1.1.1	192.168.2.5	0x350	No error (0)	astprod.azurefd.net	azurefd-t-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 28, 2024 14:21:55.859061956 CET	1.1.1.1	192.168.2.5	0x350	No error (0)	shed.dual-low.part-0012.t-0009.t-msedge.net	global-entry-afdthirdparty-fallback-first.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 28, 2024 14:21:57.515186071 CET	1.1.1.1	192.168.2.5	0x95e3	No error (0)	www.google.com			65	IN (0x0001)	false
Mar 28, 2024 14:21:57.515261889 CET	1.1.1.1	192.168.2.5	0xcd9d	No error (0)	www.google.com		142.251.167.104	A (IP address)	IN (0x0001)	false
Mar 28, 2024 14:21:57.515261889 CET	1.1.1.1	192.168.2.5	0xcd9d	No error (0)	www.google.com		142.251.167.103	A (IP address)	IN (0x0001)	false
Mar 28, 2024 14:21:57.515261889 CET	1.1.1.1	192.168.2.5	0xcd9d	No error (0)	www.google.com		142.251.167.99	A (IP address)	IN (0x0001)	false
Mar 28, 2024 14:21:57.515261889 CET	1.1.1.1	192.168.2.5	0xcd9d	No error (0)	www.google.com		142.251.167.105	A (IP address)	IN (0x0001)	false
Mar 28, 2024 14:21:57.515261889 CET	1.1.1.1	192.168.2.5	0xcd9d	No error (0)	www.google.com		142.251.167.106	A (IP address)	IN (0x0001)	false
Mar 28, 2024 14:21:57.515261889 CET	1.1.1.1	192.168.2.5	0xcd9d	No error (0)	www.google.com		142.251.167.147	A (IP address)	IN (0x0001)	false
Mar 28, 2024 14:22:04.300308943 CET	1.1.1.1	192.168.2.5	0xe137	No error (0)	attacksimgcc10sa.blob.core.usgovcloudapi.net	blob.bg8azfstr01a.store.core.usgovcloudapi.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 28, 2024 14:22:04.300308943 CET	1.1.1.1	192.168.2.5	0xe137	No error (0)	blob.bg8azfstr01a.store.core.usgovcloudapi.net		52.127.117.164	A (IP address)	IN (0x0001)	false
Mar 28, 2024 14:22:06.155236006 CET	1.1.1.1	192.168.2.5	0x977c	No error (0)	www.attemplate.com	astprod.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 28, 2024 14:22:06.155236006 CET	1.1.1.1	192.168.2.5	0x977c	No error (0)	astprod.azurefd.net	azurefd-t-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 28, 2024 14:22:06.155236006 CET	1.1.1.1	192.168.2.5	0x977c	No error (0)	shed.dual-low.part-0012.t-0009.t-msedge.net	global-entry-afdthirdparty-fallback-first.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 28, 2024 14:22:06.410295963 CET	1.1.1.1	192.168.2.5	0x6da1	No error (0)	windowsupdatebg.s.llnwi.net		69.164.0.128	A (IP address)	IN (0x0001)	false
Mar 28, 2024 14:22:06.777486086 CET	1.1.1.1	192.168.2.5	0x82b5	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 28, 2024 14:22:06.777486086 CET	1.1.1.1	192.168.2.5	0x82b5	No error (0)	fp2e7a.wpc.phicdn.net		192.229.211.108	A (IP address)	IN (0x0001)	false
Mar 28, 2024 14:22:23.089972019 CET	1.1.1.1	192.168.2.5	0x2786	No error (0)	templatesmetadata.office.net	templatesmetadata.office.net.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false

Timestamp	Bytes transferred	Direction	Data
2024-03-28 13:21:59 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-03-28 13:21:59 UTC	468	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (chd/073D) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-eus2-z1 Cache-Control: public, max-age=236490 Date: Thu, 28 Mar 2024 13:21:59 GMT Connection: close X-CID: 2

Timestamp	Bytes transferred	Direction	Data
2024-03-28 13:21:59 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-03-28 13:22:00 UTC	774	IN	HTTP/1.1 200 OK Last-Modified: Tue, 16 May 2017 22:58:00 GMT ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-CID: 7 X-CCC: US X-Azure-Ref-OriginShield: Ref A: 8BFC17DD061B46CAAD2B2AEB7B19C3D8 Ref B: CH1AA2040901011 Ref C: 2023-07-21T06:04:00Z X-MSEdge-Ref: Ref A: 1421F39FA7224BE199CC2F2C3DD24574 Ref B: CHI30EDGE0415 Ref C: 2023-07-21T06:04:00Z Content-Type: application/octet-stream X-Azure-Ref: 0DMGnYgAAAACXaXykPZuVRq4aV6pCkeO8U0pDRURHRTAzMTgAY2VmYzI1ODMtYTliMi00NGE3LTk3NTUtYjc2ZDE3ZTA1Zjdm Cache-Control: public, max-age=236469 Date: Thu, 28 Mar 2024 13:22:00 GMT Content-Length: 55 Connection: close X-CID: 2
2024-03-28 13:22:00 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Timestamp	Bytes transferred	Direction	Data
2024-03-28 13:22:04 UTC	437	OUT	GET /24f1e58b-b088-4195-ba46-839e73aec371/406eb232-0f42-45b3-8f82-5ddbf95d3c28%5C406eb232-0f42-45b3-8f82-5ddbf95d3c28-1041a756-24e9-47c4-b810-4490b2b7211d-0-attachmentImageContent.jpg?sv=2019-02-02&sr=b&sig=kHNF08XtwU3Aekfrnctycl3BWvDdRxJNmA4wSdkLPSg%3D&se=2024-04-27T20%3A21%3A59Z&sp=r HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/4.0 (compatible; ms-office; MSOffice 16) Host: attacksimgcc10sa.blob.core.usgovcloudapi.net
2024-03-28 13:22:04 UTC	573	IN	HTTP/1.1 200 OK Content-Length: 361695 Content-Type: application/octet-stream Content-MD5: qa2JNhQKJ9PY5NjCsLaBlg== Last-Modified: Thu, 28 Mar 2024 13:21:59 GMT Accept-Ranges: bytes ETag: "0x8DC4F2A0C34D83E" Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 x-ms-request-id: 3437cc16-201e-00a3-3612-81f3f3000000 x-ms-version: 2019-02-02 x-ms-creation-time: Thu, 28 Mar 2024 13:17:11 GMT x-ms-lease-status: unlocked x-ms-lease-state: available x-ms-blob-type: BlockBlob x-ms-server-encrypted: true Date: Thu, 28 Mar 2024 13:22:04 GMT Connection: close
2024-03-28 13:22:04 UTC	15811	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 ff db 00 43 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 ff c0 00 11 08 07 83 04 00 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 Data Ascii: JFIF``CC"}!1AQa"q2
2024-03-28 13:22:04 UTC	16384	IN	Data Raw: 87 ed 3d ff 00 05 c6 fd ad fe 21 7c 61 fd b0 7e 23 78 eb c6 1e 2a f0 e7 c1 c5 b5 ff 00 82 86 e8 3f 0b ff 00 62 ef 87 eb e2 2b fb 4f 87 df 08 3e 0c 59 7e cf 7e 18 d2 7c 0d 2b 5a 78 7a c3 46 f1 2f 89 3c 4b 16 a7 e2 29 75 5f 11 5f 6f bb bc bc d6 2d 75 ad 73 5f fe 82 ff 00 e0 dc ef db 3b 46 fd a2 3c 2d fb 70 7c 03 f0 0f ed 13 e3 7f da af e0 17 ec 9f fb 43 69 9a 2f ec ab f1 b3 e2 76 9f e2 f8 3e 23 eb 1f b3 7f c4 cf 0f 5d 6b fe 07 f0 97 8c b5 5f 1f 68 7e 1a f1 af 88 35 4f 87 da ae 87 e2 4f 0d 45 ab 78 af 41 d3 b5 79 ac 60 b5 8a da 24 f0 fc 3a 25 9d 97 56 1f 0f 88 a9 2a f4 2b 52 e4 c5 61 f2 b9 66 f5 96 1a 51 c7 60 68 51 a5 53 27 86 27 03 5b 31 a2 e3 41 66 58 5f ed dc 12 92 a5 0a d9 76 2e b6 1f 35 c3 e5 f8 ec 44 f2 d9 55 c5 3c 66 26 85 0a 98 79 d0 ab 1a d8 2a f9 Data Ascii: =!\|a~#x?b+O>Y~~\|+ZxzF/<K)u__o-us_;F<-p\|Ci/v>#]k_h~5OOExAy`$:%V+RafQ`hQS''[1AfX_v.5DU<f&y*
2024-03-28 13:22:04 UTC	16384	IN	Data Raw: 1c 15 0b 62 2b e5 55 2b 2c 62 c3 35 5e 34 f0 f4 aa d5 a7 4f 1f cf 4f 45 97 e3 3d 8d 6a 98 1c 5d 47 4a 9e 2a 95 39 4a 8f 3c ad 4a 5f a1 f4 57 cf bf b3 37 ed 5b fb 39 fe d9 5f 0b 74 ef 8d 5f b2 f7 c6 0f 06 7c 6a f8 65 a9 dd dc 69 b1 f8 9f c1 ba 8b dc a6 9f ab da 45 6f 3d de 85 e2 0d 26 f2 1b 3d 77 c2 fe 22 b3 b7 bb b4 b8 bc f0 f7 89 34 bd 27 5b b5 b6 bc b3 b8 b8 b0 8e 1b ab 77 93 e0 7f 8e 5f f0 5e df f8 24 27 ec e5 f1 5e 6f 82 3f 16 bf 6e 3f 86 3a 4f c4 9b 2d 66 6f 0e eb 3a 3f 85 f4 2f 89 3f 13 b4 af 0c 6b d6 ba 8f f6 4d fe 8f e3 1f 18 fc 2f f0 47 8c bc 15 e0 bd 4b 4a d4 44 96 da cd 97 8a fc 43 a3 5c 68 cd 05 cb ea b1 d9 c5 6b 70 f1 13 4e 9e 22 96 0e a2 e4 c5 d6 92 8d 1c 34 ed 0a f5 5b 8c 64 b9 29 49 c6 52 4e 33 84 94 f4 a5 69 c1 fb 6f de 53 55 33 a3 38 62 Data Ascii: b+U+,b5^4OOE=j]GJ*9J<J_W7[9_t_\|jeiEo=&=w"4'[w_^$'^o?n?:O-fo:?/?kM/GKJDC\hkpN"4[d)IRN3ioSU38b
2024-03-28 13:22:04 UTC	16384	IN	Data Raw: 7f 67 0f f8 20 df ec 47 e2 bf da 1f e3 af c1 cf 80 be 17 d4 b5 1f da 07 4e d3 bc 49 f1 9f e2 77 82 7e 17 68 17 fa 87 fc 34 c7 c5 df f4 1b 2d 63 c7 1a de 85 a7 5d 5e 7e f6 2f f4 68 2e 64 9b f7 91 fc 9f 3a e7 fa 38 f0 a7 c4 0f 01 f8 ef c1 fa 77 c4 3f 03 f8 db c2 3e 32 f0 06 b1 a6 be b3 a4 f8 e7 c2 9e 24 d1 bc 43 e0 fd 53 48 8d 64 69 35 5d 3b c4 da 45 ed e6 8b 7b a6 c6 b1 4a cf 7d 6d 7b 2d aa ac 52 16 94 04 6c 7f 9c 97 fc 13 eb fe 0d f4 f8 5b fb 7a ff 00 c1 12 ac ff 00 6d 0f 8e 3f b4 bf c7 d3 f1 43 c3 5f 0b bf 69 3d 4b f6 5c f0 4e 81 ad f8 75 7e 0e 7c 18 f0 af c2 ef 1a 7c 53 bc 4f 09 ea fe 11 d7 7c 2d ad eb 1a f5 b7 8d fe 29 69 7e 2f f1 b7 8c 27 f0 df 89 bc 1c f2 db 78 92 ce d3 4f fb 3e a9 61 7f ab ea df 41 ff 00 c1 99 9f 1b fc 71 a9 fc 22 ff 00 82 94 fe ce Data Ascii: g GNIw~h4-c]^~/h.d:8w?>2$CSHdi5];E{J}m{-Rl[zm?C_i=K\Nu~\|\|SO\|-)i~/'xO>aAq"
2024-03-28 13:22:04 UTC	16384	IN	Data Raw: e8 9e 1c d2 b4 2b 7b 68 34 9d 2a d7 e1 e5 9e b3 0c 7a 76 9f 04 16 31 5a da c4 86 15 82 10 17 cd c3 63 aa 61 78 11 f1 66 32 97 d7 f1 17 e3 6c 06 17 08 93 a5 4e b6 2b 07 99 56 c1 e5 f8 fc 6d 4a 0e 35 7d 9e 4b 2a d9 6c 68 e0 f0 b4 e9 2c 6e 1e 9e 67 5f 19 88 95 79 61 55 1e bc 46 0a 55 f8 ab 0d c3 78 5a bf 54 a7 57 0d c1 f8 bc 46 37 92 38 8a d1 85 7a 79 7d 7c c7 0f 83 c3 d4 7c 91 ad 9b a5 98 53 a9 5a bd 4a d0 c3 4f 11 97 d1 c1 e1 e1 cb 5a 73 fc 55 fd aa 3f e0 f2 af d9 73 e1 d7 c5 5b ef 85 bf b1 b7 ec a7 f1 4b f6 d3 3a 46 af 7b a4 5c f8 e5 fc 6f 0f c1 5f 07 78 a3 fb 3e d6 e2 ea f7 53 f8 67 6f 17 c3 ef 8b 7e 39 f1 5e 91 00 81 93 ed be 20 f0 57 81 fe d1 15 b6 a1 a8 d9 45 75 a3 c3 61 a8 ea 9f 66 ff 00 c1 2a 3f e0 e7 df d8 eb fe 0a 5b f1 5f c3 7f b3 8f 88 fe 1d f8 Data Ascii: +{h4zv1Zcaxf2lN+VmJ5}Klh,ng_yaUFUxZTWF78zy}\|\|SZJOZsU?s[K:F{\o_x>Sgo~9^ WEuaf*?[_
2024-03-28 13:22:04 UTC	16384	IN	Data Raw: 33 c6 5e 0f d1 3c 3f ad e9 be 3a fb 9b 51 f8 37 f0 df 56 f8 c5 e1 3f 8f da 87 87 3e d1 f1 6f c0 ff 00 0e bc 73 f0 9f c2 fe 2c fe d8 d7 a2 fe cb f0 07 c4 9f 11 78 0f c5 7e 35 d0 3f b0 61 d5 23 f0 cd ef f6 d6 bf f0 cb c1 17 ff 00 da ba 8e 8d 77 ad 69 df d8 9f 65 d2 75 2b 0b 2d 4b 57 b6 bf f3 2f 8e 9f b1 f7 c0 6f da 2b c4 5e 19 f1 a7 c4 4d 0f c7 5a 47 c4 1f 07 e9 1a a7 86 f4 0f 89 ff 00 06 3e 36 fc 71 fd 9b 3e 2c 5a f8 47 5c ba b4 d4 75 9f 02 dd 7c 56 fd 9c fe 23 7c 2a f8 8b ab 7c 3e d5 35 6d 3f 4c d7 6f fe 1f eb 1e 26 bf f0 65 df 88 74 9d 23 c4 33 68 4f ad e9 3a 75 fd af 65 49 41 c3 2c 5e c5 54 96 1b 0d 99 d0 c5 c1 54 96 1a 33 ab 5a be 72 b2 8c 44 25 49 49 e2 16 55 86 c5 e5 d1 95 1c 4b be 21 d0 8b ab 5f 17 88 cb b0 55 71 bd 11 8c 63 2c cb 92 73 8a c5 53 ca Data Ascii: 3^<?:Q7V?>os,x~5?a#wieu+-KW/o+^MZG>6q>,ZG\u\|V#\|*\|>5m?Lo&et#3hO:ueIA,^TT3ZrD%IIUK!_Uqc,sS
2024-03-28 13:22:04 UTC	16384	IN	Data Raw: 3c 54 14 5a a1 3c 33 a7 c5 18 ec 54 69 ff 00 bc ac 3e 4f 7a b0 a4 e7 99 ff 00 64 7f 50 7e 3a d7 af 74 cf 87 3e 31 f1 3f 85 f5 af 04 e9 fa 8e 9f e0 9f 10 eb de 1e f1 0f 8e b5 19 6d 3e 1c d8 de da 68 57 9a 86 93 ad 78 c7 56 d3 e6 8e 7b 6f 04 db 4f 1d bd f7 88 75 1b 1b 84 96 1d 09 2f 2e 6d a6 57 54 71 e0 96 ff 00 b5 77 c1 ef 85 5f 05 be 1e f8 e3 f6 ac fd a4 ff 00 64 ff 00 86 fe 20 bd f8 53 f0 eb c6 fe 3e f1 7d bf c6 2f 0b f8 3f e0 b5 dd cf 8b ed f4 dd 24 f8 bf e1 ef 88 3e 23 f8 8f 4e bd 9f e1 4f 8a 3c 67 75 36 9b f0 eb 5f d6 ae de 4d 6e de e3 4d b3 37 77 3a ac af 1b 79 af 87 be 09 59 fc 2a ff 00 82 66 cf f0 0f e1 ad a7 c5 af 10 e9 fe 16 fd 8e fc 4d e0 3f 00 68 7f 13 34 7f 0f 8f 8c 92 d9 bf c2 ad 56 cb c2 be 10 f1 27 86 7e 1e 78 6f c3 7e 1b b4 f1 6e 99 05 cd Data Ascii: <TZ<3Ti>OzdP~:t>1?m>hWxV{oOu/.mWTqw_d S>}/?$>#NO<gu6_MnM7w:yY*fM?h4V'~xo~n
2024-03-28 13:22:05 UTC	16384	IN	Data Raw: c4 0e 52 58 5d 5d 18 76 2a 7a 11 dd 58 65 59 4f 0c a4 a9 04 12 2b a7 ff 00 84 cf 57 ff 00 9e 76 5f f7 e6 5f fe 3f 5c 95 15 8d 4c 3d 1a cd 3a b4 a1 51 c5 34 9c 95 da 4d dd ab a6 b4 be bd 7e 46 f4 71 58 8a 0a 51 a3 5a a5 25 26 9c 94 25 64 da 56 4d a6 9a bd b4 be 9a 6f 7d 2d d6 ff 00 c2 67 ab ff 00 cf 3b 2f fb f3 2f ff 00 1f a3 fe 13 3d 5f fe 79 d9 7f df 99 7f f8 fd 72 54 56 7f 52 c2 7f d0 3d 2f fc 05 ff 00 f2 66 bf da 38 ef fa 0b ad ff 00 81 2f fe 40 ec a2 f1 b6 a2 ac 3c eb 6b 39 57 b8 45 9a 27 3e c1 8c b2 28 ff 00 bf 66 ba 9d 33 c5 3a 76 a0 cb 14 84 d9 dc 31 01 63 99 81 8d d8 ff 00 0c 73 00 aa 49 3c 05 75 8d 98 f0 aa c6 bc 92 8a ca ae 5b 85 a9 16 a3 4f d9 4b a4 a9 b6 ac fc e2 dc a3 25 dd 68 fb 34 74 50 cd f1 b4 64 9c aa 7b 78 5f 58 55 49 dd 79 4e 31 8c e2 Data Ascii: RX]]v*zXeYO+Wv__?\L=:Q4M~FqXQZ%&%dVMo}-g;//=_yrTVR=/f8/@<k9WE'>(f3:v1csI<u[OK%h4tPd{x_XUIyN1
2024-03-28 13:22:05 UTC	16384	IN	Data Raw: 65 35 26 bf b4 33 4a b8 bc 47 33 9c a8 53 c1 29 b8 1f d6 3c 27 c0 9c 39 c1 d4 54 72 ac 1a 9e 36 54 f9 31 19 ae 2f 92 b6 61 5d 34 b9 e2 aa f2 a8 61 68 49 af f7 6c 24 28 d2 b7 2a a9 3a ee 29 8b 6a db 75 cf 09 bf f7 3c 5b e1 d7 cf 4c 6d d4 a1 e6 be df af 87 14 ed d4 bc 3e f9 c6 cf 12 68 4f f9 6a 30 57 dc 75 fd fd fb 39 aa 5f 84 fc 53 a5 fc bc 53 c3 35 6d fe 3e 1a cc 29 7f ee 33 f9 9f e9 49 1f f8 59 e0 e9 f7 c9 f3 78 7f e0 39 b6 16 7f fb 70 51 45 57 bb ba 8a ce 09 2e 26 38 48 c6 70 3e f3 b1 e1 51 47 76 63 c0 ec 3a 92 14 12 3f d1 d4 9b 69 25 76 da 49 2d db 7b 23 f9 61 b5 14 e5 26 92 49 b6 de c9 2d 5b 33 f5 8d 4d 74 fb 7c 21 06 e6 60 56 15 e0 ed ec 65 61 fd d4 cf ca 0f de 7c 0c 60 31 1e 70 cc cc cc cc 4b 33 12 cc c4 92 59 89 c9 24 9e 49 24 e4 93 c9 35 66 f2 ee Data Ascii: e5&3JG3S)<'9Tr6T1/a]4ahIl$(*:)ju<[Lm>hOj0Wu9_SS5m>)3IYx9pQEW.&8Hp>QGvc:?i%vI-{#a&I-[3Mt\|!`Vea\|`1pK3Y$I$5f
2024-03-28 13:22:05 UTC	16384	IN	Data Raw: 2d 7f e0 2f 82 75 af 10 ea be 29 d3 f5 0f 1c 78 27 5a f1 0b c5 2f 89 ae 3e 1e 78 eb c4 de 0b b7 f1 34 f0 42 96 d0 de eb 7a 7e 8b a8 5b e9 f7 5a a4 76 f1 ad b8 d6 63 b5 83 58 68 55 62 92 fd d2 38 c2 43 a8 7e cf 5f 0e 2e f4 5f 02 e8 36 09 e2 bf 0c d9 fc 37 8f 58 8b c2 17 3e 13 f1 c7 8b 3c 3d ac 69 c9 af aa ae b2 25 d7 ac 35 68 f5 ab f3 a8 ed 66 bb 7b eb fb 87 9d e5 95 a4 66 32 36 6a 19 c6 4d f5 aa b8 d9 fb 79 56 c5 4e bf b9 53 0b 8a 9c 30 38 6a f9 36 23 01 f5 19 c2 96 67 46 8e 2f 0b 87 af 2a 11 c2 7d 52 18 2a f4 f0 70 92 95 4a 73 72 a5 38 9e 51 9c 7d 56 9e 0e 1e c2 34 70 b0 a1 ef d3 c4 e1 a1 3c 6e 22 8e 6f 43 1d f5 d8 ce a6 5b 5a b6 13 13 5e 84 6b cb 17 f5 a9 e3 28 d4 c5 ce 2e 34 ea 41 46 a4 70 fc 41 a4 78 b3 53 f1 8f ec cf ab 6b 3e 17 b1 d2 75 1d 0f c6 be Data Ascii: -/u)x'Z/>x4Bz~[ZvcXhUb8C~_._67X><=i%5hf{f26jMyVNS08j6#gF/}RpJsr8Q}V4p<n"oC[Z^k(.4AFpAxSk>u

Timestamp	Bytes transferred	Direction	Data
2024-03-28 13:22:10 UTC	240	OUT	GET /fs/4.38/flatFontAssets.pkg HTTP/1.1 Connection: Keep-Alive Content-Type: application/octet-stream Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Word 16.0.16827; Pro) Host: fs.microsoft.com
2024-03-28 13:22:10 UTC	501	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=flatFontAssets.pkg; filename*=UTF-8''flatFontAssets.pkg Content-Type: application/octet-stream ETag: "0xDC68D4217F953894BFCE1FAC67F2F6C8A70AE47EE5FDD6710C884557AF82AE77" Last-Modified: Mon, 20 Nov 2023 21:03:10 GMT Server: Kestrel X-CID: 11 Cache-Control: public, max-age=114589 Date: Thu, 28 Mar 2024 13:22:10 GMT Transfer-Encoding: chunked Connection: close Connection: Transfer-Encoding X-CID: 2
2024-03-28 13:22:10 UTC	15883	IN	Data Raw: 30 30 30 30 43 30 30 30 0d 0a 50 4b 03 04 14 00 02 00 08 00 fc 4b 74 57 20 ef 8c 9f 3d 10 01 00 c0 ef 07 00 14 00 1c 00 43 61 74 61 6c 6f 67 2f 4c 69 73 74 41 6c 6c 2e 4a 73 6f 6e 20 a2 18 00 28 a0 14 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 cc bd 7b af 64 49 72 1f f6 55 2e fa ef 4b 23 df 0f fe c7 79 2f 77 7a b6 3d dd 2b c9 10 08 a3 ba bb b6 bb d8 b7 ab 5a 75 ef 9d 99 b6 20 80 26 25 18 02 61 ca b4 29 82 80 48 3f 60 cb 02 64 50 a4 25 ca 22 44 ae f4 61 96 5c 3e 85 fd 0a 8e 38 cf cc 3c 91 e7 e4 79 54 77 ef ec cc ce ce 54 e6 c9 f8 65 64 64 44 64 3c fe e1 83 87 bb 5f 3e 9d ff ce fe 7c 7b 38 1d 1f fc bc ba 7e f0 f0 70 0c fe 81 74 d7 0f 3e fd ee cd e1 bc bb ab fe 3f 87 5f 7c 76 3a de dd 3e f8 f9 bf ff 0f 1f ec e0 af 4a 78 e5 8d f1 9c ff d2 Data Ascii: 0000C000PKKtW =Catalog/ListAll.Json ({dIrU.K#y/wz=+Zu &%a)H?`dP%"Da\>8<yTwTeddDd<_>\|{8~pt>?_\|v:>Jx
2024-03-28 13:22:10 UTC	15839	IN	Data Raw: e0 eb 8e c2 23 8d 14 1d e6 12 f2 45 3b 5c 2d 23 4e 8c f6 82 0c 50 5a 48 1a 3a d7 30 55 a8 d7 03 da e8 9b 0d 48 2b d9 e1 97 af 41 d9 fd e1 f7 0a b6 38 f8 25 9a 25 9c 0b f2 21 c9 d0 66 49 37 bc 47 a2 9f b0 2d ee 6a c1 54 05 d9 20 16 9d e3 28 4c b8 f6 0d f6 c1 6d 3e 93 1e 44 10 18 b7 02 76 82 f4 70 2d a6 12 8c 2e 89 35 0d 4c 1c 23 69 37 a5 b2 64 e3 0f 2f f6 37 13 0d 34 a3 74 89 66 40 88 8e f7 82 ce 22 b2 b4 d9 d5 7e b3 07 a7 5b 44 db fa 01 a0 71 52 fa a4 4a 87 ac 6c 05 51 90 0e a1 b1 3e a4 f5 d7 e8 83 b4 d6 7b f8 5b 63 b5 c3 0e 55 c2 35 6e 0b b8 f4 04 1d 29 3f 41 76 52 e9 d5 4a ba 6a d7 52 ea 41 bf 63 58 88 46 67 a8 9f 2a c4 84 d4 6b 0b f8 45 d4 57 2c 02 d4 ab 1c f5 63 09 55 2d f5 31 e1 a0 3c 90 8f 35 4b 09 87 c5 1a 30 11 43 9d bf 3a f8 b2 f1 f6 6e 4d 78 41 Data Ascii: #E;\-#NPZH:0UH+A8%%!fI7G-jT (Lm>Dvp-.5L#i7d/74tf@"~[DqRJlQ>{[cU5n)?AvRJjRAcXFg*kEW,cU-1<5K0C:nMxA
2024-03-28 13:22:10 UTC	16384	IN	Data Raw: 64 9c 93 f2 25 0e 7b 88 39 29 b2 4c 96 69 bb 1c 2e ec 1d 09 6b 52 f2 25 0e 7b 72 00 10 a7 22 2b ce 5c be 95 9d 16 de c0 ca 5e ec b0 ff fa fe 78 5c 72 d6 a7 f1 c9 bd 4e a9 41 bc 10 94 10 7c 74 24 4f b4 90 a1 2f 95 b4 98 15 92 b6 d6 56 ad ca fc 65 27 3d 81 9a dd ea 54 18 c6 85 88 a5 06 03 d8 6b 19 27 0c 4c 88 67 de c3 2e 3d e7 01 e2 18 2c d3 54 8a e3 85 60 e1 02 85 7b 0e c4 78 64 ab 99 cd c0 ce 9c f2 78 e7 77 9b 98 ac ad 7b e9 26 b6 16 73 86 65 fa c4 b9 d5 26 6e 38 e3 bf bd 3f 3d 34 1f f0 7e 70 74 91 2b 4e 3d 7a 0a 4d 3b 65 86 cf 8d 54 99 be 3f 84 33 00 1e a7 18 d3 2f 72 ae 43 84 c9 3e b7 92 3a d4 ab 81 62 38 1d 76 5d 95 e6 45 8e f3 00 34 c6 68 0c e5 61 5b 8f d1 83 6e 02 46 f0 0b 9d e2 60 6f 23 38 29 28 7d 64 35 38 2d bd d4 b0 02 eb 5f ec f0 fe ee f0 f0 f1 Data Ascii: d%{9)Li.kR%{r"+\^x\rNA\|t$O/Ve'=Tk'Lg.=,T`{xdxw{&se&n8?=4~pt+N=zM;eT?3/rC>:b8v]E4ha[nF`o#8)(}d58-_
2024-03-28 13:22:10 UTC	1058	IN	Data Raw: e4 31 92 42 84 d4 d7 1b ad 99 70 eb 92 6b 8e f7 0e 23 74 ed 70 d4 e0 5f f7 9a 61 15 99 50 3a a9 ad 88 9d 7b 5d ca 0b 4f 77 0c 23 e2 f8 f3 f5 83 60 c4 c4 6f 6e f5 7e eb 9f 25 7c 94 81 d0 f5 c4 22 57 9e d6 f2 64 5a 79 25 14 0f 83 bb cd 46 4b 27 b2 0e 2a 4b cf b6 3b e1 61 cd 11 c0 85 a4 b5 57 c6 44 e9 46 1b 23 98 25 7e a2 71 78 4f 68 5c e1 51 c5 3e 4c c6 4a 15 e5 af 6c 7c 54 67 c9 9e 29 15 b6 b0 db 33 75 02 2c 62 a3 0c 9f 1e 69 71 c1 76 2b 9a e7 86 7e 75 f9 e9 be 71 85 fb 2a 43 81 4f ea de 7a 13 d5 dc db 18 45 2d 17 ef f7 87 9b e3 bf 39 6f 9a 72 70 bb 0d 52 74 fa 09 69 e6 2d 1c 94 3c ae 60 fa f1 21 e1 50 e1 86 e3 4c af da 71 b8 18 cf 39 3f ab 24 03 58 eb 5d ab 5a ff fb c3 63 bd aa 4f 64 c1 e0 e8 a8 8c 15 3e 7c e5 bb 33 1a d6 67 30 30 d0 fd 38 ac 25 71 47 89 Data Ascii: 1Bpk#tp_aP:{]Ow#`on~%\|"WdZy%FK'K;aWDF#%~qxOh\Q>LJl\|Tg)3u,biqv+~uqCOzE-9orpRti-<`!PLq9?$X]ZcOd>\|3g008%qG
2024-03-28 13:22:10 UTC	14816	IN	Data Raw: 30 30 30 30 33 39 44 34 0d 0a e0 d5 2a ae a7 eb 0c ec 58 46 39 7c d3 dd 31 3c 8e 08 2e 18 98 7e 1b 55 fc 2f 01 6a 68 65 40 00 4a bd 58 9e 30 cf 69 5c 12 0b f3 61 98 f2 f3 e0 5a c0 28 e2 d5 81 78 00 2a cf 19 ca 09 30 b8 17 41 81 ba b4 35 ea dc 46 a4 1f 1f 5a f0 a5 67 8d 68 5c 3c 0b 53 63 6c 05 18 c0 f2 79 60 2e 65 63 dc 97 82 68 73 50 9b 34 a4 eb 39 0d 47 9d 99 8d 7a 89 94 10 16 f2 62 9b 10 26 9c 94 44 d5 96 59 a0 9d 33 96 c1 a1 bc b8 3d 4e 1b d0 05 ac 4c d0 f9 39 74 81 43 02 e4 a7 44 63 61 5f 48 85 07 8c 0a a4 64 63 12 9e 59 7a 7c 5f 79 46 3a 94 2c 76 a5 35 d2 ce aa f9 96 29 d4 3a 53 86 e9 92 ee 49 c3 03 4b 8b 83 fe 89 de db 67 81 b7 80 6d f1 63 07 23 62 2d 4b 13 86 2c 00 d0 46 2d 16 c5 de 17 59 e1 cd 63 16 59 c2 39 45 14 7e a8 03 54 16 ac 21 83 41 43 cf Data Ascii: 000039D4XF9\|1<.~U/jhe@JX0i\aZ(x0A5FZgh\<Scly`.echsP49Gzb&DY3=NL9tCDca_HdcYz\|_yF:,v5):SIKgmc#b-K,F-YcY9E~T!AC
2024-03-28 13:22:10 UTC	16384	IN	Data Raw: 30 30 30 30 34 30 30 30 0d 0a 6c d6 3d 3e 5b c6 f1 91 5b 8e 29 e1 52 f3 24 25 dc 7b 4d 52 b9 0b 52 de 3e c6 10 b1 6a d5 39 c1 26 02 32 7b 8e 35 4d 77 85 97 bf 97 2c 80 97 75 f0 00 1b 95 88 18 98 41 09 5b c3 8c c5 16 6b af 81 52 2c 44 19 b7 92 11 f5 9b 9d 60 4e c7 41 bd d3 8a af 0c 60 eb c5 55 e4 7b 74 e3 ca 89 07 fc 36 4f bc 89 6c d6 0f 11 60 66 5d 9c c4 42 78 0b c9 96 c7 8a 02 ed 88 ea 0a ed 79 23 4c b8 d2 94 e6 2b 23 c3 ba b9 33 0b 1a 5d 08 b3 20 25 51 8f a6 0b 2d 98 6e 0e e3 49 d7 c5 c8 2e 44 bb 86 a8 49 01 55 26 88 06 1e 33 13 83 68 95 de 09 2c bc bd ef e1 cc 83 4b 97 02 cd e9 2a 88 ec 9f 2e bc c0 c4 5a 72 c5 f8 ba 68 b3 85 78 17 12 36 07 49 b4 d0 a9 8b 59 cd 34 6a 7a 60 e0 be 86 0e b0 10 59 ce ad 65 6a 4b 7d ce 18 c7 09 72 56 80 16 b0 2e a7 a0 9b 70 Data Ascii: 00004000l=>[[)R$%{MRR>j9&2{5Mw,uA[kR,D`NA`U{t6Ol`f]Bxy#L+#3] %Q-nI.DIU&3h,K*.Zrhx6IY4jz`YejK}rV.p
2024-03-28 13:22:10 UTC	12	IN	Data Raw: b5 c3 01 97 46 45 de 64 4f f8 0d 0a Data Ascii: FEdO
2024-03-28 13:22:10 UTC	16384	IN	Data Raw: 30 30 30 31 38 30 30 30 0d 0a f1 b1 be d3 5c 36 33 17 8f fb 7c 11 87 33 52 4a 86 ba 32 16 d3 97 dd 0e 9b 26 52 13 90 33 f6 90 a3 29 de 38 ef 79 bf dd ee f7 db e5 c0 f4 46 33 55 5d 4d 5b 65 1c 97 45 be c6 a8 ac c2 37 7c 36 10 ca 06 72 74 8e b1 d8 a6 df b3 59 98 6c 96 b1 b9 49 cd f4 51 e4 d2 e9 47 dc c6 6c 96 b7 c8 84 93 44 26 77 6b bf 5d 3f fd ac d3 4a 67 b3 b4 28 93 34 6b 93 1b 6f 7d 68 69 c9 2d bf 6a b5 40 23 2f 48 44 6b 13 b8 9c f2 9d 8e 8e 2f 29 ef 9f c0 72 47 59 75 42 7e 65 d3 17 9c 02 c8 c2 85 ab 45 13 9f 31 16 22 ab 99 33 4f e8 df 3b b4 7f cb bc 3d 3d ca b5 c7 6c 5e b9 72 dd 96 65 c8 8e f8 83 7f 4a 4d 92 57 91 17 05 d1 72 74 3a 3a 0f 3d 80 1e 43 2f 60 13 ee 00 cf b6 0b 9f 8a 6f 80 ea e5 3e f0 6d 2f e1 37 f0 34 09 92 34 e9 27 3b 66 fd 5c a0 ec e7 d4 Data Ascii: 00018000\63\|3RJ2&R3)8yF3U]M[eE7\|6rtYlIQGlD&wk]?Jg(4ko}hi-j@#/HDk/)rGYuB~eE1"3O;==l^reJMWrt::=C/`o>m/744';f\
2024-03-28 13:22:10 UTC	16384	IN	Data Raw: fe ce e0 9f e0 7b 15 7a bd 42 a1 d3 7d 9c 74 80 bd ab 85 20 5a 84 1d 72 4f 85 fa fe 89 95 8f c0 45 0a b1 6e 5b b9 e9 ad 39 e8 7f 75 cf 3d cf bd f1 c8 23 07 00 9e 3a 72 24 45 fe b7 ce 2a 63 73 58 19 16 8b 6b 08 c2 43 2b 67 17 e1 d5 c5 e2 ca d9 f0 09 55 b0 1e 0c d5 03 1a f2 8b e0 dd e5 42 29 47 ae 68 4e 66 dc 62 56 9a 8e c5 a6 cb 18 c5 25 86 57 23 46 63 a4 8a 3b 3b e9 f7 4e 04 d1 1f 7d e3 e8 1f bd 4f c3 1f ae b3 c5 91 e6 ac f0 01 e4 72 e4 56 e4 b3 c8 57 90 ef 53 3d c2 5f 20 af 50 d8 54 42 a1 d3 24 a8 82 61 b0 0c 0e 82 cf 80 7b c0 57 8e 59 26 58 67 99 f4 5a dd b6 81 30 8f 87 1f ed b3 98 89 56 c3 6e ee a9 59 b5 4a 3a 0d e3 09 56 09 88 55 03 50 b4 d7 f2 49 8e 37 c8 b7 63 d4 36 48 7a ee d2 06 d6 ed 99 38 6e 85 da 5b da 63 6b e1 97 07 28 b0 53 c8 72 a2 31 c6 8f Data Ascii: {zB}t ZrOEn[9u=#:r$E*csXkC+gUB)GhNfbV%W#Fc;;N}OrVWS=_ PTB$a{WY&XgZ0VnYJ:VUPI7c6Hz8n[ck(Sr1
2024-03-28 13:22:10 UTC	54	IN	Data Raw: 25 cd 56 f4 7a a4 2a 3f 72 fb b9 b9 85 2d d3 d7 1c 26 ad 18 33 bd 5a 7a d9 a0 43 d1 a1 51 10 35 55 f7 75 c1 bb f6 90 4a e1 3e 2b 10 46 ac 62 77 c7 73 0a 8d 64 cc Data Ascii: %Vz*?r-&3ZzCQ5UuJ>+Fbwsd

Timestamp	Bytes transferred	Direction	Data
2024-03-28 13:22:11 UTC	2148	OUT	POST /threshold/xls.aspx HTTP/1.1 Origin: https://www.bing.com Referer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/Init Accept: / Accept-Language: en-CH Content-type: text/xml X-Agent-DeviceId: 01000A410900D492 X-BM-CBT: 1696428841 X-BM-DateFormat: dd/MM/yyyy X-BM-DeviceDimensions: 784x984 X-BM-DeviceDimensionsLogical: 784x984 X-BM-DeviceScale: 100 X-BM-DTZ: 120 X-BM-Market: CH X-BM-Theme: 000000;0078d7 X-BM-WindowsFlights: FX:117B9872,FX:119E26AD,FX:11C0E96C,FX:11C6E5C2,FX:11C7EB6A,FX:11C9408A,FX:11C940DB,FX:11CB9A9F,FX:11CB9AC1,FX:11CC111C,FX:11D5BFCD,FX:11DF5B12,FX:11DF5B75,FX:1240931B,FX:124B38D0,FX:127FC878,FX:1283FFE8,FX:12840617,FX:128979F9,FX:128EBD7E,FX:129135BB,FX:129E053F,FX:12A74DB5,FX:12AB734D,FX:12B8450E,FX:12BD6E73,FX:12C3331B,FX:12C7D66E X-Device-ClientSession: DB0AFB19004F47BC80E5208C7478FF22 X-Device-isOptin: false X-Device-MachineId: {92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A} X-Device-OSSKU: 48 X-Device-Touch: false X-DeviceID: 01000A410900D492 X-MSEdge-ExternalExp: d-thshld39,d-thshld42,d-thshld77,d-thshld78,staticsh X-MSEdge-ExternalExpType: JointCoord X-PositionerType: Desktop X-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUI X-Search-CortanaAvailableCapabilities: None X-Search-SafeSearch: Moderate X-Search-TimeZone: Bias=-60; DaylightBias=-60; TimeZoneKeyName=W. Europe Standard Time X-UserAgeClass: Unknown Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: www.bing.com Content-Length: 2484 Connection: Keep-Alive Cache-Control: no-cache Cookie: MUID=2F4E96DB8B7049E59AD4484C3C00F7CF; _SS=SID=1A6DEABB468B65843EB5F91B47916435&CPID=1711632100038&AC=1&CPH=d1a4eb75; _EDGE_S=SID=1A6DEABB468B65843EB5F91B47916435; SRCHUID=V=2&GUID=3D32B8AC657C4AD781A584E283227995&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20231004; SRCHHPGUSR=SRCHLANG=en&IPMH=986d886c&IPMID=1696428841029&HV=1696428756; CortanaAppUID=5A290E2CC4B523E2D8B5E2E3E4CB7CB7; MUIDB=2F4E96DB8B7049E59AD4484C3C00F7CF
2024-03-28 13:22:11 UTC	1	OUT	Data Raw: 3c Data Ascii: <
2024-03-28 13:22:11 UTC	2483	OUT	Data Raw: 43 6c 69 65 6e 74 49 6e 73 74 52 65 71 75 65 73 74 3e 3c 43 49 44 3e 33 36 34 34 46 44 37 34 44 46 31 36 36 31 38 46 30 38 46 37 45 43 30 33 44 45 35 35 36 30 30 31 3c 2f 43 49 44 3e 3c 45 76 65 6e 74 73 3e 3c 45 3e 3c 54 3e 45 76 65 6e 74 2e 43 6c 69 65 6e 74 49 6e 73 74 3c 2f 54 3e 3c 49 47 3e 37 35 32 32 38 31 35 36 37 30 33 41 34 30 44 35 42 39 37 45 35 41 36 38 33 36 46 32 41 31 43 45 3c 2f 49 47 3e 3c 44 3e 3c 21 5b 43 44 41 54 41 5b 7b 22 43 75 72 55 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 62 69 6e 67 2e 63 6f 6d 2f 41 53 2f 41 50 49 2f 57 69 6e 64 6f 77 73 43 6f 72 74 61 6e 61 50 61 6e 65 2f 56 32 2f 49 6e 69 74 22 2c 22 50 69 76 6f 74 22 3a 22 51 46 22 2c 22 54 22 3a 22 43 49 2e 42 6f 78 4d 6f 64 65 6c 22 2c 22 46 49 44 22 3a 22 43 49 Data Ascii: ClientInstRequest><CID>3644FD74DF16618F08F7EC03DE556001</CID><Events><E><T>Event.ClientInst</T><IG>75228156703A40D5B97E5A6836F2A1CE</IG><D><![CDATA[{"CurUrl":"https://www.bing.com/AS/API/WindowsCortanaPane/V2/Init","Pivot":"QF","T":"CI.BoxModel","FID":"CI
2024-03-28 13:22:12 UTC	480	IN	HTTP/1.1 204 No Content Access-Control-Allow-Origin: * Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 3AFFBCA3ECF2449CA6A5668879D8CF4F Ref B: LAX311000109049 Ref C: 2024-03-28T13:22:12Z Date: Thu, 28 Mar 2024 13:22:12 GMT Connection: close Alt-Svc: h3=":443"; ma=93600 X-CDN-TraceID: 0.5ded0117.1711632131.3b785515

Target ID:	0
Start time:	14:21:49
Start date:	28/03/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

System Summary

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

C:\Users\user\AppData\Local\Microsoft\FontCache\4\Catalog\ListAll.Json

C:\Users\user\AppData\Local\Microsoft\FontCache\4\PreviewFont\flat_officeFontsPreview_4_38.ttf

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\56a61aeb75d8f5be186c26607f4bb213abe7c5ec.tbres

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\5A733EB3.tmp

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\5B46FD9D.jpg

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\A2508118.tmp

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\AFFC6EFA.jpg

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{4AC6F734-BB7D-4D58-981A-8DACD066BC33}.tmp

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{AE632981-55C6-4907-9620-D41D25D44392}.tmp

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{E2835D90-D911-4EBE-BAAF-3E57730057BB}.tmp

C:\Users\user\AppData\Local\Temp\Diagnostics\WINWORD\App1711632122545713300_22183A70-CB7A-4A38-92A0-C43819997C1D.log

C:\Users\user\AppData\Local\Temp\Diagnostics\WINWORD\App1711632122546322900_22183A70-CB7A-4A38-92A0-C43819997C1D.log

C:\Users\user\AppData\Local\Temp\TCD7B8B.tmp\Content.inf

C:\Users\user\AppData\Local\Temp\TCD7B8B.tmp\TabbedArc.glox

C:\Users\user\AppData\Local\Temp\TCD7BAD.tmp\Content.inf

C:\Users\user\AppData\Local\Temp\TCD7BAD.tmp\gostname.xsl

C:\Users\user\AppData\Local\Temp\TCD7BBE.tmp\CircleProcess.glox

C:\Users\user\AppData\Local\Temp\TCD7BBE.tmp\Content.inf

C:\Users\user\AppData\Local\Temp\TCD7BEF.tmp\BracketList.glox

C:\Users\user\AppData\Local\Temp\TCD7BEF.tmp\Content.inf

C:\Users\user\AppData\Local\Temp\TCD7C10.tmp\Content.inf

C:\Users\user\AppData\Local\Temp\TCD7C10.tmp\chevronaccent.glox

Target ID:	1
Start time:	14:21:51
Start date:	28/03/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 --field-trial-handle=2152,i,3891293424011689669,8113640929626892547,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Target ID:	3
Start time:	14:21:55
Start date:	28/03/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://www.attemplate.com/gcc/24f1e58b-b088-4195-ba46-839e73aec371/406eb232-0f42-45b3-8f82-5ddbf95d3c28/4526622a-5e47-4913-897d-b139c3f50e94/attachment?id=T3JlSlFGWnFzWFRVUk1mQzVwN1d5V3BvT0lIMGd1MmFSTncyMDRDRXRKY1dLWnk0bmZKanUwWkxaU0JRa1VvOGZhTkloMFNSY24vUTU3cFB2eGJmY090ZVc1ZUc0MHdldWRuVFdSWEtLem5UV3VXTlozS0kwTGpGTDNTT0d0SHAveERBQjJFUUNPTUhqWDY3MVJlZzhiSG14ZjVqMmdjNlVUMjh1NXpwazZLblFjeHdDQlBxblJwaVNKY1R6WUp6YnlhaHo5dTRpRFZUY2w2SGQwRW9oNzNXTFJ5MjdQN090UzNtWHIwZDVVK21OV095NHRLT0plZ29TT3EweVdZaDlhUW9lK2lmOWtpOUlmTFRYL3pDSVZzRCt2WEFBbjQyNVRQTDBoRE9IK1NXbmM3UndCdjk2dUg5QVF3MnRodGN3V2NjSCt1ZXZVbzR4VUt5dnEzcFhzOGRkRGUvYWROemJ4NDNHRkJLejRtU01ISmpOYVpEbi9GdUlJUFliMGQ1MHFBaHJCYnQzWWhMTExQcUtUU0RzQT09"
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	4
Start time:	14:22:00
Start date:	28/03/2024
Path:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\user\Downloads\New Document.Docx" /o ""
Imagebase:	0x510000
File size:	1'620'872 bytes
MD5 hash:	1A0C2C2E7D9C4BC18E91604E9B0C7678
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre