Edit tour

Windows Analysis Report
Quarantined Messages (12).zip

Overview

General Information

Sample name:	Quarantined Messages (12).zip
Analysis ID:	1417074
MD5:	f9919d41ecc241b692ee46640c91e7cc
SHA1:	c2802e6fa4729fcb4629ae1f4728a4d5a3c1480c
SHA256:	a70ba12a44ff6822f02edf94d3b8b4c6eb89b62ce09bd990c97949dd522aae05
Infos:

Detection

Score:	48
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Snort IDS alert for network traffic

Creates a window with clipboard capturing capabilities

Queries the volume information (name, serial number etc) of a device

Sigma detected: Excel Network Connections

Sigma detected: Office Autorun Keys Modification

Sigma detected: Office Macro File Download

Sigma detected: Outlook Security Settings Updated - Registry

Sigma detected: Suspicious Office Outbound Connections

Stores files to the Windows start menu directory

Tries to load missing DLLs

Classification

Process Tree

System is w10x64_ra

rundll32.exe (PID: 1588 cmdline: C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding MD5: EF3179D498793BF4234F708D3BE28633)

OUTLOOK.EXE (PID: 2232 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\user\AppData\Local\Temp\Temp1_Quarantined Messages (12).zip\239b4100-1ff7-4d03-6739-08dc4e54cf5c\602240bb-8e5c-abde-6bab-9639d7c76314.eml" MD5: 91A5292942864110ED734005B7E005C0)

ai.exe (PID: 1552 cmdline: "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "C06CCE5E-9D8A-403C-BFB5-D318623DE818" "6CB4F628-663E-460A-9020-8555E32D035D" "2232" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx" MD5: EC652BEDD90E089D9406AFED89A8A8BD)

EXCEL.EXE (PID: 1728 cmdline: "C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE" "C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\Y8CBKWBK\Vendor Payment Details.XLS.xlsx" MD5: 4A871771235598812032C822E6F68F19)

EXCEL.EXE (PID: 1652 cmdline: "C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE" /Embedding MD5: 4A871771235598812032C822E6F68F19)

chrome.exe (PID: 6884 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://sites.google.com/open-remitdocuments.com/67757?usp=sharing MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

chrome.exe (PID: 7124 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 --field-trial-handle=2096,i,1099900194973404770,2569388996204506932,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

cleanup

Sigma Signatures

Sigma detected: Excel Network Connections

Source: Network Connection

Author: Christopher Peacock '@securepeacock', SCYTHE '@scythe_io', Florian Roth '@Neo23x0", Tim Shelton: Data: DestinationIp: 13.107.246.40, DestinationIsIpv6: false, DestinationPort: 443, EventID: 3, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE, Initiated: true, ProcessId: 1728, Protocol: tcp, SourceIp: 192.168.2.17, SourceIsIpv6: false, SourcePort: 49820

Sigma detected: Office Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 , EventID: 13, EventType: SetValue, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE, ProcessId: 2232, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Addins\OneNote.OutlookAddin\1

Sigma detected: Office Macro File Download

Source: File created

Author: Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE, ProcessId: 2232, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Templates\~$rmalEmail.dotm

Sigma detected: Outlook Security Settings Updated - Registry

Source: Registry Key set

Author: frack113: Data: Details: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\Y8CBKWBK\, EventID: 13, EventType: SetValue, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE, ProcessId: 2232, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Security\OutlookSecureTempFolder

Sigma detected: Suspicious Office Outbound Connections

Source: Network Connection

Author: X__Junior (Nextron Systems): Data: DestinationIp: 192.168.2.17, DestinationIsIpv6: false, DestinationPort: 49820, EventID: 3, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE, Initiated: true, ProcessId: 1728, Protocol: tcp, SourceIp: 13.107.246.40, SourceIsIpv6: false, SourcePort: 443

Sigma detected: Office Macro File Creation

Source: File created

Snort Signatures

ET CURRENT_EVENTS Possible Excel Online Phishing Landing - Title over non SSL - Source IP: 142.251.163.113 - Destination IP: 192.168.2.17

Timestamp:	03/28/24-15:27:28.713031
SID:	2024392
Source Port:	443
Destination Port:	49719
Protocol:	TCP
Classtype:	Potentially Bad Traffic

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Source: https://www.gstatic.com/atari/embeds/83a60601c213b72fb19c1855fb0c5f26/intermediate-frame-minified.html	HTTP Parser: No favicon
Source: https://www.gstatic.com/atari/embeds/83a60601c213b72fb19c1855fb0c5f26/intermediate-frame-minified.html?jsh=m%3B%2F_%2Fscs%2Fabc-static%2F_%2Fjs%2Fk%3Dgapi.lb.en.Oh6mNxd5OYM.O%2Fam%3DAAAC%2Fd%3D1%2Frs%3DAHpOoo8ivBPi_9I5G7qxoBeYV5pO1OVdmQ%2Fm%3D__features__&r=402326002	HTTP Parser: No favicon

Source: unknown	HTTPS traffic detected: 13.107.5.88:443 -> 192.168.2.17:49782 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 204.79.197.200:443 -> 192.168.2.17:49792 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.17:49817 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.40:443 -> 192.168.2.17:49820 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.40:443 -> 192.168.2.17:49822 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.40:443 -> 192.168.2.17:49821 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.40:443 -> 192.168.2.17:49824 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.40:443 -> 192.168.2.17:49823 version: TLS 1.2

Source: excel.exe

Memory has grown: Private usage: 5MB later: 92MB

Networking

Snort IDS alert for network traffic

Source: Traffic

Snort IDS: 2024392 ET CURRENT_EVENTS Possible Excel Online Phishing Landing - Title over non SSL 142.251.163.113:443 -> 192.168.2.17:49719

Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.190.130
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.190.130
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.190.130
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.190.130
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.190.130
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.190.130
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.5.88
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.5.88
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.5.88
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.190.130
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.190.130
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.190.130
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.5.88
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.190.130
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.190.130
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.5.88
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.5.88
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.5.88
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.5.88
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.5.88
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.5.88
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.5.88
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown	TCP traffic detected without corresponding DNS query: 72.21.81.240

Source: unknown

DNS traffic detected: queries for: sites.google.com

Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49680 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49809 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 13.107.5.88:443 -> 192.168.2.17:49782 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 204.79.197.200:443 -> 192.168.2.17:49792 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.17:49817 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.40:443 -> 192.168.2.17:49820 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.40:443 -> 192.168.2.17:49822 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.40:443 -> 192.168.2.17:49821 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.40:443 -> 192.168.2.17:49824 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.40:443 -> 192.168.2.17:49823 version: TLS 1.2

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Window created: window name: CLIPBRDWNDCLASS

Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: apphelp.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: c2r64.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: userenv.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: msasn1.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: cryptsp.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: rsaenh.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: gpapi.dll

Source: classification engine

Classification label: mal48.winZIP@25/73@36/101

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

File created: C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

File created: C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20240328T1527070035-2232.etl

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

File read: C:\Users\desktop.ini

Source: C:\Windows\System32\rundll32.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: unknown

Process created: C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

Source: unknown	Process created: C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
Source: unknown	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\user\AppData\Local\Temp\Temp1_Quarantined Messages (12).zip\239b4100-1ff7-4d03-6739-08dc4e54cf5c\602240bb-8e5c-abde-6bab-9639d7c76314.eml"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "C06CCE5E-9D8A-403C-BFB5-D318623DE818" "6CB4F628-663E-460A-9020-8555E32D035D" "2232" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE "C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE" "C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\Y8CBKWBK\Vendor Payment Details.XLS.xlsx"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE "C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE" /Embedding
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://sites.google.com/open-remitdocuments.com/67757?usp=sharing
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 --field-trial-handle=2096,i,1099900194973404770,2569388996204506932,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "C06CCE5E-9D8A-403C-BFB5-D318623DE818" "6CB4F628-663E-460A-9020-8555E32D035D" "2232" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE "C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE" "C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\Y8CBKWBK\Vendor Payment Details.XLS.xlsx"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE "C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE" /Embedding
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://sites.google.com/open-remitdocuments.com/67757?usp=sharing
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 --field-trial-handle=2096,i,1099900194973404770,2569388996204506932,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{275C23E2-3747-11D0-9FEA-00AA003F8646}\InProcServer32

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Window found: window name: SysTabControl32

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

File Volume queried: C:\Windows\SysWOW64 FullSizeInformation

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Process information queried: ProcessInformation

Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe

Queries volume information: C:\Program Files (x86)\Microsoft Office\root\Office16\AI\WordCombinedFloatieLreOnline.onnx VolumeInformation

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	1 Process Injection	1 Masquerading	OS Credential Dumping	1 Process Discovery	Remote Services	1 Clipboard Data	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Registry Run Keys / Startup Folder	1 DLL Side-Loading	1 Rundll32	LSASS Memory	1 File and Directory Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Registry Run Keys / Startup Folder	1 Process Injection	Security Account Manager	14 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 Extra Window Memory Injection	1 DLL Side-Loading	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Extra Window Memory Injection	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Source	Detection	Scanner	Label	Link
about:blank	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
external-new.us-west-1.elasticbeanstalk.com	52.8.165.41	true	false	high
plus.l.google.com	142.250.31.113	true	false	high
play.google.com	142.251.167.113	true	false	high
sites.google.com	142.251.163.113	true	false	high
drive.google.com	142.251.167.102	true	false	high
www.google.com	142.251.167.103	true	false	high
s3-r-w.us-west-1.amazonaws.com	52.219.116.57	true	false	high
part-0012.t-0009.t-msedge.net	13.107.246.40	true	false	unknown
googlehosted.l.googleusercontent.com	172.253.122.132	true	false	high
form.feathery.io	18.213.222.111	true	false	unknown
feathery.s3.us-west-1.amazonaws.com	unknown	unknown	false	high
cdn.feathery.io	unknown	unknown	false	unknown
api.feathery.io	unknown	unknown	false	unknown
lh3.googleusercontent.com	unknown	unknown	false	high
apis.google.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://form.feathery.io/to/IZif6Z#Step%202	false		unknown
https://drive.google.com/auth_warmup	false		high
https://form.feathery.io/to/IZif6Z#Step%201	false		unknown
about:blank	false	Avira URL Cloud: safe	low
https://sites.google.com/open-remitdocuments.com/67757?usp=sharing	false		high
https://form.feathery.io/to/IZif6Z	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
52.109.4.7	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
20.189.173.9	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
13.107.246.40	part-0012.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.251.167.103	www.google.com	United States	15169	GOOGLEUS	false
172.253.62.94	unknown	United States	15169	GOOGLEUS	false
172.253.122.132	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
142.251.167.102	drive.google.com	United States	15169	GOOGLEUS	false
20.42.65.84	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
172.253.62.95	unknown	United States	15169	GOOGLEUS	false
18.213.222.111	form.feathery.io	United States	14618	AMAZON-AESUS	false
23.215.0.45	unknown	United States	16625	AKAMAI-ASUS	false
142.251.163.94	unknown	United States	15169	GOOGLEUS	false
52.113.194.132	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
3.5.161.107	unknown	United States	16509	AMAZON-02US	false
1.1.1.1	unknown	Australia	13335	CLOUDFLARENETUS	false
142.251.167.132	unknown	United States	15169	GOOGLEUS	false
54.219.204.123	unknown	United States	16509	AMAZON-02US	false
142.251.111.95	unknown	United States	15169	GOOGLEUS	false
142.250.31.113	plus.l.google.com	United States	15169	GOOGLEUS	false
142.251.167.113	play.google.com	United States	15169	GOOGLEUS	false
172.253.63.94	unknown	United States	15169	GOOGLEUS	false
142.251.167.138	unknown	United States	15169	GOOGLEUS	false
142.251.111.94	unknown	United States	15169	GOOGLEUS	false
172.253.122.102	unknown	United States	15169	GOOGLEUS	false
142.251.163.113	sites.google.com	United States	15169	GOOGLEUS	false
23.54.46.90	unknown	United States	16625	AKAMAI-ASUS	false
172.253.122.100	unknown	United States	15169	GOOGLEUS	false
52.8.165.41	external-new.us-west-1.elasticbeanstalk.com	United States	16509	AMAZON-02US	false
172.253.122.95	unknown	United States	15169	GOOGLEUS	false
142.251.167.84	unknown	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
151.101.2.133	unknown	United States	54113	FASTLYUS	false
52.109.52.131	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
52.219.116.57	s3-r-w.us-west-1.amazonaws.com	United States	16509	AMAZON-02US	false
142.251.16.94	unknown	United States	15169	GOOGLEUS	false
54.84.236.175	unknown	United States	14618	AMAZON-AESUS	false
142.251.179.138	unknown	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.17

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1417074
Start date and time:	2024-03-28 15:26:30 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	29
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled
Analysis Mode:	stream
Analysis stop reason:	Timeout
Sample name:	Quarantined Messages (12).zip
Detection:	MAL
Classification:	mal48.winZIP@25/73@36/101
Cookbook Comments:	Found application associated with file extension: .zip

Warnings

Exclude process from analysis (whitelisted): dllhost.exe
Excluded IPs from analysis (whitelisted): 52.109.52.131, 52.113.194.132, 23.215.0.45, 23.215.0.37, 52.109.4.7, 23.54.46.90, 20.189.173.9, 20.42.65.84
Excluded domains from analysis (whitelisted): omex.cdn.office.net, onedscolprdwus08.westus.cloudapp.azure.com, us1.odcsm1.live.com.akadns.net, odc.officeapps.live.com, slscr.update.microsoft.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, asia.configsvc1.live.com.akadns.net, mobile.events.data.microsoft.com, ecs-office.s-0005.s-msedge.net, login.live.com, e16604.g.akamaiedge.net, onedscolprdeus02.eastus.cloudapp.azure.com, officeclient.microsoft.com, osiprod-eus2-bronze-azsc-000.eastus2.cloudapp.azure.com, prod.fs.microsoft.com.akadns.net, a1864.dscd.akamai.net, ecs.office.com, self-events-data.trafficmanager.net, fs.microsoft.com, prod.configsvc1.live.com.akadns.net, self.events.data.microsoft.com, s-0005-office.config.skype.com, fe3cr.delivery.mp.microsoft.com, eus2-azsc-000.odc.officeapps.live.com, jpe-azsc-config.officeapps.live.com, s-0005.s-msedge.net, config.officeapps.live.com, ecs.office.trafficmanager.net, omex.cdn.office.net.akamaized.net, p
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetValueKey calls found.
Timeout during stream target processing, analysis might miss dynamic analysis data
VT rate limit hit for: Quarantined Messages (12).zip

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntities.bin

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	322260
Entropy (8bit):	4.000299760592446
Encrypted:	false
SSDEEP:
MD5:	CC90D669144261B198DEAD45AA266572
SHA1:	EF164048A8BC8BD3A015CF63E78BDAC720071305
SHA-256:	89C701EEFF939A44F28921FD85365ECD87041935DCD0FE0BAF04957DA12C9899
SHA-512:	16F8A8A6DCBAEAEFB88C7CFF910BCCC71B76A723CF808B810F500E28E543112C2FAE2491D4D209569BD810490EDFF564A2B084709B02963BCAF6FDF1AEEC59AC
Malicious:	false
Reputation:	unknown
Preview:	51253fe60063c31af0d295afb42228b0:v2:2:1:1590:2:8479:76bd602437550e98c9043d06a55186ab7d95dea5a0e935a599f73e62a8c9b158e0afcb19351f6c353940c06a38172b94d18c02cf92bb8a80184eccca0392b259ab3e71dae73e491c7941997cb36ad4a198661f622dad478d840f66d530a0dde78acea3367f91fff62fbb3dc18faff0c708ad30edef5bea8b22c5fd782b770d8993386eaa784fd19a3c3e1db3b537b1a94d3d4fbd46f8df8fddf6d16611969fe0a97c50e0f3ac24750c93257cf5c161184aa7385800c87d803b339632a3d8ec7fe17a0afd83ce9e9d0e3f7b8d579637928a811f1f7e6d1887df2ddc7d4f752c4d600235e426c92c7bf8a1362f95457998cc0e5d4261f0efa4fada0f866dbcefb407dacab7a2914e91c2f08200f38c2d9d621962145b1464b0f204b326118a53ecdcab22bff005fdd5257c99a6dc51ac0600a49f2ef782396987e78c08b846dad5db55e8ccefffc64863bc2c3e90b95a09d25d0814a848c98fe01a82d4e30e6682dd546e12c45ca0d280a45295ab4bd632dafb070edfdc3c9e38313d5aeb195972986f8011b66817028fd8c78b67a0ac7e780eecc3fb6a31f5a025b8a9a3db278a98c0696aeaac739b18688b0f9c7d751bba02cc5f4e41853fb119b3c0c915059aaa92971244a1989124f12881ca88e6410df70b793a2c3a736ff4

C:\Users\user\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntitiesUpdated.bin

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	10
Entropy (8bit):	2.121928094887362
Encrypted:	false
SSDEEP:
MD5:	3543D74D5048E0A3C30D9BEFED70F262
SHA1:	E33BAF5C58EAE6DF9AB755D67997174A3164A472
SHA-256:	5A0F16F4F161179D58E108E6387274FC8E75CCC9D3E815800AAD5B9069735BD0
SHA-512:	A9398DC9636856C966C6FFF5B900D98004BB6E64B576B8E89B8E8B4FC4553E95AD3A3930AC9BE5EEB90C156F68AC50512DDAAC6DE3F8917481C4EBA4CEEAE169
Malicious:	false
Reputation:	unknown
Preview:	1711636031

C:\Users\user\AppData\Local\Microsoft\Office\16.0\Floodgate\Outlook.CampaignStates.json

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	JSON data
Category:	dropped
Size (bytes):	1538
Entropy (8bit):	5.166061257877196
Encrypted:	false
SSDEEP:
MD5:	472C2E92AB68B7D130E1540FDC616D7E
SHA1:	C7554D1B1407733F6ED6687E6945378D9C416588
SHA-256:	AB7FBF7E356E73BE58C0FF34DB843FB88241D5A7E57AF409935D2E24DA845463
SHA-512:	BF2D4B4FDC7595DD74552FC2D4C89B6EC0A735BB60F6744AB9E6FC621A4092C5D452869FCE3FD006C4508648AB8023EFC2121B80D97B2B670D0186399E36EEC5
Malicious:	false
Reputation:	unknown
Preview:	{"CampaignStates":[{"CampaignId":"398f8b35-ef06-4a2b-a5dc-d85540d6fff3","LastNominationTimeUtc":"2023-10-06T09:55:42Z","LastNominationBuildNumber":"16.0.16827.20130","DeleteAfterSecondsWhenStale":31536000,"ForceCandidacy":false,"IsCandidate":true,"DidCandidateTriggerSurvey":false,"LastSurveyActivatedTimeUtc":"1601-01-01T00:00:00Z","LastSurveyId":"34d6c19c-a4a8-44c8-8cde-799414b8b5bc","LastSurveyStartTimeUtc":"2023-10-06T09:55:42Z","LastSurveyExpirationTimeUtc":"2024-10-05T09:55:42Z","LastCooldownEndTimeUtc":"1601-01-01T00:00:00Z"},{"CampaignId":"69e92aee-73d9-4a12-85fe-502abaebd9b1","LastNominationTimeUtc":"2024-03-28T14:27:07Z","LastNominationBuildNumber":"16.0.16827.20130","DeleteAfterSecondsWhenStale":2592000,"ForceCandidacy":false,"IsCandidate":false,"DidCandidateTriggerSurvey":false,"LastSurveyActivatedTimeUtc":"1601-01-01T00:00:00Z","LastSurveyId":"","LastSurveyStartTimeUtc":"1601-01-01T00:00:00Z","LastSurveyExpirationTimeUtc":"1601-01-01T00:00:00Z","LastCooldownEndTimeUtc":"1601

C:\Users\user\AppData\Local\Microsoft\Office\16.0\Floodgate\Outlook.GovernedChannelStates.json

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	JSON data
Category:	dropped
Size (bytes):	740
Entropy (8bit):	4.578658879460996
Encrypted:	false
SSDEEP:
MD5:	439A34DE8DA5C04AF25AADB84A2120D4
SHA1:	F12F9FF6E03A5762BD03061557029446680B1DAE
SHA-256:	32B560C75C25C6F56C0439F67A3FA7D4F271F07B435EE41575A3D82C6C612880
SHA-512:	BE704CD0DF8041945D16B8103135650B33D5E97D6F7C202E9C9499C3AE57E33855C2CC3A8F73B578DB482F47026C756F1FAA411A2CC58B5E53CE23CD24229834
Malicious:	false
Reputation:	unknown
Preview:	{"ChannelStates":[{"ChannelType":0,"CooldownStartTimeUtc":"1601-01-01T00:00:00Z","Cooldown":1209600},{"ChannelType":1,"CooldownStartTimeUtc":"1601-01-01T00:00:00Z","Cooldown":0},{"ChannelType":2,"CooldownStartTimeUtc":"1601-01-01T00:00:00Z","Cooldown":0},{"ChannelType":3,"CooldownStartTimeUtc":"1601-01-01T00:00:00Z","Cooldown":3600},{"ChannelType":4,"CooldownStartTimeUtc":"1601-01-01T00:00:00Z","Cooldown":10800},{"ChannelType":5,"CooldownStartTimeUtc":"1601-01-01T00:00:00Z","Cooldown":7776000},{"ChannelType":6,"CooldownStartTimeUtc":"1601-01-01T00:00:00Z","Cooldown":1800},{"ChannelType":7,"CooldownStartTimeUtc":"1601-01-01T00:00:00Z","Cooldown":0},{"ChannelType":8,"CooldownStartTimeUtc":"1601-01-01T00:00:00Z","Cooldown":1209600}]}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\Floodgate\Outlook.Settings.json

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	JSON data
Category:	dropped
Size (bytes):	87
Entropy (8bit):	4.576828956814449
Encrypted:	false
SSDEEP:
MD5:	E4E83F8123E9740B8AA3C3DFA77C1C04
SHA1:	5281EAE96EFDE7B0E16A1D977F005F0D3BD7AAD0
SHA-256:	6034F27B0823B2A6A76FE296E851939FD05324D0AF9D55F249C79AF118B0EB31
SHA-512:	BD6B33FD2BBCE4A46991BC0D877695D16F7E60B1959A0DEFC79B627E569E5C6CAC7B4AD4E3E1D8389A08584602A51CF84D44CF247F03BEB95F7D307FBBA12BB9
Malicious:	false
Reputation:	unknown
Preview:	{"ShouldFloodgateTakePrecedenceOverRateAndReview":false,"AreRatingSurveysEnabled":true}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\Floodgate\Outlook.SurveyEventActivityStats.json

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	JSON data
Category:	dropped
Size (bytes):	14
Entropy (8bit):	3.378783493486176
Encrypted:	false
SSDEEP:
MD5:	6CA4960355E4951C72AA5F6364E459D5
SHA1:	2FD90B4EC32804DFF7A41B6E63C8B0A40B592113
SHA-256:	88301F0B7E96132A2699A8BCE47D120855C7F0A37054540019E3204D6BCBABA3
SHA-512:	8544CD778717788B7484FAF2001F463320A357DB63CB72715C1395EF19D32EEC4278BAB07F15DE3F4FED6AF7E4F96C41908A0C45BE94D5CDD8121877ECCF310D
Malicious:	false
Reputation:	unknown
Preview:	{"Surveys":{}}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\56B632BC-CA16-4AAC-801B-A3619C0CEA49

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	165923
Entropy (8bit):	5.34124229757787
Encrypted:	false
SSDEEP:
MD5:	9D958C6121766219EF6E296DDD720853
SHA1:	73B15AE0318B66FD5EC011E00AE6397ECADD4E43
SHA-256:	F683E637C594BEAB9000B9A5AF833938766D4091881672873C352120A15FE09F
SHA-512:	3419B385DB19B59ABD6086BFF434A27D57145E6995734CE58E7102ED38DF9A11D76F47B68F971F61F7722F2CC895B3743DDFEE8221C71DCEE166437EF9D2A78F
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8"?>..<o:OfficeConfig xmlns:o="urn:schemas-microsoft-com:office:office">.. <o:services o:GenerationTime="2024-03-28T14:27:09">.. Build: 16.0.17510.30526-->.. <o:default>.. <o:ticket o:headerName="Authorization" o:headerValue="{}" />.. </o:default>.. <o:service o:name="Research">.. <o:url>https://word-edit.officeapps.live.com/we/rrdiscovery.ashx</o:url>.. </o:service>.. <o:service o:name="ORedir">.. <o:url>https://o15.officeredir.microsoft.com/r</o:url>.. </o:service>.. <o:service o:name="ORedirSSL">.. <o:url>https://o15.officeredir.microsoft.com/r</o:url>.. </o:service>.. <o:service o:name="ClViewClientHelpId" o:authentication="1">.. <o:url>https://[MAX.BaseHost]/client/results</o:url>.. <o:ticket o:policy="MBI_SSL_SHORT" o:idprovider="1" o:target="[MAX.AuthHost]" o:headerValue="Passport1.4 from-PP='{}&p='" />.. <o:ticket o:idprovider="3" o:headerValue="Bearer {}" o:resourceId="[MAX.ResourceId]" o:authorityUrl="[ADALAuth

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	SQLite 3.x database, last written using SQLite version 3034001, writer version 2, read version 2, file counter 2, database pages 1, cookie 0, schema 0, largest root page 1, unknown 0 encoding, version-valid-for 2
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	0.09304735440217722
Encrypted:	false
SSDEEP:
MD5:	D0DE7DB24F7B0C0FE636B34E253F1562
SHA1:	6EF2957FDEDDC3EB84974F136C22E39553287B80
SHA-256:	B6DC74E4A39FFA38ED8C93D58AADEB7E7A0674DAC1152AF413E9DA7313ADE6ED
SHA-512:	42D00510CD9771CE63D44991EA10C10C8FBCF69DF08819D60B7F8E7B0F9B1D385AE26912C847A024D1D127EC098904784147218869AE8D2050BCE9B306DB2DDE
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................K.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-journal

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	4616
Entropy (8bit):	0.13654087935378098
Encrypted:	false
SSDEEP:
MD5:	04714702A3F0F0AE956F66DA2E6DD5B6
SHA1:	82F8D78BA6D2378B3E911E22081528D65F9F0D6E
SHA-256:	5F48D285B7B00968904F566AE8120DC39FFBE0214AECEF1F5B7A984CAADA3FFD
SHA-512:	1AEFDAE1ED5870780B3E7526E03E71C2868BC9F1FABB32F5F071619C5D0CE7EB2EB0ECE7CB98821AB5C5E89C0B01A8564C6F2D20F6101313C140AAA4EC78E2E6
Malicious:	false
Reputation:	unknown
Preview:	.... .c......K. ....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................SQLite format 3......@ ..........................................................................K.................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-shm

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.0445382698033491
Encrypted:	false
SSDEEP:
MD5:	BCC3770881BAB5868E3327A58939AF4A
SHA1:	E880C8596E562B983DA0741A69D1A2F8EB066910
SHA-256:	1F23FA682A4C70197213AA71135EB66277E14618ACB7BA182434D829CCF6A87C
SHA-512:	96A9580E3C9498A1027E438EC1D48D9DFB8CBE4F1CFE569CB23E87E140022072B4F59C9FBBA04A025F29B88F915E5B15974A5325AD8B123D90E96C53EBE01469
Malicious:	false
Reputation:	unknown
Preview:	..-......................M.........x..N..\|7..YnT..-......................M.........x..N..\|7..YnT........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-wal

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	45352
Entropy (8bit):	0.3942543309970873
Encrypted:	false
SSDEEP:
MD5:	A40F9E7600BBC06D76B46CB0106B1CF7
SHA1:	0B4669006347A6574CFAE4CF6AB05C08937FE609
SHA-256:	AF5B4F4CFB58BB8C972C4DC1D0FDDC2F884EB6B046C094C121782FF05F8A37E1
SHA-512:	C5759DD3B896036719FE6C10E3545CABE47817E549C084D13F23DF2C92C3DF644099C120534AB5A92227D3C26A34B5C8B4B7F6B89C1514F4EB9C6956DB54A195
Malicious:	false
Reputation:	unknown
Preview:	7....-.............x..N.M..,...............x..N...Ez.Y;kSQLite format 3......@ ..........................................................................K.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\9F1951F7.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	130073
Entropy (8bit):	7.941194513762962
Encrypted:	false
SSDEEP:
MD5:	BE8351E3DA9A2F8847B90CBD710CF1EB
SHA1:	80447B4AFF21E8786758DB63AC971E6616E0CB5C
SHA-256:	EB7A685205EFEA993B610233E13EB2E3122B9DFCFC7E97DF604C07A61B20783A
SHA-512:	F7423598F08BC701109B4B5951F5174FE3D0B044797133E36E87DBD434101591A0BB55500347EB44C5A94FF379487121360C11C7C7CFA2990DC362D20BD1817F
Malicious:	false
Reputation:	unknown
Preview:	PK..........!..>..l...........[Content_Types].xml ...(....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................TKo.0..O...r.....4Q8.q.8...5n.H.(...?7....4.%I...[vF.M...xT..l..X...R.*g.....%...B[.9......f4.:....sV...8..F`f...).oD.O_q'..........&..ih9.x...X.n.....U,y..R9SM..;...x.x...iU.@..G...TF....rxG..Pho~..)..>..^IH..w.u..\|m....Ev...-KU.....e.<..5@ht......}.....6...6.H\|.G......-D.3......e..g...k.#....\|;.S..'So..y.....h.#".A.a(...H.pq..}.$..m....7.......PK..........!..U0#....L......._rels/.rels ...(.....................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\Y8CBKWBK\~$Vendor Payment Details.XLS.xlsx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	165
Entropy (8bit):	1.4988604911361962
Encrypted:	false
SSDEEP:
MD5:	34863D0C5EDC5217BFE8F28000149692
SHA1:	B997A6CB01178B27D14131F0B3C99068378F2959
SHA-256:	AA5DEED2AFD386A6CE02460403D856BAD3C6E0969C73294FE33A76B2B1F60B4D
SHA-512:	74A541E58F69DCA407BF95CC9141D93968DB858F680B4A4CD1ECF96C4B4DF6E44A2912F2A364B423E464078739CA616815C2FCE69479B102856989F71B364BB1
Malicious:	false
Reputation:	unknown
Preview:	.user ..t.o.r.r.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{F4336852-CFFA-4B1B-AAE0-00B14765F921}.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	2856
Entropy (8bit):	3.414186101820263
Encrypted:	false
SSDEEP:
MD5:	E11511C375643172B2F7E83B49C03318
SHA1:	C81937A06CF9F07758C035BD1D5FCEAFC87DB940
SHA-256:	4C7A7BF66731042EBB4BAFEA4E69C6A4738195A7C9929AB25D033D7E92241ADE
SHA-512:	566E8781AE463CE0ABB715B29FCBFD1C55AF3C0B687401C7C6000B41255B9B854FA5FE674E7204D03E502117B19E34E37A9B0732A712D492F6B5E996B578E13C
Malicious:	false
Reputation:	unknown
Preview:	....P.l.e.a.s.e. .a.d.v.i.s.e.......T.h.a.n.k.s.,.......J.e.a.n. .R.o.b.e.r.t. .\|...S.u.p.e.r.v.i.s.o.r. .\|. .A.c.c.o.u.n.t.i.n.g. .D.e.p.t.\|. .P.o.w.e.r. .&. .C.o.n.t.r.o.l.s...C.O.L.L.I.N.S...A.E.R.O.S.P.A.C.E...O.n.e. .H.a.m.i.l.t.o.n. .R.d.,. .W.i.n.d.s.o.r. .L.o.c.k.s.,. .C.T. .0.6.0.9.6. .U.S.A...M.o.b.i.l.e.:...8.6.0.-.3.0.1.-.8.0.1.1..................................................................................................................................................................................... ...$...4...8...........0...Z......."...`..................................................................................................................................................................................................................................................................................................................................................................................................................................................-

C:\Users\user\AppData\Local\Packages\oice_16_974fa576_32c1d314_889\AC\Temp\1242CAD8.jpg

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 1768x228, components 3
Category:	dropped
Size (bytes):	119489
Entropy (8bit):	7.971533254471675
Encrypted:	false
SSDEEP:
MD5:	7E7F7F0C241C8681C66EAC157431213B
SHA1:	5E23115EE803EABA750D76630F70D4BAB9E4C849
SHA-256:	46F2948BD1F980BE5AE13355F35D57D6E616AB07E7DFF24F13D3AE7D555192A7
SHA-512:	CAC3684FBE75CD72E7F6E24D4B50E3344E93BFF5EDA98A6CAD0D6084025C17D759657D2C0AFBFB02903B2F4AE77B048A0C1EB02380D173D7A364B0000AF0D7F5
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.............C....................................................................C.......................................................................................................................E.........................!1AQ..a.....q......"2R..B.#b.3r.$S..C.4c.D..............................6.....................!1AQa...q...."....2..#3BRbCr.D.............?...Di.....!........5D@.pRA.....4k....fF_Rx.Z.....:M.SX?D.(K.&....a.E.l. .a...).......q...).R..\[.....!x..N...L?u.z@8.c^\|.,&...H)~..Nu.=...D..\|.=.i..9..A)z.....$....]..W0.K.- .;.o.g.V"..1.:YX.i=tP........I..M.....K..u...Mh.U.vgg.9.......l...X0.......F)\"4....O.!.a......M.....C...{..t....9...b.........@7.Lx..k.'.x...h.........k..T.4..Hz.!}m.O.oa...j..Lk"..b.;.hQ2.X......NHi..S.$B.n8M...E...".. lZN=....A8,...._.....,X..d..ssB..Y:Q...a....b...85&}2N.....(..3>iL57..RK..O..!-..l.R..5....^%)H&s....R(......7....Y:.....E..WVU.d.......r.SQ....:.Ci}..)"!..5.2...T...sN..(2'.$...1J.'.I ."......

C:\Users\user\AppData\Local\Packages\oice_16_974fa576_32c1d314_889\AC\Temp\752F5D41.xlsx:Zone.Identifier

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:
MD5:	FBCCF14D504B7B2DBCB5A5BDA75BD93B
SHA1:	D59FC84CDD5217C6CF74785703655F78DA6B582B
SHA-256:	EACD09517CE90D34BA562171D15AC40D302F0E691B439F91BE1B6406E25F5913
SHA-512:	AA1D2B1EA3C9DE3CCADB319D4E3E3276A2F27DD1A5244FE72DE2B6F94083DDDC762480482C5C2E53F803CD9E3973DDEFC68966F974E124307B5043E654443B98
Malicious:	false
Reputation:	unknown
Preview:	[ZoneTransfer]..ZoneId=3..

C:\Users\user\AppData\Local\Packages\oice_16_974fa576_32c1d314_889\AC\Temp\Diagnostics\EXCEL\App1711636037123260300_FEAB3EB7-B83F-4326-907B-0EAF8C71E878.log

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
File Type:	ASCII text, with very long lines (855), with CRLF line terminators
Category:	dropped
Size (bytes):	20971520
Entropy (8bit):	0.011086866640882211
Encrypted:	false
SSDEEP:
MD5:	D727C9B786CD8D17A552042F6E0C81B2
SHA1:	E0B7A6C5A5595BC7E98DFCCB2557BF5AD395B6DD
SHA-256:	9733A4DF9FE1F6BE65847E1801F68874039D22D2F156FB00958EB2A3858781B7
SHA-512:	7E6B46187424148BB415CD7945C8522D0F945E59A77153728F46FA83C78CFBCC2A16DD780ABC374BA7FA72C50D87653999755DE74F2D972B62E8B21B4BDD9A30
Malicious:	false
Reputation:	unknown
Preview:	Timestamp.Process.TID.Area.Category.EventID.Level.Message.Correlation..03/28/2024 14:27:17.156.EXCEL (0x674).0xCCC.Microsoft Excel.Telemetry Event.b7vzq.Medium.SendEvent {"EventName":"Office.Text.GDIAssistant.HandleCallback","Flags":30962256044949761,"InternalSequenceNumber":15,"Time":"2024-03-28T14:27:17.156Z","Contract":"Office.System.Activity","Activity.CV":"tz6r/j+4JkOQew6vjHHoeA.1.10","Activity.Duration":15,"Activity.Count":1,"Activity.AggMode":0,"Activity.Success":true,"Data.GdiFamilyName":"","Data.CloudFontStatus":6,"Data.CloudFontTypes":256}...03/28/2024 14:27:17.172.EXCEL (0x674).0xCCC.Microsoft Excel.Telemetry Event.b7vzq.Medium.SendEvent {"EventName":"Office.Text.ResourceClient.Deserialize","Flags":30962256044949761,"InternalSequenceNumber":17,"Time":"2024-03-28T14:27:17.172Z","Contract":"Office.System.Activity","Activity.CV":"tz6r/j+4JkOQew6vjHHoeA.1.11","Activity.Duration":10900,"Activity.Count":1,"Activity.AggMode":0,"Activity.Success":true,"Data.JsonFileMajorVersion":4,"

C:\Users\user\AppData\Local\Packages\oice_16_974fa576_32c1d314_889\AC\Temp\Diagnostics\EXCEL\App1711636037124043100_FEAB3EB7-B83F-4326-907B-0EAF8C71E878.log

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	20971520
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	8F4E33F3DC3E414FF94E5FB6905CBA8C
SHA1:	9674344C90C2F0646F0B78026E127C9B86E3AD77
SHA-256:	CD52D81E25F372E6FA4DB2C0DFCEB59862C1969CAB17096DA352B34950C973CC
SHA-512:	7FB91E868F3923BBD043725818EF3A5D8D08EBF1059A18AC0FE07040D32EEBA517DA11515E6A4AFAEB29BCC5E0F1543BA2C595B0FE8E6167DDC5E6793EDEF5BB
Malicious:	false
Reputation:	unknown
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Packages\oice_16_974fa576_32c1d314_889\AC\Temp\msoCF22.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	3221
Entropy (8bit):	4.592206700341287
Encrypted:	false
SSDEEP:
MD5:	82B25C0A95E0AD8412BC6BBDACD6915F
SHA1:	1F717D646384FE659410BA68C3E3BBDBCB8A4697
SHA-256:	92C613C6EE39A9A683DDA07D204AC7DE59606E0FE6B562306811EB7C0D7617D5
SHA-512:	EC13DC983CE385E2FC40801FBE1DFF531C912411ADD860997A33C4AD5E49A5CE9C9E60D17278152CB91520437ED265EB25FED64CE19229CFDD93BCABC89FBF64
Malicious:	false
Reputation:	unknown
Preview:	PK..........!..!..............[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0...H...W.8p@.%.#.P...7.....}{6m...H...o<.W.iT{..ch.@a....7.y/.@......6pD.U{{So..I.:P..sz...2&.2.b...1.:..5=.z.6............. ..$.G..r^.Y...Fo.KR.......JQ.vh...$..y.7...j.w..&.$.v.sL$..X..,..E.#...'."Q*.?0v..(.w..^.\.Cw..O..~.......PK..........!...K............_rels/.rels ...(..............................................................................................................................

C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1711636027248584700_692E6DBF-72EB-47BB-982E-55D2006EBA18.log

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	ASCII text, with very long lines (28730), with CRLF line terminators
Category:	dropped
Size (bytes):	20971520
Entropy (8bit):	0.15927088717406077
Encrypted:	false
SSDEEP:
MD5:	0437E6AA8ECFA7B5FA25B38FD84A1CAE
SHA1:	DB52A392AF07E79B49BB3BD4657E1B22BB5EA300
SHA-256:	E59391457E8D0D7E4C73CB6CBADADC7A7D6E4BD69266216D366245415B4D057A
SHA-512:	B3FCC8B594F39ACC93F4623F69D3B8B951F4D91C56978B9EBC968B7A348858B95F3BB3840BA433829B08DF264195473D899059E9019B36DDD7F7011B2421470B
Malicious:	false
Reputation:	unknown
Preview:	Timestamp.Process.TID.Area.Category.EventID.Level.Message.Correlation..03/28/2024 14:27:07.333.OUTLOOK (0x8B8).0x1688.Microsoft Outlook.Telemetry Event.b7vzq.Medium.SendEvent {"EventName":"Office.Text.GDIAssistant.HandleCallback","Flags":30962256044949761,"InternalSequenceNumber":21,"Time":"2024-03-28T14:27:07.333Z","Contract":"Office.System.Activity","Activity.CV":"v20uaetyu0eYLlXSAG66GA.4.9","Activity.Duration":14,"Activity.Count":1,"Activity.AggMode":0,"Activity.Success":true,"Data.GdiFamilyName":"","Data.CloudFontStatus":6,"Data.CloudFontTypes":256}...03/28/2024 14:27:07.365.OUTLOOK (0x8B8).0x1688.Microsoft Outlook.Telemetry Event.b7vzq.Medium.SendEvent {"EventName":"Office.Text.ResourceClient.Deserialize","Flags":30962256044949761,"InternalSequenceNumber":23,"Time":"2024-03-28T14:27:07.365Z","Contract":"Office.System.Activity","Activity.CV":"v20uaetyu0eYLlXSAG66GA.4.10","Activity.Duration":11835,"Activity.Count":1,"Activity.AggMode":0,"Activity.Success":true,"Data.JsonFileMajorVer

C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20240328T1527070035-2232.etl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	modified
Size (bytes):	106496
Entropy (8bit):	4.503792169733481
Encrypted:	false
SSDEEP:
MD5:	1E84D607BA0E1F0E20748FDB1060A582
SHA1:	43F4B582F679B1B4096964EEF72C486DBB6AB728
SHA-256:	860167FDBFAE9B95EF688D4CE32BAF5A3220D584C6D3A1F100ABBF10F05210D2
SHA-512:	218AFCC273E7A49C65B3FB62B4C78D919B8F3BD1322FCBDA94809C95CBF7A2705ED13893230F98538012253452C5EC7FD9A15D88D5B7996795A73C74E1CC8256
Malicious:	false
Reputation:	unknown
Preview:	............................................................................b...................................eJ..............Zb..2.......................................@.t.z.r.e.s...d.l.l.,.-.3.2.2.......................................................@.t.z.r.e.s...d.l.l.,.-.3.2.1................................................................Y..........................v.2._.O.U.T.L.O.O.K.:.8.b.8.:.7.d.d.5.5.0.8.a.5.1.a.a.4.d.2.c.b.9.7.b.b.9.b.4.c.5.5.4.2.0.1.0...C.:.\.U.s.e.r.s.\.t.o.r.r.e.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.O.u.t.l.o.o.k. .L.o.g.g.i.n.g.\.O.U.T.L.O.O.K._.1.6._.0._.1.6.8.2.7._.2.0.1.3.0.-.2.0.2.4.0.3.2.8.T.1.5.2.7.0.7.0.0.3.5.-.2.2.3.2...e.t.l.............P.P.................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Excel\A8820000

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
File Type:	Applesoft BASIC program data, first line number 16
Category:	dropped
Size (bytes):	10428
Entropy (8bit):	3.4715689510501226
Encrypted:	false
SSDEEP:
MD5:	E433C85D681BDD96FC76768E36B55AE1
SHA1:	5C3954BEC5071250466BB5C285C2E675AD4A4EA5
SHA-256:	0B36B848E397C8A17BA947C8D48708E0E6C242C871843B338113093558260657
SHA-512:	170695C47125F0D519F94FDE4A38B27099A8D9515B1CE7CEAE619609CB88440DF0F77D4D44542EC06CA7FEC76135842F8664B3C75B6144755E73B6DA09FE4499
Malicious:	false
Reputation:	unknown
Preview:	........ZO.......................................................q...q...............q...q...............q...q.....................................................................................................................#.h.#.h.............#.h.#.h.............#.h.#.h..................................#.1.#.1.............#.1.#.1.............#.1.#.1..................................#...#...............#...#...............#...#....................................#.,.#.,.............#.,.#.,.............#.,.#.,......................................................................................................................................................................................................_..._..............._..._..............._..._................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Excel\Excel15.xlb (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
File Type:	Applesoft BASIC program data, first line number 16
Category:	dropped
Size (bytes):	0
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	E433C85D681BDD96FC76768E36B55AE1
SHA1:	5C3954BEC5071250466BB5C285C2E675AD4A4EA5
SHA-256:	0B36B848E397C8A17BA947C8D48708E0E6C242C871843B338113093558260657
SHA-512:	170695C47125F0D519F94FDE4A38B27099A8D9515B1CE7CEAE619609CB88440DF0F77D4D44542EC06CA7FEC76135842F8664B3C75B6144755E73B6DA09FE4499
Malicious:	false
Reputation:	unknown
Preview:	........ZO.......................................................q...q...............q...q...............q...q.....................................................................................................................#.h.#.h.............#.h.#.h.............#.h.#.h..................................#.1.#.1.............#.1.#.1.............#.1.#.1..................................#...#...............#...#...............#...#....................................#.,.#.,.............#.,.#.,.............#.,.#.,......................................................................................................................................................................................................_..._..............._..._..............._..._................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Office\MSO3072.acl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	30
Entropy (8bit):	1.2389205950315936
Encrypted:	false
SSDEEP:
MD5:	688310D45D0499A966CDC5E6A58A372E
SHA1:	561B9F6C6BBF8692DB2B0F0465A08C57F1974C73
SHA-256:	1F0C6B8D4B237F90DCF130716DBC888B47CCA103F24DF1125CE98323C517608F
SHA-512:	89FF0B0EFED6375C4ADFECE781B4B1ECF49F7738C4063EF90C53E7B088FBD256E34154F94E05FBFDD5E0B52D62C0E7CFD0B84113FF7D003BC58B26EB09414435
Malicious:	false
Reputation:	unknown
Preview:	..............................

C:\Users\user\AppData\Roaming\Microsoft\Outlook\NoEmail.srs

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	2560
Entropy (8bit):	2.015418774089802
Encrypted:	false
SSDEEP:
MD5:	F36FB0BBF2DF9EB3336CD8C48C51ECED
SHA1:	5875939F0DCDEDD8D55828BC785FBAD1CCC1AF19
SHA-256:	BA7D3ABDF769A2BA1FFE4FE5C21B125440A11D17CF1761FB1CE02D53CBC36750
SHA-512:	68F5E47192B9BF350B287C5ECC928964FD9369045987CBE238EFC66E5735392B6AAFAE1B2C7CF0819F986C84CD1D364AB5336636AC5950812F1F3CD5F4CC3382
Malicious:	false
Reputation:	unknown
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Templates\NormalEmail.dotm (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	Microsoft Word 2007+
Category:	dropped
Size (bytes):	0
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	A8F70140209E65448AB4417383BDA36D
SHA1:	09786AB9552C9F7A1072F77801AF23FAFEE6144F
SHA-256:	899C10C96368D366BDB03C7DD6A4C73F9BF5F73FE6FA5CBDF5C6B08E103CECED
SHA-512:	0AA0BC21A222E0D97F86893FAED963854D37ACC82AAB79DD7BDA49AFB7B91CD515BB6DF94CB95898C56F9BEF14D2446BC435746C8C81F27BC78CA6D68A104224
Malicious:	false
Reputation:	unknown
Preview:	PK..........!.Q3.p............[Content_Types].xml ...(.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J\X ......J..0....K......H...R.D.g..3.H....M!`.l.....J.j;...>.b.Fa...B....wz...<`F..K6.._s.r.F`.<X.T....7....U.._t:.\:...<&....A%&:f.9..H.hd..*1y.Lx.k)".........e..k.g.....)....&......A...3..WNN.U..e...<....'4(.....x.....nh.t.....p7..j..s...I@.w6.X..C.Tp...r+..^..F.N...".az...h.[!F.!...g...i"...C..n9.~l...3.....H..V..9.2.,)s..GZD..mo6M..a.!...q$.......O..r-.........PK..........!.........N......

C:\Users\user\AppData\Roaming\Microsoft\Templates\~$rmalEmail.dotm

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	modified
Size (bytes):	162
Entropy (8bit):	3.886189625909144
Encrypted:	false
SSDEEP:
MD5:	47705CB8CC2F023247273E922071D5B9
SHA1:	36FE882D1BFD29B9E7485BEF53B8107DE14D7B6A
SHA-256:	B2641678D857D7C552A2B8DEE2E7D3564784ACF2455C3CF28DF0599DF8F53D08
SHA-512:	BB21C4686C4F0A4B1FAF9CB72DA767E489AAB392E7D83DE471C27CDE094AA38FF27EB5A6276054FD0C1C65E8FA6AE1ED513B5B7FE47ABD7B2C6F5F445CCC6081
Malicious:	false
Reputation:	unknown
Preview:	.user.................................................t.o.r.r.e.s....<.v........h...Y..Xz=dM...PD.....b........h...j..............M....................Z...j..

C:\Users\user\AppData\Roaming\Microsoft\Templates\~WRD0000.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	Microsoft Word 2007+
Category:	dropped
Size (bytes):	19603
Entropy (8bit):	7.4759892983272636
Encrypted:	false
SSDEEP:
MD5:	A8F70140209E65448AB4417383BDA36D
SHA1:	09786AB9552C9F7A1072F77801AF23FAFEE6144F
SHA-256:	899C10C96368D366BDB03C7DD6A4C73F9BF5F73FE6FA5CBDF5C6B08E103CECED
SHA-512:	0AA0BC21A222E0D97F86893FAED963854D37ACC82AAB79DD7BDA49AFB7B91CD515BB6DF94CB95898C56F9BEF14D2446BC435746C8C81F27BC78CA6D68A104224
Malicious:	false
Reputation:	unknown
Preview:	PK..........!.Q3.p............[Content_Types].xml ...(.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J\X ......J..0....K......H...R.D.g..3.H....M!`.l.....J.j;...>.b.Fa...B....wz...<`F..K6.._s.r.F`.<X.T....7....U.._t:.\:...<&....A%&:f.9..H.hd..*1y.Lx.k)".........e..k.g.....)....&......A...3..WNN.U..e...<....'4(.....x.....nh.t.....p7..j..s...I@.w6.X..C.Tp...r+..^..F.N...".az...h.[!F.!...g...i"...C..n9.~l...3.....H..V..9.2.,)s..GZD..mo6M..a.!...q$.......O..r-.........PK..........!.........N......

C:\Users\user\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	18
Entropy (8bit):	2.725480556997868
Encrypted:	false
SSDEEP:
MD5:	A5E51FDFAF429614FB5218AB559D299A
SHA1:	262EC76760BB9A83BCFF955C985E70820DF567AE
SHA-256:	3E82E9F60CE38815C28B0E5323268BDA212A84C3A9C7ACCC731360F998DF0240
SHA-512:	9B68F1C04BDE0024CECFC05A37932368CE2F09BD96C72AB0442E16C8CF5456ED9BB995901095AC1BBDF645255014A5E43AADEE475564F01CA6BE3889C96C29C9
Malicious:	false
Reputation:	unknown
Preview:	..t.o.r.r.e.s.....

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Mar 28 13:27:29 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.981401543682457
Encrypted:	false
SSDEEP:
MD5:	7743F0605E246BB01204559EFCC1A06D
SHA1:	4005A28801C597819EBB4795578F9EC086868A1A
SHA-256:	7EC1E889E8808124D84B895134C9D514433D721A1039F603E7FD7C7C2ADD01C0
SHA-512:	C1B6D59B052D095B5CF39BD9A5D52ACBD3680982987F4F36F143422F5D96F0DEA7D7118A5EC753D36E6B28C43B827F8F329641EEBB8CE9055BA85F17E07D9643
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.....Rw.........y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.I\|XWs....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V\|Xns....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.V\|Xns....M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.V\|Xns...........................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V\|Xos...........................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............-G.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Mar 28 13:27:29 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.9964350527666554
Encrypted:	false
SSDEEP:
MD5:	A517600F7D967C14FCD88F684729FC8B
SHA1:	310D85F83DB9C8A0D28EB057D4B49588CD6246F8
SHA-256:	859F89B4716F40BC55EEAA181637C13D5FF04B057888DB11EAC1201BB28E15C9
SHA-512:	430915E54807D497E7A6438A7FDFCDFCAA3AFAF631D3FDB7D41AE730B46EFD74905FC39506CFE85A576CF10315182BBB2E2FC2C939AC9A67A5C5AB84FBDBAE94
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.....Hi.........y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.I\|XWs....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V\|Xns....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.V\|Xns....M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.V\|Xns...........................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V\|Xos...........................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............-G.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:54:41 2023, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2693
Entropy (8bit):	4.010422293172381
Encrypted:	false
SSDEEP:
MD5:	1D33B5C009259D74A123EF090A7CEA5A
SHA1:	6FB4F28BEF5C572EBC88608FF32435C4C0BDED48
SHA-256:	D755A66AEF35A61CF52B2BB5EF383145CE66CF03CF2ECD87C2F1FDBCB604A10E
SHA-512:	43CF014F06937D9B086C67D2187DFC298D3AFD7D15187B6B711A2528715EDA175BCB05D53BB76DF2550823C3F898C91D3853A05383A74530F66EB63E0EC7CED3
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.....v. ;.......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.I\|XWs....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V\|Xns....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.V\|Xns....M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.V\|Xns...........................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.VFW.N...........................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............-G.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Mar 28 13:27:29 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.9944947873135663
Encrypted:	false
SSDEEP:
MD5:	C889B3DD870B841DFE55AA5FACF9F0D7
SHA1:	E00ADE9FC59AFA2AF3F4C313DE449B40FD19C069
SHA-256:	2A1B4BAC82BB71883B3522E53F14C5526597375B5767E1EB8DFE79C17373C42C
SHA-512:	DD538F82A6FCFF3CC8B7A6D40EAFAFC97FD918D01D35492A1427C9EDEB1F69C8844028B552D04449ACED8900E07EC9D328F3066F7327CB58EE867DA65CDF2E49
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.....Cb.........y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.I\|XWs....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V\|Xns....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.V\|Xns....M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.V\|Xns...........................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V\|Xos...........................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............-G.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Mar 28 13:27:29 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.9854116768400045
Encrypted:	false
SSDEEP:
MD5:	AD43BB9228ED8387516D4C999554D78E
SHA1:	C02E9A3F7011BF787882E8BEC78C5EB5769DD792
SHA-256:	9A289EDB87053B0B90A7BF527FE2F921DB6691B0F587E46D43B9016330B78F45
SHA-512:	10B5B756870053267C52B1E673859DF346E85B459C7BFDF64BA90A4621C0693557F0CC15F6A8F609940DD68649469423A335D0CF91A66966F3F449DDE7314F3A
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,......p.........y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.I\|XWs....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V\|Xns....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.V\|Xns....M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.V\|Xns...........................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V\|Xos...........................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............-G.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Mar 28 13:27:29 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2683
Entropy (8bit):	3.9938280331262908
Encrypted:	false
SSDEEP:
MD5:	7376A985FCEA4FC338A01E0C0D1E60C4
SHA1:	E3691BD85A2C95CF1AE0CA3F08F6D670116751B3
SHA-256:	CEB9BF179156EF3757E26BA2FD46C41930F4E9147683E67C9873A1322ED5CC9D
SHA-512:	91F210B2E71816A01DF582FEFC4372895AB7F855BC5E18F6255AFA46438549D563B7F90CBA8F142C82246321E21492C32D091E70442807BFCFC8C89044BB75E0
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,......X.........y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.I\|XWs....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V\|Xns....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.V\|Xns....M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.V\|Xns...........................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V\|Xos...........................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............-G.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\Documents\Outlook Files\Outlook Data File - NoEmail.pst

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	Microsoft Outlook email folder (>=2003)
Category:	dropped
Size (bytes):	271360
Entropy (8bit):	6.571910146463599
Encrypted:	false
SSDEEP:
MD5:	2663B29826C26160A0E22EB710BB3DFA
SHA1:	66C0FC0B5478BE0AA7B723B4E96B0B799B81C25B
SHA-256:	62093CE49FBB12C6EE7032BB3D5285573A8BF877B19F247A82B35B76F364F43A
SHA-512:	9FF0202D554E22BEF48DA31C063D4E04AEA6109B5DD77781293CB27A1ED13BFF5FA27F40D566D2DF5516410E180E5F71FD1BDD9949C0B3B5C0A17793C3776825
Malicious:	false
Reputation:	unknown
Preview:	!BDN.kn.SM......\...............I.......d................@...........@...@...................................@...........................................................................$.......D......................B...............E........p............................................................................................................................................................................................................................................................................................ {.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	262144
Entropy (8bit):	5.846663534977678
Encrypted:	false
SSDEEP:
MD5:	EB2918725D15F24CE8E2C082E7043701
SHA1:	A13DC5547C8131544E578582195E34906F47CA43
SHA-256:	F555E5CA1C48859796DCD1D895A4A4FAF99AC421D484D7976B6FA87D039A721B
SHA-512:	93E87884DF2806F5942B445E0280FA0589B98CE587A09A137257CF06C0E7A4D20F5CC9F040CADCC84FEE4B3A78D9DFF9FCE43C365A71D22A30EE8E7E688D1385
Malicious:	false
Reputation:	unknown
Preview:	.}..0................Y...........D............#.........../................................................................................................................................................................................................................................................................................................................................................................................................................?.........................................................................................9...D......q.z.0................Y...........B............#.........................................................................................................................................................................................................................................................................................................................................................................................................

Chrome Cache Entry: 228

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	117154
Entropy (8bit):	5.2387849737652195
Encrypted:	false
SSDEEP:
MD5:	EA126AAED6FB983EE6F0871563CD5B11
SHA1:	630A4494ED8C08B0F0174D7C1D326815B5760E8C
SHA-256:	BFCA6537131BF505F39AA74A5B0E09754E8A58C92C93F5020ADFE5098010917D
SHA-512:	E18BB13B36F58C4DB9A1866ACDD4271B8B0841353888A64C672DA9FCE317D2F0917270314D46C2E96DCF6BD906BE8612DD9277E030FCCE3A0B56BAA43B2D1934
Malicious:	false
Reputation:	unknown
URL:	https://form.feathery.io/_next/static/chunks/556ae1b7-dd7c5e65c16bbf90.js
Preview:	"use strict";(self.webpackChunk_N_E=self.webpackChunk_N_E\|\|[]).push([[904],{973:function(e,t,r){function n(e,t){if(e){if("string"==typeof e)return i(e,t);var r=Object.prototype.toString.call(e).slice(8,-1);if("Object"===r&&e.constructor&&(r=e.constructor.name),"Map"===r\|\|"Set"===r)return Array.from(e);if("Arguments"===r\|\|/^(?:Ui\|I)nt(?:8\|16\|32)(?:Clamped)?Array$/.test(r))return i(e,t)}}function i(e,t){(null==t\|\|t>e.length)&&(t=e.length);for(var r=0,n=Array(t);r<t;r++)n[r]=e[r];return n}function o(e,t){if("function"!=typeof t&&null!==t)throw TypeError("Super expression must either be null or a function");e.prototype=Object.create(t&&t.prototype,{constructor:{value:e,writable:!0,configurable:!0}}),Object.defineProperty(e,"prototype",{writable:!1}),t&&s(e,t)}function s(e,t){return(s=Object.setPrototypeOf?Object.setPrototypeOf.bind():function(e,t){return e.__proto__=t,e})(e,t)}function a(e){var t=function(){if("undefined"==typeof Reflect\|\|!Reflect.construct\|\|Reflect.construct.sham)return!1

Chrome Cache Entry: 229

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (1759)
Category:	downloaded
Size (bytes):	2223
Entropy (8bit):	5.081124136635537
Encrypted:	false
SSDEEP:
MD5:	4FE36A65AF733D58A702E80CDA7A63F7
SHA1:	6C4CD770A611B0F5491AF5E1E5FEAD028C3DCB38
SHA-256:	3691026B21B883801B6F0F4DF2E35D5C862A4DC92445D48A00FC43147D1C70C8
SHA-512:	6B0E04490EDA0A575EC7A518E9272F2F63B32FEF2144F3F3CE891DABF58886FCC8908B59988F34C3F3B327D32B1642D35DB8A8A46868ED11BC4F9DA2AA2BBA2B
Malicious:	false
Reputation:	unknown
URL:	https://www.gstatic.com/atari/embeds/83a60601c213b72fb19c1855fb0c5f26/intermediate-frame-minified.html?jsh=m%3B%2F_%2Fscs%2Fabc-static%2F_%2Fjs%2Fk%3Dgapi.lb.en.Oh6mNxd5OYM.O%2Fam%3DAAAC%2Fd%3D1%2Frs%3DAHpOoo8ivBPi_9I5G7qxoBeYV5pO1OVdmQ%2Fm%3D__features__&r=402326002
Preview:	<!DOCTYPE html>.<html>.<head>. <style>body,html,iframe{margin:0;padding:0;height:100%;width:100%;overflow:hidden}.forceIosScrolling{overflow:scroll;-webkit-overflow-scrolling:touch}</style>.</head>..<body>.<iframe id='innerFrame' name='innerFrame' sandbox='allow-scripts allow-popups allow-forms allow-same-origin allow-popups-to-escape-sandbox allow-downloads allow-storage-access-by-user-activation' frameborder='0' allowfullscreen>.</iframe>..<script>function loadGapi(){var loaderScript=document.createElement('script');loaderScript.setAttribute('src','https://apis.google.com/js/api.js?checkCookie=1');loaderScript.onload=function(){this.onload=function(){};loadGapiClient();};loaderScript.onreadystatechange=function(){if(this.readyState==='complete'){this.onload();}};(document.head\|\|document.body\|\|document.documentElement).appendChild(loaderScript);}function updateInnerFrame(url,enableInteraction,forceIosScrolling){var urlEl=document.createElement('a');urlEl.setAttribute('href',url);if(u

Chrome Cache Entry: 230

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1162)
Category:	downloaded
Size (bytes):	29392
Entropy (8bit):	5.416277850178202
Encrypted:	false
SSDEEP:
MD5:	01EF348FA40C46513E6B6DF248B93A82
SHA1:	75EDA7B2B8F1919E3B43E871981E45F9D609597E
SHA-256:	9F6F23DC9738BF4DAB4EF668B8C7AACDB171795BB8A44977AE8F1F23A7FD624A
SHA-512:	6D1C743A3DC2FD185006C30111B37AAA82F4E1DE87BEF1BE5FC992A0923BC8E98FC39DCD27827F0B46BA473344F460C8B79DF2DFFDB59158E672FD12CC032685
Malicious:	false
Reputation:	unknown
URL:	"https://www.gstatic.com/_/atari/_/js/k=atari.vw.en_US.U11LfA80YQU.O/am=wA/d=0/rs=AGEqA5k91f_pW_l3C1wBo_FFKsQAOGUakg/m=sy2u,IZT63,vfuNJf,sy3j,sy3n,sy3p,sy40,sy3y,sy3z,siKnQd,sy3f,sy3h,sy3o,sy3q,sy2v,YNjGDd,sy3r,PrPYRd,iFQyKf,hc6Ubd,sy41,SpsfSb,sy3k,sy3m,wR5FRb,pXdRYb,dIoSBb,zbML3c"
Preview:	"use strict";this.default_vw=this.default_vw\|\|{};(function(_){var window=this;.try{._.hyb=function(a,c){c=void 0===c?window:c;return(c=c.WIZ_global_data)&&a in c?c[a]:null};.}catch(e){_._DumpException(e)}.try{._.v("IZT63");.var fNb=function(){var a=_.hyb("nQyAE",window),c;if((c=_.hyb("TSDtV",window))&&"string"===typeof c){var d=_.Ej(_.ep(c,cNb),dNb,1,_.Aj())[0];if(d){c={};d=_.Ej(d,eNb,2,_.Aj());d=_.q(d);for(var e=d.next();!e.done;e=d.next()){e=e.value;var f=_.K(e,7);switch(_.Dj(e,w8)){case 3:c[f]=_.I(e,_.Cj(e,w8,3));break;case 2:c[f]=_.Rj(e,_.Cj(e,w8,2));break;case 4:c[f]=_.Tj(e,_.Cj(e,w8,4));break;case 5:c[f]=_.K(e,_.Cj(e,w8,5))}}}else c={}}else c={};if(c&&0<Object.keys(c).length)for(d=_.q(Object.keys(c)),e=d.next();!e.done;e=.d.next())e=e.value,e in a\|\|(a[e]=c[e]);return a};var eNb=function(a){this.oa=_.u(a)};_.E(eNb,_.L);eNb.prototype.setBooleanValue=function(a){return _.Bj(this,3,w8,_.Pb(a))};var w8=[2,3,4,5,6];var dNb=function(a){this.oa=_.u(a)};_.E(dNb,_.L);dNb.xb=[2];var gNb=fun

Chrome Cache Entry: 231

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2443), with no line terminators
Category:	downloaded
Size (bytes):	2443
Entropy (8bit):	5.190327551202253
Encrypted:	false
SSDEEP:
MD5:	62139F56C3BC349D9382BC7695A9D3C8
SHA1:	44471644EF03FD199E379880D7987D9C944451FA
SHA-256:	81525C55BB514D6D67B81CA598FC0C77002AB908CF9E7FC0C8EB153F4A332B7C
SHA-512:	28AD43E95A1757D33AE39E24D68F08210B338A7E1396E124B4413CAC5F457B0557532FC391669874D49BC1047E15E346FEF99314D8BF03EAA417F8312CD233BA
Malicious:	false
Reputation:	unknown
URL:	https://form.feathery.io/_next/static/chunks/webpack-41e4e2d1eb0c0667.js
Preview:	!function(){"use strict";var e,t,n,r,o,u,i={},f={};function c(e){var t=f[e];if(void 0!==t)return t.exports;var n=f[e]={id:e,loaded:!1,exports:{}},r=!0;try{i[e].call(n.exports,n,n.exports,c),r=!1}finally{r&&delete f[e]}return n.loaded=!0,n.exports}c.m=i,e=[],c.O=function(t,n,r,o){if(n){o=o\|\|0;for(var u=e.length;u>0&&e[u-1][2]>o;u--)e[u]=e[u-1];e[u]=[n,r,o];return}for(var i=1/0,u=0;u<e.length;u++){for(var n=e[u][0],r=e[u][1],o=e[u][2],f=!0,l=0;l<n.length;l++)i>=o&&Object.keys(c.O).every(function(e){return c.O[e](n[l])})?n.splice(l--,1):(f=!1,o<i&&(i=o));if(f){e.splice(u--,1);var a=r();void 0!==a&&(t=a)}}return t},c.n=function(e){var t=e&&e.__esModule?function(){return e.default}:function(){return e};return c.d(t,{a:t}),t},n=Object.getPrototypeOf?function(e){return Object.getPrototypeOf(e)}:function(e){return e.__proto__},c.t=function(e,r){if(1&r&&(e=this(e)),8&r\|\|"object"==typeof e&&e&&(4&r&&e.__esModule\|\|16&r&&"function"==typeof e.then))return e;var o=Object.create(null);c.r(o);var u={}

Chrome Cache Entry: 232

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	56
Entropy (8bit):	4.7199646901008006
Encrypted:	false
SSDEEP:
MD5:	C62CE1C0179FB1A5D1EFCB7E7785DC83
SHA1:	9EA1CABB8B63C19F9FA7AD496871A3972EC92903
SHA-256:	6141EBD082593DF5D54734E1635743034BE74FEEF49F4B9A024651949825F782
SHA-512:	1F9D87B3EBD830A60126643F1234113136E0F7B0133783EE43A51780185592343734BBB4928C4377E14060F2B8F9669E4E166407855AD7B9A50BD8D742029D11
Malicious:	false
Reputation:	unknown
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xNDkSFwlIchSBGJTTsRIFDb2Fgw8SBQ2pDPG0EhAJQybUiIFY6gUSBQ29hYMPEhAJl5xQp92pH24SBQ2pDPG0?alt=proto
Preview:	ChIKBw29hYMPGgAKBw2pDPG0GgAKCQoHDb2Fgw8aAAoJCgcNqQzxtBoA

Chrome Cache Entry: 233

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2121)
Category:	downloaded
Size (bytes):	57591
Entropy (8bit):	5.531429783884011
Encrypted:	false
SSDEEP:
MD5:	927B42BCBD65D0BB9EBC1D6D3450AD3F
SHA1:	DEB2A50624D56F449D092446557D345336F3AD8C
SHA-256:	92B0F6043E77D1ACB73595BCFA6E0B97B91A58E63738166F1B513538F372B30F
SHA-512:	E7AE2C3E542AB9A7A0AF4981C4AE95306E3A8298DEB07BA07792E6A7ED260E2350746538804B89B68FEC96DBEC9DDCF7D769B9A1CEC4033ED3B3B9080DF3A1DF
Malicious:	false
Reputation:	unknown
URL:	https://apis.google.com/_/scs/abc-static/_/js/k=gapi.lb.en.Oh6mNxd5OYM.O/m=gapi_rpc/rt=j/sv=1/d=1/ed=1/am=AAAC/rs=AHpOoo8ivBPi_9I5G7qxoBeYV5pO1OVdmQ/cb=gapi.loaded_0?le=scs
Preview:	gapi.loaded_0(function(_){var window=this;._._F_toggles_initialize=function(a){("undefined"!==typeof globalThis?globalThis:"undefined"!==typeof self?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([0x20000, ]);.var da,ma,na,sa,ta,ya,Ca,Ea;_.ca=function(a){return function(){return _.ba[a].apply(this,arguments)}};_.ba=[];da=function(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}};ma="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.na=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("a");};_.qa=na(this);sa=function(a,b){if(b)a:{var c=_.qa;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&null!=b

Chrome Cache Entry: 234

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2054)
Category:	downloaded
Size (bytes):	15096
Entropy (8bit):	5.467032201011118
Encrypted:	false
SSDEEP:
MD5:	57303C65EDB1DD8F1CCE0F160350F1AE
SHA1:	F3507DFBF8F34322D502FE09B2064E762DD7B073
SHA-256:	35C6D67435B57733F96C935A919A2582B9341E87E3415CCAECBEFE1B4EB01BB9
SHA-512:	ADAED023504D945A3D1955072E44688A7A221DA86696F0BFD61D08D8DCFE00524C64C88155ED7EEC9F11B5E774B7A5ECEA4E47017C6493C365C2F521858373CD
Malicious:	false
Reputation:	unknown
URL:	https://apis.google.com/js/api.js?checkCookie=1
Preview:	(function(){var aa="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a},ba=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");},ca=ba(this),g=function(a,b){if(b)a:{var c=ca;a=a.split(".");for(var d=0;d<a.length-.1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&null!=b&&aa(c,a,{configurable:!0,writable:!0,value:b})}},h=function(a,b,c){if(null==a)throw new TypeError("The 'this' value for String.prototype."+c+" must not be null or undefined");if(b instanceof RegExp)throw new TypeError("First argument to String.prototype."+c+" must not be a regular expression");return a+""};.g("String.prototype.endsWith",function(a){return a?a:function(b,c){var d=h(this

Chrome Cache Entry: 235

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1504)
Category:	downloaded
Size (bytes):	83920
Entropy (8bit):	5.615641671795586
Encrypted:	false
SSDEEP:
MD5:	537A914F06E5CFE872CCE7A86A107B25
SHA1:	A6233CB9F40EB81B0E270097C09ACDCD8B3EF1FD
SHA-256:	5DED627007BF2F9FDBE8032B682CA5DD01D1CC068FCF41578B04914256E720ED
SHA-512:	23C1EFB8CBDD040D6E1E4E533ED747EEE11711567EFBBA6B9BC0385A3D90584BDF5B903A96A071F5DB778C1A80EB6A607D5DCDD99D83E7DB51A9CE19236480E9
Malicious:	false
Reputation:	unknown
URL:	"https://www.gstatic.com/_/atari/_/js/k=atari.vw.en_US.U11LfA80YQU.O/am=wA/d=0/rs=AGEqA5k91f_pW_l3C1wBo_FFKsQAOGUakg/m=NTMZac,m9oV,rCcCxc,RAnnUd,nAFL3,sy2t,gJzDyc,sy32,sy33,uu7UOe,sy34,soHxf,sy35,uY3Nvd,syt,sys,HYv29e"
Preview:	"use strict";this.default_vw=this.default_vw\|\|{};(function(_){var window=this;.try{._.v("NTMZac");.var L8=function(a){_.O.call(this,a.Ja)};_.E(L8,_.O);L8.Sa=_.O.Sa;L8.Aa=_.O.Aa;L8.prototype.Ul=function(){throw Error("ch");};L8.prototype.HF=function(){throw Error("ch");};L8.prototype.ec=function(){throw Error("ch");};_.pq(_.Tqa,L8);._.x();.}catch(e){_._DumpException(e)}.try{._.v("m9oV");._.k4=function(a){_.O.call(this,a.Ja);this.enabled=!1};_.E(_.k4,_.O);_.k4.Sa=_.O.Sa;_.k4.Aa=_.O.Aa;_.k4.prototype.kb=function(a){this.enabled=a};_.k4.prototype.isEnabled=function(){return this.enabled};_.pq(_.MDa,_.k4);._.x();.}catch(e){_._DumpException(e)}.try{._.v("rCcCxc");._.u2=function(a){_.O.call(this,a.Ja);this.B=[]};_.E(_.u2,_.O);_.u2.Sa=_.O.Sa;_.u2.Aa=_.O.Aa;_.pq(_.Rra,_.u2);._.x();.}catch(e){_._DumpException(e)}.try{._.v("RAnnUd");._.l4=function(a){_.qq.call(this,a.Ja);this.I=!1;this.xa=null;this.valid=!0;this.wa=this.Na=this.focused=!1;this.label=this.Ia=this.H=this.Ca=this.ea=null;this.W=!1;t

Chrome Cache Entry: 237

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 1976 x 401, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	71357
Entropy (8bit):	7.845946085852833
Encrypted:	false
SSDEEP:
MD5:	74FA3FE42387DD470C1E14FD45E5715F
SHA1:	46FD2A55DDB9F17DE7616180C447AAF2215E45A3
SHA-256:	BE3B07988C45C9E0B18455F93D554524F3462531A9870A374E128992F7C58A3E
SHA-512:	94C4A8161E78B151BABE2EC6D9FD9C93FA981C236FA9CFFAA90B7AEE48B7C482DE4958BDD0008AFE26B7D62393D4AFAA04AA8D6AF3ABC829BEC4076A24EC6D1F
Malicious:	false
Reputation:	unknown
URL:	https://feathery.s3.us-west-1.amazonaws.com/full-logo-1.png
Preview:	.PNG........IHDR...............l.....pHYs...%...%.IR$.....sRGB.........gAMA......a....RIDATx....d....u"."U.H.T../:....H&.........A.zz.g..2!.4.%....uwI.4......!x.B....L._....T,.@.U.".g.9{...>......x.....~>..g.{..y.....x$.....>..3.~IT~8-z.............................C..P..5b...~.....S.................\8....w..m..M...m.S..O<9........................C....b....m....$.................p...:~....U.@J(......l.E..'........................6...k..+.....Wn................\......{..cofe{...D...Y.r.k...?..W..................n...._94..fA.z...{....M.O.,s...............\(.....^y^.[_.V...]n[.t..sM..~u..S...+.............p!...k.;w.n...\.Y...,dO..r}..\|r.Z.................7\[&q{....wU.f..g.vB...Rs{^:i.k...}...................%...7.oM...l..Mg...`[5pK.W5.e...{.......Y....................!nO77..v.!/.....gm{...w._[)...{.......................'uzS...x]~..;C.].vGw..........................0......L.t.%...,]W..\|[K...w.v....fGwux......+..................7\.~.._..9..nJ.....

Chrome Cache Entry: 238

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	111017
Entropy (8bit):	5.337190773752627
Encrypted:	false
SSDEEP:
MD5:	7B403194B8C2DACB734F64402F9270DF
SHA1:	6E4FD26A2177777D82165E7110B39E3162483383
SHA-256:	18AF63E8638AD84D5B787C91A0238B704A1801C34E24D64BA0ABA82C52756D74
SHA-512:	0A00E2A8492CBD5F16AFB4DE7219E77832E178A65ECDE4B63041EA4FEE4AEEAEF2C86CE22285BF8FEB163F08513FB8746B811B81E0D42ED0234445A44576396D
Malicious:	false
Reputation:	unknown
URL:	https://form.feathery.io/_next/static/chunks/main-494089155be20b28.js
Preview:	(self.webpackChunk_N_E=self.webpackChunk_N_E\|\|[]).push([[179],{37:function(){"trimStart"in String.prototype\|\|(String.prototype.trimStart=String.prototype.trimLeft),"trimEnd"in String.prototype\|\|(String.prototype.trimEnd=String.prototype.trimRight),"description"in Symbol.prototype\|\|Object.defineProperty(Symbol.prototype,"description",{configurable:!0,get:function(){var e=/$(.*)$/.exec(this.toString());return e?e[1]:void 0}}),Array.prototype.flat\|\|(Array.prototype.flat=function(e,t){return t=this.concat.apply([],this),e>1&&t.some(Array.isArray)?t.flat(e-1):t},Array.prototype.flatMap=function(e,t){return this.map(e,t).flat()}),Promise.prototype.finally\|\|(Promise.prototype.finally=function(e){if("function"!=typeof e)return this.then(e,e);var t=this.constructor\|\|Promise;return this.then(function(r){return t.resolve(e()).then(function(){return r})},function(r){return t.resolve(e()).then(function(){throw r})})}),Object.fromEntries\|\|(Object.fromEntries=function(e){return Array.from(e).reduce

Chrome Cache Entry: 239

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	520268
Entropy (8bit):	5.4545470454830935
Encrypted:	false
SSDEEP:
MD5:	354E95F311F836DCF51428FC9A71389F
SHA1:	62941F27E4AD6ADE169A495CF07D0152D4C12CB2
SHA-256:	C353687F9545B5D2488394BE4A3CE0DAB116DF7EC066BD4998F9AD8E9C4046E8
SHA-512:	D3A5240D61882C365EA23141EA58BB4261136799CBD8D1EA1F47EAD0D56B79EA2D6F40C79B3BAFBF109F09C10EDC9CBE874DE19B4D7129281CE57324691860B8
Malicious:	false
Reputation:	unknown
URL:	https://form.feathery.io/_next/static/chunks/cf721ce5-ad12c370b42e326b.js
Preview:	(self.webpackChunk_N_E=self.webpackChunk_N_E\|\|[]).push([[446],{1222:function(e,t,n){var r;e.exports=(r=n(7294),(()=>{"use strict";var e,t,a={621:e=>{e.exports=n(5277)},544:e=>{e.exports=n(5933)},156:e=>{e.exports=r}},o={};function i(e){var t=o[e];if(void 0!==t)return t.exports;var n=o[e]={exports:{}};return a[e](n,n.exports,i),n.exports}i.n=e=>{var t=e&&e.__esModule?()=>e.default:()=>e;return i.d(t,{a:t}),t},t=Object.getPrototypeOf?e=>Object.getPrototypeOf(e):e=>e.__proto__,i.t=function(n,r){if(1&r&&(n=this(n)),8&r\|\|"object"==typeof n&&n&&(4&r&&n.__esModule\|\|16&r&&"function"==typeof n.then))return n;var a=Object.create(null);i.r(a);var o={};e=e\|\|[null,t({}),t([]),t(t)];for(var c=2&r&&n;"object"==typeof c&&!~e.indexOf(c);c=t(c))Object.getOwnPropertyNames(c).forEach(e=>o[e]=()=>n[e]);return o.default=()=>n,i.d(a,o),a},i.d=(e,t)=>{for(var n in t)i.o(t,n)&&!i.o(e,n)&&Object.defineProperty(e,n,{enumerable:!0,get:t[n]})},i.g=function(){if("object"==typeof globalThis)return globalThis;try{ret

Chrome Cache Entry: 241

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	110327
Entropy (8bit):	5.227948277165201
Encrypted:	false
SSDEEP:
MD5:	FD907A8657A91064E428393552A21CFE
SHA1:	443BCFB6B531CA0FC7D16168A8800028480E3C23
SHA-256:	F79DF82BFB5E5F6FCC413C5B9D284F10ADDA2E1A13A1E7636B7041977DC866FC
SHA-512:	81D85D6B03BC09F7D5D1EDD22185BC4EFF5ADA911F267245B2620EB2FDCADF39914FA885A2523218D65DCC78C7CEFDCC04C53FA828495513522E6E492FE2996E
Malicious:	false
Reputation:	unknown
URL:	https://form.feathery.io/_next/static/chunks/pages/_app-d685d89e76884ca9.js
Preview:	(self.webpackChunk_N_E=self.webpackChunk_N_E\|\|[]).push([[888],{3454:function(t,e,n){"use strict";var r,i;t.exports=(null==(r=n.g.process)?void 0:r.env)&&"object"==typeof(null==(i=n.g.process)?void 0:i.env)?n.g.process:n(7663)},6840:function(t,e,n){(window.__NEXT_P=window.__NEXT_P\|\|[]).push(["/_app",function(){return n(6863)}])},8179:function(t,e,n){"use strict";n.d(e,{J:function(){return r}});let r="production"},556:function(t,e,n){"use strict";n.d(e,{RP:function(){return function t(e,n,r){let a=arguments.length>3&&void 0!==arguments[3]?arguments[3]:0;return new i.cW((i,o)=>{let c=e[a];if(null===n\|\|"function"!=typeof c)i(n);else{let u=c({...n},r);(0,s.J8)(u)?u.then(n=>t(e,n,r,a+1).then(i)).then(null,o):t(e,u,r,a+1).then(i).then(null,o)}})}},cc:function(){return o},fH:function(){return a}});var r=n(21),i=n(7884),s=n(2135);function a(){return(0,r.YO)("globalEventProcessors",()=>[])}function o(t){a().push(t)}},128:function(t,e,n){"use strict";n.d(e,{$e:function(){return a},Tb:function(){r

Chrome Cache Entry: 242

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	4613
Entropy (8bit):	5.346659866900068
Encrypted:	false
SSDEEP:
MD5:	FBC5756CF2D585EEB18EBFD9CD6F9642
SHA1:	892FAF621ABD948E60190DB38FC2E5B2B6A01A65
SHA-256:	B182DB1057F945FFFA546BA81B50550DB742F6007C3298D9A2FFC5A8B9472F91
SHA-512:	EEAD2DE8C557441DB08B43EE3235AABEF209B3BFFC04A8A9332255244CF48AC35374827F9DC1E45D7734A21C945204115E84F3755BD7240D49ABFAAC5B558723
Malicious:	false
Reputation:	unknown
URL:	https://fonts.googleapis.com/css?family=Lato%3A300%2C300italic%2C400%2C400italic%2C700%2C700italic&display=swap
Preview:	/* latin-ext /.@font-face {. font-family: 'Lato';. font-style: italic;. font-weight: 300;. font-display: swap;. src: url(https://fonts.gstatic.com/s/lato/v24/S6u_w4BMUTPHjxsI9w2_FQft1dw.woff2) format('woff2');. unicode-range: U+0100-02AF, U+0304, U+0308, U+0329, U+1E00-1E9F, U+1EF2-1EFF, U+2020, U+20A0-20AB, U+20AD-20C0, U+2113, U+2C60-2C7F, U+A720-A7FF;.}./ latin /.@font-face {. font-family: 'Lato';. font-style: italic;. font-weight: 300;. font-display: swap;. src: url(https://fonts.gstatic.com/s/lato/v24/S6u_w4BMUTPHjxsI9w2_Gwft.woff2) format('woff2');. unicode-range: U+0000-00FF, U+0131, U+0152-0153, U+02BB-02BC, U+02C6, U+02DA, U+02DC, U+0304, U+0308, U+0329, U+2000-206F, U+2074, U+20AC, U+2122, U+2191, U+2193, U+2212, U+2215, U+FEFF, U+FFFD;.}./ latin-ext */.@font-face {. font-family: 'Lato';. font-style: italic;. font-weight: 400;. font-display: swap;. src: url(https://fonts.gstatic.com/s/lato/v24/S6u8w4BMUTPHjxsAUi-qJCY.woff2) format('woff2');. unicode-rang

Chrome Cache Entry: 243

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	77
Entropy (8bit):	4.37144473219773
Encrypted:	false
SSDEEP:
MD5:	B6652DF95DB52FEB4DAF4ECA35380933
SHA1:	65451D110137761B318C82D9071C042DB80C4036
SHA-256:	6F5B4AA00D2F8D6AED9935B471806BF7ACEF464D0C1D390260E5FE27F800C67E
SHA-512:	3390C5663EF9081885DF8CDBC719F6C2F1597A4E25168529598097E9472608A4A62EC7F7E0BC400D22AAC81BF6EA926532886E4DC6E4E272D3B588490A090473
Malicious:	false
Reputation:	unknown
URL:	https://form.feathery.io/_next/static/Ai01PBAcqIAgfxw3crlkP/_ssgManifest.js
Preview:	self.__SSG_MANIFEST=new Set,self.__SSG_MANIFEST_CB&&self.__SSG_MANIFEST_CB();

Chrome Cache Entry: 245

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	downloaded
Size (bytes):	1150
Entropy (8bit):	2.3710475547263856
Encrypted:	false
SSDEEP:
MD5:	EA69A3F95DD5484853D128186DB7E13D
SHA1:	5FDB5FE05108FD6E5386BBDA06778AF4B446DC6A
SHA-256:	8179E80BCFEF62154D1FF7371A1C60BD2C6C1E71C3DA2F4A8B1DB518A1900EC2
SHA-512:	2169D31065059C3677D025F27A5650C1E35BF83B6D6B3D80842B0809FF67E85388CB00213A4BD3FA76F71909A21298C824B39299A3980BA3B11C0297DB472610
Malicious:	false
Reputation:	unknown
URL:	https://ssl.gstatic.com/atari/images/public/favicon.ico
Preview:	............ .h.......(....... ..... .....@....................P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>......................P>..P>..............P>..P>..P>..P>..P>..P>......................P>..P>..............P>..P>..P>..P>..P>..P>......................P>..P>..............P>..P>..P>..P>..P>..P>......................P>..P>..............P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..........................................P>..P>..P>..P>..P>..P>..........................................P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P

Chrome Cache Entry: 246

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	16
Entropy (8bit):	3.875
Encrypted:	false
SSDEEP:
MD5:	900914BC560773CAF9E095A8F17F6E37
SHA1:	51E0C4C0C0902C50F0D7E7581E0EDB0DCC191D7D
SHA-256:	08E437A7674E58F221D4EE6D5742EF2643929FB566511709F988B5EBE4FE4C1E
SHA-512:	2B48B170CEEBD6DB978D4DC79710A746903473B7C378FA25D6564AD6F6D2141A080E83C66D79688C35D3146F6DBFE996D3232C7A643F7767B8124C18065DB1C2
Malicious:	false
Reputation:	unknown
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xNDkSEAlDJtSIgVjqBRIFDb2Fgw8=?alt=proto
Preview:	CgkKBw29hYMPGgA=

Chrome Cache Entry: 247

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1900)
Category:	downloaded
Size (bytes):	38371
Entropy (8bit):	5.6612236412725245
Encrypted:	false
SSDEEP:
MD5:	A38E7840E2D1DE121D69A58603160204
SHA1:	5E53CA8AA1BAB02858E075B3BFF619C62E9F6C6B
SHA-256:	6D6F4904F17ABBDB1FAFD02F645B17D0FC133F6E83A133E349049DB035CBBE18
SHA-512:	561FB4BC4D91FCABBD3514D18EB23305B01DFD50C95C04EB0B35C7E41F3A1E153155B2E8956D03415CB5E8D43743524CE569E19F4501802F4CB98E9D87D77CC2
Malicious:	false
Reputation:	unknown
URL:	"https://www.gstatic.com/_/atari/_/js/k=atari.vw.en_US.U11LfA80YQU.O/am=wA/d=0/rs=AGEqA5k91f_pW_l3C1wBo_FFKsQAOGUakg/m=sy1b,sy1c,sy1a,FoQBg"
Preview:	"use strict";this.default_vw=this.default_vw\|\|{};(function(_){var window=this;.try{._.aKa=function(a){for(var c=[],d=0,e=0;e<a.length;e++){var f=a.charCodeAt(e);128>f?c[d++]=f:(2048>f?c[d++]=f>>6\|192:(55296==(f&64512)&&e+1<a.length&&56320==(a.charCodeAt(e+1)&64512)?(f=65536+((f&1023)<<10)+(a.charCodeAt(++e)&1023),c[d++]=f>>18\|240,c[d++]=f>>12&63\|128):c[d++]=f>>12\|224,c[d++]=f>>6&63\|128),c[d++]=f&63\|128)}return c};_.CC=function(a,c,d){return _.Vq(_.$q(a,c),c,d)};_.DC=function(){this.blockSize=-1};.}catch(e){_._DumpException(e)}.try{.var EC,FC,bKa,cKa,fKa,gKa,IC,nKa,oKa,pKa,qKa,MC,rKa,tKa,uKa,OC;EC=function(a,c){this.F=a;this.H=c;this.B=!0};FC=function(a){var c={};a=a.replace(/\r/g,"").split("\n");for(var d=0;d<a.length;d++){var e=a[d],f=e.indexOf(":");0>f\|\|(c[e.substring(0,f)]=e.substring(f+2,e.length))}return c};bKa=function(a){var c="";_.td(a,function(d,e){c+=e+": "+d+"\r\n"});return c};cKa=function(){};_.GC=function(a,c,d){return(a=_.Sc(a,c,d,!1))?a:_.hc(c)};._.dKa=function(a,c){retu

Chrome Cache Entry: 249

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	56
Entropy (8bit):	4.731661512101757
Encrypted:	false
SSDEEP:
MD5:	1C6F8368B42FDDD8C45C574CE0D1F49A
SHA1:	328C01DCDC6CFC35D883D65394589A23955FE653
SHA-256:	B151579C7FB2783DC568F950666A612FD39E99D390F0FD8FD8C9890B4B1C595C
SHA-512:	D7268DECAF5E5415CE2687D1FD739D2A7688D896D5B17B5AFA2F42ACEB8A14C419E95D5E85C1ED0AF7E7A6148771567C6BA8F839D99603D2A1CF9ECE538B9D41
Malicious:	false
Reputation:	unknown
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xNDkSFwmcIDDaFmy0IRIFDb2Fgw8SBQ0gzSsPEhAJQybUiIFY6gUSBQ29hYMPEhAJQkIoLhzVyjwSBQ0gzSsP?alt=proto
Preview:	ChIKBw29hYMPGgAKBw0gzSsPGgAKCQoHDb2Fgw8aAAoJCgcNIM0rDxoA

Chrome Cache Entry: 250

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), CFF, length 46464, version 0.0
Category:	downloaded
Size (bytes):	46464
Entropy (8bit):	7.994045765284662
Encrypted:	true
SSDEEP:
MD5:	2794D45DF0CB292ED2DA28F793F5F34C
SHA1:	721B112B4D6EFBC43D76E6FAB1194FB8237D2023
SHA-256:	EDF9AF9CEFDDE51601AE04D8FD5797C2C83F31060AEA815A098BA60B8A3E6CD1
SHA-512:	DF42B3490259EE4A2CBB9C3F1E99ACE7BD114BA64AD37175B6D1FA2665426CAE087C8CE4E49B8C25C06143C64BF9868A4C86A74B0568850EA87C4F7EF5C00D49
Malicious:	false
Reputation:	unknown
URL:	https://form.feathery.io/_next/static/media/AxiformaMediumfont.03305590.woff2
Preview:	wOF2OTTO.......................d...................<..@...@..v.`..<.6.$..\|....b. [+....5.0.Q=....{......"5..LUUUUMI.x......O~.._..w..._.................X..V..M9."7qiG.d[c.?-...h.i.....16J...BRet.?.n.}d.b.Z.NI..3..6.E..<.7.......X).....@m.....#..$L......sF3A....dQ..$)...b.'.b.(("YB.DL ..`H...?C.Z.....z....b........hsv....m4.Qp^...D[`%FR.. .....\|z.....!.p.'^.j%.y%Z.I....f...?....C./@&..`...5aU....T.e.fE.!.TS.....L....$.!N.(@...:TZ........8G..\p.`...<.s..<#V.R.h.H.e ....BwR....M.#g..V..e.UQa.0.....1.$.....t_H.z"..:.L..p.w..:.+..>..j..A........I.hE...QKE\|RQ.vsf.0..i.Q. ..\|.}...6%J?...wB.$vD."["......`.1b...C..2`...i... P..BZ;.7.)%k?0....p....i..?.e..d.(l.}Wm..F:.(.].J..$...........l.$;...,.,#...H..=.e_Pa...+,...V.r.i7..e.2.i...V).t}...S.v..Rp.+...b.P...U..\|.........1.&....ej..f....C.mH$...H(eJ..9..k.......RQK.;w.....u....L..9.uX..1nd.......2.}.....w.n`I._.~.[........ %..x.y....T.e.R.R.d.G...J2...0.1..C..i.fM...FqC..c.,.g.i...F.. .l..(.7F

Chrome Cache Entry: 251

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (3383)
Category:	downloaded
Size (bytes):	109002
Entropy (8bit):	5.487228566621995
Encrypted:	false
SSDEEP:
MD5:	36D3ED351F0A1F94ECA1D05622680ACC
SHA1:	1934F936AC5C609F5DA9999E6632F9428AB65AE1
SHA-256:	7E2ECEE513FD3CEE859BA116561A5A71EA95A8F89C9294397945FD4787BA2D13
SHA-512:	01506714F6E320AE6DBE5E20D6315B2A5621D3228984F084CE36BA52D8BD746648802F486209A99D144A752FA07FD8E8BE0847D39C0CA655EC0A97CEDBCA7205
Malicious:	false
Reputation:	unknown
URL:	https://www.gstatic.com/feedback/js/help/prod/service/lazy.min.js
Preview:	(function(){var m,aa=function(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}},ba="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a},ca=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");.},da=ca(this),r=function(a,b){if(b)a:{var c=da;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&null!=b&&ba(c,a,{configurable:!0,writable:!0,value:b})}};.r("Symbol",function(a){if(a)return a;var b=function(g,f){this.wc=g;ba(this,"description",{configurable:!0,writable:!0,value:f})};b.prototype.toString=function(){return this.wc};var c="jscomp_symbol_"+(1E9*Math.random()>>>0)+"_",d=0,e=function

Chrome Cache Entry: 252

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1222)
Category:	downloaded
Size (bytes):	1347068
Entropy (8bit):	5.624150091820299
Encrypted:	false
SSDEEP:
MD5:	F32DA4FA1E97528B6E7A912C50E8A1DC
SHA1:	ADFCDBCA7ADF2CB02A6FD61EB85DB75172766391
SHA-256:	38073A5C873AEC5159694617008677CAF9575C0BD6E1E694F7829ACA6DC23452
SHA-512:	985E03A843BAFEDF03184E282DB176C63FAED7335ED99185764E2DEDA92E56C92D5D7B286D72FF13BD484A4AC2747E8E63801293D9B92E9C08AA993C59C43AE8
Malicious:	false
Reputation:	unknown
URL:	"https://www.gstatic.com/_/atari/_/js/k=atari.vw.en_US.U11LfA80YQU.O/am=wA/d=0/rs=AGEqA5k91f_pW_l3C1wBo_FFKsQAOGUakg/m=MpJwZc,n73qwf,A4UTCb,mzzZzc,CHCSlb,qAKInc,syz,X85Uvc,sy2z,abQiW,W26a5e,hJUyqe,sy14,sy16,sy11,sy12,sy13,sy15,fuVYe,syv,PVlQOd,NPKaK,sy5,BVgquf,fmklff,TGYpv,KUM7Z,XDKZTc,sy10,qkPXAf,qEW1W,oNFsLb,sy3v,yxTchf,sy3w,sy3x,xQtZb,yf2Bs,sy2,sy9,yyxWAc,qddgKe,sy31,SM1lmd,sy7,sy6,syw,RRzQxe,zZvHmd,sy8,syb,sy28,syk,sya,fNFZH,sy30,syl,RrXLpc,cgRV2c,syy,sy1q,o1L5Wb,X4BaPc,syf,Md9ENb,sy1g,sy1h,sy1i,syp,sy1e,sy1f,Ko0sOe,syn,syx,sy17,sy18,sy1d,NlqxW,sy1k,sy1m,sy1n,sy1o,sy1p,sy1u,sy1j,sy1t,sy1s,sy1r,sy1z,sy21,sy24,sy25,sy26,sy27,sy1w,sy20,sy2b,sy2i,sy1x,sy1l,sy1v,sy23,syo,sy1y,sy29,sy2a,sy2f,sy2g,sy2h,sy2k,sy2l,T807ad,sy22,zmwrxd,sy2c,sy2d,sy2e,sy2j,oy3iwb,dBhIIb,sy2m,sy2n,Yr1Pcb,LUQjOd,a9i3ec,CmOog,qYIcH,zTt0Rb,ap0X9d,Ik1vNd,NzVYMd,KlZlNb,rj51oe,zAU64c,uUwMBf,zRiL5c,AQnEY,jhxjge,ZV9ZUe,Tc7Qif,heobjb,R4KMEc,KlrXId,sy2o,sy2p,sy2q,sy2r,UYjpC,vVEdxc,sy3,VYKRW,sy19,CG0Qwb,RZ9OZ,N0NZx"
Preview:	"use strict";this.default_vw=this.default_vw\|\|{};(function(_){var window=this;.try{._.v("MpJwZc");.._.x();.}catch(e){_._DumpException(e)}.try{._.v("n73qwf");.._.x();.}catch(e){_._DumpException(e)}.try{._.v("A4UTCb");.._.x();.}catch(e){_._DumpException(e)}.try{._.v("mzzZzc");.var iGa;_.XA=function(a){_.O.call(this,a.Ja)};_.E(_.XA,_.O);_.XA.Sa=_.O.Sa;_.XA.Aa=_.O.Aa;iGa=function(a){a=_.pe(a,function(c){return _.oe(c)&&"yDmH0d"===c.id});return _.oe(a)?a:null};_.YA=function(a){var c=a?_.qe(a):document,d;return null!=(d=a?iGa(a):c.getElementById("yDmH0d"))?d:c.body};_.pq(_.ir,_.XA);._.x();.}catch(e){_._DumpException(e)}.try{._.v("CHCSlb");._.WA=function(a){_.O.call(this,a.Ja)};_.E(_.WA,_.O);_.WA.Sa=_.O.Sa;_.WA.Aa=_.O.Aa;_.pq(_.Pla,_.WA);._.x();.}catch(e){_._DumpException(e)}.try{._.v("qAKInc");.var B3=function(a){_.qq.call(this,a.Ja);this.B=this.getData("active").B(!1);this.C=this.S("vyyg5");this.F=_.Ye(_.Ze(this).Oc().pb(function(){var c=this.V();this.B?c.ib("qs41qe"):c.ib("sf4e6b");this.B&

Chrome Cache Entry: 253

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (8376), with no line terminators
Category:	downloaded
Size (bytes):	8376
Entropy (8bit):	5.174863332775615
Encrypted:	false
SSDEEP:
MD5:	549DF3C0ECE9717DA5C0084D7639BB24
SHA1:	345C759C85026D2DF0099FF59795325F80DD0845
SHA-256:	06DFA456A0491ADF214B721E67E5B37016AB1B20D078F480CFB086A4DADD3DB8
SHA-512:	302C7AE80E938DFCDB45A063C15A1EC2C5035A85A9A912EB8B26FB0DAA8F621EE554F1E735B35FB12C216F8F0AA9B93374CA2F887160B14317482B2E1090D6E4
Malicious:	false
Reputation:	unknown
URL:	https://form.feathery.io/_next/static/css/d50ca6027d2c0e2c.css
Preview:	body{margin:0;height:100vh;width:100vw;font-family:-apple-system,BlinkMacSystemFont,Segoe UI,Roboto,Oxygen,Ubuntu,Cantarell,Fira Sans,Droid Sans,Helvetica Neue,sans-serif;-webkit-font-smoothing:antialiased;-moz-osx-font-smoothing:grayscale}#__next,body{overflow-x:hidden}#__next{display:flex;min-height:100%;width:100%}code{font-family:source-code-pro,Menlo,Monaco,Consolas,Courier New,monospace}@font-face{font-family:Axiforma;font-weight:100;src:local("Axiforma"),url(/_next/static/media/AxiformaThinfont.c973422b.woff2) format("woff2")}@font-face{font-family:Axiforma;font-weight:200;src:local("Axiforma"),url(/_next/static/media/AxiformaLightfont.ececd535.woff2) format("woff2")}@font-face{font-family:Axiforma;font-weight:300;src:local("Axiforma"),url(/_next/static/media/AxiformaBookfont.73bc18ed.woff2) format("woff2")}@font-face{font-family:Axiforma;font-weight:400;src:local("Axiforma"),url(/_next/static/media/AxiformaRegularfont.7d4662a2.woff2) format("woff2")}@font-face{font-family:Axifo

Chrome Cache Entry: 254

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (383)
Category:	downloaded
Size (bytes):	855
Entropy (8bit):	5.43258464734463
Encrypted:	false
SSDEEP:
MD5:	808549A338B353A621EA8AAB6AD05616
SHA1:	8DF01A686270FC5BE8EF7FD65175D169EBA8E024
SHA-256:	348E952683CDBA4FDC4A70856E9C2D2EA72BDE85CAF28BD109D1C2E49D218C2C
SHA-512:	938A875CA1F8A57A3831C1E072FE33537867ACFE7516CC8C7BAF7F261F2A5F7FAE5D6B968E614CDCEC92280332499EB5A99E7DB192C6AF2EFF2283CED83442FD
Malicious:	false
Reputation:	unknown
URL:	"https://www.gstatic.com/_/atari/_/js/k=atari.vw.en_US.U11LfA80YQU.O/am=wA/d=0/rs=AGEqA5k91f_pW_l3C1wBo_FFKsQAOGUakg/m=sy2y,TRvtze"
Preview:	"use strict";this.default_vw=this.default_vw\|\|{};(function(_){var window=this;.try{.var MAb,LAb,OAb;MAb=function(a){return(a=LAb.exec(a))&&a[1]?a[1]:""};_.NAb=function(a){var c=MAb(a);return a.substring(c.length)};_.PAb=function(){void 0===OAb&&(OAb=MAb(location.pathname));return OAb};LAb=RegExp("^(/prod\|/corp\|/scary)?/");OAb=void 0;.}catch(e){_._DumpException(e)}.try{._.v("TRvtze");.var e4=function(a){_.O.call(this,a.Ja);this.B=a.Xa.configuration;this.C=_.It()};_.E(e4,_.O);e4.Sa=_.O.Sa;e4.Aa=function(){return{Xa:{configuration:_.Dq},service:{flags:_.hv}}};e4.prototype.F=function(){return _.PAb()};e4.prototype.D=function(){return _.Kt(this.C,"atari-rhpp")?_.Nt(this.C,"atari-rhpp"):_.zj(this.B.get(),213)?"/_":_.PAb()+"/u/"+this.B.Pg().yk()+"/_"};_.pq(_.ICa,e4);._.x();.}catch(e){_._DumpException(e)}.}).call(this,this.default_vw);.// Google Inc..

Chrome Cache Entry: 255

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2121)
Category:	downloaded
Size (bytes):	322211
Entropy (8bit):	5.522177100532246
Encrypted:	false
SSDEEP:
MD5:	79D4BD9775FF102A821FA1BC8A37E818
SHA1:	2913B972B8D47A13F406B907FF982FF7C78E51B1
SHA-256:	6D3606F0DC83F347C1865622B8ADD883AD2136C55F823956013227DB56C3D8CE
SHA-512:	DCB969F7B1977081B6B7A8C590BCEA012676ACC5328508F7C6F7BB1DD9125D065932519FEEB03F07D397C01272CD98C14E3E034CB12EF0BCC94AE38A1EE18D2A
Malicious:	false
Reputation:	unknown
URL:	https://apis.google.com/_/scs/abc-static/_/js/k=gapi.lb.en.Oh6mNxd5OYM.O/m=client/rt=j/sv=1/d=1/ed=1/am=AAAC/rs=AHpOoo8ivBPi_9I5G7qxoBeYV5pO1OVdmQ/cb=gapi.loaded_0?le=scs
Preview:	gapi.loaded_0(function(_){var window=this;._._F_toggles_initialize=function(a){("undefined"!==typeof globalThis?globalThis:"undefined"!==typeof self?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([0x20000, ]);.var da,ma,na,sa,ta,ya,Ca,Ea;_.ca=function(a){return function(){return _.ba[a].apply(this,arguments)}};_.ba=[];da=function(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}};ma="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.na=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("a");};_.qa=na(this);sa=function(a,b){if(b)a:{var c=_.qa;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&null!=b

Chrome Cache Entry: 256

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	261
Entropy (8bit):	4.946693349605244
Encrypted:	false
SSDEEP:
MD5:	17F97395B404BE09070A086BF5AD0EAC
SHA1:	BF2911A975C8D9572FF1200D255C1853A5AEC803
SHA-256:	CCFECB56109F22893660023FC17A8F0B8AE17EDF14B3B1DBF225306015A1E935
SHA-512:	FC5D25E09F6D8BAC54FD25A641FF11C2FDB42FB820AA8ED334EA2D46D32EE3BD0AAF6EF9D7129CE217CBCFE098F05FA263ECA1525E422EA72103CE6B2ADE3022
Malicious:	false
Reputation:	unknown
URL:	https://apis.google.com/_/scs/abc-static/_/js/k=gapi.lb.en.Oh6mNxd5OYM.O/m=gapi_rpc/exm=client/rt=j/sv=1/d=1/ed=1/am=AAAC/rs=AHpOoo8ivBPi_9I5G7qxoBeYV5pO1OVdmQ/cb=gapi.loaded_1?le=scs
Preview:	gapi.loaded_1(function(_){var window=this;._.B("gapi.rpc.setup",_.dm);_.B("gapi.rpc.register",_.Tl);_.B("gapi.rpc.call",_.Xl);_.B("gapi.rpc.unregister",_.Ul);_.B("gapi.rpc.sendHandshake",function(a,b){_.dm(a)();_.Ol.send(a,_.Ol.LI(b),"*")});.});.// Google Inc..

Chrome Cache Entry: 257

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (64642), with CRLF line terminators
Category:	downloaded
Size (bytes):	199444
Entropy (8bit):	5.35248921501931
Encrypted:	false
SSDEEP:
MD5:	A81BBC098B6FEEF2A64AB1BB33B21CB7
SHA1:	13D82CFE8DA0267FAD07880DB1A2B22CB8D9199B
SHA-256:	D3754AF9F44CEDDB15F0045DB29DF41DD35FA9A7572929B6465B36D13912B27B
SHA-512:	4CA39985516430AF2ACD30D11F02AFAFD4526CFE451317B829A46B2198D49598CEF561B29E00EADF7FF188A7A589B7EA1C6C971AD8F2B179EBB030ED78B2BCD4
Malicious:	false
Reputation:	unknown
URL:	https://form.feathery.io/_next/static/chunks/ad7f724d-1c40c3094ead0a0b.js
Preview:	(self.webpackChunk_N_E=self.webpackChunk_N_E\|\|[]).push([[443],{1120:function(A){A.exports=function(){"use strict";/! **************************************************************************.. Copyright (c) Microsoft Corporation..... Permission to use, copy, modify, and/or distribute this software for any.. purpose with or without fee is hereby granted..... THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH.. REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY.. AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,.. INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM.. LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR.. OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR.. PERFORMANCE OF THIS SOFTWARE... *************************************************************************** */var A,e,t,r,B,n,s,o,i,

Chrome Cache Entry: 258

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	29875
Entropy (8bit):	5.565681731212922
Encrypted:	false
SSDEEP:
MD5:	0EBB7B6EA38FD3796236DDAFBFD00D04
SHA1:	63F706C63220B76FE8D8A0AB16C8F15E88D88318
SHA-256:	C886F70FD06EE5BF0B7087F389154F625C98D079D42DC4A1964F5BB1BA3330BD
SHA-512:	4763C00BD3549F504AF0DAACE3F15177A7A83CB0AE3C7463011D7A6C08DD462EC540ADAEC9C508D17790FD42FAC5996A6AF1EC7600BC1C6EE06B0CF5A6620026
Malicious:	false
Reputation:	unknown
URL:	"https://fonts.googleapis.com/css?family=Google+Sans:400,500\|Roboto:300,400,500,700\|Source+Code+Pro:400,700&display=swap"
Preview:	/. See: https://fonts.google.com/license/googlerestricted. /./ armenian /.@font-face {. font-family: 'Google Sans';. font-style: normal;. font-weight: 400;. font-display: swap;. src: url(https://fonts.gstatic.com/s/googlesans/v58/4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPiIUvaYr.woff2) format('woff2');. unicode-range: U+0308, U+0530-058F, U+2010, U+2024, U+25CC, U+FB13-FB17;.}./ bengali /.@font-face {. font-family: 'Google Sans';. font-style: normal;. font-weight: 400;. font-display: swap;. src: url(https://fonts.gstatic.com/s/googlesans/v58/4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPiAUvaYr.woff2) format('woff2');. unicode-range: U+0951-0952, U+0964-0965, U+0980-09FE, U+1CD0, U+1CD2, U+1CD5-1CD6, U+1CD8, U+1CE1, U+1CEA, U+1CED, U+1CF2, U+1CF5-1CF7, U+200C-200D, U+20B9, U+25CC, U+A8F1;.}./ cyrillic-ext */.@font-face {. font-family: 'Google Sans';. font-style: normal;. font-weight: 400;. font-display: swap;. src: url(https://fonts.g

Chrome Cache Entry: 259

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (546)
Category:	downloaded
Size (bytes):	632049
Entropy (8bit):	5.551113052705356
Encrypted:	false
SSDEEP:
MD5:	0547E0EC5DB76D46EDB71B93C83CC59B
SHA1:	F7111DD97BD4DF283FFFF0FC750F8AF120AD59D0
SHA-256:	F1793F71D19EC4A44708F5D71CD23773EE7E6B3C49B21CC5708F181AAC02654D
SHA-512:	C0C01460226F66003F31035156A37A5502ECD455B20F9E258A0EECF205612D6F0D93BD84D59639BC5206439AF9381C951CB9CD9765D78A26851E39A45EDB469D
Malicious:	false
Reputation:	unknown
URL:	https://www.gstatic.com/_/atari/_/js/k=atari.vw.en_US.U11LfA80YQU.O/am=wA/d=1/rs=AGEqA5k91f_pW_l3C1wBo_FFKsQAOGUakg/m=view
Preview:	"use strict";this.default_vw=this.default_vw\|\|{};(function(_){var window=this;.try{._._F_toggles_initialize=function(a){("undefined"!==typeof globalThis?globalThis:"undefined"!==typeof self?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([0xc0, ]);./.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0././.. SPDX-License-Identifier: Apache-2.0././. SPDX-License-Identifier: Apache-2.0././.. Copyright Google LLC All Rights Reserved... Use of this source code is governed by an MIT-style license that can be. found in the LICENSE file at https://angular.io/license././.. Copyright 2017 Google LLC. SPDX-License-Identifier: BSD-3-Clause././*.. Copyright 2019 Google Inc... Permission is hereby granted, free of charge, to any person obtaining a copy. of this software and associated documentation files (the "Software"), to deal. in the Software without restriction, including without limitation the rights. to use, copy, modify, merge, publish, distribute

Chrome Cache Entry: 260

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 34108, version 1.0
Category:	downloaded
Size (bytes):	34108
Entropy (8bit):	7.993096562158293
Encrypted:	true
SSDEEP:
MD5:	C15D33A9508923BE839D315A999AB9C7
SHA1:	D17F6E786A1464E13D4EC8E842F4EB121B103842
SHA-256:	65C99D3B9F1A1B905046E30D00A97F2D4D605E565C32917E7A89A35926E04B98
SHA-512:	959490E7AE26D4821170482D302E8772DD641FFBBE08CFEE47F3AA2D7B1126DCCD6DEC5F1448CA71A4A8602981966EF8790AE0077429857367A33718B5097D06
Malicious:	false
Reputation:	unknown
URL:	https://fonts.gstatic.com/s/googlesans/v58/4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPjIUvQ.woff2
Preview:	wOF2.......<..........................................\..4?HVAR.t.`?STAT..'...J/<.....`..(..Z.0..,.6.$.... ..B..K..[.h...c.....nC .../.V.v..6>nT.R...b.8.@.......ON.ch.......k..."..".9..\D...JBJ."T%5...Z2..Q.)wJ...sA.h..m....n..F.....t..ig.=..y.s@............t..j.....n.h(...........N..)9.....v`\|z....8.7..kTq....^.......[.K.O..1ZP.....;.HP.......>..+..j:.V.......A......[.f.l..v`x....F_..vo...e....n...H..X.2.v}...(.1J...x.....}.....5.3.....?..?..7...S..0.9..C.0.M..M9..e.b....bc..b4.0"e.G.....XT....z............E'c.(."...x`].]..e.rQ..ye.z........kFh;....Y.yPt.._Q.._-q..mi.Og.W.-qUI...m5..r.mvA~o....S.f........s..ql.aXD...H..wy.P..k...f$.V^.2...8U{...f.....]]..G..cf.......D.c&B'S.2~..N..........R;..).5...../... 6....b....]d6."C..T..........OI\+V'...E.[.g.u.E....,!F.....*U.q. :x.s..1..C....H..S%..)....h......K..........pw.f...f.......an3....9....@......%.2.c.+........cXD..F...B.....0'...O.z8.B....4...\..&c...H....;..p....@.l...:........L..`...5..xo&.

Chrome Cache Entry: 261

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1136)
Category:	dropped
Size (bytes):	1555
Entropy (8bit):	5.249530958699059
Encrypted:	false
SSDEEP:
MD5:	FBE36EB2EECF1B90451A3A72701E49D2
SHA1:	AE56EA57C52D1153CEC33CEF91CF935D2D3AF14D
SHA-256:	E8F2DED5D74C0EE5F427A20B6715E65BC79ED5C4FC67FB00D89005515C8EFE63
SHA-512:	7B1FD6CF34C26AF2436AF61A1DE16C9DBFB4C43579A9499F4852A7848F873BAC15BEEEA6124CF17F46A9F5DD632162364E0EC120ACA5F65E7C5615FF178A248F
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>.<html lang=en>. <meta charset=utf-8>. <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width">. <title>Error 400 (Bad Request)!!1</title>. <style>. {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//ww

Chrome Cache Entry: 262

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	956715
Entropy (8bit):	5.407270886431986
Encrypted:	false
SSDEEP:
MD5:	4CFDE9AF1839337BC3C2D5D0B70E3152
SHA1:	5DD4D1198129B3B831053CA07D4338EB82C0FA38
SHA-256:	8CA8FBB9688B6B8B7B9788DC24BD8DE9918C128DDF6DB1C652A4B2BB99870529
SHA-512:	F38497EB5DBD1E4F22166983A73311DFEF8A733358E8CABD4CC3DD8ED20FF3A6414BFDAAA14A28F8474EB9619E470459274F0B662B527A533C30A9CEDC7892FC
Malicious:	false
Reputation:	unknown
URL:	https://form.feathery.io/_next/static/chunks/826-3825941f9e3afcfb.js
Preview:	(self.webpackChunk_N_E=self.webpackChunk_N_E\|\|[]).push([[826],{8417:function(e,t,n){"use strict";n.d(t,{Z:function(){return W}});var r=function(){function e(e){var t=this;this._insertTag=function(e){var n;n=0===t.tags.length?t.insertionPoint?t.insertionPoint.nextSibling:t.prepend?t.container.firstChild:t.before:t.tags[t.tags.length-1].nextSibling,t.container.insertBefore(e,n),t.tags.push(e)},this.isSpeedy=void 0===e.speedy\|\|e.speedy,this.tags=[],this.ctr=0,this.nonce=e.nonce,this.key=e.key,this.container=e.container,this.prepend=e.prepend,this.insertionPoint=e.insertionPoint,this.before=null}var t=e.prototype;return t.hydrate=function(e){e.forEach(this._insertTag)},t.insert=function(e){if(this.ctr%(this.isSpeedy?65e3:1)==0){var t;this._insertTag(((t=document.createElement("style")).setAttribute("data-emotion",this.key),void 0!==this.nonce&&t.setAttribute("nonce",this.nonce),t.appendChild(document.createTextNode("")),t.setAttribute("data-s",""),t))}var n=this.tags[this.tags.length-1];if

Chrome Cache Entry: 263

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2054)
Category:	downloaded
Size (bytes):	15101
Entropy (8bit):	5.466918303320186
Encrypted:	false
SSDEEP:
MD5:	1C0777C81441C24E051A3EF4B97A387A
SHA1:	E2E59435B48EEA250CCD291446F952F281DF6066
SHA-256:	4A0461C83EE115FA609C85D89FB18EDBC8E97220EDEDFC6A2C6D4F42635B76C4
SHA-512:	D023AD9C0DC9339D1BDE483C3CA2CA4B76A77EC82FC966B90D1AD64CC5B88FFD4D7A56EAC6011DE69A1C281AF7340602EBB1F1FB456F98AE71B4C84787AD26ED
Malicious:	false
Reputation:	unknown
URL:	https://apis.google.com/js/client.js?onload=gapiLoaded
Preview:	(function(){var aa="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a},ba=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");},ca=ba(this),g=function(a,b){if(b)a:{var c=ca;a=a.split(".");for(var d=0;d<a.length-.1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&null!=b&&aa(c,a,{configurable:!0,writable:!0,value:b})}},h=function(a,b,c){if(null==a)throw new TypeError("The 'this' value for String.prototype."+c+" must not be null or undefined");if(b instanceof RegExp)throw new TypeError("First argument to String.prototype."+c+" must not be a regular expression");return a+""};.g("String.prototype.endsWith",function(a){return a?a:function(b,c){var d=h(this

Chrome Cache Entry: 264

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 15744, version 1.0
Category:	downloaded
Size (bytes):	15744
Entropy (8bit):	7.986588355476176
Encrypted:	false
SSDEEP:
MD5:	15D9F621C3BD1599F0169DCF0BD5E63E
SHA1:	7CA9C5967F3BB8BFFEAB24B639B49C1E7D03FA52
SHA-256:	F6734F8177112C0839B961F96D813FCB189D81B60E96C33278C1983B6F419615
SHA-512:	D35A47162FC160CD5F806C3BB7FEB50EC96FDFC81753660EAD22EF33F89BE6B1BFD63D1135F6B479D35C2E9D30F2360FFC8819EFCA672270E230635BCB206C82
Malicious:	false
Reputation:	unknown
URL:	https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2
Preview:	wOF2......=........t..=..........................d..d..^.`.. .T..<.....\|..{........6.$.... ..t. ..I.3.%.....8..&....4Z.\|t .8.........D...$.uNE.P.E.Ak...=.x.9Xz.`.I..R....#F+B`..}.RP\|E...Z\.W[.............C...QB....m...cm.?.F.g.......Q....3......p...L2.[......!+@U..^~.......D.?.......j...U...c..U.l.6{...m.CD].h.t.....Q8.....@P...L.c.....+...ZD..2.K...:..4{g..:..~....v......<..H^.R.'....8....?.;...uy.VW..8=.".F..*.....@E....c....=..Ib.....y8$.a){.......KiIW.&..~.}..1..w.M..{.4......!..{..F.H.5#K...t..5.w...ve;. '......NJ......'(%;...?...D...M.Cq,<.=?.f......._...V..bA.(..37..v....+.uY.C.b.w8AF..3.n.-..'..U%.2....o.l."...^bj..aoF.!`....A....j...'.:Z.u...[..p.GW:U%.Ejq...:I...C........S.C...sJe.6D...<.UM,..&h..z}.y\|..9...D..j...n..B.$..T....?../.Q..=B...C._.f.#.:Bo.@]T.(..v..F..+d...". ......R..R..R....!..~A....X............>!`p..,08. 9.../.....r..Q.......Qpg.\ko...C..3..Y.y..t'.d9..>#\|..3..?.#..$....i........g5.z....S....{3..Sp..S2..w.6........

Chrome Cache Entry: 265

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (3265), with no line terminators
Category:	downloaded
Size (bytes):	3265
Entropy (8bit):	5.321369356521337
Encrypted:	false
SSDEEP:
MD5:	68FDA31C09900E4DDCF0780ADCCBF09E
SHA1:	8CC2B348AB50ADC2749A19DC3D365DCF0BE472A8
SHA-256:	AFDEBECAE1BCF685503E95F611CA178CB226950BCBB93A4E4154693DFD6BC33E
SHA-512:	6C65C089C3D54C5AE314EB9C751B6F53859FBC666B20AFBABA6BD8A2FA37048B25202F9DCDA7AC6656D775AF614FC00DE5EA518C7F2A3A39E6AE1A086CF2767B
Malicious:	false
Reputation:	unknown
URL:	https://form.feathery.io/_next/static/chunks/pages/to/%5Bslug%5D-2c6a77e5376e30f4.js
Preview:	(self.webpackChunk_N_E=self.webpackChunk_N_E\|\|[]).push([[473],{5746:function(e,t,n){(window.__NEXT_P=window.__NEXT_P\|\|[]).push(["/to/[slug]",function(){return n(1230)}])},7119:function(e,t,n){"use strict";n.d(t,{Z:function(){return g}});var r=n(5893),o=e=>{let t=Object.keys(e).filter(e=>!e.includes("feathery_"));return t.reduce((t,n)=>({...t,[n]:e[n]}),{})},a=n(7294),i=n(1222);let u=e=>{var t,n,r;let o=null!==(n=e.reason)&&void 0!==n?n:e.error;(null==o?void 0:null===(t=o.stack)\|\|void 0===t?void 0:t.includes("eval"))&&(console.warn("Error caught while running a logic rule. Error Message: ",null!==(r=o.message)&&void 0!==r?r:""),e.preventDefault())},s=e=>{let t=e.getStepProperties().backgroundColor;setTimeout(()=>document.body.style.backgroundColor="#".concat(t),0)};var l=e=>{let{formName:t,useAuth:n=!1,sdkKey:o,draft:l,parsedQueryParams:c,region:f,featheryOpts:d={},customDomain:m}=e;(0,a.useEffect)(()=>{window.addEventListener("unhandledrejection",u),window.addEventListener("error",u)},

Chrome Cache Entry: 267

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	16
Entropy (8bit):	3.702819531114783
Encrypted:	false
SSDEEP:
MD5:	DC6D99B5F2D48E695184AC65CF7254EC
SHA1:	DA380167D162E9A3416374AF030DF645AD9A6924
SHA-256:	05597E45A9B7F50B7F7CA28D32AF10DB048CFD57E717ED932B8092BA3DC52E97
SHA-512:	04AA1E4C3E92B66EA6B0A93C1EB1B02249E6BAE53301EF4ED3DD2849FF35A06FFBB6EB2645116961259F60D861890CAF6DD03E526685FEB5C0A4189BE57F7CE8
Malicious:	false
Reputation:	unknown
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xNDkSEAlCQiguHNXKPBIFDSDNKw8=?alt=proto
Preview:	CgkKBw0gzSsPGgA=

Chrome Cache Entry: 268

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	1427156
Entropy (8bit):	5.665526507475286
Encrypted:	false
SSDEEP:
MD5:	AC92511F3697C926C580991F62133EDC
SHA1:	BF70C5004026B90C7CD617E532F7461749270A28
SHA-256:	8894C5AA968FA2A7240A35A434D24B639E9FD3FBC90ACF00FEDB6F23CA1041B8
SHA-512:	6689A5E3C5AF5EF659B546315EF3989385BF1C25DC11BC0BC4B6D35FC08CB778F6134D4F752D1135EE0FCA6A09EFBA37BA2BC455739AB4F2337DBAA7A4BC4D68
Malicious:	false
Reputation:	unknown
URL:	https://www.gstatic.com/_/atari/_/ss/k=atari.vw.yBV3yYvSZ_4.L.W.O/am=wA/d=1/rs=AGEqA5kOkvkDTdvbUxYfnVsiOcBUPEk6zw
Preview:	.VIpgJd-TzA9Ye-eEGnhe{position:relative;display:-moz-inline-box;display:inline-block}* html .VIpgJd-TzA9Ye-eEGnhe{display:inline}:first-child+html .VIpgJd-TzA9Ye-eEGnhe{display:inline}/! normalize.css v2.1.1 \| MIT License \| git.io/normalize */article,aside,details,figcaption,figure,footer,header,hgroup,main,nav,section,summary{display:block}audio,canvas,video{display:inline-block}audio:not([controls]){display:none;height:0}[hidden]{display:none}html{font-family:sans-serif;-ms-text-size-adjust:100%;-webkit-text-size-adjust:100%}body{margin:0}a:focus{outline:thin dotted}a:active,a:hover{outline:0}h1{font-size:2em;margin:.67em 0}abbr[title]{border-bottom:1px dotted}b,strong{font-weight:bold}dfn{font-style:italic}hr{box-sizing:content-box;height:0}mark{background:#ff0;color:#000}code,kbd,pre,samp{font-family:monospace,serif;font-size:1em}pre{white-space:pre-wrap}q{quotes:"\201C" "\201D" "\2018" "\2019"}small{font-size:80%}sub,sup{font-size:75%;line-height:0;position:relative;vertical-ali

Chrome Cache Entry: 269

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (705), with no line terminators
Category:	downloaded
Size (bytes):	705
Entropy (8bit):	5.536624133348632
Encrypted:	false
SSDEEP:
MD5:	38F079413A7669DF9868454C6BAAFDF0
SHA1:	EB52F53C151A4E83F864E07706CA64772E105A61
SHA-256:	D8283F8BFDC524B4387BA28566FF15806D5E3E2C6D00688E4F5EFE4D3729BAE0
SHA-512:	28CE02FF7737A8CF4BE9A4D7A4A57BBA4F69B8E30747B15A69D0135C53E8C8509B2FF7405D0377A75643E86F245A31D1D7012A906DF9546B6D434D8BDFAA39A8
Malicious:	false
Reputation:	unknown
URL:	https://form.feathery.io/_next/static/Ai01PBAcqIAgfxw3crlkP/_buildManifest.js
Preview:	self.__BUILD_MANIFEST=function(s,e,c,t,a){return{__rewrites:{beforeFiles:[],afterFiles:[{source:"/monitoring(/?)",has:[{type:s,key:"o",value:"(?<orgid>\\d)"},{type:s,key:"p",value:"(?<projectid>\\d)"}]}],fallback:[]},"/":[e,c,t,a,"static/chunks/pages/index-01d85d1b5065c136.js"],"/_error":["static/chunks/pages/_error-e27f70034a0ad7fe.js"],"/to/[slug]":[e,c,t,a,"static/chunks/pages/to/[slug]-2c6a77e5376e30f4.js"],sortedPages:["/","/_app","/_error","/to/[slug]"]}}("query","static/chunks/cf721ce5-ad12c370b42e326b.js","static/chunks/ad7f724d-1c40c3094ead0a0b.js","static/chunks/556ae1b7-dd7c5e65c16bbf90.js","static/chunks/826-3825941f9e3afcfb.js"),self.__BUILD_MANIFEST_CB&&self.__BUILD_MANIFEST_CB();

Chrome Cache Entry: 270

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65202)
Category:	downloaded
Size (bytes):	141023
Entropy (8bit):	5.268169612452616
Encrypted:	false
SSDEEP:
MD5:	35EFF474CD1A13A3091A43E43A9DF835
SHA1:	6555379B87BC1C26469D19233EC97C2E4E7E3D36
SHA-256:	D91D5D637B21C36E6DDE4A9AA28DA379CE7CCE037AA22F1CB3FA5CB4D4E61076
SHA-512:	21A2D61F908146551D3ED9352EDC5EBFB09F8826691E8FBAFC43BA6C097627F86DFEE54D8AA0A24D272EA0588AF9070320C756E271E0532390C2470BAAB8AC77
Malicious:	false
Reputation:	unknown
URL:	https://form.feathery.io/_next/static/chunks/framework-305cb810cde7afac.js
Preview:	"use strict";(self.webpackChunk_N_E=self.webpackChunk_N_E\|\|[]).push([[774],{4448:function(e,n,t){/*. @license React. * react-dom.production.min.js. . Copyright (c) Facebook, Inc. and its affiliates.. . This source code is licensed under the MIT license found in the. * LICENSE file in the root directory of this source tree.. */var r,l,a,u,o,i,s=t(7294),c=t(3840);function f(e){for(var n="https://reactjs.org/docs/error-decoder.html?invariant="+e,t=1;t<arguments.length;t++)n+="&args[]="+encodeURIComponent(arguments[t]);return"Minified React error #"+e+"; visit "+n+" for the full message or use the non-minified dev environment for full errors and additional helpful warnings."}var d=new Set,p={};function m(e,n){h(e,n),h(e+"Capture",n)}function h(e,n){for(p[e]=n,e=0;e<n.length;e++)d.add(n[e])}var g=!("undefined"==typeof window\|\|void 0===window.document\|\|void 0===window.document.createElement),v=Object.prototype.hasOwnProperty,y=/^[:A-Z_a-z\u00C0-\u00D6\u00D8-\u00F6\u00F8-\u02FF\u0370

Static File Info

General

File type:	Zip archive data, at least v4.5 to extract, compression method=deflate
Entropy (8bit):	7.998551755762164
TrID:	ZIP compressed archive (8000/1) 100.00%
File name:	Quarantined Messages (12).zip
File size:	126'200 bytes
MD5:	f9919d41ecc241b692ee46640c91e7cc
SHA1:	c2802e6fa4729fcb4629ae1f4728a4d5a3c1480c
SHA256:	a70ba12a44ff6822f02edf94d3b8b4c6eb89b62ce09bd990c97949dd522aae05
SHA512:	920e2c19c9547625ff96124c9b235009f9b25d78e1035901220a0f7dcc96fc344d4f52add77735486c3491ff51836176d4636fdcdfffd42ac57cb72be1935881
SSDEEP:	3072:pFtW3UuieW4t5S4SnSPOr6An1fi+nkUdwLuR0LZ4E:pm3XrHtY9nrXV5fwjZ4E
TLSH:	A2C3120BF9EF031DD191105D61B91E7478E1FC3AF850220DAB7BA56BDA8F4D468DE0A4
File Content Preview:	PK..-.....5s\|X...*........M...239b4100-1ff7-4d03-6739-08dc4e54cf5c/602240bb-8e5c-abde-6bab-9639d7c76314.eml.....................)....#{...).]G......{:%Q..I.)Xs.!....e....+..2..v.N.....^W..R.v..\..UU..&j.M.-..\|gO....C.H..f..]l.4...V...7.ZSO.{....n.}5...hZ>

File Icon


Icon Hash:	1c1c1e4e4ececedc

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: `rundll32.exe {DLLname, DLLfunction}` ).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Quarantined Messages (12).zip

Overview

General Information

Detection

Signatures

Classification

Process Tree

Yara Signatures

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

Phishing

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntities.bin

C:\Users\user\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntitiesUpdated.bin

C:\Users\user\AppData\Local\Microsoft\Office\16.0\Floodgate\Outlook.CampaignStates.json

C:\Users\user\AppData\Local\Microsoft\Office\16.0\Floodgate\Outlook.GovernedChannelStates.json

C:\Users\user\AppData\Local\Microsoft\Office\16.0\Floodgate\Outlook.Settings.json

C:\Users\user\AppData\Local\Microsoft\Office\16.0\Floodgate\Outlook.SurveyEventActivityStats.json

C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\56B632BC-CA16-4AAC-801B-A3619C0CEA49

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-journal

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-shm

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-wal

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\9F1951F7.tmp

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\Y8CBKWBK\~$Vendor Payment Details.XLS.xlsx

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{F4336852-CFFA-4B1B-AAE0-00B14765F921}.tmp

C:\Users\user\AppData\Local\Packages\oice_16_974fa576_32c1d314_889\AC\Temp\1242CAD8.jpg

C:\Users\user\AppData\Local\Packages\oice_16_974fa576_32c1d314_889\AC\Temp\752F5D41.xlsx:Zone.Identifier

C:\Users\user\AppData\Local\Packages\oice_16_974fa576_32c1d314_889\AC\Temp\Diagnostics\EXCEL\App1711636037123260300_FEAB3EB7-B83F-4326-907B-0EAF8C71E878.log

C:\Users\user\AppData\Local\Packages\oice_16_974fa576_32c1d314_889\AC\Temp\Diagnostics\EXCEL\App1711636037124043100_FEAB3EB7-B83F-4326-907B-0EAF8C71E878.log

C:\Users\user\AppData\Local\Packages\oice_16_974fa576_32c1d314_889\AC\Temp\msoCF22.tmp

C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1711636027248584700_692E6DBF-72EB-47BB-982E-55D2006EBA18.log

C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20240328T1527070035-2232.etl

C:\Users\user\AppData\Roaming\Microsoft\Excel\A8820000

C:\Users\user\AppData\Roaming\Microsoft\Excel\Excel15.xlb (copy)

C:\Users\user\AppData\Roaming\Microsoft\Office\MSO3072.acl

C:\Users\user\AppData\Roaming\Microsoft\Outlook\NoEmail.srs

C:\Users\user\AppData\Roaming\Microsoft\Templates\NormalEmail.dotm (copy)

C:\Users\user\AppData\Roaming\Microsoft\Templates\~$rmalEmail.dotm

C:\Users\user\AppData\Roaming\Microsoft\Templates\~WRD0000.tmp

C:\Users\user\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Windows Analysis Report
Quarantined Messages (12).zip