Analysis Report http://37.1.220.206/bTcpkT?subacc=manualen2015&subacc2=m.inmanuals.com&subacc3=inmanuals.com&keyword=Fall%20Trivia%20Questions%20And%20Answers&site=

Overview

General Information

Sample URL:	http://37.1.220.206/bTcpkT?subacc=manualen2015&subacc2=m.inmanuals.com&subacc3=inmanuals.com&keyword=Fall%20Trivia%20Questions%20And%20Answers&site=
Analysis ID:	321247
Most interesting Screenshot:

Detection

HTMLPhisher

Score:	48
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected HtmlPhish_31

Classification

Signatures

Phishing:

Yara detected HtmlPhish_31

Source: Yara match	File source: 347688.0.links.csv, type: HTML
Source: Yara match	File source: 347688.pages.csv, type: HTML
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\1310630327[1].htm, type: DROPPED

Source: unknown	TCP traffic detected without corresponding DNS query: 37.1.220.206
Source: unknown	TCP traffic detected without corresponding DNS query: 37.1.220.206
Source: unknown	TCP traffic detected without corresponding DNS query: 37.1.220.206
Source: unknown	TCP traffic detected without corresponding DNS query: 37.1.220.206
Source: unknown	TCP traffic detected without corresponding DNS query: 37.1.220.206
Source: unknown	TCP traffic detected without corresponding DNS query: 37.1.220.206

Source: global traffic

HTTP traffic detected: GET /bTcpkT?subacc=manualen2015&subacc2=m.inmanuals.com&subacc3=inmanuals.com&keyword=Fall%20Trivia%20Questions%20And%20Answers&site= HTTP/1.1Accept: text/html, application/xhtml+xml, image/jxr, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: 37.1.220.206Connection: Keep-Alive

Source: msapplication.xml0.1.dr	String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.facebook.com/"/><date>0x6f0eea0e,0x01d6bfa5</date><accdate>0x6f0eea0e,0x01d6bfa5</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig> equals www.facebook.com (Facebook)
Source: msapplication.xml0.1.dr	String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.facebook.com/"/><date>0x6f0eea0e,0x01d6bfa5</date><accdate>0x6f0eea0e,0x01d6bfa5</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Facebook.url"/></tile></msapplication></browserconfig> equals www.facebook.com (Facebook)
Source: msapplication.xml5.1.dr	String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.twitter.com/"/><date>0x6f18737c,0x01d6bfa5</date><accdate>0x6f18737c,0x01d6bfa5</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig> equals www.twitter.com (Twitter)
Source: msapplication.xml5.1.dr	String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.twitter.com/"/><date>0x6f18737c,0x01d6bfa5</date><accdate>0x6f18737c,0x01d6bfa5</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Twitter.url"/></tile></msapplication></browserconfig> equals www.twitter.com (Twitter)
Source: msapplication.xml7.1.dr	String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.youtube.com/"/><date>0x6f18737c,0x01d6bfa5</date><accdate>0x6f18737c,0x01d6bfa5</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig> equals www.youtube.com (Youtube)
Source: msapplication.xml7.1.dr	String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.youtube.com/"/><date>0x6f18737c,0x01d6bfa5</date><accdate>0x6f18737c,0x01d6bfa5</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Youtube.url"/></tile></msapplication></browserconfig> equals www.youtube.com (Youtube)

Source: unknown

DNS traffic detected: queries for: higet-prizenow3.life

Source: bootstrap.min[1].js.2.dr	String found in binary or memory: http://getbootstrap.com)
Source: msapplication.xml.1.dr	String found in binary or memory: http://www.amazon.com/
Source: msapplication.xml1.1.dr	String found in binary or memory: http://www.google.com/
Source: msapplication.xml2.1.dr	String found in binary or memory: http://www.live.com/
Source: msapplication.xml3.1.dr	String found in binary or memory: http://www.nytimes.com/
Source: msapplication.xml4.1.dr	String found in binary or memory: http://www.reddit.com/
Source: msapplication.xml5.1.dr	String found in binary or memory: http://www.twitter.com/
Source: msapplication.xml6.1.dr	String found in binary or memory: http://www.wikipedia.com/
Source: msapplication.xml7.1.dr	String found in binary or memory: http://www.youtube.com/
Source: 1310630327[1].htm.2.dr	String found in binary or memory: https://ajax.googleapis.com/ajax/libs/jquery/3.2.1/jquery.min.js
Source: {98412184-2B98-11EB-90E4-ECF4BB862DED}.dat.1.dr	String found in binary or memory: https://camediscusshap3.life/?u=lr5kaew&o=h578zym&t=manualen2015&cid=34bstmnite8dfc8ono3ipen14.live/
Source: ~DF1D0EECD5229DE63D.TMP.1.dr, {98412184-2B98-11EB-90E4-ECF4BB862DED}.dat.1.dr	String found in binary or memory: https://camediscusshappen14.live/1310630327/
Source: ~DF1D0EECD5229DE63D.TMP.1.dr, {98412184-2B98-11EB-90E4-ECF4BB862DED}.dat.1.dr	String found in binary or memory: https://camediscusshappen14.live/1310630327/=lr5kaew&o=h578zym&t=manualen2015&cid=34bstmnite8dfc8ono
Source: ~DF1D0EECD5229DE63D.TMP.1.dr, {98412184-2B98-11EB-90E4-ECF4BB862DED}.dat.1.dr	String found in binary or memory: https://camediscusshappen14.live/1310630327/?u=lr5kaew&o=h578zym&t=manualen2015&cid=34bstmnite8dfc8o
Source: bootstrap.min[1].js.2.dr	String found in binary or memory: https://github.com/twbs/bootstrap/blob/master/LICENSE)
Source: ~DF1D0EECD5229DE63D.TMP.1.dr	String found in binary or memory: https://higet-prizenow3.life/?u=lr5kaew&o=h578zym&t=manualen2015&cid=34bstmnite8dfc8ono3i
Source: {98412184-2B98-11EB-90E4-ECF4BB862DED}.dat.1.dr	String found in binary or memory: https://higet-prizenow3.life/?u=lr5kaew&o=h578zym&t=manualen2015&cid=34bstmnite8dfc8ono3iRoot

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: classification engine

Classification label: mal48.phis.win@3/51@3/5

Source: C:\Program Files\internet explorer\iexplore.exe

File created: C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High

Jump to behavior

Source: C:\Program Files\internet explorer\iexplore.exe

File created: C:\Users\user\AppData\Local\Temp\~DF88A48CC6663AC579.TMP

Jump to behavior

Source: C:\Program Files\internet explorer\iexplore.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: unknown	Process created: C:\Program Files\internet explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Source: unknown	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:1092 CREDAT:17410 /prefetch:2
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:1092 CREDAT:17410 /prefetch:2	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll

Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
5.188.178.195	unknown	Russian Federation	209813	FASTCONTENTDE	false
5.189.217.27	unknown	Russian Federation	209813	FASTCONTENTDE	false
37.1.220.206	unknown	Ukraine	58061	SCALAXY-ASNL	false
185.50.248.46	unknown	Ukraine	209813	FASTCONTENTDE	false

Private

IP
192.168.2.1

Contacted Domains

Name	IP	Active
tdsjsext3.life	185.50.248.46	true
camediscusshappen14.live	5.189.217.27	true
higet-prizenow3.life	5.188.178.195	true

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://37.1.220.206/bTcpkT?subacc=manualen2015&subacc2=m.inmanuals.com&subacc3=inmanuals.com&keyword=Fall%20Trivia%20Questions%20And%20Answers&site=	false		unknown
https://camediscusshappen14.live/1310630327/	true		unknown

ID:	321247
Product:	CloudBasic
Start time:	17:25:47
Start date:	20.11.2020
Cookbook:	browseurl.jbs
System description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Architecture:	WINDOWS

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{98412182-2B98-11EB-90E4-ECF4BB862DED}.dat	Microsoft Word Document	E45DBED18D4E0C4BECAD9FED8C70EE20	9F1E0F848F60A096EB0CAF45D244B42A88CB0772	727F506AF55F85BF378ECFAC6143460FCA7F6DAB5E08233AF08D2E8AAAB22E8F
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{98412184-2B98-11EB-90E4-ECF4BB862DED}.dat	Microsoft Word Document	1071A3CE736613CA518DE02F1129262C	29B595F94CE857866570A936349B140A15AF6882	B1B32C1F32B86499B962206C8EFA6525C51AB20696B2035AAE7C98006EB2F3EB
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{9E38EFF4-2B98-11EB-90E4-ECF4BB862DED}.dat	Microsoft Word Document	84B88211A1A178D513D4E1E35728EC40	2F9A274D7E9730F572105092FB0CD1BBDB918BAD	7C54DB4750D2BC9C67F2793E0B80F6C3BE95CDD4EC88BD648D3F02966FADE4C4
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-17529550060\msapplication.xml	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators	C66166DC99D1891A1AD005E977E93B2C	860E3CDFA27FF2E7263FD845C92B2126955D3C9B	44E50C7B2F207C938D7C92312EF38C219AF267B046DD8EF0FD9094845D95C610
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-18270793970\msapplication.xml	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators	2B57B95AD9054FF6E3909B7E8351449E	CFC6F3A432E1A9B52EB1BE8D5261B02AD39CCFE8	C1B5F87ADD233380897DE2C2EA3AF354BCD53DD69C07AE0AD47A3A66DDA3C5E3
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-21706820\msapplication.xml	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators	03CCC3D5AE60A68730F31D562211CE95	2F140F93A326CBCB9BA49F2B053F32BBED7F98A9	58F7C72A8829817D056A23B5603FEC0CFA28279D5C097E6C7A1DE75ED0AB527D
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-4759708130\msapplication.xml	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators	B02FD8A66A94186E72EA0E15BB8E8026	46BBFBAAD580DC2AD7C1D61E1F184E9D0ECFEB25	366476BADEF571FF1AEBAAE91E260BD4C73AA6B964FF94AAD1F12F12CC5890C9
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-6757900\msapplication.xml	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators	26BDDEB1A683FFDBF2F0E9F55DBDACFE	8CBA8BCFBB80456992164A569D01A6B5F263B354	8BC66D1B1BA9A893A6D4E7694DA9E11FF2455021D88A10130096D47289798D65
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-8760897390\msapplication.xml	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators	59FC51D689ADAC3806623EE1E6756F43	C550A80954DFA960530A7A5D8608C553C99F4A6A	85FF64233209A3CF43E0D0049ECBF7B562B7D873EC316D6018D42CFB385D8744
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin20259167780\msapplication.xml	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators	B21580714E9E0FCC1F248D515054BF19	A22A1231DFC0C95BE74FF6E3A92772D728B793FD	088C5C98C0C99FE3E429206E2788C01F956EE0F2BF507646723EE44491D4D61F
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin20332743330\msapplication.xml	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators	37BC1CFF4AAB9358F2229526F0235509	2CE6717017444A53226EDB1028DADAD7C5A71015	B440BD9376AE0E9F76C8A2A50C80C1922E1F58E60D0ED5792F6BACB0D361B31D
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin8215062560\msapplication.xml	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators	8E975AAD278328C8881A0420C777FDE5	3B22EA95DCEDEAD4F12D644014127FA51F144889	D2A31BEC08EE3DB860F0792F646DF61FCD28C39CDFA4789E85EDF2FCC745CDF2
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\1310630327[1].htm	HTML document, UTF-8 Unicode (with BOM) text	7F59D3EC40DDBE5CD6A684BC9933CD03	C1DA645FAB25474BA164CDAD050130B9339A100C	0693D0CBCE1607BCB5EC8F9F57797EF13A06ABD97DB1B927E68904176E6DDE0E
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\bbms[1].js	ASCII text, with no line terminators	15E4DCF4FB72D2D50957034C8B308E64	CF37906A37F7FF4BDE838CBCF5590895D2DA588E	23640080CB6A976A11A714AA680973CB1A3F6AEEC25A5B34236C5C95C0114204
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\ie[1].png	PNG image data, 245 x 241, 8-bit colormap, non-interlaced	A0DB15B639D5375161EF299FC22A9E6D	5FEA3A9E67EDB6F8A1A5EE6D99E259DD83AFF686	DD21E3489A111B59404CDA401A90BDD74331500B3B8C4497A0F288D2CCA830E7
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\img10[1].jpg	JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 48x48, frames 3	0D0F29ABFCEDC7DFFFE3811A5100A6CD	19567E85AAB4FD05D752CFA86F88087465042B0A	E3DA7D20BE42DA6E260D3085D2A3F3965A549065345EE2D139E28625104E2393
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\img5[1].jpg	JPEG image data, baseline, precision 8, 50x50, frames 3	6D02D5CF49120718501B9A6629290C48	A7BFDE16CD37F6A331E8F17FBFC2F1772A5929A1	84D7F0648AEBA8D80BB0F47E781CBA8955B8FA7425748D9830C7A8C9BC35E5E9
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\jquery.min[1].js	ASCII text, with very long lines	C9F5AEECA3AD37BF2AA006139B935F0A	1055018C28AB41087EF9CCEFE411606893DABEA2	87083882CC6015984EB0411A99D3981817F5DC5C90BA24F0940420C5548D82DE
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\js.cookie6_pure[1].js	ASCII text, with very long lines, with no line terminators	0418C49452A056920F6DB594DDC23E1A	1F0870CA6C2C32EA29A9852426EEE3717FDC2717	71773F8C559A1FDB770D7FA5720C08612D9CE7194BE8BB44BDF95393F1469CE0
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\main[1].js	ASCII text, with very long lines, with no line terminators	8B1EBE52B7E264F632FBD1C5FCD93DE4	3F660F2C38F3BCF9E50AC9AD356DAC83420A43C0	B8415ABAABB26FE68590EB086A43FF6ABB3EF683FB24E0A2E6FB86B3EC93FC91
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\utils-ms[1].js	ASCII text, with very long lines, with CRLF line terminators	A582687D075E8D2AE73974B8D2901D5C	A30E7436CD68411299C7266457883B38879EC1EF	6AEAC44FA0A32481694E2E050E6D6DD1A297E794599B7E2523089A4EC47C3546
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\bootstrap.min[1].js	ASCII text, with very long lines	BA847811448EF90D98D272AECCEF2A95	5814E91BB6276F4DE8B7951C965F2F190A03978D	898D05A17F2CFC5120DDCDBA47A885C378C0B466F30F0700E502757E24B403A1
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\confetti[1].js	ASCII text, with very long lines, with no line terminators	116C9460F5E882A7FCF4E837F7EFC72A	13A88E74735D05985E5D07E8CBFF716329F5D81C	651141C8290087AF54C66793AA063EE5697661FB914925F56BD09390A2895CE4
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\de-en[1].js	ASCII text, with very long lines, with no line terminators	037B4AB2C01D5AA6CB97A507BAD1688A	82D9836549BF829D6EB0C4B44EC5FFB5016365D9	7EC2C7B30496E579913BBDD1A473FBD11EC985B21F356767E09502E8096D0F72
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\getextparams[1].json	UTF-8 Unicode (with BOM) text, with very long lines, with no line terminators	C2052B82E88758EA3331B15A4240A13E	E23CEEEC18FA422704DCE580D89D147FDF6F22A1	FD12DB0E39558826450737FE0630C998D944526FDDF2F45C7043F0125B4A3921
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\img2[1].jpg	JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 50x50, frames 3	92B944714CEA3E478A8E50DEA1A80B26	F12FC267BE0AB02E2F3585B42DF5B8C10D3CD3A5	FA07D78345204BF48B255523990B544E1B28F9A7810AAF2B8A5A356D05575205
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\img4[1].jpg	JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 50x50, frames 3	A848711320A9DF61E6457F65B0DFA9FB	68A62A84D89F4F9E1E831A6CEF920797C7F2E7D5	AEA3443FFA2DF4454DAAC365B37A61F9B9B1BA24DC0899FF3AFCA9F770765CE0
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\img9[1].jpg	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 50x50, frames 3	A2DBD5C25807FBAD37ACEB676E90CD66	6972C6DF94B50DD66111D5A555BDF2907B6F3E7E	6592C5497D79980109EE577663BEAC8D709726A63329F893775F89083CC8858E
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\pixel[1].htm	HTML document, ASCII text, with no line terminators	086707E4369F60AFEDCAFB16050A7618	8216B0CC6876CBD44F01C158E7DFF3833CECCD41	A7FE83EC64BB23EB28090598DB3D166ED98E52E39D1AFBBFD74C579553F93E4E
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\returnDate.de[1].js	UTF-8 Unicode text	50C340711D920FD7555736D4F63B227A	0ADD481C5A8FBEA2997036DE8093D4F079CBC335	F7A34F1C806BB9C1091558719CA37AE42B7489B3742C67DD850F177B1D635A45
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\bootstrap-mini[1].css	ASCII text, with very long lines, with CRLF line terminators	F0A842B8B8A52BB05E6C729828FBB40E	F1FE8A76DB92BC9BD3F9D70F3867F03D51EBBAE5	EB9FE798331B592BD8FC54D5EDE3AC19E961B5AA7C2DFFB3DBB17CE5FCB88E01
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\comment[1].js	ASCII text, with very long lines, with no line terminators	E2A1C316F64D089444F66AACC41DB396	FD526DC9FE1C352A17082A07164E0B92A9E81F7B	72E3B6817E1FAFD50792B2C33BC4416683A391AA1837BEE1F43FDBC210C99CCC
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\exit_ms[1].js	ASCII text, with very long lines, with CRLF line terminators	709A4B79345C9E6C8DA41E6D7306ACD6	1D27618BBD6960BCA4202FAC5C55B618BED0872D	2F253C796FBA64159D8269D8188486A6616E8707335D110F14BC4FC6445562CA
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\fontawesome-webfont[1].woff	Web Open Font Format, TrueType, length 44432, version 1.0	3293616EC0C605C7C2DB25829A0A509E	04C3BF56D87A0828935BD6B4AEE859995F321693	0FD28FECE9EBD606B8B071460EBD3FC2ED7BC7A66EF91C8834F11DFACAB4A849
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\img3[1].jpg	JPEG image data, baseline, precision 8, 50x50, frames 3	5EDF4DB493423AC10C72A27AD5C4A618	5C535D00EAEAA725B39E3E1167A12DE5BD66A1F2	A7C86CA5470F7D68B4C5F1C87F29F7DAF816D1BD95353091BBA8753341BB6F5F
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\img6[1].jpg	JPEG image data, baseline, precision 8, 50x50, frames 3	F48AA7778890400E3BE6131E64CD4236	9341D039B9F7DE4EAC9070C36FECAC2772CC1BA0	388E1EB0CB648490EA1C4913F4EA3128F3FBFBDA0608BF85E471D947DB905302
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\img8[1].jpg	JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 50x50, frames 3	5DA3831556C780010E0E5C5B967E43CE	574623AFDE349258B91D44849EF16D483B61E223	45F901BD7A281C73DB028F014EB9196AD0297D6EAEDE94151BF2832946EB8F07
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\main[1].css	ASCII text, with very long lines, with no line terminators	45EE95B113A9887EDFBCEA71BC7D32C7	AC4EC0D547F009D4F007AC70B1FC6A04CDC1DBDC	09A619318CE5080423FBC31A6B97F08D785B31677D713D9154E2CA837B12A010
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\7N1OA2TZ.htm	HTML document, ASCII text, with very long lines, with CRLF line terminators	94D2B3B4205EBABD63DC23C1B443D50F	010C4EEEB7AF810ECD645704023BFCBD83A83B0A	54299CBF19E93E7C76AC022EFA6B240267FFEB530D2246ECCCD9D4C80FD04C77
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\facebook-icons2[1].png	PNG image data, 23 x 766, 8-bit colormap, non-interlaced	EE2E95C6D88BF77C809F0C65DAFA34E2	119233DF6BF224B41BC59ED1BBFA34F9BED73BB7	EFA8D9BBD0AFE26B0ED378E4FCB204738D96085699EAE4BAA7058109F4FE5E2C
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\font-awesome-mini[1].css	ASCII text, with very long lines, with no line terminators	8B2FE9DCD9E31F21056EBC3D6667123C	49E6A844F0085D9F653FAAB8A451742BE82ECDF7	E7EB3BA41E31F5D9710BB64A87A5E9E7664143A95F68D0F357FE0D4252BB58D5
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\img11[1].jpg	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 50x50, frames 3	14CA7A7E1BB1DB7A31AF7C44A0AE9062	7293947D75065F3DEF42439F32138127D605BC8F	D8D2B0E0BAAD97E943838712911352A8C9DD0D5BF2114E78C3D1649BCC0D634A
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\img1[1].jpg	JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 50x50, frames 3	C3C59916D3B4977017C89125DC42B664	C8E5A97A6E9FBF41558C09C65B2CA6DF9BA8723A	AA05DE326A8AFD2A7B16C253D8C10FC41857B474F23A814FFA7684D4EF17C1A9
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\img7[1].jpg	JPEG image data, baseline, precision 8, 50x50, frames 3	7364BF39DCF0941D3A1760E46A562710	A358405162193128CCEAE8551E14648798BD4254	BA858C8ECC8F498253509A9251E5070CE3B3AD9950B704A22A9A1FB1EFC62541
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\iphone11pro[1].png	PNG image data, 300 x 402, 8-bit colormap, non-interlaced	80311B6F5B7AF08899350D4DCCE87EE6	B4B9A1B3A777AAAEB0A19866B743D6D3BA861A5B	BD1C43C51E6D8B7669315F6A44009A78B5D6542625AFF8F6136411587F600493
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\logo1[1].js	ASCII text, with very long lines, with no line terminators	CE979E65F9EBC1BC977DE4C484210BE7	B73D356E63F27AEF8975C7B0752D5472D2AC07E9	45AA665ABBB7FFC79A4513179621509FA02F86D3916F24ABD1CB43D4EAC120C1
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\logo2[1].js	ASCII text, with very long lines, with no line terminators	C1BD16B2E39C5928B80710D02238A99F	D74EFD774B1FBBCEF95DCEBD8F2E33C1788E2C94	14858ED060AA807E826E006A44E5812742A3AAAC775BD27209CAC463A9C19EE0
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\logo_f01[1].png	PNG image data, 130 x 126, 8-bit colormap, non-interlaced	192B810BA6ED4B80611AEF274D85948D	2835CC503EFCD77D03613293DBC33C4CC7B6B5B9	91E5C1968EEE9298437A097FD47978A077D667E086593AB0FD7988EF60D2DDF4
C:\Users\user\AppData\Local\Temp\~DF1D0EECD5229DE63D.TMP	data	D81AAF3E67E02A9964C70A65E0DB0A14	94CAB45E48A92B7E634A41A8A71DFC5978D38180	E25010CD751FE0B9BE9CF5C03B0CAEFD715BA70EFA69CC3D7D0B00943184E38E
C:\Users\user\AppData\Local\Temp\~DF88A48CC6663AC579.TMP	data	C756B5CC9B148B311D47AC5557AF5B65	4D011806F787E3F879BA1AA8ACC2E441875F9D01	94220F5C11F11F4D8F17D1302E27DE3B42381784B292E88755CE2FE73F60E83A
C:\Users\user\AppData\Local\Temp\~DFD8D874BBA555E660.TMP	data	AB889A32AB9ACD33E816C2422337C69A	1190C6B34DED2D295827C2A88310D10A8B90B59B	4D6EC54B8D244E63B0F04FBE2B97402A3DF722560AD12F218665BA440F4CEFDA

Analysis Report http://37.1.220.206/bTcpkT?subacc=manualen2015&subacc2=m.inmanuals.com&subacc3=inmanuals.com&keyword=Fall%20Trivia%20Questions%20And%20Answers&site=

Overview

General Information

Detection

Signatures

Classification

Signatures

Phishing:

Networking:

System Summary:

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs