Analysis Report https://sscpa.ebpages.com/4766563715514368

Overview

General Information

Sample URL:	https://sscpa.ebpages.com/4766563715514368
Analysis ID:	345188
Most interesting Screenshot:

Detection

HTMLPhisher

Score:	76
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Phishing site detected (based on shot template match)

Yara detected HtmlPhish_10

Yara detected HtmlPhish_7

Phishing site detected (based on logo template match)

HTML body contains low number of good links

HTML title does not match URL

Classification

Signatures

AV Detection:

Antivirus / Scanner detection for submitted sample

Source: https://sscpa.ebpages.com/4766563715514368

SlashNext: detection malicious, Label: Fake Login Page type: Phishing & Social Engineering

Phishing:

Phishing site detected (based on shot template match)

Source: https://espaciorojo.com.mx/Silverberg/xx/

Matcher: Template: office matched

Yara detected HtmlPhish_10

Source: Yara match	File source: 936905.0.links.csv, type: HTML
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\xx[1].htm, type: DROPPED

Yara detected HtmlPhish_7

Source: Yara match	File source: 936905.0.links.csv, type: HTML
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\xx[1].htm, type: DROPPED

Phishing site detected (based on logo template match)

Source: https://espaciorojo.com.mx/Silverberg/xx/

Matcher: Template: onedrive matched

HTML body contains low number of good links

Source: https://espaciorojo.com.mx/Silverberg/xx/	HTTP Parser: Number of links: 0
Source: https://espaciorojo.com.mx/Silverberg/xx/	HTTP Parser: Number of links: 0

HTML title does not match URL

Source: https://espaciorojo.com.mx/Silverberg/xx/	HTTP Parser: Title: OneDrive \| Login does not match URL
Source: https://espaciorojo.com.mx/Silverberg/xx/	HTTP Parser: Title: OneDrive \| Login does not match URL

Source: https://espaciorojo.com.mx/Silverberg/xx/	HTTP Parser: No <meta name="author".. found
Source: https://espaciorojo.com.mx/Silverberg/xx/	HTTP Parser: No <meta name="author".. found

Source: https://espaciorojo.com.mx/Silverberg/xx/	HTTP Parser: No <meta name="copyright".. found
Source: https://espaciorojo.com.mx/Silverberg/xx/	HTTP Parser: No <meta name="copyright".. found

Compliance:

Uses new MSVCR Dlls

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll

Jump to behavior

Uses secure TLS version for HTTPS connections

Source: unknown	HTTPS traffic detected: 159.89.137.49:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 159.89.137.49:443 -> 192.168.2.4:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.19.94:443 -> 192.168.2.4:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.226.175.105:443 -> 192.168.2.4:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.226.175.105:443 -> 192.168.2.4:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.226.175.105:443 -> 192.168.2.4:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.226.175.105:443 -> 192.168.2.4:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.226.175.105:443 -> 192.168.2.4:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.19.94:443 -> 192.168.2.4:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.226.175.105:443 -> 192.168.2.4:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 99.86.154.102:443 -> 192.168.2.4:49746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 99.86.154.102:443 -> 192.168.2.4:49747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.23.83:443 -> 192.168.2.4:49757 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.23.83:443 -> 192.168.2.4:49758 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.23.83:443 -> 192.168.2.4:49759 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 159.89.137.49:443 -> 192.168.2.4:49769 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 192.185.131.184:443 -> 192.168.2.4:49773 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 192.185.131.184:443 -> 192.168.2.4:49772 version: TLS 1.2

Networking:

Source: unknown

DNS traffic detected: queries for: sscpa.ebpages.com

Source: font-awesome.min[1].css.2.dr	String found in binary or memory: http://fontawesome.io
Source: font-awesome.min[1].css.2.dr	String found in binary or memory: http://fontawesome.io/license
Source: xx[1].htm0.2.dr	String found in binary or memory: http://gmail.com/
Source: hover[1].css.2.dr	String found in binary or memory: http://ianlunn.co.uk/
Source: hover[1].css.2.dr	String found in binary or memory: http://ianlunn.github.io/Hover/)
Source: popper.min[1].js.2.dr	String found in binary or memory: http://opensource.org/licenses/MIT).
Source: 4766563715514368[1].htm.2.dr	String found in binary or memory: http://www.fsscpa.ca/
Source: ~DFB37E734FE4AE4955.TMP.1.dr	String found in binary or memory: http://www.fsscpa.ca/m.mx/Silverberg/xx/
Source: xx[1].htm0.2.dr	String found in binary or memory: https://ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js
Source: leadgrabbers[1].json.2.dr	String found in binary or memory: https://app.engagebay.com/rest/api/signup/signup-user
Source: leadgrabbers[1].json.2.dr	String found in binary or memory: https://app.engagebay.com/signup
Source: 4766563715514368[1].htm.2.dr	String found in binary or memory: https://cdn2.eb-pages.com/uploads/6685880245813248/download__1_.png
Source: xx[1].htm0.2.dr	String found in binary or memory: https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/popper.min.js
Source: 4766563715514368[1].htm.2.dr	String found in binary or memory: https://cdnjs.cloudflare.com/ajax/libs/twitter-bootstrap/4.5.3/js/bootstrap.min.js
Source: xx[1].htm0.2.dr	String found in binary or memory: https://code.jquery.com/jquery-3.1.1.min.js
Source: xx[1].htm0.2.dr	String found in binary or memory: https://code.jquery.com/jquery-3.2.1.slim.min.js
Source: xx[1].htm0.2.dr	String found in binary or memory: https://code.jquery.com/jquery-3.3.1.js
Source: 4766563715514368[1].htm.2.dr	String found in binary or memory: https://d2p078bqz5urf7.cloudfront.net/cloud//landingpage-builder/page/page-actions.js?=82-0.43265363
Source: leadgrabbers[1].json.2.dr	String found in binary or memory: https://d2p078bqz5urf7.cloudfront.net/cloud/assets/img/avatar/avatar-new.png
Source: imagestore.dat.2.dr, 4766563715514368[1].htm.2.dr	String found in binary or memory: https://d2p078bqz5urf7.cloudfront.net/cloud/assets/img/logo/fav/ab-16x16.ico
Source: imagestore.dat.2.dr	String found in binary or memory: https://d2p078bqz5urf7.cloudfront.net/cloud/assets/img/logo/fav/ab-16x16.ico5:
Source: imagestore.dat.2.dr	String found in binary or memory: https://d2p078bqz5urf7.cloudfront.net/cloud/assets/img/logo/fav/ab-16x16.ico~
Source: 4766563715514368[1].htm.2.dr	String found in binary or memory: https://d2p078bqz5urf7.cloudfront.net/cloud/landingpage-builder/page/bootstrap.min.css
Source: 4766563715514368[1].htm.2.dr	String found in binary or memory: https://d2p078bqz5urf7.cloudfront.net/cloud/landingpage-builder/page/commons.css?82-0.43265363450355
Source: 4766563715514368[1].htm.2.dr	String found in binary or memory: https://d2p078bqz5urf7.cloudfront.net/cloud/landingpage-builder/page/iframe.js?=82-0.432653634503556
Source: 4766563715514368[1].htm.2.dr	String found in binary or memory: https://d2p078bqz5urf7.cloudfront.net/cloud/landingpage-builder/page/page.css?82-0.43265363450355653
Source: 4766563715514368[1].htm.2.dr	String found in binary or memory: https://d2p078bqz5urf7.cloudfront.net/cloud/prod/assets/lib/font-family/roboto.css
Source: ehform[1].js.2.dr	String found in binary or memory: https://d2p078bqz5urf7.cloudfront.net/jsapi
Source: {34E18AB7-60D4-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://espaciorojo.co
Source: {34E18AB7-60D4-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://espaciorojo.cocom/4766563715514368v
Source: {34E18AB7-60D4-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://espaciorojo.com.mx/Silver
Source: 4766563715514368[1].htm.2.dr	String found in binary or memory: https://espaciorojo.com.mx/Silverberg/xx
Source: {34E18AB7-60D4-11EB-90EB-ECF4BBEA1588}.dat.1.dr, ~DFB37E734FE4AE4955.TMP.1.dr, xx[1].htm.2.dr	String found in binary or memory: https://espaciorojo.com.mx/Silverberg/xx/
Source: free.min[1].css.2.dr, free-fa-solid-900[1].eot.2.dr	String found in binary or memory: https://fontawesome.com
Source: free.min[1].css.2.dr	String found in binary or memory: https://fontawesome.com/license/free
Source: free-fa-solid-900[1].eot.2.dr, free-fa-regular-400[1].eot.2.dr	String found in binary or memory: https://fontawesome.comhttps://fontawesome.comFont
Source: xx[1].htm0.2.dr	String found in binary or memory: https://fonts.googleapis.com/css?family=Archivo
Source: roboto[1].css.2.dr	String found in binary or memory: https://fonts.googleapis.com/css?family=Roboto:100
Source: css[1].css0.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/archivonarrow/v12/tss0ApVBdCYD5Q7hcxTE1ArZ0bbwiXo.woff)
Source: css[1].css.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v20/KFOiCnqEu92Fr1Mu51QrEzAdKQ.woff)
Source: css[1].css.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v20/KFOjCnqEu92Fr1Mu51S7ACc6CsI.woff)
Source: css[1].css.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v20/KFOjCnqEu92Fr1Mu51TLBCc6CsI.woff)
Source: css[1].css.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v20/KFOjCnqEu92Fr1Mu51TjASc6CsI.woff)
Source: css[1].css.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v20/KFOjCnqEu92Fr1Mu51TzBic6CsI.woff)
Source: css[1].css.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v20/KFOkCnqEu92Fr1MmgVxIIzQ.woff)
Source: css[1].css.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v20/KFOkCnqEu92Fr1Mu51xIIzQ.woff)
Source: css[1].css.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v20/KFOlCnqEu92Fr1MmEU9fBBc-.woff)
Source: css[1].css.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v20/KFOlCnqEu92Fr1MmSU5fBBc-.woff)
Source: css[1].css.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v20/KFOlCnqEu92Fr1MmWUlfBBc-.woff)
Source: css[1].css.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v20/KFOlCnqEu92Fr1MmYUtfBBc-.woff)
Source: css[1].css.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v20/KFOmCnqEu92Fr1Mu4mxM.woff)
Source: bootstrap.min[2].js.2.dr, bootstrap.min[1].css0.2.dr	String found in binary or memory: https://getbootstrap.com)
Source: bootstrap.min[1].js.2.dr, bootstrap.min[1].css.2.dr, bootstrap.min[1].js0.2.dr	String found in binary or memory: https://getbootstrap.com/)
Source: hover[1].css.2.dr	String found in binary or memory: https://github.com/IanLunn/Hover
Source: v205[1].js.2.dr	String found in binary or memory: https://github.com/faisalman/ua-parser-js
Source: bootstrap.min[1].js.2.dr	String found in binary or memory: https://github.com/twbs/bootstrap/blob/main/LICENSE)
Source: bootstrap.min[2].js.2.dr, bootstrap.min[1].css.2.dr	String found in binary or memory: https://github.com/twbs/bootstrap/blob/master/LICENSE)
Source: bootstrap.min[1].js.2.dr, bootstrap.min[2].js.2.dr	String found in binary or memory: https://github.com/twbs/bootstrap/graphs/contributors)
Source: 585b051251[1].js.2.dr	String found in binary or memory: https://ka-f.fontawesome.com
Source: 585b051251[1].js.2.dr	String found in binary or memory: https://kit.fontawesome.com
Source: xx[1].htm0.2.dr	String found in binary or memory: https://kit.fontawesome.com/585b051251.js
Source: xx[1].htm0.2.dr	String found in binary or memory: https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/css/bootstrap.min.css
Source: xx[1].htm0.2.dr	String found in binary or memory: https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/bootstrap.min.js
Source: {34E18AB7-60D4-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://sscpa.ebpages.com/4766563715514368
Source: {34E18AB7-60D4-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://sscpa.ebpages.com/4766563715514368Root
Source: {34E18AB7-60D4-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://sscpa.ebpages.com/4766563715514368v
Source: xx[1].htm0.2.dr	String found in binary or memory: https://stackpath.bootstrapcdn.com/bootstrap/4.1.3/js/bootstrap.min.js
Source: 4766563715514368[1].htm.2.dr	String found in binary or memory: https://stackpath.bootstrapcdn.com/font-awesome/4.7.0/css/font-awesome.min.css
Source: {34E18AB7-60D4-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://www.engagebay.
Source: 4766563715514368[1].htm.2.dr, ~DFB37E734FE4AE4955.TMP.1.dr	String found in binary or memory: https://www.engagebay.com/?utm_source=eb-lps
Source: ~DFB37E734FE4AE4955.TMP.1.dr	String found in binary or memory: https://www.engagebay.com/?utm_source=eb-lpsS

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 159.89.137.49:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 159.89.137.49:443 -> 192.168.2.4:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.19.94:443 -> 192.168.2.4:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.226.175.105:443 -> 192.168.2.4:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.226.175.105:443 -> 192.168.2.4:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.226.175.105:443 -> 192.168.2.4:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.226.175.105:443 -> 192.168.2.4:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.226.175.105:443 -> 192.168.2.4:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.19.94:443 -> 192.168.2.4:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.226.175.105:443 -> 192.168.2.4:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 99.86.154.102:443 -> 192.168.2.4:49746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 99.86.154.102:443 -> 192.168.2.4:49747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.23.83:443 -> 192.168.2.4:49757 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.23.83:443 -> 192.168.2.4:49758 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.23.83:443 -> 192.168.2.4:49759 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 159.89.137.49:443 -> 192.168.2.4:49769 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 192.185.131.184:443 -> 192.168.2.4:49773 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 192.185.131.184:443 -> 192.168.2.4:49772 version: TLS 1.2

System Summary:

Source: classification engine

Classification label: mal76.phis.win@3/69@14/8

Source: C:\Program Files\internet explorer\iexplore.exe

File created: C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{34E18AB5-60D4-11EB-90EB-ECF4BBEA1588}.dat

Jump to behavior

Source: C:\Program Files\internet explorer\iexplore.exe

File created: C:\Users\user\AppData\Local\Temp\~DFFC8A88A8F281A5C1.TMP

Jump to behavior

Source: C:\Program Files\internet explorer\iexplore.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: unknown	Process created: C:\Program Files\internet explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Source: unknown	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:6884 CREDAT:17410 /prefetch:2
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:6884 CREDAT:17410 /prefetch:2	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll

Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
159.89.137.49	unknown	United States	14061	DIGITALOCEAN-ASNUS	false
66.113.178.70	unknown	United States	14280	NETNATIONCA	false
99.86.154.102	unknown	United States	16509	AMAZON-02US	false
172.217.23.83	unknown	United States	15169	GOOGLEUS	false
192.185.131.184	unknown	United States	46606	UNIFIEDLAYER-AS-1US	false
13.226.175.105	unknown	United States	16509	AMAZON-02US	false
104.16.19.94	unknown	United States	13335	CLOUDFLARENETUS	false

Private

IP
192.168.2.1

Contacted Domains

Name	IP	Active
espaciorojo.com.mx	192.185.131.184	true
cdnjs.cloudflare.com	104.16.19.94	true
d3w29h23ietttc.cloudfront.net	99.86.154.102	true
d2p078bqz5urf7.cloudfront.net	13.226.175.105	true
sscpa.ebpages.com	159.89.137.49	true
www.fsscpa.ca	66.113.178.70	true
ghs.googlehosted.com	172.217.23.83	true
stackpath.bootstrapcdn.com	unknown	unknown
app.engagebay.com	unknown	unknown
ka-f.fontawesome.com	unknown	unknown
cdn2.eb-pages.com	unknown	unknown
code.jquery.com	unknown	unknown
kit.fontawesome.com	unknown	unknown
maxcdn.bootstrapcdn.com	unknown	unknown

Contacted URLs

Name	Malicious	Reputation
https://www.engagebay.com/?utm_source=eb-lps	true	unknown
https://sscpa.ebpages.com/4766563715514368	true	unknown
http://www.fsscpa.ca/	true	unknown
https://espaciorojo.com.mx/Silverberg/xx/	true	unknown

ID:	345188
Product:	CloudBasic
Start time:	20:15:55
Start date:	27.01.2021
Cookbook:	browseurl.jbs
System description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Architecture:	WINDOWS

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\DOMStore\E5F0NRSV\sscpa.ebpages[1].xml	ASCII text, with no line terminators	56AE21364B4A1F7013889748C538BEED	E449249081E94C0BA88213EF4CE153DF67F58D40	C5179D90E43A9AF57BF2D32B7ED50C41C3455E34939D293E8DC1A2F31F88E211
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{34E18AB5-60D4-11EB-90EB-ECF4BBEA1588}.dat	Microsoft Word Document	B88F9FCED1190D78EF95BBBDAB92E177	FA156358A7BBADE53FDF90B0F1E4674A82D14548	8E34C9149A224A9A9F48B20B92F9D24272E68F9D8DD46520F982358F26CFEE5C
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{34E18AB7-60D4-11EB-90EB-ECF4BBEA1588}.dat	Microsoft Word Document	C0631347765C452DAC46405A39C0869F	4FD0DE38EE6CEBFA32D56DB7E228B4080D4C2416	D42AEAA2EEBDE3F080BDD6FCA4B8F8B11B525DBC76356EFC100C0AD78FEEC26B
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{3B4EA0BF-60D4-11EB-90EB-ECF4BBEA1588}.dat	Microsoft Word Document	A9C125474FEFC8AB088600B1549811B9	DE9D24DD2C1CAFA62E5F174269A6E3A9D6090E2B	221E46CFCDA3875EDA978C6D80148456C82F32BF4287593DC8052088597EA3CD
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\imagestore\gee00pr\imagestore.dat	data	6B3FA8577AB315084378F2CBEB14DCF3	96F398B3FADB464CE1C0B4C2A3BB47247F7931E7	88EDC53FA7AE5B6666A825149C50845AA5C5B6FA9181421B71C18866D607124A
C:\Users\user\AppData\Local\Microsoft\Windows\History\History.IE5\mms\E3QHOZ30\onedrive[1].dat	data	8A6B74370F99662230C6F5693D6EE296	A0F339F1279D2D68FFB9F3A8758163BD21176F62	4501CB4AB5F6BC93136BDF5A5B60B722250002D9A079F3C11449808750145414
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\4766563715514368[1].htm	HTML document, ASCII text, with very long lines	ED70BB26967F80CE1257389549AA53E8	378FAEE851246A5AA06BF5A76709962B95CA7C64	CC7D8552E7E99D2418EDDE9F58DE5059EF5E025F34B4764270A5B507C3E70BB2
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\KFOjCnqEu92Fr1Mu51S7ACc6CsI[1].woff	Web Open Font Format, TrueType, length 22020, version 1.1	288AD9C6E8B43CF02443A1F499BDF67E	96A90B4B2F04445CEE7091C257D9C7D905BF74B8	6F2974A396DC0695D071E842551E7AF9C72F0EF8D2D076FE73A523B1A3C2D0E7
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\KFOlCnqEu92Fr1MmEU9fBBc-[1].woff	Web Open Font Format, TrueType, length 20464, version 1.1	87284894879F5B1C229CB49C8FF6DECC	FB1BD3BAF122D5D350EB387F0536C20DA71F09DF	BA98F991D002C6BFAAF7B874652FFDCDE9261A86925DB87DF3ED2861EA080ADF
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\KFOlCnqEu92Fr1MmSU5fBBc-[1].woff	Web Open Font Format, TrueType, length 20348, version 1.1	B00849E00F4C2331CDDD8FFB44A6720B	5B7820FEC8F9810E291E1EB98764979830ED6621	76B05400FFF9DA5B43862E3713099E3913916A629560265ED24B19D031227CBF
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\KFOlCnqEu92Fr1MmWUlfBBc-[1].woff	Web Open Font Format, TrueType, length 20356, version 1.1	ADCDE98F1D584DE52060AD7B16373DA3	0A9B76D81989A7A45336EBD7B48ED25803F344B9	806EA46C426AF8FC24E5CF42A210228739696933D36299EB28AEE64F69FC71F1
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\KFOlCnqEu92Fr1MmYUtfBBc-[1].woff	Web Open Font Format, TrueType, length 20392, version 1.1	BB1E4DC6333675D11ADA2E857E7F95D7	3E2625FE48669F4AD48823E8C18E6FB14B74C5A0	E8586F9DB7C0503A984C944AD2F1F783BF6051AEA2A066BC21FDEDC8FE7FA68A
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\bootstrap.min[1].js	ASCII text, with very long lines	67176C242E1BDC20603C878DEE836DF3	27A71B00383D61EF3C489326B3564D698FC1227C	56C12A125B021D21A69E61D7190CEFA168D6C28CE715265CEA1B3B0112D169C4
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\css[1].css	ASCII text	629A4721FDC302D2DC49D68A0DB682F0	984F51AAA7C7A4982E4CC6BDCC85EEAAD6604000	9FA56F8263CBCA9C4828F35707D67841615AEB9BE198E9E832EC10E0745A7147
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\dnserror[1]	HTML document, UTF-8 Unicode (with BOM) text, with CRLF line terminators	2DC61EB461DA1436F5D22BCE51425660	E1B79BCAB0F073868079D807FAEC669596DC46C1	ACDEB4966289B6CE46ECC879531F85E9C6F94B718AAB521D38E2E00F7F7F7993
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\ehform[1].js	ASCII text, with very long lines, with no line terminators	2BF59092C3B2D985D70BD3BC6E9D5DDB	FBD3A683BA46B5318B4D72069277AFEF5608DB27	36C3CA764F9F0889012091D5A720CDD3B6B5F45B78726E38406CC9B6E0E9036B
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\free-fa-regular-400[1].eot	Embedded OpenType (EOT), Font Awesome 5 Free Regular family	73570FCA80D5237954C19C20BDA58A70	E27F09071CA6B858A1B96B1CD02B2B34BCE85178	75BAC9C568E4B2DF8C25F96513A92FA4740D4B11E58FB0ADB88E2F4DADC7FFCD
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\free-fa-solid-900[1].eot	Embedded OpenType (EOT), Font Awesome 5 Free Solid family	AD5381B40F2857CE48DC73585FC92294	B404BB9916EDFD272560C27CFD09C032EC9F9B96	2D45F4A3844BEFB918111DF65049A4FA71577D5E8FF009934B62E647E4702AB0
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\free.min[1].css	ASCII text, with very long lines	4ECC071B77D6B1790FA9FB8A5173F972	B44FCBAAC4F3AA7381D71DE20064AC84B0B729D1	8C7BBA7DEB64FF95E98F7AC8CD0D3B675A4BCF02F302E57EDC5A1D6FA3D6CF94
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\jquery-3.1.1.min[1].js	ASCII text, with very long lines	E071ABDA8FE61194711CFC2AB99FE104	F647A6D37DC4CA055CED3CF64BBC1F490070ACBA	85556761A8800D14CED8FCD41A6B8B26BF012D44A318866C0D81A62092EFD9BF
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\jquery-3.2.1.slim.min[1].js	ASCII text, with very long lines	5F48FC77CAC90C4778FA24EC9C57F37D	9E89D1515BC4C371B86F4CB1002FD8E377C1829F	9365920887B11B33A3DC4BA28A0F93951F200341263E3B9CEFD384798E4BE398
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\KFOjCnqEu92Fr1Mu51TLBCc6CsI[1].woff	Web Open Font Format, TrueType, length 22304, version 1.1	28F9151055C950874D2C6803A39B425B	C5044FF5D371B2816C589725F0EA681EDF54A3A8	6A80D9CB4F49B5951B407F8905CFA887F1E3F2E2EC4369BF58EAC633B2E05948
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\KFOkCnqEu92Fr1MmgVxIIzQ[1].woff	Web Open Font Format, TrueType, length 20368, version 1.1	5CB7EDFCEB233100075DC9A1E12E8DA3	0BD90E5EF8C6650F6ECC41A11A46D3F66E5A898E	C4EAD4DE9F7AFF237D06B530EAD8413D1357427F6A925944342BB4E2B1DCE6D0
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\KFOmCnqEu92Fr1Mu4mxM[1].woff	Web Open Font Format, TrueType, length 20268, version 1.1	60FA3C0614B8FB2F394FA29944C21540	42C8AE79841C592A26633F10EE9A26C75BCF9273	C1DC87F99C7FF228806117D58F085C6C573057FA237228081802B7D8D3CF7684
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\bootstrap.min[1].css	ASCII text, with very long lines	450FC463B8B1A349DF717056FBB3E078	895125A4522A3B10EE7ADA06EE6503587CBF95C5	2C0F3DCFE93D7E380C290FE4AB838ED8CADFF1596D62697F5444BE460D1F876D
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\bootstrap.min[1].js	ASCII text, with very long lines	F20FA8B102F205141295CDEFD6FFE449	0C4E8445F6F0C9611DC1C13DC6F085EB4BCACA0B	D8968086F7509DF34C3278563DAB87399DA4F9DCDFB419818E3A309EEDC70B88
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\bootstrap.min[2].js	ASCII text, with very long lines	14D449EB8876FA55E1EF3C2CC52B0C17	A9545831803B1359CFEED47E3B4D6BAE68E40E99	E7ED36CEEE5450B4243BBC35188AFABDFB4280C7C57597001DE0ED167299B01B
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\dnserror[1]	HTML document, UTF-8 Unicode (with BOM) text, with CRLF line terminators	2DC61EB461DA1436F5D22BCE51425660	E1B79BCAB0F073868079D807FAEC669596DC46C1	ACDEB4966289B6CE46ECC879531F85E9C6F94B718AAB521D38E2E00F7F7F7993
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\down[1]	PNG image data, 15 x 15, 8-bit colormap, non-interlaced	C4F558C4C8B56858F15C09037CD6625A	EE497CC061D6A7A59BB66DEFEA65F9A8145BA240	39E7DE847C9F731EAA72338AD9053217B957859DE27B50B6474EC42971530781
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\httpErrorPagesScripts[1]	UTF-8 Unicode (with BOM) text, with CRLF line terminators	9234071287E637F85D721463C488704C	CCA09B1E0FBA38BA29D3972ED8DCECEFDEF8C152	65CC039890C7CEB927CE40F6F199D74E49B8058C3F8A6E22E8F916AD90EA8649
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\jquery.min[1].js	ASCII text, with very long lines	E071ABDA8FE61194711CFC2AB99FE104	F647A6D37DC4CA055CED3CF64BBC1F490070ACBA	85556761A8800D14CED8FCD41A6B8B26BF012D44A318866C0D81A62092EFD9BF
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\jquery.min[2].js	ASCII text, with very long lines	2F6B11A7E914718E0290410E85366FE9	69BB69E25CA7D5EF0935317584E6153F3FD9A88C	05B85D96F41FFF14D8F608DAD03AB71E2C1017C2DA0914D7C59291BAD7A54F8E
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\leadgrabbers[1].json	ASCII text, with very long lines, with no line terminators	9544281227CEDF63F8737DEA5BC89A78	A5DAA8CBF11D4CAB599DEB9EB600A423D4979155	F092AEE9FB7BF40321A3C7ABF02FCA6133E7E5E393829B83DB56DF6A8D3E0DB1
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\onedrive-w[1].png	PNG image data, 242 x 167, 8-bit/color RGBA, non-interlaced	A4E9A192337B2DD72BAACE5F6BB7A7C8	88EB42C8A10E146E610C9519CAD72B0FE175A64C	D4594C50BCDB75CC4A51C77C77A089C1BC9D1860F4E50B7AC33039551C82B408
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\v205[1].js	C source, UTF-8 Unicode text, with very long lines	EDCA140F86A136B68CBB6B1E1FB80F39	CCCD4BB63783A5DE85737CBCFCDD3AA1A0C4EA31	D1D3394931774C92F39AA24752BE2252B943FA9A37051528BCD700E094354B73
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\xx[1].htm	HTML document, ASCII text, with CRLF line terminators	90B9B5AEF0B580B439C7E47FE36550CA	696840191967AFE6CFE72DF21F9F1351B9EF8CF4	74D9357DE367B4AB1879D4D0C9831753A033E822204ED0B4AB86AB738CA7812E
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\KFOiCnqEu92Fr1Mu51QrEzAdKQ[1].woff	Web Open Font Format, TrueType, length 21704, version 1.1	F9E8E590B4E0F1FF83469BB2A55B8488	E90B097A67B069E35C13D4D481D259C35BF0A8B7	5A3A9840414768FA2EC988B33C9E966FDFFE2DB7E560A270B3A9C6BA01F17718
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\KFOjCnqEu92Fr1Mu51TjASc6CsI[1].woff	Web Open Font Format, TrueType, length 22204, version 1.1	4DF32891A5F2F98A363314F595482E08	A8AB4E03143BCF7646C96A8CB33B3E596A9E55BD	0BE0AE6EFD852B3695CB7A76286096F60E93B7D31C16E0B71CA35ECED7FDE8F6
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\KFOjCnqEu92Fr1Mu51TzBic6CsI[1].woff	Web Open Font Format, TrueType, length 21588, version 1.1	81F57861ED4AC74741F5671E1DFF2FD9	AC3993E9EDC4C30C97FE670AA1E8A7088AA69E31	EEC142608E8B417E2ACB6E5301A750047A04E2C5A6563223CAAE499E19EA08EE
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\KFOkCnqEu92Fr1Mu51xIIzQ[1].woff	Web Open Font Format, TrueType, length 21952, version 1.1	FE65B8335EE19DD944289F9ED3178C78	E9E842D5ED5321DDD719599057E9F8643B2AD539	80815EFE3BD9317C666DF0F2E6D701335E178954F64EB1E99103FEA81C2AA137
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\NewErrorPageTemplate[1]	UTF-8 Unicode (with BOM) text, with CRLF line terminators	DFEABDE84792228093A5A270352395B6	E41258C9576721025926326F76063C2305586F76	77B138AB5D0A90FF04648C26ADDD5E414CC178165E3B54A4CB3739DA0F58E075
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\css[1].css	ASCII text	72C5D331F2135E52DA2A95F7854049A3	572F349BB65758D377CCBAE434350507341ACD7B	C3A12D7E8F6B2B1F5E4CD0C9938DFC79532AEF90802B424EE910093F156586DA
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\down[1]	PNG image data, 15 x 15, 8-bit colormap, non-interlaced	C4F558C4C8B56858F15C09037CD6625A	EE497CC061D6A7A59BB66DEFEA65F9A8145BA240	39E7DE847C9F731EAA72338AD9053217B957859DE27B50B6474EC42971530781
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\download__1_[1].png	PNG image data, 203 x 249, 8-bit colormap, non-interlaced	0DFE1271C4FEEE62A37D4F324DDEE500	930AC14F3E0418FC6D95EFA7194CACDF8FE54710	93AAADA248E9F32EA33261086CC12C91AFFC6591049DF18E4F087384F0D8EB53
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\errorPageStrings[1]	UTF-8 Unicode (with BOM) text, with CRLF line terminators	D65EC06F21C379C87040B83CC1ABAC6B	208D0A0BB775661758394BE7E4AFB18357E46C8B	A1270E90CEA31B46432EC44731BF4400D22B38EB2855326BF934FE8F1B169A4F
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\font-awesome.min[1].css	ASCII text, with very long lines	269550530CC127B6AA5A35925A7DE6CE	512C7D79033E3028A9BE61B540CF1A6870C896F8	799AEB25CC0373FDEE0E1B1DB7AD6C2F6A0E058DFADAA3379689F583213190BD
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\gmail[1].png	PNG image data, 1280 x 1280, 8-bit/color RGBA, non-interlaced	DCE2F2B0E50CB1DBB0246D152791CB46	D0A69C159304EDC08DB005163E7A0DAF5A1E98A6	ACF087C1757F08B0CFD53D59066544D7EF0BFCC50999E77C5813739CD9DC1479
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\min_v6[1].css	ASCII text, with very long lines, with no line terminators	0001A59FB5DC223B9327003735A359B4	2E83DDF2239116E46CE84D5CB3BCFFC4152CD87E	668C4EA01B5AD8F78A731AB245C4E23994EFB33D0A6F525D5B0F42828B2E2591
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\office3651[1].png	PNG image data, 187 x 188, 8-bit/color RGBA, non-interlaced	A5CDADD60382E9AE6228121542EB1C2A	CEC15F6470D0237569E931D7D11752B41AC5D8A3	71E729939E175F4AE9D3FCC645D6B7389EC341A47A84950E047197331FDC22F1
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\outlook1[1].png	PNG image data, 26 x 26, 8-bit/color RGBA, non-interlaced	C3FC46C5799C76F9107504028F39190F	519096AD3F03410CF9CE3C9B9FCCA6B439D97B23	57898461712A639D119BDF88B7145919DCC8956C7A271D2E4A1084B29EAE6785
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\popper.min[1].js	ASCII text, with very long lines	70D3FDA195602FE8B75E0097EED74DDE	C3B977AA4B8DFB69D651E07015031D385DED964B	A52F7AA54D7BCAAFA056EE0A050262DFC5694AE28DEE8B4CAC3429AF37FF0D66
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\585b051251[1].js	ASCII text, with very long lines	4B900F0AF3BBDA85E1077C8EC8C83831	7E7015965195F25AFA3A47BE2108278AD6A0A4AC	7943D6D067DB8587E9FB675F0D2CC78D6C90C91B187CF8642A3F52FF91381685
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\NewErrorPageTemplate[1]	UTF-8 Unicode (with BOM) text, with CRLF line terminators	DFEABDE84792228093A5A270352395B6	E41258C9576721025926326F76063C2305586F76	77B138AB5D0A90FF04648C26ADDD5E414CC178165E3B54A4CB3739DA0F58E075
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\ab-16x16[1].ico	MS Windows icon resource - 9 icons, 16x16, 32 bits/pixel, 24x24, 32 bits/pixel	890AAFC101CF6E505068ED8DD5BF78DD	910FC714CAC915688F59B4ED247AA6202D9E2A76	D5C1A1248313F34F24D1F9785EC26E71E00318378636C9C41CF536A49233532C
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\album[1].css	assembler source, ASCII text, with CRLF line terminators	944799FC98B666F3BA0ECE9304DD7DDA	0EBFD347A653629D57D6D8C135C87C390E6EBA44	A6DCBF5C0D819D82A0A8781DFCDE5BB405A4311A6B9CC088F4D4056A3E5095A8
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\bootstrap.min[1].css	ASCII text, with very long lines, with CRLF line terminators	F64D3837A895BE24BE21E6B11E1664F4	E6C5CB0A491D9B8D97E03CD6F5A1937BB02D8014	A36B91284CC33D2E26FEBA77675A1D587684C541455E347F3BB1AC2529657AC9
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\commons[1].css	ASCII text, with CRLF line terminators	7E58D8C57DD337D51C801F2DE145B33A	59CCED5D51BE1996FC1123033D187D755DF3C8A8	222283BD442533DF373E971DD801D07E58E2FBD7C0702C79078EBABBD8BAB3A5
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\errorPageStrings[1]	UTF-8 Unicode (with BOM) text, with CRLF line terminators	D65EC06F21C379C87040B83CC1ABAC6B	208D0A0BB775661758394BE7E4AFB18357E46C8B	A1270E90CEA31B46432EC44731BF4400D22B38EB2855326BF934FE8F1B169A4F
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\free-v4-shims.min[1].css	ASCII text, with very long lines	1848E71668F42835079E5FA2AF6CF4A8	6AE345E2FEB8C2A524E7CF9E22A3A87BAEE60593	D7CC3C57F9BDA4C6DCB83BB3C19F2F2AA86ECEC6274E243CD4EC315AE8E30101
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\hover[1].css	ASCII text	FAC4178C15E5A86139C662DAFC809501	EF1481841399156A880EC31B07DDA9CFAA1ACE39	BB88454962767EB6F2DDB1AABAAF844D8A57DE7E8F848D7F6928F81B54998452
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\httpErrorPagesScripts[1]	UTF-8 Unicode (with BOM) text, with CRLF line terminators	9234071287E637F85D721463C488704C	CCA09B1E0FBA38BA29D3972ED8DCECEFDEF8C152	65CC039890C7CEB927CE40F6F199D74E49B8058C3F8A6E22E8F916AD90EA8649
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\iframe[1].js	ASCII text, with CRLF line terminators	116E28F03C0E6DDA20174E08F1A49685	1D23C80D0102F33C8E08B48E764C6BC8BAE97E7C	4401CB5A593CBA0A74412658BAB8F87A2976E49183C8343FCC209CA99AE9EF2F
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\page-actions[1].js	ASCII text, with CRLF line terminators	62E9E627C1322AB990194EB6BDFD5499	448B8FD27CF3E19E92374CEF0045A08BC2C26B3E	FAE77A813E81D7829692F1C70D6F9E2CEBFAACE0941A85CDC7E142204840C635
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\page[1].css	ASCII text, with CRLF line terminators	71374AEE1A3FD085641B64402B0FA5CE	86FA69E69AE2BECCF082FD67766C46648B4861C9	D3D99606E7E22717A6225968F11A608D5DF2FFB37488D4DDAE8B139D157337C7
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\roboto[1].css	ASCII text, with CRLF line terminators	775CD75CE56F94D14325B4C781973549	D876A8786FC35410F3079D057B1E953B3DC662E1	A1AD98928C3F060D83E612380CEC67893929AAA4C8BD9EDF4A8AF49891C1DC7A
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\xx[1].htm	HTML document, ASCII text	57A644F4F7B4CC6E4A608E20EB07CEBE	78B372CCC61D0142D17D03EE5BFED1ED05732610	6E94D21264CA29B7D77D9F5E274CE6A0F8425F478FDE05B0128A306B1E300B00
C:\Users\user\AppData\Local\Temp\~DF405AF7377B42C889.TMP	data	31F2217D82FA3EAF4D12BEEBC8A67BA5	C31A9C01ADD99913375770E18801613B40262357	50296A3819F3C9A432E8FF0CAADC8A3757852366D4AFE70CB6EA6F6604C8453F
C:\Users\user\AppData\Local\Temp\~DFB37E734FE4AE4955.TMP	data	1D43717DB2F57F1817391715822A25B4	4A30B565EC78D20C4D398433DF925A30F31960E5	591432910467E3AEA4F9D3914C52AB79357880B5F3DED96CBB95AB1FF025A0F1
C:\Users\user\AppData\Local\Temp\~DFFC8A88A8F281A5C1.TMP	data	184A100635DD1B72E55002D430D64383	62494A856FD2D6EA9FA4AF6F641F892DEDE7AA81	0BC2F8BFE1E660697339FDDFA919BB7D81436F8B6BA4CFEE1E101B6BE7FEC7C1

Analysis Report https://sscpa.ebpages.com/4766563715514368

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection:

Phishing:

Compliance:

Networking:

System Summary:

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs