Analysis Report https://public.3.basecamp.com/p/9HoiMQPNPfT1V5JoFAC5GG7t

Overview

General Information

Sample URL:	https://public.3.basecamp.com/p/9HoiMQPNPfT1V5JoFAC5GG7t
Analysis ID:	358584
Infos:
Most interesting Screenshot:

Detection

Score:	48
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Classification

Signatures

AV Detection:

Antivirus / Scanner detection for submitted sample

Source: https://public.3.basecamp.com/p/9HoiMQPNPfT1V5JoFAC5GG7t

SlashNext: detection malicious, Label: Fake Login Page type: Phishing & Social Engineering

Compliance:

Uses new MSVCR Dlls

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll

Jump to behavior

Uses secure TLS version for HTTPS connections

Source: unknown	HTTPS traffic detected: 64.202.125.18:443 -> 192.168.2.4:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 64.202.125.18:443 -> 192.168.2.4:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.224.94.82:443 -> 192.168.2.4:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.224.94.82:443 -> 192.168.2.4:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.224.94.82:443 -> 192.168.2.4:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.224.94.82:443 -> 192.168.2.4:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 130.211.11.159:443 -> 192.168.2.4:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 64.202.125.15:443 -> 192.168.2.4:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 64.202.125.15:443 -> 192.168.2.4:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 64.202.125.18:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 64.202.125.15:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 199.34.228.53:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 199.34.228.53:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.1.46:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.1.46:443 -> 192.168.2.4:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.1.46:443 -> 192.168.2.4:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.1.46:443 -> 192.168.2.4:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.1.46:443 -> 192.168.2.4:49738 version: TLS 1.2

Networking:

Source: unknown

DNS traffic detected: queries for: public.3.basecamp.com

Source: 9HoiMQPNPfT1V5JoFAC5GG7t[1].htm.2.dr	String found in binary or memory: https://apis.google.com/js/platform.js?onload=setupGoogleSignIn
Source: 9HoiMQPNPfT1V5JoFAC5GG7t[1].htm.2.dr	String found in binary or memory: https://bc3-production-assets-cdn.basecamp-static.com
Source: 9HoiMQPNPfT1V5JoFAC5GG7t[1].htm.2.dr	String found in binary or memory: https://bc3-production-assets-cdn.basecamp-static.com/assets/billing-4200b9e83e3eb94932d80c6cbcaca79
Source: 9HoiMQPNPfT1V5JoFAC5GG7t[1].htm.2.dr	String found in binary or memory: https://bc3-production-assets-cdn.basecamp-static.com/assets/desktop-09334a52f8be90f7ab2c69fb59eb0ea
Source: 9HoiMQPNPfT1V5JoFAC5GG7t[1].htm.2.dr	String found in binary or memory: https://bc3-production-assets-cdn.basecamp-static.com/assets/fonts-0adca736826e5341a26aa294e6302bb22
Source: 9HoiMQPNPfT1V5JoFAC5GG7t[1].htm.2.dr	String found in binary or memory: https://bc3-production-assets-cdn.basecamp-static.com/assets/packs/libraries-a6ab6002c86dc39bd54d.js
Source: 9HoiMQPNPfT1V5JoFAC5GG7t[1].htm.2.dr	String found in binary or memory: https://bc3-production-assets-cdn.basecamp-static.com/assets/public-e8b06a8ee10d5c07ccf7e91ef27eaae0
Source: 9HoiMQPNPfT1V5JoFAC5GG7t[1].htm.2.dr	String found in binary or memory: https://bc3-production-assets-cdn.basecamp-static.com/assets/rich_text-7df2a91e108ef44ef372558ec3956
Source: {EF122194-77AA-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://mibghgh.weebly
Source: 9HoiMQPNPfT1V5JoFAC5GG7t[1].htm.2.dr	String found in binary or memory: https://mibghgh.weebly.com
Source: ~DFA5A270FBA6D61E89.TMP.1.dr	String found in binary or memory: https://mibghgh.weebly.com/m/p/9HoiMQPNPfT1V5JoFAC5GG7t
Source: {EF122194-77AA-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://mibghgh.weeblyamp.com/p/9HoiMQPNPfT1V5JoFAC5GG7t
Source: {EF122194-77AA-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://public.3..com/m/p/9HoiMQPNPfT1V5JoFAC5GG7tRoot
Source: {EF122194-77AA-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://public.3.Root
Source: {EF122194-77AA-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://public.3.ba24b-7732-4312-b6e5-6bb75d448e48
Source: 9HoiMQPNPfT1V5JoFAC5GG7t[1].htm.2.dr	String found in binary or memory: https://public.3.basecamp.com/buckets/20950190/vaults/3492664608
Source: imagestore.dat.2.dr	String found in binary or memory: https://public.3.basecamp.com/favicon-32x32.png
Source: ~DFA5A270FBA6D61E89.TMP.1.dr	String found in binary or memory: https://public.3.basecamp.com/p/9HoiMQPNPfT1V5JoFAC5GG7t
Source: ~DFA5A270FBA6D61E89.TMP.1.dr	String found in binary or memory: https://public.3.basecamp.com/p/9HoiMQPNPfT1V5JoFAC5GG7tNYou
Source: {EF122194-77AA-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://public.3.basecamp.com/p/9HoiMQPNPfT1V5JoFAC5GG7tRoot
Source: {EF122194-77AA-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://public.3.basecamp.com/p/9HoiMQPNPfT1V5JoFAC5GG7tamp.com/p/9HoiMQPNPfT1V5JoFAC5GG7tRoot

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443

Source: unknown	HTTPS traffic detected: 64.202.125.18:443 -> 192.168.2.4:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 64.202.125.18:443 -> 192.168.2.4:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.224.94.82:443 -> 192.168.2.4:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.224.94.82:443 -> 192.168.2.4:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.224.94.82:443 -> 192.168.2.4:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.224.94.82:443 -> 192.168.2.4:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 130.211.11.159:443 -> 192.168.2.4:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 64.202.125.15:443 -> 192.168.2.4:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 64.202.125.15:443 -> 192.168.2.4:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 64.202.125.18:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 64.202.125.15:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 199.34.228.53:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 199.34.228.53:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.1.46:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.1.46:443 -> 192.168.2.4:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.1.46:443 -> 192.168.2.4:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.1.46:443 -> 192.168.2.4:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.1.46:443 -> 192.168.2.4:49738 version: TLS 1.2

System Summary:

Source: classification engine

Classification label: mal48.win@3/22@11/6

Source: C:\Program Files\internet explorer\iexplore.exe

File created: C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{EF122192-77AA-11EB-90EB-ECF4BBEA1588}.dat

Jump to behavior

Source: C:\Program Files\internet explorer\iexplore.exe

File created: C:\Users\user\AppData\Local\Temp\~DF8853F3693435E5B4.TMP

Jump to behavior

Source: C:\Program Files\internet explorer\iexplore.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: unknown	Process created: C:\Program Files\internet explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Source: unknown	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:6136 CREDAT:17410 /prefetch:2
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:6136 CREDAT:17410 /prefetch:2	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll

Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
64.202.125.18	unknown	United States	25657	BASECAMPUS	false
64.202.125.15	unknown	United States	25657	BASECAMPUS	false
130.211.11.159	unknown	United States	15169	GOOGLEUS	false
151.101.1.46	unknown	United States	54113	FASTLYUS	false
13.224.94.82	unknown	United States	16509	AMAZON-02US	false
199.34.228.53	unknown	United States	27647	WEEBLYUS	false

Contacted Domains

Name	IP	Active
pages-wildcard.weebly.com	199.34.228.53	true
3.basecamp.com	64.202.125.15	true
d30fxesrqrvb2r.cloudfront.net	13.224.94.73	true
weebly.map.fastly.net	151.101.1.46	true
beanstalk.37signals.com	130.211.11.159	true
public.3.basecamp.com	64.202.125.18	true
mibghgh.weebly.com	unknown	unknown
cdn2.editmysite.com	unknown	unknown
cdn1.editmysite.com	unknown	unknown
bc3-production-assets-cdn.basecamp-static.com	unknown	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://mibghgh.weebly.com/	false		high
https://public.3.basecamp.com/p/9HoiMQPNPfT1V5JoFAC5GG7t	false		high

ID:	358584
Product:	CloudBasic
Start time:	21:48:38
Start date:	25.02.2021
Cookbook:	browseurl.jbs
System description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Architecture:	WINDOWS

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\DOMStore\E5F0NRSV\public.3.basecamp[1].xml	ASCII text, with no line terminators	C1DDEA3EF6BBEF3E7060A1A9AD89E4C5	35E3224FCBD3E1AF306F2B6A2C6BBEA9B0867966	B71E4D17274636B97179BA2D97C742735B6510EB54F22893D3A2DAFF2CEB28DB
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{EF122192-77AA-11EB-90EB-ECF4BBEA1588}.dat	Microsoft Word Document	E1D7EB63ED9A4254977233FE8701EED5	8ECCBF8E40A31DEA4C0FD9C0D0A8E4E080F433B3	60FB656883E9701BC377ACC48B374483163B523434F030F31528DB43D30EFCCC
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{EF122194-77AA-11EB-90EB-ECF4BBEA1588}.dat	Microsoft Word Document	42AC3A7479FF7176E66A86BB3B7B77F9	67D128E4B5D3CA22CA5C2F95B5EF08B3DC2E9D26	8EA4483715460C866A13E1F0F0484D5D9595C06DA2AA601E1BC6BEC59C3D93F6
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{EF122195-77AA-11EB-90EB-ECF4BBEA1588}.dat	Microsoft Word Document	FA75D466028E223687F37C37D1E073C8	C2340825D7B2E2EB3F2CB970DE1517BB4840C125	1F75B0798C358F7CC69348416F49487476DF6791488079B4576873FC9173A24C
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\imagestore\gee00pr\imagestore.dat	data	3F191763ED4D53E44D641F5AA0A7BF75	4AA5E44314450869971B75C281A9AFD4AEFF7835	C23970A37D64CB96AC8F5722E884B9E8C793EC1C2899EAC929A0D98CF65F270E
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\9HoiMQPNPfT1V5JoFAC5GG7t[1].htm	HTML document, UTF-8 Unicode text, with very long lines	5F266ECA288347CB9624728C6E1A3B42	B3816D522B5922C5B515F99DC63F6F5DB08E99B1	85E5458DF9F36137DAE5A84AFFB3CF3FC5D85196110C63ED7738C448D3E4E188
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\Graphik-RegularItalic-Cy-Gr-Web-a10a70f48489dfe7e0ab1fe80eebaa027610df48049f44cd1724ddcbce3ec509[1].woff	Web Open Font Format, TrueType, length 73940, version 0.0	B17BB2A0EA500EC4C31CBB96080B5AFE	CD5690833C747BD80971393BCE01F6F8B11ED6C9	A10A70F48489DFE7E0AB1FE80EEBAA027610DF48049F44CD1724DDCBCE3EC509
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\Graphik-SemiboldItalic-Cy-Gr-Web-9331e9964cf8f0a6ec536ecafb1ccfb7bde3bad32248b64a51b31142786bc3f3[1].woff	Web Open Font Format, TrueType, length 79628, version 0.0	14A6EDE8AC93E36D96D78FCF696FDAD8	D27CB2D866A51F97431F7B77EB61DC712E20D08F	9331E9964CF8F0A6EC536ECAFB1CCFB7BDE3BAD32248B64A51B31142786BC3F3
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\31AC96_1_0[1].woff	Web Open Font Format, TrueType, length 46052, version 0.0	61F3BC4FC6146CC65961A8C8E917855A	02E25E22CF1C0A26D838A477B1F21BF33B71CA38	AABC1A485E0941F1E2927B6A4BEED2B368431466977483068BBE367DE253A05C
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\desktop-09334a52f8be90f7ab2c69fb59eb0eaf1a2a7c3015b9151b4e641a93284fe9d1[1].css	UTF-8 Unicode (with BOM) text, with very long lines	2D9C48D6330C135EB1224B69A2F0915D	70F5450AD2718BEAD8A3C5163C7401FF256A3BD3	19AEED5179B3110518DD2CD4A88380E3CC73C509038F81C865EDA51537965BD5
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\libraries-a6ab6002c86dc39bd54d[1].js	ASCII text, with very long lines	0697FC0B478CFBD5D146879015679A41	839820629A3134D8D138DC722F128799F48E633B	D7A0E827B469575FDBB6C1FF092E37AEB1E133ACCBCF31950FABB5BCF1B6A554
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\public-e8b06a8ee10d5c07ccf7e91ef27eaae0ca5404d0c4d5ba63c7fc633b29923020[1].js	ASCII text, with very long lines	2C62A42A265EB61425AA177A7EA220B1	749500441C8A8C98A2FBF9C2689FF167DB3709CF	1D2617B41B6304457C8B3741BA2A81410E6DD5B353736242B9B7BA83E38C6634
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\weebly-logo-blue[1].png	PNG image data, 174 x 62, 8-bit colormap, non-interlaced	6907726EDE4FC851BEEAFB7B9FF6EEB9	86B1E9AF4A07E02A426EC9475E37A13DFCEDCB3C	2B37CA56C61B7F2F892D75655CC37699EF847DD9139C94171414E5F92FFD97ED
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\31AC96_0_0[1].eot	Embedded OpenType (EOT)	7C30957EB7A237DF8696E09CBDDE124B	02C7B7953DBB7AE44F086A723DC947BE0E1AEE0B	1DD1965136AE270F9FE9D8C318ACCE7D00F637BF54F128683AFB4DDDA45C1343
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\31AC96_2_0[1].eot	Embedded OpenType (EOT)	12B5BF0F4F082E07C41803E75183EFF8	51C2C509B0DA204C6E4ED1E3F164927BA265263E	8F19E7604EE75D48AB7EB5E8F4D14E35BAB7E79B9E44890828504283C45C213D
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\favicon-32x32[1].png	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced	BB5321E1CB9B06F7573B5134772CD790	CDB34803B4EF038770A4F1B7265112ED7FCC3754	60DC043471398565D32B4966ADAFEEDF804E1F9DA1E4F2E79D11684FA931230F
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\fonts-0adca736826e5341a26aa294e6302bb2284836e97151246bbe094a75e994e2fc[1].css	ASCII text, with very long lines	2F8E5177916AE095C90A065ABAE35143	36261FC1EA18909D8BDC362A3AD914F3C6FF8005	C112991B36561E40E831982DBDE30560A8A4DA1A9F8BBD4426DE35FEA6CA6429
C:\Users\user\AppData\Local\Temp\dat8C2F.tmp	Web Open Font Format, TrueType, length 69114, version 0.0	FCCD32C4512A8C252EB55BAFBA24F472	8DBCF712C1AE5FA5AB4421E85859A62C8D2C76D9	28FC14EF04AB26D01042FE366E72CD7AE3E76EB21FDABBD03319D3737F7459CA
C:\Users\user\AppData\Local\Temp\dat8C4F.tmp	Web Open Font Format, TrueType, length 76130, version 0.0	C0ABC3FF95FA29E0154416B04A69B174	280B46CA89DBF5983D4402BF1C9C2F443F6DF225	2AFD0C6F1A0642526FB2DF8018C801CD21D5A428FD2618D17C0FC5EFE7552335
C:\Users\user\AppData\Local\Temp\~DF8853F3693435E5B4.TMP	data	858BEFEC366699EDC75E50AC6E588333	265CAA3BBEA3B644D7E03A7E8737474011DBF3C4	9E60778922D89049BAB884297A4B43C2C1DA1DF394F6CAE2C0608A78CFB71A21
C:\Users\user\AppData\Local\Temp\~DFA00F9F0FC6A06177.TMP	data	AB889A32AB9ACD33E816C2422337C69A	1190C6B34DED2D295827C2A88310D10A8B90B59B	4D6EC54B8D244E63B0F04FBE2B97402A3DF722560AD12F218665BA440F4CEFDA
C:\Users\user\AppData\Local\Temp\~DFA5A270FBA6D61E89.TMP	data	3E738BF0A9609BCA146D433358CA3E1D	7DEA6B70BC34DBF15CC708134ED1C739B171F411	1AAF12C7D435ADBBFFAA6EA363B21718C0393DACF39FCD7D02D33E58C930008F

Analysis Report https://public.3.basecamp.com/p/9HoiMQPNPfT1V5JoFAC5GG7t

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection:

Compliance:

Networking:

System Summary:

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted Domains

Contacted URLs