Analysis Report https://polyscience-app.com/PolyScience-Images/SharedImage-View/Oauth/0zzdgkl7q1p2aaklyhr94v7p.html?authorize&client_id=75HH9&redirect_uri=https%3A%2F%2F16148896541f94f7f8002d2a8c2b5af6f7f6e99e941f94f7f8002d2a8c2b5af6f7f6e99e941f94f7f8002d2a8c2b5af6f7f6e99e941f94f7f8002d2a8c2b5af6f7f6e99e941f94f7f8002d2a8c2b5af6f7f6e99e94

Overview

General Information

Sample URL:	https://polyscience-app.com/PolyScience-Images/SharedImage-View/Oauth/0zzdgkl7q1p2aaklyhr94v7p.html?authorize&client_id=75HH9&redirect_uri=https%3A%2F%2F16148896541f94f7f8002d2a8c2b5af6f7f6e99e941f94f7f8002d2a8c2b5af6f7f6e99e941f94f7f8002d2a8c2b5af6f7f6e99e941f94f7f8002d2a8c2b5af6f7f6e99e941f94f7f8002d2a8c2b5af6f7f6e99e94
Analysis ID:	363565
Infos:
Most interesting Screenshot:

Detection

HTMLPhisher

Score:	60
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Phishing site detected (based on favicon image match)

Yara detected HtmlPhish_10

Phishing site detected (based on logo template match)

HTML body contains low number of good links

No HTML title found

Classification

Signatures

Phishing:

Phishing site detected (based on favicon image match)

Source: https://polyscience-app.com/PolyScience-Images/SharedImage-View/Oauth/0zzdgkl7q1p2aaklyhr94v7p.html?authorize&client_id=75HH9&redirect_uri=https%3A%2F%2F16148896541f94f7f8002d2a8c2b5af6f7f6e99e941f94f7f8002d2a8c2b5af6f7f6e99e941f94f7f8002d2a8c2b5af6f7f6e99e941f94f7f8002d2a8c2b5af6f7f6e99e941f94f7f8002d2a8c2b5af6f7f6e99e94

Matcher: Template: microsoft matched with high similarity

Yara detected HtmlPhish_10

Source: Yara match

File source: 878411.pages.csv, type: HTML

Phishing site detected (based on logo template match)

Matcher: Template: microsoft matched

HTML body contains low number of good links

Source: https://polyscience-app.com/PolyScience-Images/SharedImage-View/Oauth/0zzdgkl7q1p2aaklyhr94v7p.html?authorize&client_id=75HH9&redirect_uri=https%3A%2F%2F16148896541f94f7f8002d2a8c2b5af6f7f6e99e941f94f7f8002d2a8c2b5af6f7f6e99e941f94f7f8002d2a8c2b5af6f7f6e99e941f94f7f8002d2a8c2b5af6f7f6e99e941f94f7f8002d2a8c2b5af6f7f6e99e94	HTTP Parser: Number of links: 0
Source: https://polyscience-app.com/PolyScience-Images/SharedImage-View/Oauth/0zzdgkl7q1p2aaklyhr94v7p.html?authorize&client_id=75HH9&redirect_uri=https%3A%2F%2F16148896541f94f7f8002d2a8c2b5af6f7f6e99e941f94f7f8002d2a8c2b5af6f7f6e99e941f94f7f8002d2a8c2b5af6f7f6e99e941f94f7f8002d2a8c2b5af6f7f6e99e941f94f7f8002d2a8c2b5af6f7f6e99e94	HTTP Parser: Number of links: 0

No HTML title found

Source: https://polyscience-app.com/PolyScience-Images/SharedImage-View/Oauth/0zzdgkl7q1p2aaklyhr94v7p.html?authorize&client_id=75HH9&redirect_uri=https%3A%2F%2F16148896541f94f7f8002d2a8c2b5af6f7f6e99e941f94f7f8002d2a8c2b5af6f7f6e99e941f94f7f8002d2a8c2b5af6f7f6e99e941f94f7f8002d2a8c2b5af6f7f6e99e941f94f7f8002d2a8c2b5af6f7f6e99e94	HTTP Parser: HTML title missing
Source: https://polyscience-app.com/PolyScience-Images/SharedImage-View/Oauth/0zzdgkl7q1p2aaklyhr94v7p.html?authorize&client_id=75HH9&redirect_uri=https%3A%2F%2F16148896541f94f7f8002d2a8c2b5af6f7f6e99e941f94f7f8002d2a8c2b5af6f7f6e99e941f94f7f8002d2a8c2b5af6f7f6e99e941f94f7f8002d2a8c2b5af6f7f6e99e941f94f7f8002d2a8c2b5af6f7f6e99e94	HTTP Parser: HTML title missing

Source: https://polyscience-app.com/PolyScience-Images/SharedImage-View/Oauth/0zzdgkl7q1p2aaklyhr94v7p.html?authorize&client_id=75HH9&redirect_uri=https%3A%2F%2F16148896541f94f7f8002d2a8c2b5af6f7f6e99e941f94f7f8002d2a8c2b5af6f7f6e99e941f94f7f8002d2a8c2b5af6f7f6e99e941f94f7f8002d2a8c2b5af6f7f6e99e941f94f7f8002d2a8c2b5af6f7f6e99e94	HTTP Parser: No <meta name="author".. found
Source: https://polyscience-app.com/PolyScience-Images/SharedImage-View/Oauth/0zzdgkl7q1p2aaklyhr94v7p.html?authorize&client_id=75HH9&redirect_uri=https%3A%2F%2F16148896541f94f7f8002d2a8c2b5af6f7f6e99e941f94f7f8002d2a8c2b5af6f7f6e99e941f94f7f8002d2a8c2b5af6f7f6e99e941f94f7f8002d2a8c2b5af6f7f6e99e941f94f7f8002d2a8c2b5af6f7f6e99e94	HTTP Parser: No <meta name="author".. found

Source: https://polyscience-app.com/PolyScience-Images/SharedImage-View/Oauth/0zzdgkl7q1p2aaklyhr94v7p.html?authorize&client_id=75HH9&redirect_uri=https%3A%2F%2F16148896541f94f7f8002d2a8c2b5af6f7f6e99e941f94f7f8002d2a8c2b5af6f7f6e99e941f94f7f8002d2a8c2b5af6f7f6e99e941f94f7f8002d2a8c2b5af6f7f6e99e941f94f7f8002d2a8c2b5af6f7f6e99e94	HTTP Parser: No <meta name="copyright".. found
Source: https://polyscience-app.com/PolyScience-Images/SharedImage-View/Oauth/0zzdgkl7q1p2aaklyhr94v7p.html?authorize&client_id=75HH9&redirect_uri=https%3A%2F%2F16148896541f94f7f8002d2a8c2b5af6f7f6e99e941f94f7f8002d2a8c2b5af6f7f6e99e941f94f7f8002d2a8c2b5af6f7f6e99e941f94f7f8002d2a8c2b5af6f7f6e99e941f94f7f8002d2a8c2b5af6f7f6e99e94	HTTP Parser: No <meta name="copyright".. found

Compliance:

Uses new MSVCR Dlls

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll

Jump to behavior

Uses secure TLS version for HTTPS connections

Source: unknown	HTTPS traffic detected: 13.66.56.74:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.66.56.74:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 192.229.221.185:443 -> 192.168.2.4:49746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 192.229.221.185:443 -> 192.168.2.4:49748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 146.59.152.166:443 -> 192.168.2.4:49747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 146.59.152.166:443 -> 192.168.2.4:49749 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.18.94:443 -> 192.168.2.4:49751 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.18.94:443 -> 192.168.2.4:49750 version: TLS 1.2

Networking:

Source: unknown

DNS traffic detected: queries for: polyscience-app.com

Source: jquery-3.3.1[1].js.2.dr	String found in binary or memory: http://jquery.org/license
Source: popper.min[1].js.2.dr	String found in binary or memory: http://opensource.org/licenses/MIT).
Source: imagestore.dat.2.dr	String found in binary or memory: https://aadcdn.msauth.net/ests/2.1/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico
Source: imagestore.dat.2.dr	String found in binary or memory: https://aadcdn.msauth.net/ests/2.1/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico~
Source: imagestore.dat.2.dr	String found in binary or memory: https://aadcdn.msauth.net/ests/2.1/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico~(
Source: jquery-3.3.1[1].js.2.dr	String found in binary or memory: https://bugs.chromium.org/p/chromium/issues/detail?id=378607
Source: jquery-3.3.1[1].js.2.dr	String found in binary or memory: https://bugs.chromium.org/p/chromium/issues/detail?id=449857
Source: jquery-3.3.1[1].js.2.dr	String found in binary or memory: https://bugs.chromium.org/p/chromium/issues/detail?id=470258
Source: jquery-3.3.1[1].js.2.dr	String found in binary or memory: https://bugs.chromium.org/p/chromium/issues/detail?id=589347
Source: jquery-3.3.1[1].js.2.dr	String found in binary or memory: https://bugs.jquery.com/ticket/12359
Source: jquery-3.3.1[1].js.2.dr	String found in binary or memory: https://bugs.jquery.com/ticket/13378
Source: jquery-3.3.1[1].js.2.dr	String found in binary or memory: https://bugs.webkit.org/show_bug.cgi?id=136851
Source: jquery-3.3.1[1].js.2.dr	String found in binary or memory: https://bugs.webkit.org/show_bug.cgi?id=137337
Source: jquery-3.3.1[1].js.2.dr	String found in binary or memory: https://bugs.webkit.org/show_bug.cgi?id=29084
Source: jquery-3.3.1[1].js.2.dr	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=687787
Source: jquery-3.3.1[1].js.2.dr	String found in binary or memory: https://developer.mozilla.org/en-US/docs/CSS/display
Source: jquery-3.3.1[1].js.2.dr	String found in binary or memory: https://drafts.csswg.org/cssom/#common-serializing-idioms
Source: jquery-3.3.1[1].js.2.dr	String found in binary or memory: https://drafts.csswg.org/cssom/#resolved-values
Source: free.min[1].css.2.dr, free-fa-solid-900[1].eot.2.dr	String found in binary or memory: https://fontawesome.com
Source: free.min[1].css.2.dr	String found in binary or memory: https://fontawesome.com/license/free
Source: free-fa-solid-900[1].eot.2.dr, free-fa-regular-400[1].eot.2.dr	String found in binary or memory: https://fontawesome.comhttps://fontawesome.comFont
Source: css[1].css.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/archivonarrow/v12/tss0ApVBdCYD5Q7hcxTE1ArZ0bbwiXo.woff)
Source: bootstrap.min[1].js.2.dr, bootstrap.min[1].css.2.dr	String found in binary or memory: https://getbootstrap.com)
Source: jquery-3.3.1[1].js.2.dr	String found in binary or memory: https://github.com/eslint/eslint/issues/3229
Source: jquery-3.3.1[1].js.2.dr	String found in binary or memory: https://github.com/eslint/eslint/issues/6125
Source: jquery-3.3.1[1].js.2.dr	String found in binary or memory: https://github.com/jquery/jquery/pull/557)
Source: jquery-3.3.1[1].js.2.dr	String found in binary or memory: https://github.com/jquery/sizzle/pull/225
Source: jquery-3.3.1[1].js.2.dr	String found in binary or memory: https://github.com/jrburke/requirejs/wiki/Updating-existing-libraries#wiki-anon
Source: bootstrap.min[1].js.2.dr, bootstrap.min[1].css.2.dr	String found in binary or memory: https://github.com/twbs/bootstrap/blob/master/LICENSE)
Source: bootstrap.min[1].js.2.dr	String found in binary or memory: https://github.com/twbs/bootstrap/graphs/contributors)
Source: jquery-3.3.1[1].js.2.dr	String found in binary or memory: https://html.spec.whatwg.org/#strip-and-collapse-whitespace
Source: jquery-3.3.1[1].js.2.dr	String found in binary or memory: https://html.spec.whatwg.org/multipage/forms.html#category-listed
Source: jquery-3.3.1[1].js.2.dr	String found in binary or memory: https://html.spec.whatwg.org/multipage/forms.html#concept-fe-disabled
Source: jquery-3.3.1[1].js.2.dr	String found in binary or memory: https://html.spec.whatwg.org/multipage/forms.html#concept-option-disabled
Source: jquery-3.3.1[1].js.2.dr	String found in binary or memory: https://html.spec.whatwg.org/multipage/scripting.html#selector-disabled
Source: jquery-3.3.1[1].js.2.dr	String found in binary or memory: https://html.spec.whatwg.org/multipage/scripting.html#selector-enabled
Source: jquery-3.3.1[1].js.2.dr	String found in binary or memory: https://html.spec.whatwg.org/multipage/syntax.html#attributes-2
Source: jquery-3.3.1[1].js.2.dr	String found in binary or memory: https://infra.spec.whatwg.org/#strip-and-collapse-ascii-whitespace
Source: jquery-3.3.1[1].js.2.dr	String found in binary or memory: https://jquery.com/
Source: jquery-3.3.1[1].js.2.dr	String found in binary or memory: https://jquery.org/license
Source: jquery-3.3.1[1].js.2.dr	String found in binary or memory: https://jsperf.com/getall-vs-sizzle/2
Source: jquery-3.3.1[1].js.2.dr	String found in binary or memory: https://jsperf.com/thor-indexof-vs-for/5
Source: 585b051251[1].js.2.dr	String found in binary or memory: https://ka-f.fontawesome.com
Source: 585b051251[1].js.2.dr	String found in binary or memory: https://kit.fontawesome.com
Source: {B54B0312-7D28-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://polyscience-app.com/PolyScience-Images/SharedImage-View/Oauth/0zzdgkl7q1p2aaklyhr94v7p.html?
Source: jquery-3.3.1[1].js.2.dr	String found in binary or memory: https://promisesaplus.com/#point-48
Source: jquery-3.3.1[1].js.2.dr	String found in binary or memory: https://promisesaplus.com/#point-54
Source: jquery-3.3.1[1].js.2.dr	String found in binary or memory: https://promisesaplus.com/#point-57
Source: jquery-3.3.1[1].js.2.dr	String found in binary or memory: https://promisesaplus.com/#point-59
Source: jquery-3.3.1[1].js.2.dr	String found in binary or memory: https://promisesaplus.com/#point-61
Source: jquery-3.3.1[1].js.2.dr	String found in binary or memory: https://promisesaplus.com/#point-64
Source: jquery-3.3.1[1].js.2.dr	String found in binary or memory: https://promisesaplus.com/#point-75
Source: jquery-3.3.1[1].js.2.dr	String found in binary or memory: https://sizzlejs.com/
Source: jquery-3.3.1[1].js.2.dr	String found in binary or memory: https://web.archive.org/web/20100324014747/http://blindsignals.com/index.php/2009/07/jquery-delay/
Source: jquery-3.3.1[1].js.2.dr	String found in binary or memory: https://web.archive.org/web/20141116233347/http://fluidproject.org/blog/2008/01/09/getting-setting-a

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746

Source: unknown	HTTPS traffic detected: 13.66.56.74:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.66.56.74:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 192.229.221.185:443 -> 192.168.2.4:49746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 192.229.221.185:443 -> 192.168.2.4:49748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 146.59.152.166:443 -> 192.168.2.4:49747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 146.59.152.166:443 -> 192.168.2.4:49749 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.18.94:443 -> 192.168.2.4:49751 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.18.94:443 -> 192.168.2.4:49750 version: TLS 1.2

System Summary:

Source: classification engine

Classification label: mal60.phis.win@3/24@10/4

Source: C:\Program Files\internet explorer\iexplore.exe

File created: C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{B54B0310-7D28-11EB-90EB-ECF4BBEA1588}.dat

Jump to behavior

Source: C:\Program Files\internet explorer\iexplore.exe

File created: C:\Users\user\AppData\Local\Temp\~DF61F363B5B55EB848.TMP

Jump to behavior

Source: C:\Program Files\internet explorer\iexplore.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: unknown	Process created: C:\Program Files\internet explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Source: unknown	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:6536 CREDAT:17410 /prefetch:2
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:6536 CREDAT:17410 /prefetch:2	Jump to behavior

Source: C:\Program Files\internet explorer\iexplore.exe	Automated click: Next
Source: C:\Program Files\internet explorer\iexplore.exe	Automated click: Next

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll

Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
146.59.152.166	i.ibb.co	Norway	16276	OVHFR	false
192.229.221.185	cs1227.wpc.alphacdn.net	United States	15133	EDGECASTUS	false
104.16.18.94	cdnjs.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
13.66.56.74	polyscience-app.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false

Contacted Domains

Name	IP	Active
polyscience-app.com	13.66.56.74	true
cdnjs.cloudflare.com	104.16.18.94	true
cs1227.wpc.alphacdn.net	192.229.221.185	true
i.ibb.co	146.59.152.166	true
logincdn.msauth.net	unknown	unknown
ka-f.fontawesome.com	unknown	unknown
code.jquery.com	unknown	unknown
kit.fontawesome.com	unknown	unknown
maxcdn.bootstrapcdn.com	unknown	unknown
aadcdn.msauth.net	unknown	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://polyscience-app.com/PolyScience-Images/SharedImage-View/Oauth/0zzdgkl7q1p2aaklyhr94v7p.html?authorize&client_id=75HH9&redirect_uri=https%3A%2F%2F16148896541f94f7f8002d2a8c2b5af6f7f6e99e941f94f7f8002d2a8c2b5af6f7f6e99e941f94f7f8002d2a8c2b5af6f7f6e99e941f94f7f8002d2a8c2b5af6f7f6e99e941f94f7f8002d2a8c2b5af6f7f6e99e94	true		unknown

ID:	363565
Product:	CloudBasic
Start time:	21:31:34
Start date:	04.03.2021
Cookbook:	browseurl.jbs
System description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Architecture:	WINDOWS

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{B54B0310-7D28-11EB-90EB-ECF4BBEA1588}.dat	Microsoft Word Document	F7029FDAC527579B7E174BE01B02CF7D	461A42D4609B92476AF49BB7784C793FB90C5DC7	516F4B4A564ABD4A3613D3A15042ECBB29444E667110139EA6B7917436A749C8
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{B54B0312-7D28-11EB-90EB-ECF4BBEA1588}.dat	Microsoft Word Document	A64E9A66526D29A4AEE2B3D2CBA450E6	D05585D38E86DE47B0FE9A637CAD335999A26DB1	FDDA00B22AC09156D35F19274ECE59801DF1E30B2F545C71CFCBF3C778F62614
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{BBAC2C7A-7D28-11EB-90EB-ECF4BBEA1588}.dat	Microsoft Word Document	AD49420BD5704FC69A85F33A9B348D9A	77A46CA7215C3D94C867D321CA5AAA8CE282D303	A1EAE89E1956C82B1FB4DF8AFFA6F4538ADBA5E2B487D27E40CB215EC792AB1A
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\imagestore\gee00pr\imagestore.dat	data	05DB3205730D5081B05AEBFEE9E349C0	7DD7F11A2AF9185CDB39640FC9B913CF59BFAFA9	531D750C866DD9E898C5AF5A8FFFF12E4A3EBF7368D19894337F4EF1FFE4FC48
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\0zzdgkl7q1p2aaklyhr94v7p[1].htm	HTML document, ASCII text, with very long lines, with CRLF line terminators	D1B4F7ECD2FC70F62C4B74126BFC2D8E	A7C0D83D6DC3676AD6ADAE0643405D82CE88CDDF	3CA413AE0C290373446DE148AECFE2622FC733B67EFC6C56AA1DC2B193510465
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\bootstrap.min[1].css	ASCII text, with very long lines	450FC463B8B1A349DF717056FBB3E078	895125A4522A3B10EE7ADA06EE6503587CBF95C5	2C0F3DCFE93D7E380C290FE4AB838ED8CADFF1596D62697F5444BE460D1F876D
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\free-fa-solid-900[1].eot	Embedded OpenType (EOT), Font Awesome 5 Free Solid family	AD5381B40F2857CE48DC73585FC92294	B404BB9916EDFD272560C27CFD09C032EC9F9B96	2D45F4A3844BEFB918111DF65049A4FA71577D5E8FF009934B62E647E4702AB0
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\free.min[1].css	ASCII text, with very long lines	4ECC071B77D6B1790FA9FB8A5173F972	B44FCBAAC4F3AA7381D71DE20064AC84B0B729D1	8C7BBA7DEB64FF95E98F7AC8CD0D3B675A4BCF02F302E57EDC5A1D6FA3D6CF94
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\popper.min[1].js	ASCII text, with very long lines	70D3FDA195602FE8B75E0097EED74DDE	C3B977AA4B8DFB69D651E07015031D385DED964B	A52F7AA54D7BCAAFA056EE0A050262DFC5694AE28DEE8B4CAC3429AF37FF0D66
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\585b051251[1].js	ASCII text, with very long lines	4B900F0AF3BBDA85E1077C8EC8C83831	7E7015965195F25AFA3A47BE2108278AD6A0A4AC	7943D6D067DB8587E9FB675F0D2CC78D6C90C91B187CF8642A3F52FF91381685
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\favicon_a_eupayfgghqiai7k9sol6lg2[1].ico	MS Windows icon resource - 6 icons, 128x128, 16 colors, 72x72, 16 colors	12E3DAC858061D088023B2BD48E2FA96	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\jquery-3.1.1.min[1].js	ASCII text, with very long lines	E071ABDA8FE61194711CFC2AB99FE104	F647A6D37DC4CA055CED3CF64BBC1F490070ACBA	85556761A8800D14CED8FCD41A6B8B26BF012D44A318866C0D81A62092EFD9BF
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd[1].svg	SVG Scalable Vector Graphics image	EE5C8D9FB6248C938FD0DC19370E90BD	D01A22720918B781338B5BBF9202B241A5F99EE4	04D29248EE3A13A074518C93A18D6EFC491BF1F298F9B87FC989A6AE4B9FAD7A
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\bg5[1].jpg	JPEG image data, progressive, precision 8, 640x360, frames 3	758ECED283C775E80880D5A62BD3A68C	DCF807EC4EE9E979A221B55DD3070F717FC3AC9B	A8A114B350D75CFF132058A9685D8491E92E21D2758606C4353500A553CBEE98
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\free-fa-regular-400[1].eot	Embedded OpenType (EOT), Font Awesome 5 Free Regular family	73570FCA80D5237954C19C20BDA58A70	E27F09071CA6B858A1B96B1CD02B2B34BCE85178	75BAC9C568E4B2DF8C25F96513A92FA4740D4B11E58FB0ADB88E2F4DADC7FFCD
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\jquery-3.2.1.slim.min[1].js	ASCII text, with very long lines	5F48FC77CAC90C4778FA24EC9C57F37D	9E89D1515BC4C371B86F4CB1002FD8E377C1829F	9365920887B11B33A3DC4BA28A0F93951F200341263E3B9CEFD384798E4BE398
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\jquery-3.3.1[1].js	ASCII text	6A07DA9FAE934BAF3F749E876BBFDD96	46A436EBA01C79ACDB225757ED80BF54BAD6416B	D8AA24ECC6CECB1A60515BC093F1C9DA38A0392612D9AB8AE0F7F36E6EEE1FAD
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\bootstrap.min[1].js	ASCII text, with very long lines	14D449EB8876FA55E1EF3C2CC52B0C17	A9545831803B1359CFEED47E3B4D6BAE68E40E99	E7ED36CEEE5450B4243BBC35188AFABDFB4280C7C57597001DE0ED167299B01B
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\css[1].css	ASCII text	72C5D331F2135E52DA2A95F7854049A3	572F349BB65758D377CCBAE434350507341ACD7B	C3A12D7E8F6B2B1F5E4CD0C9938DFC79532AEF90802B424EE910093F156586DA
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\free-v4-shims.min[1].css	ASCII text, with very long lines	1848E71668F42835079E5FA2AF6CF4A8	6AE345E2FEB8C2A524E7CF9E22A3A87BAEE60593	D7CC3C57F9BDA4C6DCB83BB3C19F2F2AA86ECEC6274E243CD4EC315AE8E30101
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\jquery.min[1].js	ASCII text, with very long lines	2F6B11A7E914718E0290410E85366FE9	69BB69E25CA7D5EF0935317584E6153F3FD9A88C	05B85D96F41FFF14D8F608DAD03AB71E2C1017C2DA0914D7C59291BAD7A54F8E
C:\Users\user\AppData\Local\Temp\~DF61F363B5B55EB848.TMP	data	C4AF435217017F9D83946E358C4B71AA	0DCAE09B7D817A57BF9FBAE7D66FA1FE884B18B8	AB8AC58E05B6513F033E118BBAF8FCAADE8100C3E23C0E2392DBCB2B1525108F
C:\Users\user\AppData\Local\Temp\~DF873B1047B545AACB.TMP	data	46B4ACC5173434BFCD5D73C7CBC767FF	1990E5224D340DB83BBD86E37BD5563DE8059C27	D782828BC478434C5DAF3BA0F0742BD8B87A442620481655C39F2ED3428B5A33
C:\Users\user\AppData\Local\Temp\~DFF0037413C6601648.TMP	data	53006C9962728B3FE777953AAE8063B3	68767E54C545C8E83C4BD299507FF6CCEA81E074	9F546BE16F18E792BA4967D4279DC73EC7B58DC8BFBF31B6004B35EFF44D7522

Overview

General Information

Detection

Signatures

Classification

Signatures

Phishing:

Compliance:

Networking:

System Summary:

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted Domains

Contacted URLs