It went to an address on a software wallet I rarely use, first. Then to a couple known clean addresses. Unfortunately I downloaded the app so long ago I no longer can get a link. All I remember is the page looked like GitHub and I got lazy and didn’t check the hash first.

Here is the unauthorized TX that got broadcast:

Unauthorized TX Attempt
RX address: bc1qlfqvh9hla5sa64yfn9jsch54fqf09g52ja8t4r
TXID: 87be9389913a86ed6e1e43e57755ac545a07b51dde940a6dd6e7d654cd39bb03