Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
Firstontario_FAX_832.eml

Overview

General Information

Sample name:Firstontario_FAX_832.eml
Analysis ID:1415458
MD5:1ca56b32e51905b7e7470609c4107eb8
SHA1:4c4e4f8938adad07ace5b899da9c7ab9c1735ed2
SHA256:a51734a0b5dcb860f7334361a319fe61ae1ff9c039f1131aa2984ccd7d6366e4
Infos:

Detection

HTMLPhisher
Score:52
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Yara detected HtmlPhish10
Phishing site detected (based on image similarity)
HTML body contains low number of good links
HTML page contains hidden URLs or javascript code
HTML title does not match URL
Invalid 'forgot password' link found
Queries the volume information (name, serial number etc) of a device
Sigma detected: Office Autorun Keys Modification
Stores files to the Windows start menu directory
Tries to load missing DLLs

Classification

Process Tree

  • System is w10x64_ra
  • OUTLOOK.EXE (PID: 7000 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\user\Desktop\Firstontario_FAX_832.eml" MD5: 91A5292942864110ED734005B7E005C0)
    • ai.exe (PID: 7152 cmdline: "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "1B012E90-C62A-4E67-93B8-DD7D3EE374DC" "E66E5A19-C31A-465A-94B9-D45E5B6D3E97" "7000" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx" MD5: EC652BEDD90E089D9406AFED89A8A8BD)
    • chrome.exe (PID: 6480 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\MUT0AOV0\Voice_832.html MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
      • chrome.exe (PID: 3020 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 --field-trial-handle=1944,i,12091048892103669513,16072004547865988003,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
  • cleanup

Yara Signatures

HTML

SourceRuleDescriptionAuthorStrings
3.5.pages.csvJoeSecurity_HtmlPhish_10Yara detected HtmlPhish_10Joe Security
    3.6.pages.csvJoeSecurity_HtmlPhish_10Yara detected HtmlPhish_10Joe Security
      3.5.pages.csvJoeSecurity_HtmlPhish_10Yara detected HtmlPhish_10Joe Security

        Sigma Signatures

        Sigma detected: Office Autorun Keys Modification
        Source: Registry Key setAuthor: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 , EventID: 13, EventType: SetValue, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE, ProcessId: 7000, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Addins\OneNote.OutlookAddin\1

        Snort Signatures

        ⊘No Snort rule has matched

        Joe Sandbox Signatures

        Click to jump to signature section

        Show All Signature Results

        Phishing

        barindex
        Yara detected HtmlPhish10
        Source: Yara matchFile source: 3.5.pages.csv, type: HTML
        Source: Yara matchFile source: 3.6.pages.csv, type: HTML
        Source: Yara matchFile source: 3.5.pages.csv, type: HTML
        Phishing site detected (based on image similarity)
        Source: https://freelanceimaging.com/77624fc8e83077b92433578af825365d6601eb90ad4f4PAS77624fc8e83077b92433578af825365d6601eb90ad4f6Matcher: Found strong image similarity, brand: MICROSOFT
        Source: https://freelanceimaging.com/77624fc8e83077b92433578af825365d6601eb90ad4f4PAS77624fc8e83077b92433578af825365d6601eb90ad4f6HTTP Parser: Number of links: 0
        Source: https://freelanceimaging.com/Mjohn.doran@firstontario.comHTTP Parser: Base64 decoded: https://freelanceimaging.com/Mjohn.doran@firstontario.com
        Source: https://freelanceimaging.com/77624fc8e83077b92433578af825365d6601eb90ad4f4PAS77624fc8e83077b92433578af825365d6601eb90ad4f6HTTP Parser: Title: 65333d4af09ca8e33463d1a52a400bbf6601eb90ad35c does not match URL
        Source: https://freelanceimaging.com/77624fc8e83077b92433578af825365d6601eb90ad4f4PAS77624fc8e83077b92433578af825365d6601eb90ad4f6HTTP Parser: Invalid link: FJoJrJgJoJtJ JmJyJ JpJaJsJsJwJoJrJd
        Source: https://freelanceimaging.com/77624fc8e83077b92433578af825365d6601eb90ad4f4PAS77624fc8e83077b92433578af825365d6601eb90ad4f6HTTP Parser: <input type="password" .../> found
        Source: https://freelanceimaging.com/Mjohn.doran@firstontario.comHTTP Parser: No favicon
        Source: https://freelanceimaging.com/Mjohn.doran@firstontario.comHTTP Parser: No favicon
        Source: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/pux0l/0x4AAAAAAADnPIDROrmt1Wwj/light/normalHTTP Parser: No favicon
        Source: https://freelanceimaging.com/Mjohn.doran@firstontario.com?__cf_chl_tk=19l4S6ZOW8h1YL5wMSaq_BKasXsGl2kkUBB4GqKFlJU-1711401860-0.0.1.1-1642HTTP Parser: No favicon
        Source: https://freelanceimaging.com/77624fc8e83077b92433578af825365d6601eb90ad4f4PAS77624fc8e83077b92433578af825365d6601eb90ad4f6HTTP Parser: No favicon
        Source: https://freelanceimaging.com/77624fc8e83077b92433578af825365d6601eb90ad4f4PAS77624fc8e83077b92433578af825365d6601eb90ad4f6HTTP Parser: No favicon
        Source: https://freelanceimaging.com/77624fc8e83077b92433578af825365d6601eb90ad4f4PAS77624fc8e83077b92433578af825365d6601eb90ad4f6HTTP Parser: No favicon
        Source: https://freelanceimaging.com/77624fc8e83077b92433578af825365d6601eb90ad4f4PAS77624fc8e83077b92433578af825365d6601eb90ad4f6HTTP Parser: No <meta name="author".. found
        Source: https://freelanceimaging.com/77624fc8e83077b92433578af825365d6601eb90ad4f4PAS77624fc8e83077b92433578af825365d6601eb90ad4f6HTTP Parser: No <meta name="author".. found
        Source: https://freelanceimaging.com/77624fc8e83077b92433578af825365d6601eb90ad4f4PAS77624fc8e83077b92433578af825365d6601eb90ad4f6HTTP Parser: No <meta name="copyright".. found
        Source: https://freelanceimaging.com/77624fc8e83077b92433578af825365d6601eb90ad4f4PAS77624fc8e83077b92433578af825365d6601eb90ad4f6HTTP Parser: No <meta name="copyright".. found
        Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
        Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
        Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
        Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
        Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
        Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
        Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
        Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
        Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
        Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
        Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
        Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
        Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
        Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
        Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
        Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
        Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
        Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
        Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
        Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
        Source: unknownDNS traffic detected: queries for: freelanceimaging.com
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49744
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49743
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49742
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49741
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49740
        Source: unknownNetwork traffic detected: HTTP traffic on port 49766 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49743 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49746 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49769 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49720 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49739
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49738
        Source: unknownNetwork traffic detected: HTTP traffic on port 49717 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49737
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49736
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49735
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49734
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49732
        Source: unknownNetwork traffic detected: HTTP traffic on port 49732 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49728 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49749 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49763 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49752 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49728
        Source: unknownNetwork traffic detected: HTTP traffic on port 49714 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49726
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49725
        Source: unknownNetwork traffic detected: HTTP traffic on port 49735 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49724
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49723
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49721
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49720
        Source: unknownNetwork traffic detected: HTTP traffic on port 49748 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49760 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49745 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49719
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49718
        Source: unknownNetwork traffic detected: HTTP traffic on port 49751 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49717
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49716
        Source: unknownNetwork traffic detected: HTTP traffic on port 49715 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49715
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49714
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49713
        Source: unknownNetwork traffic detected: HTTP traffic on port 49757 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49734 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49726 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49740 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49765 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49768 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49723 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49754 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49737 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49771 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49762 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49713 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49736 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49759 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49753 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49771
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49770
        Source: unknownNetwork traffic detected: HTTP traffic on port 49724 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49742 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49767 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49721 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49718 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49769
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49768
        Source: unknownNetwork traffic detected: HTTP traffic on port 49739 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49756 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49767
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49766
        Source: unknownNetwork traffic detected: HTTP traffic on port 49758 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49765
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49764
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49763
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49762
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49760
        Source: unknownNetwork traffic detected: HTTP traffic on port 49725 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49741 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49764 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49770 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49719 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49759
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49758
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49757
        Source: unknownNetwork traffic detected: HTTP traffic on port 49738 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49755 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49756
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49755
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49754
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49753
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49752
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49751
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49750
        Source: unknownNetwork traffic detected: HTTP traffic on port 49747 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49744 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49716 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49750 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49749
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49748
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49747
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49746
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49745
        Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: apphelp.dll
        Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: c2r64.dll
        Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: userenv.dll
        Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: msasn1.dll
        Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: kernel.appcore.dll
        Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: cryptsp.dll
        Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: rsaenh.dll
        Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: cryptbase.dll
        Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: gpapi.dll
        Source: classification engineClassification label: mal52.phis.winEML@22/36@20/76
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEFile created: C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEFile created: C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20240325T2222480131-7000.etl
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEFile read: C:\Users\desktop.ini
        Source: unknownProcess created: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\user\Desktop\Firstontario_FAX_832.eml"
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "1B012E90-C62A-4E67-93B8-DD7D3EE374DC" "E66E5A19-C31A-465A-94B9-D45E5B6D3E97" "7000" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "1B012E90-C62A-4E67-93B8-DD7D3EE374DC" "E66E5A19-C31A-465A-94B9-D45E5B6D3E97" "7000" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\MUT0AOV0\Voice_832.html
        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 --field-trial-handle=1944,i,12091048892103669513,16072004547865988003,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\MUT0AOV0\Voice_832.html
        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 --field-trial-handle=1944,i,12091048892103669513,16072004547865988003,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{F959DBBB-3867-41F2-8E5F-3B8BEFAA81B3}\InprocServer32
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEWindow found: window name: SysTabControl32
        Source: Window RecorderWindow detected: More than 3 window changes detected
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Common
        Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
        Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
        Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
        Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
        Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
        Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
        Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information queried: ProcessInformation
        Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeQueries volume information: C:\Program Files (x86)\Microsoft Office\root\Office16\AI\WordCombinedFloatieLreOnline.onnx VolumeInformation
        Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

        Mitre Att&ck Matrix

        ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
        Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management Instrumentation1
        DLL Side-Loading        		1
        Process Injection        		1
        Masquerading        		OS Credential Dumping1
        Process Discovery        		Remote ServicesData from Local System2
        Encrypted Channel        		Exfiltration Over Other Network MediumAbuse Accessibility Features
        CredentialsDomainsDefault AccountsScheduled Task/Job1
        Registry Run Keys / Startup Folder        		1
        DLL Side-Loading        		1
        Process Injection        		LSASS Memory1
        File and Directory Discovery        		Remote Desktop ProtocolData from Removable Media1
        Non-Application Layer Protocol        		Exfiltration Over BluetoothNetwork Denial of Service
        Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)1
        Registry Run Keys / Startup Folder        		1
        DLL Side-Loading        		Security Account Manager12
        System Information Discovery        		SMB/Windows Admin SharesData from Network Shared Drive2
        Application Layer Protocol        		Automated ExfiltrationData Encrypted for Impact

        Screenshots

        Thumbnails

        This section contains all screenshots as thumbnails, including those not shown in the slideshow.


        windows-stand

        Antivirus, Machine Learning and Genetic Malware Detection

        Initial Sample

        ⊘No Antivirus matches

        Dropped Files

        ⊘No Antivirus matches

        Unpacked PE Files

        ⊘No Antivirus matches

        Domains

        ⊘No Antivirus matches

        URLs

        ⊘No Antivirus matches

        Domains and IPs

        Contacted Domains

        NameIPActiveMaliciousAntivirus DetectionReputation
        a.nel.cloudflare.com
        		35.190.80.1
        		truefalse
          		high
          sni1gl.wpc.upsiloncdn.net
          		152.195.19.97
          		truefalse
            		unknown
            challenges.cloudflare.com
            		104.17.3.184
            		truefalse
              		high
              www.google.com
              		172.253.62.104
              		truefalse
                		high
                freelanceimaging.com
                		172.67.162.18
                		truefalse
                  		unknown
                  unpkg.com
                  		104.16.124.175
                  		truefalse
                    		high
                    aadcdn.msauthimages.net
                    		unknown
                    		unknownfalse
                      		unknown

                      Contacted URLs

                      NameMaliciousAntivirus DetectionReputation
                      https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/pux0l/0x4AAAAAAADnPIDROrmt1Wwj/light/normalfalse
                        		high
                        https://freelanceimaging.com/Mjohn.doran@firstontario.com?__cf_chl_tk=19l4S6ZOW8h1YL5wMSaq_BKasXsGl2kkUBB4GqKFlJU-1711401860-0.0.1.1-1642false
                          		unknown
                          https://freelanceimaging.com/Mjohn.doran@firstontario.comfalse
                            		unknown
                            https://freelanceimaging.com/77624fc8e83077b92433578af825365d6601eb90ad4f4PAS77624fc8e83077b92433578af825365d6601eb90ad4f6true
                              		unknown

                              World Map of Contacted IPs

                              • No. of IPs < 25%
                              • 25% < No. of IPs < 50%
                              • 50% < No. of IPs < 75%
                              • 75% < No. of IPs

                              Public IPs

                              IPDomainCountryFlagASNASN NameMalicious
                              52.113.194.132
                              		unknownUnited States
                              		8068MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                              52.109.4.7
                              		unknownUnited States
                              		8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                              142.251.111.84
                              		unknownUnited States
                              		15169GOOGLEUSfalse
                              152.195.19.97
                              		sni1gl.wpc.upsiloncdn.netUnited States
                              		15133EDGECASTUSfalse
                              172.253.63.95
                              		unknownUnited States
                              		15169GOOGLEUSfalse
                              172.253.63.94
                              		unknownUnited States
                              		15169GOOGLEUSfalse
                              52.178.17.2
                              		unknownUnited States
                              		8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                              172.67.162.18
                              		freelanceimaging.comUnited States
                              		13335CLOUDFLARENETUSfalse
                              142.251.16.113
                              		unknownUnited States
                              		15169GOOGLEUSfalse
                              104.17.3.184
                              		challenges.cloudflare.comUnited States
                              		13335CLOUDFLARENETUSfalse
                              23.215.0.37
                              		unknownUnited States
                              		16625AKAMAI-ASUSfalse
                              239.255.255.250
                              		unknownReserved
                              		unknownunknownfalse
                              104.16.124.175
                              		unpkg.comUnited States
                              		13335CLOUDFLARENETUSfalse
                              35.190.80.1
                              		a.nel.cloudflare.comUnited States
                              		15169GOOGLEUSfalse
                              104.17.2.184
                              		unknownUnited States
                              		13335CLOUDFLARENETUSfalse
                              172.253.62.104
                              		www.google.comUnited States
                              		15169GOOGLEUSfalse

                              Private

                              IP
                              192.168.2.16

                              General Information

                              Joe Sandbox version:40.0.0 Tourmaline
                              Analysis ID:1415458
                              Start date and time:2024-03-25 22:22:21 +01:00
                              Joe Sandbox product:CloudBasic
                              Overall analysis duration:
                              Hypervisor based Inspection enabled:false
                              Report type:full
                              Cookbook file name:defaultwindowsinteractivecookbook.jbs
                              Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                              Number of analysed new started processes analysed:18
                              Number of new started drivers analysed:0
                              Number of existing processes analysed:0
                              Number of existing drivers analysed:0
                              Number of injected processes analysed:0
                              Technologies:
                              • EGA enabled
                              Analysis Mode:stream
                              Analysis stop reason:Timeout
                              Sample name:Firstontario_FAX_832.eml
                              Detection:MAL
                              Classification:mal52.phis.winEML@22/36@20/76
                              Cookbook Comments:
                              • Found application associated with file extension: .eml

                              Warnings

                              • Exclude process from analysis (whitelisted): SIHClient.exe, SgrmBroker.exe, MoUsoCoreWorker.exe, svchost.exe
                              • Exclude process from analysis (whitelisted): dllhost.exe
                              • Excluded IPs from analysis (whitelisted): 52.113.194.132, 23.215.0.37, 23.215.0.46
                              • Excluded domains from analysis (whitelisted): ecs.office.com, omex.cdn.office.net, s-0005.s-msedge.net, ecs.office.trafficmanager.net, s-0005-office.config.skype.com, omex.cdn.office.net.akamaized.net, ecs-office.s-0005.s-msedge.net, a1864.dscd.akamai.net
                              • Not all processes where analyzed, report is missing behavior information
                              • Report size getting too big, too many NtQueryAttributesFile calls found.
                              • Report size getting too big, too many NtQueryValueKey calls found.
                              • Report size getting too big, too many NtSetValueKey calls found.
                              • VT rate limit hit for: Firstontario_FAX_832.eml

                              Created / dropped Files

                              C:\Users\user\AppData\Local\Microsoft\FORMS\FRMCACHE.DAT

                              Download File
                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                              File Type:data
                              Category:dropped
                              Size (bytes):231348
                              Entropy (8bit):4.385211076921066
                              Encrypted:false
                              SSDEEP:
                              MD5:EC2BA8E2C92F16CD83DDEFB08B6AA9F7
                              SHA1:ED79FCAE165E95F389BBE9388F1B4BCBFC878F2F
                              SHA-256:BC772643478A7C46471E158D32C3CF6B0AD04C700103D2F1EDD99DF7BBF90BC8
                              SHA-512:DCE2F12E73CF3B55A8AB0DF44DCE22BDAB3C35C0B314E9D147338817884684ACA8EE07DDDD6160A99E079C84E23E16B2C49E353388BAAABABCD648BF1EF18E14
                              Malicious:false
                              Reputation:unknown
                              Preview:TH02...... .0i|..~......SM01X...,...P.p..~..........IPM.Activity...........h...............h............H..h$.g.....'@5....h........(w..H..h\cal ...pDat...hx...0.....g....h'E.............h........_`.j...h.B..@...I.lw...h....H...8..j...0....T...............d.........2h...............k..............!h.............. h........g...#h....8.........$h(w......8....."h.............'h..............1h'E..<.........0h....4....j../h....h......jH..h(0..p...$.g...-h ........g...+h.D.......g................. ..............F7..............FIPM.Activity.st.Form.e..Standard.tanJournal Entry.pdIPM.Microsoft.FolderDesign.FormsDescription................F.k..........1122110020000000.000Microsoft.ofThis form is used to create journal entries.........kf...... ..........&...........(.......(... ...@.....................................................................................................................fffffffff........wwwwwwww.p....pp..............p...............pw..............pw..DDDDO..

                              C:\Users\user\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntities.bin

                              Download File
                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                              File Type:ASCII text, with very long lines (65536), with no line terminators
                              Category:dropped
                              Size (bytes):322260
                              Entropy (8bit):4.000299760592446
                              Encrypted:false
                              SSDEEP:
                              MD5:CC90D669144261B198DEAD45AA266572
                              SHA1:EF164048A8BC8BD3A015CF63E78BDAC720071305
                              SHA-256:89C701EEFF939A44F28921FD85365ECD87041935DCD0FE0BAF04957DA12C9899
                              SHA-512:16F8A8A6DCBAEAEFB88C7CFF910BCCC71B76A723CF808B810F500E28E543112C2FAE2491D4D209569BD810490EDFF564A2B084709B02963BCAF6FDF1AEEC59AC
                              Malicious:false
                              Reputation:unknown
                              Preview:51253fe60063c31af0d295afb42228b0:v2:2:1:1590:2:8479:76bd602437550e98c9043d06a55186ab7d95dea5a0e935a599f73e62a8c9b158e0afcb19351f6c353940c06a38172b94d18c02cf92bb8a80184eccca0392b259ab3e71dae73e491c7941997cb36ad4a198661f622dad478d840f66d530a0dde78acea3367f91fff62fbb3dc18faff0c708ad30edef5bea8b22c5fd782b770d8993386eaa784fd19a3c3e1db3b537b1a94d3d4fbd46f8df8fddf6d16611969fe0a97c50e0f3ac24750c93257cf5c161184aa7385800c87d803b339632a3d8ec7fe17a0afd83ce9e9d0e3f7b8d579637928a811f1f7e6d1887df2ddc7d4f752c4d600235e426c92c7bf8a1362f95457998cc0e5d4261f0efa4fada0f866dbcefb407dacab7a2914e91c2f08200f38c2d9d621962145b1464b0f204b326118a53ecdcab22bff005fdd5257c99a6dc51ac0600a49f2ef782396987e78c08b846dad5db55e8ccefffc64863bc2c3e90b95a09d25d0814a848c98fe01a82d4e30e6682dd546e12c45ca0d280a45295ab4bd632dafb070edfdc3c9e38313d5aeb195972986f8011b66817028fd8c78b67a0ac7e780eecc3fb6a31f5a025b8a9a3db278a98c0696aeaac739b18688b0f9c7d751bba02cc5f4e41853fb119b3c0c915059aaa92971244a1989124f12881ca88e6410df70b793a2c3a736ff4

                              C:\Users\user\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntitiesUpdated.bin

                              Download File
                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                              File Type:ASCII text, with no line terminators
                              Category:modified
                              Size (bytes):10
                              Entropy (8bit):1.8464393446710154
                              Encrypted:false
                              SSDEEP:
                              MD5:99E2250CC086F203EFB9ADC7FB1DEE9D
                              SHA1:DB5A4BB439970DF8A98D8871978430302CE6E004
                              SHA-256:C665C40D5E122D30EEDF478E7781A26D4411002D3C0DCE0AC770D3C9E2B1453C
                              SHA-512:CDE24837F0E7708B7277BB997FEB1E407ECD6261B06E0D6AF77B76C492B7C939CDF862EC030E36A319CEB758964C57434C2BB0723773E4C924858DD88135F2DB
                              Malicious:false
                              Reputation:unknown
                              Preview:1711401770

                              C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db

                              Download File
                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                              File Type:SQLite 3.x database, last written using SQLite version 3034001, writer version 2, read version 2, file counter 2, database pages 1, cookie 0, schema 0, largest root page 1, unknown 0 encoding, version-valid-for 2
                              Category:dropped
                              Size (bytes):4096
                              Entropy (8bit):0.09304735440217722
                              Encrypted:false
                              SSDEEP:
                              MD5:D0DE7DB24F7B0C0FE636B34E253F1562
                              SHA1:6EF2957FDEDDC3EB84974F136C22E39553287B80
                              SHA-256:B6DC74E4A39FFA38ED8C93D58AADEB7E7A0674DAC1152AF413E9DA7313ADE6ED
                              SHA-512:42D00510CD9771CE63D44991EA10C10C8FBCF69DF08819D60B7F8E7B0F9B1D385AE26912C847A024D1D127EC098904784147218869AE8D2050BCE9B306DB2DDE
                              Malicious:false
                              Reputation:unknown
                              Preview:SQLite format 3......@ ..........................................................................K.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                              C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-journal

                              Download File
                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                              File Type:SQLite Rollback Journal
                              Category:dropped
                              Size (bytes):4616
                              Entropy (8bit):0.1378497710305501
                              Encrypted:false
                              SSDEEP:
                              MD5:56BA0BCB8E91CF13FAB1D340153E6B5A
                              SHA1:66EC7F54C399E34DEE605EF5904DECD1FA73CB18
                              SHA-256:C2E710F87BC9DCA05DD84DE49B2BDEFB27C06B36E8E96420909D3D630ECE3238
                              SHA-512:5E263C08357693DEB06995CB3C39025850DA81DDEEA22CD7D8E42B720D6B18D22349BB9FF4425EF12936982655E11332C4D5C3B7E994BF6787DF953948A2241D
                              Malicious:false
                              Reputation:unknown
                              Preview:.... .c.....n.G.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................SQLite format 3......@ ..........................................................................K.................................................................................................................................................................................................................................................................................................................................................................................................

                              C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-shm

                              Download File
                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                              File Type:data
                              Category:dropped
                              Size (bytes):32768
                              Entropy (8bit):0.04474066038091713
                              Encrypted:false
                              SSDEEP:
                              MD5:2CF01096440254D0057E4AC442B67775
                              SHA1:48E19DE78B89108E8F6B34BC8957BF5A086F4288
                              SHA-256:EBFA5E35C0FBE3C47B9D36C870DB0CFC59831A112B3D0AE2F8EACA6134B26209
                              SHA-512:6BE71F1CDE0A99A5EA381B9F0ACDE558B26D2C5B2DA12003C735DD86D38B83B5A451E0671A7DC87843C55BC70CABAA286FA7C07CEFE3C1CD7DD8CEF72B4857AD
                              Malicious:false
                              Reputation:unknown
                              Preview:..-.....................eh.]..J..S.Is...x.. .R...-.....................eh.]..J..S.Is...x.. .R.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                              C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-wal

                              Download File
                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                              File Type:SQLite Write-Ahead Log, version 3007000
                              Category:dropped
                              Size (bytes):45352
                              Entropy (8bit):0.3943116342349805
                              Encrypted:false
                              SSDEEP:
                              MD5:C869CD035286A5F35E8A817B1E860A35
                              SHA1:82FF956DF8884F02870743C85C0F4C124FD01556
                              SHA-256:93216AFF190CA2D63E2D037A6A944466AE5BD013807A494CE7FA5822406C32C0
                              SHA-512:4954348E01D50033352EB4A8792ECBB2E17755B5561773105A136A71FC36C49751E7EED0D990AD952D14F7DA7E637C402EE990F41A93165EA7AF460494ED26C7
                              Malicious:false
                              Reputation:unknown
                              Preview:7....-............S.Is...:....B...........S.Is....\..m".SQLite format 3......@ ..........................................................................K.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                              C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\MUT0AOV0\Voice_832 (002).html

                              Download File
                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                              File Type:HTML document, ASCII text, with CRLF line terminators
                              Category:dropped
                              Size (bytes):187
                              Entropy (8bit):4.7761536332993995
                              Encrypted:false
                              SSDEEP:
                              MD5:38AF01D33CB85AD43CCBA81AFA86603D
                              SHA1:5DF210D7B6F6569022FE2A884E1C81DA5C4F34C9
                              SHA-256:1DA074402AE2A92F1170BACDC1B8F07C2B5AA6D486949F85546ABB1B93837196
                              SHA-512:AF7C680C9D61BB324F8AF3242C906D2238494C37E73C24EE32F318AA57887E754D9F281D87D63B5A452F1BB358701332DFBC5FC392B6B646009C2E333A384937
                              Malicious:false
                              Reputation:unknown
                              Preview:<head> ..<title>Redirecting...</title> ..<script> ..window.location.href = "https://FreelanceImaging.com/Mjohn.doran@firstontario.com"; ..</script> ..</head> ..<body> ..</body> ..</html>

                              C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\MUT0AOV0\Voice_832 (002).html:Zone.Identifier (copy)

                              Download File
                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                              File Type:HTML document, ASCII text, with CRLF line terminators
                              Category:dropped
                              Size (bytes):0
                              Entropy (8bit):0.0
                              Encrypted:false
                              SSDEEP:
                              MD5:38AF01D33CB85AD43CCBA81AFA86603D
                              SHA1:5DF210D7B6F6569022FE2A884E1C81DA5C4F34C9
                              SHA-256:1DA074402AE2A92F1170BACDC1B8F07C2B5AA6D486949F85546ABB1B93837196
                              SHA-512:AF7C680C9D61BB324F8AF3242C906D2238494C37E73C24EE32F318AA57887E754D9F281D87D63B5A452F1BB358701332DFBC5FC392B6B646009C2E333A384937
                              Malicious:false
                              Reputation:unknown
                              Preview:<head> ..<title>Redirecting...</title> ..<script> ..window.location.href = "https://FreelanceImaging.com/Mjohn.doran@firstontario.com"; ..</script> ..</head> ..<body> ..</body> ..</html>

                              C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\MUT0AOV0\Voice_832.html:Zone.Identifier

                              Download File
                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                              File Type:ASCII text, with CRLF line terminators
                              Category:dropped
                              Size (bytes):26
                              Entropy (8bit):3.95006375643621
                              Encrypted:false
                              SSDEEP:
                              MD5:FBCCF14D504B7B2DBCB5A5BDA75BD93B
                              SHA1:D59FC84CDD5217C6CF74785703655F78DA6B582B
                              SHA-256:EACD09517CE90D34BA562171D15AC40D302F0E691B439F91BE1B6406E25F5913
                              SHA-512:AA1D2B1EA3C9DE3CCADB319D4E3E3276A2F27DD1A5244FE72DE2B6F94083DDDC762480482C5C2E53F803CD9E3973DDEFC68966F974E124307B5043E654443B98
                              Malicious:false
                              Reputation:unknown
                              Preview:[ZoneTransfer]..ZoneId=3..

                              C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1711401768332047400_F6EAC999-50A3-4DFA-AD4E-283D2FDD7D93.log

                              Download File
                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                              File Type:ASCII text, with very long lines (28742), with CRLF line terminators
                              Category:dropped
                              Size (bytes):20971520
                              Entropy (8bit):0.15976372213611156
                              Encrypted:false
                              SSDEEP:
                              MD5:CE6E644278FD1ECD7BBDE386CB0995C1
                              SHA1:62F8AA4C168D70F80A73E2A66F7A468A6BA690B0
                              SHA-256:6135836B2DAF03D7FB12E7D67AC64ABA05ECCCF755C8363511B300672D4467B2
                              SHA-512:A9CE7BE120039032A354640BDEA99ADE11E09A13F942DCC511EBB7C173021244C8AFC435ADA4EE27AA62A2DF88FC55BC4297C0F46DBDFA74A8CC41F2FB6ED574
                              Malicious:false
                              Reputation:unknown
                              Preview:Timestamp.Process.TID.Area.Category.EventID.Level.Message.Correlation..03/25/2024 21:22:48.355.OUTLOOK (0x1B58).0x1B5C.Microsoft Outlook.Telemetry Event.b7vzq.Medium.SendEvent {"EventName":"Office.Text.GDIAssistant.HandleCallback","Flags":30962256044949761,"InternalSequenceNumber":25,"Time":"2024-03-25T21:22:48.355Z","Contract":"Office.System.Activity","Activity.CV":"mcnq9qNQ+k2tTig9L919kw.4.11","Activity.Duration":12,"Activity.Count":1,"Activity.AggMode":0,"Activity.Success":true,"Data.GdiFamilyName":"","Data.CloudFontStatus":6,"Data.CloudFontTypes":256}...03/25/2024 21:22:48.371.OUTLOOK (0x1B58).0x1B5C.Microsoft Outlook.Telemetry Event.b7vzq.Medium.SendEvent {"EventName":"Office.Text.ResourceClient.Deserialize","Flags":30962256044949761,"InternalSequenceNumber":27,"Time":"2024-03-25T21:22:48.371Z","Contract":"Office.System.Activity","Activity.CV":"mcnq9qNQ+k2tTig9L919kw.4.12","Activity.Duration":10399,"Activity.Count":1,"Activity.AggMode":0,"Activity.Success":true,"Data.JsonFileMajor

                              C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1711401768332963300_F6EAC999-50A3-4DFA-AD4E-283D2FDD7D93.log

                              Download File
                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                              File Type:data
                              Category:dropped
                              Size (bytes):20971520
                              Entropy (8bit):0.0
                              Encrypted:false
                              SSDEEP:
                              MD5:8F4E33F3DC3E414FF94E5FB6905CBA8C
                              SHA1:9674344C90C2F0646F0B78026E127C9B86E3AD77
                              SHA-256:CD52D81E25F372E6FA4DB2C0DFCEB59862C1969CAB17096DA352B34950C973CC
                              SHA-512:7FB91E868F3923BBD043725818EF3A5D8D08EBF1059A18AC0FE07040D32EEBA517DA11515E6A4AFAEB29BCC5E0F1543BA2C595B0FE8E6167DDC5E6793EDEF5BB
                              Malicious:false
                              Reputation:unknown
                              Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                              C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20240325T2222480131-7000.etl

                              Download File
                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                              File Type:data
                              Category:modified
                              Size (bytes):106496
                              Entropy (8bit):4.508528184942438
                              Encrypted:false
                              SSDEEP:
                              MD5:B4535F695D7BA92B9C1E5E0D74789A32
                              SHA1:92B1D10276BBCDF142A4ACADBB7F68492C0D1E4D
                              SHA-256:67AB4BA1A7492CF8C2F26D6FC621DBCD2A5BFF66531C3B63AE1AFCDC6D92C1E6
                              SHA-512:BB27AC045A3AE26A983B6BAAAF5100E9E3CE08A02FE602EFE403F3512E640DBD8896B338F996575533FFC9775679C1D0F3DCC672C591C6358D7B2A212CACBA38
                              Malicious:false
                              Reputation:unknown
                              Preview:............................................................................`...\...X.......~..................eJ..............Zb..2.......................................@.t.z.r.e.s...d.l.l.,.-.3.2.2.......................................................@.t.z.r.e.s...d.l.l.,.-.3.2.1............................................................S.&.Y..............~..........v.2._.O.U.T.L.O.O.K.:.1.b.5.8.:.7.6.3.6.3.6.0.0.b.e.1.5.4.6.9.d.a.7.f.c.b.e.8.d.7.d.c.9.0.c.2.3...C.:.\.U.s.e.r.s.\.c.a.l.i.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.O.u.t.l.o.o.k. .L.o.g.g.i.n.g.\.O.U.T.L.O.O.K._.1.6._.0._.1.6.8.2.7._.2.0.1.3.0.-.2.0.2.4.0.3.2.5.T.2.2.2.2.4.8.0.1.3.1.-.7.0.0.0...e.t.l.......P.P.\...X.......~..........................................................................................................................................................................................................................................................................................................

                              C:\Users\user\AppData\Roaming\Microsoft\Office\MSO3072.acl

                              Download File
                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                              File Type:data
                              Category:dropped
                              Size (bytes):30
                              Entropy (8bit):1.2389205950315936
                              Encrypted:false
                              SSDEEP:
                              MD5:0ED9CF324921B6A8A2F778063F1D80B0
                              SHA1:F579B329EA05A5695D64270FB36B6F271071D4B7
                              SHA-256:0C32E856F34E9FEEE4ED816CB346AAF0B0BFF0BFF5D4B8CB6A095C8AC161BA1A
                              SHA-512:6296C5F28C0F37210F9B0865878C47AC9EE2F7B4A3407D9A9F3F4A6C68533EF07F3BF243D0AB145C1787BD33F1CB900867367094319C7F0C03E00BC615892E33
                              Malicious:false
                              Reputation:unknown
                              Preview:....l.........................

                              C:\Users\user\AppData\Roaming\Microsoft\Outlook\NoEmail.srs

                              Download File
                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                              File Type:Composite Document File V2 Document, Cannot read section info
                              Category:dropped
                              Size (bytes):16384
                              Entropy (8bit):0.6704960301728311
                              Encrypted:false
                              SSDEEP:
                              MD5:706BCC9AD6A7AF1ADEC5B4B443392606
                              SHA1:62D41C37A5F7D475568759F2FB2FBDE3B4DB6F16
                              SHA-256:B3BF374455B9CD568A03F04FC78369EFD54EE7B49B002108B13574B1AEFADBD7
                              SHA-512:CAE328349441AFAB1D8C3836890310BA3AA996AC5FF145C9A4E22278ED1A8CEF73AEC492D359D975686970B34001380B6D1041FCA43414B85F676387CE48357F
                              Malicious:false
                              Reputation:unknown
                              Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                              C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

                              Download File
                              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                              File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Mar 25 20:24:20 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                              Category:dropped
                              Size (bytes):2673
                              Entropy (8bit):3.989172030219626
                              Encrypted:false
                              SSDEEP:
                              MD5:406A484B9A836A17D7FCC160D84E4C71
                              SHA1:D0FD38F8DE1E25F9AFACA7B4836164893DB2489E
                              SHA-256:7AA0334699B883A7A464547C23CBD1FA70D1BE1229D00E8D7529B2BDD54B6BFD
                              SHA-512:D4870506696C4D9306E764D9BCE16E198A51C701086BFA6304701615D13D6F0478DCC505B382F0427D29358415EFB91BA3A51D0ED3B4CBCEBB17D8A80534C83A
                              Malicious:false
                              Reputation:unknown
                              Preview:L..................F.@.. ...$+.,........~..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IyX.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VyX......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VyX......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VyX............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VyX.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............:.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                              C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

                              Download File
                              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                              File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Mar 25 20:24:20 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                              Category:dropped
                              Size (bytes):2675
                              Entropy (8bit):4.0050175551695295
                              Encrypted:false
                              SSDEEP:
                              MD5:C357961EE7FF684533793EAAFD124CA2
                              SHA1:F9DCEDB97A684699C05FBB1DBC8DFB645C994605
                              SHA-256:937D2542122E7B1566231056BB685A980B78A560667B31120F59BCDB31EC561B
                              SHA-512:B415DF87C5BA0014FCBFF9841F1EE1F2F5C1A4775B9E6D4B233B919C3558CFA16D69FCC4DAC4316204378C030667EBE5746695B32772028008075C81BE1C2972
                              Malicious:false
                              Reputation:unknown
                              Preview:L..................F.@.. ...$+.,.........~..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IyX.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VyX......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VyX......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VyX............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VyX.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............:.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                              C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

                              Download File
                              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                              File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                              Category:dropped
                              Size (bytes):2689
                              Entropy (8bit):4.010080654617613
                              Encrypted:false
                              SSDEEP:
                              MD5:BC7A29DF9A62E2D300B20A16261B676B
                              SHA1:566827B6CC2403B1F544D1DC0D9AF84EF316D851
                              SHA-256:817C8B37C00062925F163F87E8D6AB7777099B3AB67B394BB0437B942DDD1D8D
                              SHA-512:3275A40C806B1417452EA037C540379E21264443CF0CA4DDA4ECF65669FC107329229F48A43E3F8D663CCD262F6D35CA2F2BDE9B96023E5B400A8509029E8D39
                              Malicious:false
                              Reputation:unknown
                              Preview:L..................F.@.. ...$+.,.....Y.04...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IyX.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VyX......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VyX......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VyX............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VFW.E...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............:.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                              C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

                              Download File
                              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                              File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Mar 25 20:24:20 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                              Category:dropped
                              Size (bytes):2677
                              Entropy (8bit):4.002384409366269
                              Encrypted:false
                              SSDEEP:
                              MD5:0362273F9C7ED32CB02BF114A699F70C
                              SHA1:BB21AA10BACEC1E8059992EB3097CEA4B7F2B870
                              SHA-256:632233080AA3EA711238F43F90F3A238DA112BBFF178E8DB29C5DB858146EE4D
                              SHA-512:216887F8F9D7506C8291A014BEF62A9A611A28781BEC436506BB178492528512D8639021902A14D2E7822C6E0607CC9522DA2DCD8CF87EF60F203668CD4AD386
                              Malicious:false
                              Reputation:unknown
                              Preview:L..................F.@.. ...$+.,.........~..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IyX.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VyX......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VyX......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VyX............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VyX.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............:.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                              C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

                              Download File
                              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                              File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Mar 25 20:24:20 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                              Category:dropped
                              Size (bytes):2677
                              Entropy (8bit):3.9903766490615773
                              Encrypted:false
                              SSDEEP:
                              MD5:5DCA9872BFF3CF2F0340BE548A1D36A4
                              SHA1:23DB03D517CFA8AA7F8F561C83CC288C4989BB17
                              SHA-256:4D8F46E0C820E110BEC129B8F9C164AF548F77FCDAACE19606519FE74F0CF94E
                              SHA-512:57E88A5DF66452D0E06C0DA1F9111DD12D3E3485E943A91FE999B5B552BECBC5938E170E9039297353E7928BFD40844C2C8F574746D03D4C07F6EAD8BFCDD8F1
                              Malicious:false
                              Reputation:unknown
                              Preview:L..................F.@.. ...$+.,.....R...~..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IyX.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VyX......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VyX......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VyX............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VyX.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............:.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                              C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

                              Download File
                              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                              File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Mar 25 20:24:19 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                              Category:dropped
                              Size (bytes):2679
                              Entropy (8bit):4.000800305917137
                              Encrypted:false
                              SSDEEP:
                              MD5:9C4B8ADE97ABBA18D1C0023E30219772
                              SHA1:88A3431D3C17160D621530ABC2857521434DEE15
                              SHA-256:E05E04EB3238D43330B6FC7E23F4C8CB8C0F1390F989D0C753F8D13303091F6C
                              SHA-512:B3EDF7799BEA7C52AB8858F08F16BCE276BA19FB09F413515FA49953A48F1D7F858A59D549FD2C4384AFEBD9A655A0B91B6D3AA3B3A491911F2E16D3516A6B96
                              Malicious:false
                              Reputation:unknown
                              Preview:L..................F.@.. ...$+.,....$Y...~..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IyX.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VyX......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VyX......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VyX............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VyX.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............:.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                              C:\Users\user\Documents\Outlook Files\Outlook Data File - NoEmail.pst

                              Download File
                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                              File Type:Microsoft Outlook email folder (>=2003)
                              Category:dropped
                              Size (bytes):271360
                              Entropy (8bit):2.1737570084169238
                              Encrypted:false
                              SSDEEP:
                              MD5:8F0A887E236FADC28FBCDEE8E0257A73
                              SHA1:C7C98669043ABFB1BFEEDC7F1FCD5F4D1D983A4B
                              SHA-256:F1D1D239853F15C064D55C72905A13B3CA6E5CBA68791CA9A619F82DB2A84FC5
                              SHA-512:188C7F6CCDDC43A3DEA3DCC35BBC5AE3F2C490FA0200EFA59E33C7FA0F8AF36AF27F610F7B4C2FDE7733CCD254AA45E25362F49CFD5FE60319611489B99F3288
                              Malicious:false
                              Reputation:unknown
                              Preview:!BDN.*..SM......\...x...........?.......b................@...........@...@...................................@...........................................................................$.......D......@...............>........<......;...........................................................................................................................................................................................................................................................................................4......._0.q..8.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                              C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp

                              Download File
                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                              File Type:data
                              Category:dropped
                              Size (bytes):131072
                              Entropy (8bit):2.0162712116044474
                              Encrypted:false
                              SSDEEP:
                              MD5:D3882D8800293ABF840C7A49979FDB8E
                              SHA1:5098DC69875125A314F522B5E569D9E65007C569
                              SHA-256:C6F0DD1A25709528AA06CCB90E262C321B170253CA45096B29481C1D48C86A21
                              SHA-512:F0C58C87C68337261F40EAA7A529E4404C932BE2CFCE980FF041A4E6317468B28B8FC4365CB0F4DA44BFEC33E993B4366BF19E3767E5B5CFB66D507734070532
                              Malicious:false
                              Reputation:unknown
                              Preview:.\..C...\.......X....4...~....................#.!BDN.*..SM......\...x...........?.......b................@...........@...@...................................@...........................................................................$.......D......@...............>........<......;...........................................................................................................................................................................................................................................................................................4......._0.q..8..4...~.......B............#.........................................................................................................................................................................................................................................................................................................................................................................................................

                              Chrome Cache Entry: 76

                              Download File
                              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                              File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 240x240, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=1], baseline, precision 8, 1920x1080, components 3
                              Category:dropped
                              Size (bytes):279994
                              Entropy (8bit):7.962545602165181
                              Encrypted:false
                              SSDEEP:
                              MD5:57538480D3F347ED52A252DFAB885155
                              SHA1:4D763C99B2EE0E7D16FA8365A344936D3D20FC6E
                              SHA-256:C05C489F1041ECDCC1EBFA77F10AA8348377DD6A0757C79114CAE99531837FD1
                              SHA-512:045F9F0F1AA085B9FD16C9AD7FD3C3173D27B2709F71C1DDC9024027C4F0A7C14F25BEE02243C8A81F9CD78186D9B4702C5A2446A6E4A235BF4A4FADEC37678B
                              Malicious:false
                              Reputation:unknown
                              Preview:......JFIF..............Exif..MM.*.......i...........................P...........d........00..........00......2019:06:12 21:15:42.2019:06:12 21:15:42.......http://ns.adobe.com/xap/1.0/.<?xpacket begin='.' id='W5M0MpCehiHzreSzNTczkc9d'?>..<x:xmpmeta xmlns:x="adobe:ns:meta/"><rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"><rdf:Description rdf:about="uuid:faf5bdd5-ba3d-11da-ad31-d33d75182f1b" xmlns:xmp="http://ns.adobe.com/xap/1.0/"><xmp:CreateDate>2019-06-12T21:15:42</xmp:CreateDate></rdf:Description></rdf:RDF></x:xmpmeta>..<?xpacket end='w'?>...C.....................................%...#... , #&')*)..-0-(0%()(...C...........(...((((((((((((((((((((((((((((((((((((((((((((((((((......8...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......

                              Chrome Cache Entry: 77

                              Download File
                              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                              File Type:PNG image data, 2 x 2, 8-bit/color RGB, non-interlaced
                              Category:dropped
                              Size (bytes):61
                              Entropy (8bit):3.990210155325004
                              Encrypted:false
                              SSDEEP:
                              MD5:9246CCA8FC3C00F50035F28E9F6B7F7D
                              SHA1:3AA538440F70873B574F40CD793060F53EC17A5D
                              SHA-256:C07D7D29E3C20FA6CA4C5D20663688D52BAD13E129AD82CE06B80EB187D9DC84
                              SHA-512:A2098304D541DF4C71CDE98E4C4A8FB1746D7EB9677CEBA4B19FF522EFDD981E484224479FD882809196B854DBC5B129962DBA76198D34AAECF7318BD3736C6B
                              Malicious:false
                              Reputation:unknown
                              Preview:.PNG........IHDR...............s....IDAT.....$.....IEND.B`.

                              Chrome Cache Entry: 78

                              Download File
                              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                              File Type:ASCII text, with no line terminators
                              Category:downloaded
                              Size (bytes):16
                              Entropy (8bit):3.875
                              Encrypted:false
                              SSDEEP:
                              MD5:D6B82198AF25D0139723AF9E44D3D23A
                              SHA1:D60DEEF1847EEEF1889803E9D3ADC7EDA220F544
                              SHA-256:A5C8CC49FA6649BE393EF22C2B31F1C46B671F8D763F783ED6D7B4E33669BDA3
                              SHA-512:B21BEE2EEC588308A9DC3C3C2405377704B39B08AA20CBA40BA6E6834E67CF6F2C086E0701F5B05AEE27E2677E9C5C24FF137318275ACA00DD063DF3DCC07D4D
                              Malicious:false
                              Reputation:unknown
                              URL:https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISEAnJtcvwrM92NxIFDVd69_0=?alt=proto
                              Preview:CgkKBw1Xevf9GgA=

                              Chrome Cache Entry: 79

                              Download File
                              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                              File Type:HTML document, ASCII text
                              Category:downloaded
                              Size (bytes):315
                              Entropy (8bit):5.0572271090563765
                              Encrypted:false
                              SSDEEP:
                              MD5:A34AC19F4AFAE63ADC5D2F7BC970C07F
                              SHA1:A82190FC530C265AA40A045C21770D967F4767B8
                              SHA-256:D5A89E26BEAE0BC03AD18A0B0D1D3D75F87C32047879D25DA11970CB5C4662A3
                              SHA-512:42E53D96E5961E95B7A984D9C9778A1D3BD8EE0C87B8B3B515FA31F67C2D073C8565AFC2F4B962C43668C4EFA1E478DA9BB0ECFFA79479C7E880731BC4C55765
                              Malicious:false
                              Reputation:unknown
                              URL:https://freelanceimaging.com/favicon.ico
                              Preview:<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">.<html><head>.<title>404 Not Found</title>.</head><body>.<h1>Not Found</h1>.<p>The requested URL was not found on this server.</p>.<p>Additionally, a 404 Not Found.error was encountered while trying to use an ErrorDocument to handle the request.</p>.</body></html>.

                              Chrome Cache Entry: 80

                              Download File
                              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                              File Type:ASCII text, with very long lines (32065)
                              Category:downloaded
                              Size (bytes):85578
                              Entropy (8bit):5.366055229017455
                              Encrypted:false
                              SSDEEP:
                              MD5:2F6B11A7E914718E0290410E85366FE9
                              SHA1:69BB69E25CA7D5EF0935317584E6153F3FD9A88C
                              SHA-256:05B85D96F41FFF14D8F608DAD03AB71E2C1017C2DA0914D7C59291BAD7A54F8E
                              SHA-512:0D40BCCAA59FEDECF7243D63B33C42592541D0330FEFC78EC81A4C6B9689922D5B211011CA4BE23AE22621CCE4C658F52A1552C92D7AC3615241EB640F8514DB
                              Malicious:false
                              Reputation:unknown
                              URL:https://freelanceimaging.com/jq/75a551cd5bd32cdeceb67e3f30dd2f8a6601eb914b815
                              Preview:/*! jQuery v2.2.4 | (c) jQuery Foundation | jquery.org/license */.!function(a,b){"object"==typeof module&&"object"==typeof module.exports?module.exports=a.document?b(a,!0):function(a){if(!a.document)throw new Error("jQuery requires a window with a document");return b(a)}:b(a)}("undefined"!=typeof window?window:this,function(a,b){var c=[],d=a.document,e=c.slice,f=c.concat,g=c.push,h=c.indexOf,i={},j=i.toString,k=i.hasOwnProperty,l={},m="2.2.4",n=function(a,b){return new n.fn.init(a,b)},o=/^[\s\uFEFF\xA0]+|[\s\uFEFF\xA0]+$/g,p=/^-ms-/,q=/-([\da-z])/gi,r=function(a,b){return b.toUpperCase()};n.fn=n.prototype={jquery:m,constructor:n,selector:"",length:0,toArray:function(){return e.call(this)},get:function(a){return null!=a?0>a?this[a+this.length]:this[a]:e.call(this)},pushStack:function(a){var b=n.merge(this.constructor(),a);return b.prevObject=this,b.context=this.context,b},each:function(a){return n.each(this,a)},map:function(a){return this.pushStack(n.map(this,function(b,c){return a.call

                              Chrome Cache Entry: 81

                              Download File
                              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                              File Type:ASCII text, with very long lines (65536), with no line terminators
                              Category:downloaded
                              Size (bytes):105369
                              Entropy (8bit):5.240719144154261
                              Encrypted:false
                              SSDEEP:
                              MD5:8E6B0F88563F9C33F78BCE65CF287DF7
                              SHA1:EF7765CD2A7D64ED27DD7344702597AFF6F8C397
                              SHA-256:A7057BEBFFF43E7281CA31DA00D40BD88C8D02D1576B9C45891DD56A3853269A
                              SHA-512:7DCE31D45ACA40340490B9F437A22ADF212B049DE0D4DDEB908A50C1F5C6C7B5561323B3A93B6ED3E5A7C44D7170460BFF8D8722749191C0F5A8DBD83E093E7F
                              Malicious:false
                              Reputation:unknown
                              URL:https://freelanceimaging.com/APP-A8SGQX/75a551cd5bd32cdeceb67e3f30dd2f8a6601eb92f2153
                              Preview:html{font-family:sans-serif;-ms-text-size-adjust:100%;-webkit-text-size-adjust:100%}body{margin:0}article,aside,details,figcaption,figure,footer,header,hgroup,main,menu,nav,section,summary{display:block}audio,canvas,progress,video{display:inline-block;vertical-align:baseline}audio:not([controls]){display:none;height:0}[hidden],template{display:none}a{background-color:transparent}a:active,a:hover{outline:0}abbr[title]{border-bottom:1px dotted}b,strong{font-weight:bold}dfn{font-style:italic}h1{font-size:2em;margin:.67em 0}mark{background:#ff0;color:#000}small{font-size:80%}sub,sup{font-size:75%;line-height:0;position:relative;vertical-align:baseline}sup{top:-0.5em}sub{bottom:-0.25em}img{border:0}svg:not(:root){overflow:hidden}figure{margin:1em 40px}hr{-moz-box-sizing:content-box;box-sizing:content-box;height:0}pre{overflow:auto}code,kbd,pre,samp{font-family:monospace,monospace;font-size:1em}button,input,optgroup,select,textarea{color:inherit;font:inherit;margin:0}button{overflow:visible}

                              Chrome Cache Entry: 82

                              Download File
                              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                              File Type:SVG Scalable Vector Graphics image
                              Category:dropped
                              Size (bytes):513
                              Entropy (8bit):4.720499940334011
                              Encrypted:false
                              SSDEEP:
                              MD5:A9CC2824EF3517B6C4160DCF8FF7D410
                              SHA1:8DB9AEBAD84CA6E4225BFDD2458FF3821CC4F064
                              SHA-256:34F9DB946E89F031A80DFCA7B16B2B686469C9886441261AE70A44DA1DFA2D58
                              SHA-512:AA3DDAB0A1CFF9533F9A668ABA4FB5E3D75ED9F8AFF8A1CAA4C29F9126D85FF4529E82712C0119D2E81035D1CE1CC491FF9473384D211317D4D00E0E234AD97F
                              Malicious:false
                              Reputation:unknown
                              Preview:<svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24"><title>assets</title><path d="M18,11.578v.844H7.617l3.921,3.928-.594.594L6,12l4.944-4.944.594.594L7.617,11.578Z" fill="#404040"/><path d="M10.944,7.056l.594.594L7.617,11.578H18v.844H7.617l3.921,3.928-.594.594L6,12l4.944-4.944m0-.141-.071.07L5.929,11.929,5.858,12l.071.071,4.944,4.944.071.07.071-.07.594-.595.071-.07-.071-.071L7.858,12.522H18.1V11.478H7.858l3.751-3.757.071-.071-.071-.07-.594-.595-.071-.07Z" fill="#404040"/></svg>

                              Chrome Cache Entry: 83

                              Download File
                              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                              File Type:ASCII text, with very long lines (39928)
                              Category:downloaded
                              Size (bytes):39929
                              Entropy (8bit):5.378411954063623
                              Encrypted:false
                              SSDEEP:
                              MD5:7F3FE50B0F2AD92528FF217C1B608B27
                              SHA1:54FC4814C739C7142EF4A5B562140EE764BCBDFC
                              SHA-256:D2E584D67A5B1A868363ED5E83A72EA6BC2CAD8A052F64583D0FE95E7FA36E97
                              SHA-512:3B4F838B651CC39D8CA8B5C815CCE04B0062A26F8C398CD5D1943995C2C47049D2546407FBE619219EACF417D1D66FEB0AA77512BF52848CF961BB0D3F7A98EE
                              Malicious:false
                              Reputation:unknown
                              URL:https://challenges.cloudflare.com/turnstile/v0/g/dc6b543c1346/api.js?onload=QkWxI7&render=explicit
                              Preview:"use strict";(function(){function gt(e,r,t,i,u,s,g){try{var y=e[s](g),m=y.value}catch(f){t(f);return}y.done?r(m):Promise.resolve(m).then(i,u)}function yt(e){return function(){var r=this,t=arguments;return new Promise(function(i,u){var s=e.apply(r,t);function g(m){gt(s,i,u,g,y,"next",m)}function y(m){gt(s,i,u,g,y,"throw",m)}g(void 0)})}}function k(e,r){return r!=null&&typeof Symbol!="undefined"&&r[Symbol.hasInstance]?!!r[Symbol.hasInstance](e):k(e,r)}function Ee(e,r,t){return r in e?Object.defineProperty(e,r,{value:t,enumerable:!0,configurable:!0,writable:!0}):e[r]=t,e}function ze(e){for(var r=1;r<arguments.length;r++){var t=arguments[r]!=null?arguments[r]:{},i=Object.keys(t);typeof Object.getOwnPropertySymbols=="function"&&(i=i.concat(Object.getOwnPropertySymbols(t).filter(function(u){return Object.getOwnPropertyDescriptor(t,u).enumerable}))),i.forEach(function(u){Ee(e,u,t[u])})}return e}function ir(e,r){var t=Object.keys(e);if(Object.getOwnPropertySymbols){var i=Object.getOwnPropertyS

                              Chrome Cache Entry: 84

                              Download File
                              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                              File Type:ASCII text, with very long lines (6357), with no line terminators
                              Category:downloaded
                              Size (bytes):6357
                              Entropy (8bit):5.243003524346767
                              Encrypted:false
                              SSDEEP:
                              MD5:82FF6E77E3B8F004B23294185E108264
                              SHA1:03C685B50FD4587427495348CD1231882A8C48D0
                              SHA-256:0E230A53A5D5ABD125C2A8E1CDD97B32DDD84A9F7FD07C23BFF95413886B05FA
                              SHA-512:4A2CE7166010BDAEBFA09A7D7F8F858AB28FFF7128F4EF650D8BD0214E3AECADE963D29A4BC5B27E820FF45B3827B6BE69F519DC890118FD423D5375B3893758
                              Malicious:false
                              Reputation:unknown
                              URL:https://freelanceimaging.com/jm/75a551cd5bd32cdeceb67e3f30dd2f8a6601eb914b81b
                              Preview:var _0x93a3bf=_0x2d52;(function(_0x547797,_0x18550f){var _0x59203=_0x2d52,_0x4480cd=_0x547797();while(!![]){try{var _0xcc5b57=-parseInt(_0x59203(0xeb))/0x1+parseInt(_0x59203(0x10b))/0x2*(-parseInt(_0x59203(0xfa))/0x3)+-parseInt(_0x59203(0xd9))/0x4+-parseInt(_0x59203(0xe4))/0x5*(parseInt(_0x59203(0xe0))/0x6)+parseInt(_0x59203(0xfb))/0x7+parseInt(_0x59203(0xe3))/0x8*(-parseInt(_0x59203(0xec))/0x9)+-parseInt(_0x59203(0xd7))/0xa*(-parseInt(_0x59203(0xcb))/0xb);if(_0xcc5b57===_0x18550f)break;else _0x4480cd['push'](_0x4480cd['shift']());}catch(_0x1f86db){_0x4480cd['push'](_0x4480cd['shift']());}}}(_0x5821,0xf115f));var _0x743837=(function(){var _0x2211cb=!![];return function(_0x41026e,_0x2b42dd){var _0x50a8cc=_0x2211cb?function(){var _0x2a2063=_0x2d52;if(_0x2b42dd){var _0x1cceff=_0x2b42dd[_0x2a2063(0xdb)](_0x41026e,arguments);return _0x2b42dd=null,_0x1cceff;}}:function(){};return _0x2211cb=![],_0x50a8cc;};}()),_0x4a9cd1=_0x743837(this,function(){var _0x3e2c84=_0x2d52;return _0x4a9cd1[_0x3e2c

                              Chrome Cache Entry: 88

                              Download File
                              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                              File Type:ASCII text, with very long lines (41442)
                              Category:downloaded
                              Size (bytes):41481
                              Entropy (8bit):5.31009549751899
                              Encrypted:false
                              SSDEEP:
                              MD5:3B5B3D36FDE8FFE8ED76B1EFBFC65410
                              SHA1:D63107D0912FDB387530D5CE2D512C928D73D122
                              SHA-256:29D600462A30694EFD15B9848B4CA42D178CD067009275C35A30580121114304
                              SHA-512:3C96B7A1048B59107BC0767B190FE0FAACAFEABE266EE8668836FC06348567C359D9AE36A13B40AB99F4B9C580C1C403962900B64B9BFAD3D50B0E27A76ED60A
                              Malicious:false
                              Reputation:unknown
                              URL:https://unpkg.com/axios@1.6.8/dist/axios.min.js
                              Preview:!function(e,t){"object"==typeof exports&&"undefined"!=typeof module?module.exports=t():"function"==typeof define&&define.amd?define(t):(e="undefined"!=typeof globalThis?globalThis:e||self).axios=t()}(this,(function(){"use strict";function e(e,t){var r=Object.keys(e);if(Object.getOwnPropertySymbols){var n=Object.getOwnPropertySymbols(e);t&&(n=n.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),r.push.apply(r,n)}return r}function t(t){for(var r=1;r<arguments.length;r++){var n=null!=arguments[r]?arguments[r]:{};r%2?e(Object(n),!0).forEach((function(e){c(t,e,n[e])})):Object.getOwnPropertyDescriptors?Object.defineProperties(t,Object.getOwnPropertyDescriptors(n)):e(Object(n)).forEach((function(e){Object.defineProperty(t,e,Object.getOwnPropertyDescriptor(n,e))}))}return t}function r(){r=function(){return t};var e,t={},n=Object.prototype,o=n.hasOwnProperty,i=Object.defineProperty||function(e,t,r){e[t]=r.value},a="function"==typeof Symbol?Symbol:{},s=a.iterator||"@@

                              Chrome Cache Entry: 91

                              Download File
                              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                              File Type:PNG image data, 46 x 77, 8-bit/color RGB, non-interlaced
                              Category:downloaded
                              Size (bytes):61
                              Entropy (8bit):4.068159130770307
                              Encrypted:false
                              SSDEEP:
                              MD5:8CF013C5771DE62B4C9BFC0E3B6F8DBB
                              SHA1:6C8323AC81993BB0E1F745A59B93861B7773415E
                              SHA-256:14B731AF27720099F278BCC4BC5671717C177E0F495642163B1D4D0272431423
                              SHA-512:588FAF1C89B30B2319800D034148150544D50F4DAA74218BA9FA0A3B1C69E9BE173E820A87473854E9674F05E899990A617964E45DBE2F410A76614489E520A9
                              Malicious:false
                              Reputation:unknown
                              URL:https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/i/86a1f7a76a7d0582/1711401863669/JVpLHG1O4t__3We
                              Preview:.PNG........IHDR.......M.....V.......IDAT.....$.....IEND.B`.

                              Chrome Cache Entry: 93

                              Download File
                              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                              File Type:PNG image data, 280 x 60, 8-bit colormap, non-interlaced
                              Category:dropped
                              Size (bytes):5089
                              Entropy (8bit):7.9435811968649785
                              Encrypted:false
                              SSDEEP:
                              MD5:5F5EF4D1150B6E9C3432FF8116FFF7BE
                              SHA1:38DB3092CBE4E5EB467F1CED123AE16A66441402
                              SHA-256:0C634F07D09C4048E0FBB85958CA04A0C35CD7E1DC5D4CF03024A58C0B594F59
                              SHA-512:F964289F906161414E3BCE7038A74DFCF6D0B0E4A360657D18E6CC6BFB1E9626D58183F4723F3D30E12D845304A468957EFB5B3245FF712FC71EAEC9E0F7D852
                              Malicious:false
                              Reputation:unknown
                              Preview:.PNG........IHDR.......<.......U*....sRGB.........gAMA......a.....PLTE..b.!d.%f.&h.)i.,k.-m..n.*k.0n.1o.0n.1o.2p.4q.2q.6r.6t.8s.8t.6s.7t.2p.7s.9u.<v.9u.<v.=x.7s.;v.?y.>x.@z.B|.Bz.B|.D|.C|.F~.H."H..G..H..I..L. K.!M."N.$N.)O.#P.%P.(R.)T.*U.,V..X.0Y.2Z.3\.5].8_.7_.8_.9`.<b.>d.?e.@f.Bh.Ei.Fk.Gl.Hj.Im.Lo.Lp.Nq.Pr.Rt.Tu.Tv.Sv.Uv.Vx.Xx.Yz.[|.\{.\|.]}.`~._..a..d..c..d..f..h..j..j..m..n..q..p..t..q..t..s..u..x..x..z..{..{..}..~...]..a..b..e..h..j..k..l..n..r".t%.v(.y-.{0.}4.<.I.N.P.S.U.Z.\._.c.f.i.k.r.w........................................................................................................................................................................................................................................................................................................pHYs...s...s..".....jIDATx^.}|[.Y..r}.J..f.u$..[........`{.............,..0`.h.+0.....&..nE.(....7.7*VP...EqK.:H"...J..s..+.qK....A.?b..{^..9.y.

                              Chrome Cache Entry: 94

                              Download File
                              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                              File Type:SVG Scalable Vector Graphics image
                              Category:dropped
                              Size (bytes):3651
                              Entropy (8bit):4.094801914706141
                              Encrypted:false
                              SSDEEP:
                              MD5:EE5C8D9FB6248C938FD0DC19370E90BD
                              SHA1:D01A22720918B781338B5BBF9202B241A5F99EE4
                              SHA-256:04D29248EE3A13A074518C93A18D6EFC491BF1F298F9B87FC989A6AE4B9FAD7A
                              SHA-512:C77215B729D0E60C97F075998E88775CD0F813B4D094DC2FDD13E5711D16F4E5993D4521D0FBD5BF7150B0DBE253D88B1B1FF60901F053113C5D7C1919852D58
                              Malicious:false
                              Reputation:unknown
                              Preview:<svg xmlns="http://www.w3.org/2000/svg" width="108" height="24" viewBox="0 0 108 24"><title>assets</title><path d="M44.836,4.6V18.4h-2.4V7.583H42.4L38.119,18.4H36.531L32.142,7.583h-.029V18.4H29.9V4.6h3.436L37.3,14.83h.058L41.545,4.6Zm2,1.049a1.268,1.268,0,0,1,.419-.967,1.413,1.413,0,0,1,1-.39,1.392,1.392,0,0,1,1.02.4,1.3,1.3,0,0,1,.4.958,1.248,1.248,0,0,1-.414.953,1.428,1.428,0,0,1-1.01.385A1.4,1.4,0,0,1,47.25,6.6a1.261,1.261,0,0,1-.409-.948M49.41,18.4H47.081V8.507H49.41Zm7.064-1.694a3.213,3.213,0,0,0,1.145-.241,4.811,4.811,0,0,0,1.155-.635V18a4.665,4.665,0,0,1-1.266.481,6.886,6.886,0,0,1-1.554.164,4.707,4.707,0,0,1-4.918-4.908,5.641,5.641,0,0,1,1.4-3.932,5.055,5.055,0,0,1,3.955-1.545,5.414,5.414,0,0,1,1.324.168,4.431,4.431,0,0,1,1.063.39v2.233a4.763,4.763,0,0,0-1.1-.611,3.184,3.184,0,0,0-1.15-.217,2.919,2.919,0,0,0-2.223.9,3.37,3.37,0,0,0-.847,2.416,3.216,3.216,0,0,0,.813,2.338,2.936,2.936,0,0,0,2.209.837M65.4,8.343a2.952,2.952,0,0,1,.5.039,2.1,2.1,0,0,1,.375.1v2.358a2.04,2.04,0,0,0-.

                              Chrome Cache Entry: 95

                              Download File
                              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                              File Type:ASCII text, with very long lines (50758)
                              Category:downloaded
                              Size (bytes):51039
                              Entropy (8bit):5.247253437401007
                              Encrypted:false
                              SSDEEP:
                              MD5:67176C242E1BDC20603C878DEE836DF3
                              SHA1:27A71B00383D61EF3C489326B3564D698FC1227C
                              SHA-256:56C12A125B021D21A69E61D7190CEFA168D6C28CE715265CEA1B3B0112D169C4
                              SHA-512:9FA75814E1B9F7DB38FE61A503A13E60B82D83DB8F4CE30351BD08A6B48C0D854BAF472D891AF23C443C8293380C2325C7B3361B708AF9971AA0EA09A25CDD0A
                              Malicious:false
                              Reputation:unknown
                              URL:https://freelanceimaging.com/boot/75a551cd5bd32cdeceb67e3f30dd2f8a6601eb914b81a
                              Preview:/*!. * Bootstrap v4.1.3 (https://getbootstrap.com/). * Copyright 2011-2018 The Bootstrap Authors (https://github.com/twbs/bootstrap/graphs/contributors). * Licensed under MIT (https://github.com/twbs/bootstrap/blob/master/LICENSE). */.!function(t,e){"object"==typeof exports&&"undefined"!=typeof module?e(exports,require("jquery"),require("popper.js")):"function"==typeof define&&define.amd?define(["exports","jquery","popper.js"],e):e(t.bootstrap={},t.jQuery,t.Popper)}(this,function(t,e,h){"use strict";function i(t,e){for(var n=0;n<e.length;n++){var i=e[n];i.enumerable=i.enumerable||!1,i.configurable=!0,"value"in i&&(i.writable=!0),Object.defineProperty(t,i.key,i)}}function s(t,e,n){return e&&i(t.prototype,e),n&&i(t,n),t}function l(r){for(var t=1;t<arguments.length;t++){var o=null!=arguments[t]?arguments[t]:{},e=Object.keys(o);"function"==typeof Object.getOwnPropertySymbols&&(e=e.concat(Object.getOwnPropertySymbols(o).filter(function(t){return Object.getOwnPropertyDescriptor(o,t).enum

                              Static File Info

                              General

                              File type:news or mail, ASCII text, with very long lines (772), with CRLF line terminators
                              Entropy (8bit):5.41286092015823
                              TrID:
                              • E-Mail message (Var. 2) (17506/1) 100.00%
                              File name:Firstontario_FAX_832.eml
                              File size:4'917 bytes
                              MD5:1ca56b32e51905b7e7470609c4107eb8
                              SHA1:4c4e4f8938adad07ace5b899da9c7ab9c1735ed2
                              SHA256:a51734a0b5dcb860f7334361a319fe61ae1ff9c039f1131aa2984ccd7d6366e4
                              SHA512:62863844c95217db8932daa573860f4865bc2c61af783164b87b36b81969226760c665adf0905386261bd1c62794c89ef43b9a773d8c3a2d0e571ca3b6778a7c
                              SSDEEP:96:se1aNg1abzQN56BmBrE+CYQN56BmBrE+jECQfG2BmBrE+cGQsG6BmBrE+OX9znpv:srm6BCo6BCjN2BCY6BC69A6BCFOL6M
                              TLSH:78A13159D2555EA0C2970C65B19F7B08BA3C028FEF03C6B82DA56E65C24F25D23F6324
                              File Content Preview:From: Caller ID +1 (408) 218 - 218 <john.doran@Firstontario.com.com>..To: john.doran <john.doran@firstontario.com>..Subject: Firstontario Your calIer left you a message..x-originating-ip: [139.46.18.101]..Content-Type: multipart/related;...boundary="_001_

                              File Icon

                              Icon Hash:46070c0a8e0c67d6