Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
original (3).eml

Overview

General Information

Sample name:original (3).eml
Analysis ID:1467272
MD5:8d76f9f95d7346c886503af3f774cf1a
SHA1:13aa40ba54e9776e22b14e16b2d09e796218885e
SHA256:f0847d37e306f5fd2b2c0115732a9e49222ffd810c8b6a57ea41e188a1ef8d0e
Infos:

Detection

Score:2
Range:0 - 100
Whitelisted:false
Confidence:60%

Signatures

Queries the volume information (name, serial number etc) of a device
Sigma detected: Office Autorun Keys Modification
Sigma detected: Suspicious Office Outbound Connections
Stores files to the Windows start menu directory

Classification

Process Tree

  • System is w10x64_ra
  • OUTLOOK.EXE (PID: 7112 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\user\Desktop\original (3).eml" MD5: 91A5292942864110ED734005B7E005C0)
    • ai.exe (PID: 6276 cmdline: "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "F6594241-FCF2-4735-8AED-9AEE22C9A711" "AFD1C963-6D43-4C03-9FA5-ECE8DCB49D5E" "7112" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx" MD5: EC652BEDD90E089D9406AFED89A8A8BD)
    • chrome.exe (PID: 6632 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www.clover.com/checkout/0552f742-a361-4d4b-a3ae-90d09d1e75d2 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
      • chrome.exe (PID: 6792 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 --field-trial-handle=2024,i,8583603568419811748,7210310975597614668,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
  • cleanup

Yara Signatures

⊘No yara matches

Sigma Signatures

Sigma detected: Office Autorun Keys Modification
Source: Registry Key setAuthor: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 , EventID: 13, EventType: SetValue, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE, ProcessId: 7112, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Addins\OneNote.OutlookAddin\1
Sigma detected: Suspicious Office Outbound Connections
Source: Network ConnectionAuthor: X__Junior (Nextron Systems): Data: DestinationIp: 192.168.2.16, DestinationIsIpv6: false, DestinationPort: 49708, EventID: 3, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE, Initiated: true, ProcessId: 7112, Protocol: tcp, SourceIp: 166.73.4.197, SourceIsIpv6: false, SourcePort: 443

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: https://checkout.clover.com/widget.html?baseOrigin=https%3A%2F%2Fcheckout.clover.com&element=CARD_POSTAL_CODE&origin=https%3A%2F%2Fwww.clover.com&apiKey=bc22012281f7c86f7aa9b5c865b718c0&mId=TFBPCD63SEK91&styles=%7B%22.hydrated%22%3A%7B%22display%22%3A%22block%22%2C%22height%22%3A%222em%22%2C%22overflow%22%3A%22hidden%22%7D%2C%22input%22%3A%7B%22backgroundColor%22%3A%22transparent%22%2C%22boxShadow%22%3A%22none%22%2C%22fontSize%22%3A%2215px%22%2C%22height%22%3A%221.2em%22%2C%22width%22%3A%22100%25%22%7D%2C%22img%22%3A%7B%22height%22%3A%221.2em%20!important%22%2C%22width%22%3A%221.8em%22%7D%7D&locale=enHTTP Parser: No favicon
Source: https://checkout.clover.com/widget.html?baseOrigin=https%3A%2F%2Fcheckout.clover.com&element=CARD_CVV&origin=https%3A%2F%2Fwww.clover.com&apiKey=bc22012281f7c86f7aa9b5c865b718c0&mId=TFBPCD63SEK91&styles=%7B%22.hydrated%22%3A%7B%22display%22%3A%22block%22%2C%22height%22%3A%222em%22%2C%22overflow%22%3A%22hidden%22%7D%2C%22input%22%3A%7B%22backgroundColor%22%3A%22transparent%22%2C%22boxShadow%22%3A%22none%22%2C%22fontSize%22%3A%2215px%22%2C%22height%22%3A%221.2em%22%2C%22width%22%3A%22100%25%22%7D%2C%22img%22%3A%7B%22height%22%3A%221.2em%20!important%22%2C%22width%22%3A%221.8em%22%7D%7D&locale=enHTTP Parser: No favicon
Source: https://checkout.clover.com/widget.html?baseOrigin=https%3A%2F%2Fcheckout.clover.com&element=CARD_NUMBER&origin=https%3A%2F%2Fwww.clover.com&apiKey=bc22012281f7c86f7aa9b5c865b718c0&mId=TFBPCD63SEK91&styles=%7B%22.hydrated%22%3A%7B%22display%22%3A%22block%22%2C%22height%22%3A%222em%22%2C%22overflow%22%3A%22hidden%22%7D%2C%22input%22%3A%7B%22backgroundColor%22%3A%22transparent%22%2C%22boxShadow%22%3A%22none%22%2C%22fontSize%22%3A%2215px%22%2C%22height%22%3A%221.2em%22%2C%22width%22%3A%22100%25%22%7D%2C%22img%22%3A%7B%22height%22%3A%221.2em%20!important%22%2C%22width%22%3A%221.8em%22%7D%7D&locale=enHTTP Parser: No favicon
Source: https://checkout.clover.com/widget.html?baseOrigin=https%3A%2F%2Fcheckout.clover.com&element=CARD_DATE&origin=https%3A%2F%2Fwww.clover.com&apiKey=bc22012281f7c86f7aa9b5c865b718c0&mId=TFBPCD63SEK91&styles=%7B%22.hydrated%22%3A%7B%22display%22%3A%22block%22%2C%22height%22%3A%222em%22%2C%22overflow%22%3A%22hidden%22%7D%2C%22input%22%3A%7B%22backgroundColor%22%3A%22transparent%22%2C%22boxShadow%22%3A%22none%22%2C%22fontSize%22%3A%2215px%22%2C%22height%22%3A%221.2em%22%2C%22width%22%3A%22100%25%22%7D%2C%22img%22%3A%7B%22height%22%3A%221.2em%20!important%22%2C%22width%22%3A%221.8em%22%7D%7D&locale=enHTTP Parser: No favicon
Source: https://checkout.clover.com/widget.html?baseOrigin=https%3A%2F%2Fcheckout.clover.com&element=INTERMEDIATE&origin=https%3A%2F%2Fwww.clover.com&apiKey=bc22012281f7c86f7aa9b5c865b718c0&mId=TFBPCD63SEK91&locale=enHTTP Parser: No favicon
Source: https://checkout.clover.com/widget.html?baseOrigin=https%3A%2F%2Fcheckout.clover.com&element=PAYMENT_REQUEST_BUTTON&origin=https%3A%2F%2Fwww.clover.com&apiKey=bc22012281f7c86f7aa9b5c865b718c0&mId=TFBPCD63SEK91&styles=%7B%7D&paymentRequest=%7B%22total%22%3A%7B%22label%22%3A%22Clover%20checkout%22%2C%22amount%22%3A25750%7D%2C%22merchantHostname%22%3A%22www.clover.com%22%7D&locale=enHTTP Parser: No favicon
Source: https://checkout.clover.com/widget.html?baseOrigin=https%3A%2F%2Fcheckout.clover.com&element=PAYMENT_REQUEST_BUTTON&origin=https%3A%2F%2Fwww.clover.com&apiKey=bc22012281f7c86f7aa9b5c865b718c0&mId=TFBPCD63SEK91&styles=%7B%7D&paymentRequest=%7B%22total%22%3A%7B%22label%22%3A%22Clover%20checkout%22%2C%22amount%22%3A25750%7D%2C%22merchantHostname%22%3A%22www.clover.com%22%7D&locale=enHTTP Parser: No favicon
Source: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LcvpW0nAAAAAMdjeor9kycixdFzk33K1G_hmOM_&co=aHR0cHM6Ly93d3cuY2xvdmVyLmNvbTo0NDM.&hl=en&type=image&v=rKbTvxTxwcw5VqzrtN-ICwWt&theme=light&size=invisible&badge=bottomright&cb=82nue22mxl4zHTTP Parser: No favicon
Source: https://pay.google.com/gp/p/generate_gpay_btn_img?buttonColor=default&browserLocale=en&hl=en&buttonSizeMode=fill&enableGpayNewButtonAsset=false&gpayButtonVariantType=1&gpayButtonType=longHTTP Parser: No favicon
Source: https://pay.google.com/gp/p/generate_gpay_btn_img?buttonColor=default&browserLocale=en&hl=en&buttonSizeMode=fill&enableGpayNewButtonAsset=false&gpayButtonVariantType=1&gpayButtonType=longHTTP Parser: No favicon
Source: https://www.google.com/recaptcha/api2/bframe?hl=en&v=rKbTvxTxwcw5VqzrtN-ICwWt&k=6LcvpW0nAAAAAMdjeor9kycixdFzk33K1G_hmOM_HTTP Parser: No favicon
Source: https://www.google.com/recaptcha/api2/bframe?hl=en&v=rKbTvxTxwcw5VqzrtN-ICwWt&k=6LcvpW0nAAAAAMdjeor9kycixdFzk33K1G_hmOM_HTTP Parser: No favicon
Source: https://pay.google.com/gp/p/ui/payframe?origin=https%3A%2F%2Fcheckout.clover.com&mid=HTTP Parser: No favicon
Source: https://checkout.clover.com/widget.html?baseOrigin=https%3A%2F%2Fcheckout.clover.com&element=PAYMENT_REQUEST_BUTTON&origin=https%3A%2F%2Fwww.clover.com&apiKey=bc22012281f7c86f7aa9b5c865b718c0&mId=TFBPCD63SEK91&styles=%7B%7D&paymentRequest=%7B%22total%22%3A%7B%22label%22%3A%22Clover%20checkout%22%2C%22amount%22%3A25750%7D%2C%22merchantHostname%22%3A%22www.clover.com%22%7D&locale=enHTTP Parser: No favicon
Source: unknownHTTPS traffic detected: 40.126.31.69:443 -> 192.168.2.16:49706 version: TLS 1.2
Source: unknownHTTPS traffic detected: 40.126.31.69:443 -> 192.168.2.16:49707 version: TLS 1.2
Source: unknownHTTPS traffic detected: 166.73.4.197:443 -> 192.168.2.16:49708 version: TLS 1.2
Source: unknownHTTPS traffic detected: 167.89.115.147:443 -> 192.168.2.16:49709 version: TLS 1.2
Source: unknownHTTPS traffic detected: 52.165.165.26:443 -> 192.168.2.16:49715 version: TLS 1.2
Source: unknownHTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.16:49866 version: TLS 1.2
Source: unknownTCP traffic detected without corresponding DNS query: 40.126.31.69
Source: unknownTCP traffic detected without corresponding DNS query: 40.126.31.69
Source: unknownTCP traffic detected without corresponding DNS query: 40.126.31.69
Source: unknownTCP traffic detected without corresponding DNS query: 40.126.31.69
Source: unknownTCP traffic detected without corresponding DNS query: 40.126.31.69
Source: unknownTCP traffic detected without corresponding DNS query: 40.126.31.69
Source: unknownTCP traffic detected without corresponding DNS query: 40.126.31.69
Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknownTCP traffic detected without corresponding DNS query: 40.126.31.69
Source: unknownTCP traffic detected without corresponding DNS query: 40.126.31.69
Source: unknownTCP traffic detected without corresponding DNS query: 40.126.31.69
Source: unknownTCP traffic detected without corresponding DNS query: 40.126.31.69
Source: unknownTCP traffic detected without corresponding DNS query: 40.126.31.69
Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknownTCP traffic detected without corresponding DNS query: 40.126.31.69
Source: unknownTCP traffic detected without corresponding DNS query: 40.126.31.69
Source: unknownTCP traffic detected without corresponding DNS query: 40.126.31.69
Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknownTCP traffic detected without corresponding DNS query: 40.126.31.69
Source: unknownTCP traffic detected without corresponding DNS query: 40.126.31.69
Source: unknownTCP traffic detected without corresponding DNS query: 40.126.31.69
Source: unknownTCP traffic detected without corresponding DNS query: 40.126.31.69
Source: unknownTCP traffic detected without corresponding DNS query: 40.126.31.69
Source: unknownTCP traffic detected without corresponding DNS query: 40.126.31.69
Source: unknownTCP traffic detected without corresponding DNS query: 40.126.31.69
Source: unknownTCP traffic detected without corresponding DNS query: 40.126.31.69
Source: unknownTCP traffic detected without corresponding DNS query: 40.126.31.69
Source: unknownTCP traffic detected without corresponding DNS query: 40.126.31.69
Source: unknownTCP traffic detected without corresponding DNS query: 40.126.31.69
Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknownTCP traffic detected without corresponding DNS query: 40.126.31.69
Source: unknownTCP traffic detected without corresponding DNS query: 40.126.31.69
Source: unknownTCP traffic detected without corresponding DNS query: 40.126.31.69
Source: unknownTCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknownTCP traffic detected without corresponding DNS query: 40.126.31.69
Source: unknownTCP traffic detected without corresponding DNS query: 40.126.31.69
Source: unknownTCP traffic detected without corresponding DNS query: 40.126.31.69
Source: unknownTCP traffic detected without corresponding DNS query: 40.126.31.69
Source: unknownTCP traffic detected without corresponding DNS query: 40.126.31.69
Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknownTCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknownTCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknownTCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknownTCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknownTCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknownTCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknownTCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknownTCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknownTCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknownTCP traffic detected without corresponding DNS query: 52.165.165.26
Source: global trafficDNS traffic detected: DNS query: www.clover.com
Source: global trafficDNS traffic detected: DNS query: u17060778.ct.sendgrid.net
Source: global trafficDNS traffic detected: DNS query: cloverstatic.com
Source: global trafficDNS traffic detected: DNS query: www.google.com
Source: global trafficDNS traffic detected: DNS query: checkout.clover.com
Source: global trafficDNS traffic detected: DNS query: google.com
Source: global trafficDNS traffic detected: DNS query: pay.google.com
Source: global trafficDNS traffic detected: DNS query: api.clover.com
Source: global trafficDNS traffic detected: DNS query: pay.sandbox.google.com
Source: global trafficDNS traffic detected: DNS query: play.google.com
Source: unknownNetwork traffic detected: HTTP traffic on port 49708 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49744
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49865
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49743
Source: unknownNetwork traffic detected: HTTP traffic on port 49817 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49864
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49742
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49863
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49741
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49862
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49740
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49861
Source: unknownNetwork traffic detected: HTTP traffic on port 49789 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49766 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49743 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49795 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49739
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49738
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49859
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49737
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49736
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49735
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49734
Source: unknownNetwork traffic detected: HTTP traffic on port 49772 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49855
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49733
Source: unknownNetwork traffic detected: HTTP traffic on port 49841 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49732
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49731
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49730
Source: unknownNetwork traffic detected: HTTP traffic on port 49732 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49851
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49850
Source: unknownNetwork traffic detected: HTTP traffic on port 49784 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49749 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49806 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49823 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49729
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49849
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49848
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49726
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49847
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49725
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49846
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49724
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49845
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49723
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49844
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49722
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49843
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49842
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49841
Source: unknownNetwork traffic detected: HTTP traffic on port 49731 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49840
Source: unknownNetwork traffic detected: HTTP traffic on port 49834 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49748 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49828 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49839
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49717
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49838
Source: unknownNetwork traffic detected: HTTP traffic on port 49715 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49837
Source: unknownNetwork traffic detected: HTTP traffic on port 49847 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49715
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49836
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49835
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49834
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49833
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49832
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49710
Source: unknownNetwork traffic detected: HTTP traffic on port 49709 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49831
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49830
Source: unknownNetwork traffic detected: HTTP traffic on port 49839 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49864 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49822 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49726 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49765 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49709
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49708
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49829
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49707
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49828
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49706
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49827
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49826
Source: unknownNetwork traffic detected: HTTP traffic on port 49754 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49825
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49824
Source: unknownNetwork traffic detected: HTTP traffic on port 49737 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49823
Source: unknownNetwork traffic detected: HTTP traffic on port 49771 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49822
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49788
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49787
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49784
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49781
Source: unknownNetwork traffic detected: HTTP traffic on port 49836 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49845 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49736 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49791 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49868 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49759 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49753 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49707 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49862 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49772
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49771
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49770
Source: unknownNetwork traffic detected: HTTP traffic on port 49724 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49742 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49851 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49830 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49768
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49767
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49766
Source: unknownNetwork traffic detected: HTTP traffic on port 49758 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49765
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49764
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49763
Source: unknownNetwork traffic detected: HTTP traffic on port 49863 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49762
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49761
Source: unknownNetwork traffic detected: HTTP traffic on port 49840 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49725 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49741 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49764 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49770 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49824 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49759
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49758
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49757
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49756
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49755
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49754
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49753
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49752
Source: unknownNetwork traffic detected: HTTP traffic on port 49730 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49751
Source: unknownNetwork traffic detected: HTTP traffic on port 49818 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49750
Source: unknownNetwork traffic detected: HTTP traffic on port 49835 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49747 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49829 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49749
Source: unknownNetwork traffic detected: HTTP traffic on port 49846 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49748
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49747
Source: unknownNetwork traffic detected: HTTP traffic on port 49792 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49868
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49746
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49745
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49866
Source: unknownNetwork traffic detected: HTTP traffic on port 49746 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49781 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49826 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49717 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49849 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49866 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49837 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49763 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49855 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49752 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49798 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49861 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49735 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49706 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49819 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49844 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49787 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49729 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49745 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49793 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49850 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49831 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49751 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49757 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49798
Source: unknownNetwork traffic detected: HTTP traffic on port 49734 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49795
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49793
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49792
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49791
Source: unknownNetwork traffic detected: HTTP traffic on port 49740 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49768 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49723 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49825 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49808 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49789
Source: unknownNetwork traffic detected: HTTP traffic on port 49733 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49865 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49710 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49842 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49859 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49762 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49833 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49819
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49818
Source: unknownNetwork traffic detected: HTTP traffic on port 49810 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49817
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49816
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49810
Source: unknownNetwork traffic detected: HTTP traffic on port 49816 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49788 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49767 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49827 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49808
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49806
Source: unknownNetwork traffic detected: HTTP traffic on port 49848 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49804
Source: unknownNetwork traffic detected: HTTP traffic on port 49756 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49739 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49838 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49678 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49722 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49755 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49738 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49673 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49843 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49761 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49804 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49744 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49832 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49750 -> 443
Source: unknownHTTPS traffic detected: 40.126.31.69:443 -> 192.168.2.16:49706 version: TLS 1.2
Source: unknownHTTPS traffic detected: 40.126.31.69:443 -> 192.168.2.16:49707 version: TLS 1.2
Source: unknownHTTPS traffic detected: 166.73.4.197:443 -> 192.168.2.16:49708 version: TLS 1.2
Source: unknownHTTPS traffic detected: 167.89.115.147:443 -> 192.168.2.16:49709 version: TLS 1.2
Source: unknownHTTPS traffic detected: 52.165.165.26:443 -> 192.168.2.16:49715 version: TLS 1.2
Source: unknownHTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.16:49866 version: TLS 1.2
Source: classification engineClassification label: clean2.winEML@26/16@42/342
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEFile created: C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEFile created: C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20240703T1800170215-7112.etl
Source: unknownProcess created: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\user\Desktop\original (3).eml"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "F6594241-FCF2-4735-8AED-9AEE22C9A711" "AFD1C963-6D43-4C03-9FA5-ECE8DCB49D5E" "7112" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "F6594241-FCF2-4735-8AED-9AEE22C9A711" "AFD1C963-6D43-4C03-9FA5-ECE8DCB49D5E" "7112" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www.clover.com/checkout/0552f742-a361-4d4b-a3ae-90d09d1e75d2
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 --field-trial-handle=2024,i,8583603568419811748,7210310975597614668,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www.clover.com/checkout/0552f742-a361-4d4b-a3ae-90d09d1e75d2
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 --field-trial-handle=2024,i,8583603568419811748,7210310975597614668,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: apphelp.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: c2r64.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: userenv.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: msasn1.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: cryptsp.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: rsaenh.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: cryptbase.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: gpapi.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{F959DBBB-3867-41F2-8E5F-3B8BEFAA81B3}\InprocServer32
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEWindow found: window name: SysTabControl32
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Common
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEFile Volume queried: C:\Windows\SysWOW64 FullSizeInformation
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information queried: ProcessInformation
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeQueries volume information: C:\Program Files (x86)\Microsoft Office\root\Office16\AI\WordCombinedFloatieLreOnline.onnx VolumeInformation
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management Instrumentation1
DLL Side-Loading		1
Process Injection		1
Masquerading		OS Credential Dumping1
Process Discovery		Remote ServicesData from Local System2
Encrypted Channel		Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/Job1
Registry Run Keys / Startup Folder		1
DLL Side-Loading		1
Process Injection		LSASS Memory13
System Information Discovery		Remote Desktop ProtocolData from Removable Media1
Non-Application Layer Protocol		Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)1
Registry Run Keys / Startup Folder		1
DLL Side-Loading		Security Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared Drive2
Application Layer Protocol		Automated ExfiltrationData Encrypted for Impact

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

⊘No Antivirus matches

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

SourceDetectionScannerLabelLink
about:blank0%Avira URL Cloudsafe

Domains and IPs

Contacted Domains

NameIPActiveMaliciousAntivirus DetectionReputation
google.com
142.250.184.206
truefalse
    		unknown
    checkout.clover.com
    		35.241.51.22
    		truefalse
      		unknown
      u17060778.ct.sendgrid.net
      		167.89.115.147
      		truefalse
        		unknown
        pay.sandbox.google.com
        		66.102.1.81
        		truefalse
          		unknown
          play.google.com
          		142.250.186.174
          		truefalse
            		unknown
            pay.google.com
            		64.233.167.92
            		truefalse
              		unknown
              www.google.com
              		142.250.185.100
              		truefalse
                		unknown
                api.clover.com
                		166.73.4.198
                		truefalse
                  		unknown
                  cloverstatic.com
                  		166.73.4.207
                  		truefalse
                    		unknown
                    www.clover.com
                    		166.73.4.197
                    		truefalse
                      		unknown

                      Contacted URLs

                      NameMaliciousAntivirus DetectionReputation
                      https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LcvpW0nAAAAAMdjeor9kycixdFzk33K1G_hmOM_&co=aHR0cHM6Ly93d3cuY2xvdmVyLmNvbTo0NDM.&hl=en&type=image&v=rKbTvxTxwcw5VqzrtN-ICwWt&theme=light&size=invisible&badge=bottomright&cb=82nue22mxl4zfalse
                        		unknown
                        https://checkout.clover.com/widget.html?baseOrigin=https%3A%2F%2Fcheckout.clover.com&element=PAYMENT_REQUEST_BUTTON&origin=https%3A%2F%2Fwww.clover.com&apiKey=bc22012281f7c86f7aa9b5c865b718c0&mId=TFBPCD63SEK91&styles=%7B%7D&paymentRequest=%7B%22total%22%3A%7B%22label%22%3A%22Clover%20checkout%22%2C%22amount%22%3A25750%7D%2C%22merchantHostname%22%3A%22www.clover.com%22%7D&locale=enfalse
                          		unknown
                          https://checkout.clover.com/widget.html?baseOrigin=https%3A%2F%2Fcheckout.clover.com&element=INTERMEDIATE&origin=https%3A%2F%2Fwww.clover.com&apiKey=bc22012281f7c86f7aa9b5c865b718c0&mId=TFBPCD63SEK91&locale=enfalse
                            		unknown
                            https://pay.google.com/gp/p/generate_gpay_btn_img?buttonColor=default&browserLocale=en&hl=en&buttonSizeMode=fill&enableGpayNewButtonAsset=false&gpayButtonVariantType=1&gpayButtonType=longfalse
                              		unknown
                              https://checkout.clover.com/widget.html?baseOrigin=https%3A%2F%2Fcheckout.clover.com&element=CARD_DATE&origin=https%3A%2F%2Fwww.clover.com&apiKey=bc22012281f7c86f7aa9b5c865b718c0&mId=TFBPCD63SEK91&styles=%7B%22.hydrated%22%3A%7B%22display%22%3A%22block%22%2C%22height%22%3A%222em%22%2C%22overflow%22%3A%22hidden%22%7D%2C%22input%22%3A%7B%22backgroundColor%22%3A%22transparent%22%2C%22boxShadow%22%3A%22none%22%2C%22fontSize%22%3A%2215px%22%2C%22height%22%3A%221.2em%22%2C%22width%22%3A%22100%25%22%7D%2C%22img%22%3A%7B%22height%22%3A%221.2em%20!important%22%2C%22width%22%3A%221.8em%22%7D%7D&locale=enfalse
                                		unknown
                                about:blankfalse
                                • Avira URL Cloud: safe
                                		unknown
                                https://pay.google.com/gp/p/ui/payframe?origin=https%3A%2F%2Fcheckout.clover.com&mid=false
                                  		unknown
                                  https://www.google.com/recaptcha/api2/bframe?hl=en&v=rKbTvxTxwcw5VqzrtN-ICwWt&k=6LcvpW0nAAAAAMdjeor9kycixdFzk33K1G_hmOM_false
                                    		unknown
                                    https://checkout.clover.com/widget.html?baseOrigin=https%3A%2F%2Fcheckout.clover.com&element=CARD_POSTAL_CODE&origin=https%3A%2F%2Fwww.clover.com&apiKey=bc22012281f7c86f7aa9b5c865b718c0&mId=TFBPCD63SEK91&styles=%7B%22.hydrated%22%3A%7B%22display%22%3A%22block%22%2C%22height%22%3A%222em%22%2C%22overflow%22%3A%22hidden%22%7D%2C%22input%22%3A%7B%22backgroundColor%22%3A%22transparent%22%2C%22boxShadow%22%3A%22none%22%2C%22fontSize%22%3A%2215px%22%2C%22height%22%3A%221.2em%22%2C%22width%22%3A%22100%25%22%7D%2C%22img%22%3A%7B%22height%22%3A%221.2em%20!important%22%2C%22width%22%3A%221.8em%22%7D%7D&locale=enfalse
                                      		unknown
                                      https://checkout.clover.com/widget.html?baseOrigin=https%3A%2F%2Fcheckout.clover.com&element=CARD_CVV&origin=https%3A%2F%2Fwww.clover.com&apiKey=bc22012281f7c86f7aa9b5c865b718c0&mId=TFBPCD63SEK91&styles=%7B%22.hydrated%22%3A%7B%22display%22%3A%22block%22%2C%22height%22%3A%222em%22%2C%22overflow%22%3A%22hidden%22%7D%2C%22input%22%3A%7B%22backgroundColor%22%3A%22transparent%22%2C%22boxShadow%22%3A%22none%22%2C%22fontSize%22%3A%2215px%22%2C%22height%22%3A%221.2em%22%2C%22width%22%3A%22100%25%22%7D%2C%22img%22%3A%7B%22height%22%3A%221.2em%20!important%22%2C%22width%22%3A%221.8em%22%7D%7D&locale=enfalse
                                        		unknown
                                        https://www.clover.com/checkout/0552f742-a361-4d4b-a3ae-90d09d1e75d2false
                                          		unknown
                                          https://checkout.clover.com/widget.html?baseOrigin=https%3A%2F%2Fcheckout.clover.com&element=CARD_NUMBER&origin=https%3A%2F%2Fwww.clover.com&apiKey=bc22012281f7c86f7aa9b5c865b718c0&mId=TFBPCD63SEK91&styles=%7B%22.hydrated%22%3A%7B%22display%22%3A%22block%22%2C%22height%22%3A%222em%22%2C%22overflow%22%3A%22hidden%22%7D%2C%22input%22%3A%7B%22backgroundColor%22%3A%22transparent%22%2C%22boxShadow%22%3A%22none%22%2C%22fontSize%22%3A%2215px%22%2C%22height%22%3A%221.2em%22%2C%22width%22%3A%22100%25%22%7D%2C%22img%22%3A%7B%22height%22%3A%221.2em%20!important%22%2C%22width%22%3A%221.8em%22%7D%7D&locale=enfalse
                                            		unknown

                                            World Map of Contacted IPs

                                            • No. of IPs < 25%
                                            • 25% < No. of IPs < 50%
                                            • 50% < No. of IPs < 75%
                                            • 75% < No. of IPs

                                            Public IPs

                                            IPDomainCountryFlagASNASN NameMalicious
                                            142.250.186.68
                                            		unknownUnited States
                                            		15169GOOGLEUSfalse
                                            108.177.15.92
                                            		unknownUnited States
                                            		15169GOOGLEUSfalse
                                            142.250.186.174
                                            		play.google.comUnited States
                                            		15169GOOGLEUSfalse
                                            20.42.65.84
                                            		unknownUnited States
                                            		8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                                            142.250.185.100
                                            		www.google.comUnited States
                                            		15169GOOGLEUSfalse
                                            142.250.185.227
                                            		unknownUnited States
                                            		15169GOOGLEUSfalse
                                            172.217.23.99
                                            		unknownUnited States
                                            		15169GOOGLEUSfalse
                                            166.73.4.198
                                            		api.clover.comUnited States
                                            		6318CHECKFREEUSfalse
                                            64.233.184.92
                                            		unknownUnited States
                                            		15169GOOGLEUSfalse
                                            2.19.126.160
                                            		unknownEuropean Union
                                            		16625AKAMAI-ASUSfalse
                                            166.73.4.197
                                            		www.clover.comUnited States
                                            		6318CHECKFREEUSfalse
                                            64.233.167.92
                                            		pay.google.comUnited States
                                            		15169GOOGLEUSfalse
                                            52.109.89.19
                                            		unknownUnited States
                                            		8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                                            35.241.51.22
                                            		checkout.clover.comUnited States
                                            		15169GOOGLEUSfalse
                                            142.250.184.206
                                            		google.comUnited States
                                            		15169GOOGLEUSfalse
                                            142.250.186.74
                                            		unknownUnited States
                                            		15169GOOGLEUSfalse
                                            52.113.194.132
                                            		unknownUnited States
                                            		8068MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                                            142.250.184.195
                                            		unknownUnited States
                                            		15169GOOGLEUSfalse
                                            23.212.194.8
                                            		unknownUnited States
                                            		16625AKAMAI-ASUSfalse
                                            66.102.1.81
                                            		pay.sandbox.google.comUnited States
                                            		15169GOOGLEUSfalse
                                            1.1.1.1
                                            		unknownAustralia
                                            		13335CLOUDFLARENETUSfalse
                                            173.194.76.92
                                            		unknownUnited States
                                            		15169GOOGLEUSfalse
                                            167.89.115.147
                                            		u17060778.ct.sendgrid.netUnited States
                                            		11377SENDGRIDUSfalse
                                            172.217.16.206
                                            		unknownUnited States
                                            		15169GOOGLEUSfalse
                                            142.250.186.163
                                            		unknownUnited States
                                            		15169GOOGLEUSfalse
                                            172.217.18.3
                                            		unknownUnited States
                                            		15169GOOGLEUSfalse
                                            2.19.126.137
                                            		unknownEuropean Union
                                            		16625AKAMAI-ASUSfalse
                                            142.250.185.238
                                            		unknownUnited States
                                            		15169GOOGLEUSfalse
                                            216.58.206.46
                                            		unknownUnited States
                                            		15169GOOGLEUSfalse
                                            64.233.167.84
                                            		unknownUnited States
                                            		15169GOOGLEUSfalse
                                            239.255.255.250
                                            		unknownReserved
                                            		unknownunknownfalse
                                            142.250.185.195
                                            		unknownUnited States
                                            		15169GOOGLEUSfalse
                                            142.250.186.164
                                            		unknownUnited States
                                            		15169GOOGLEUSfalse
                                            172.217.16.196
                                            		unknownUnited States
                                            		15169GOOGLEUSfalse
                                            166.73.4.207
                                            		cloverstatic.comUnited States
                                            		6318CHECKFREEUSfalse
                                            172.217.16.195
                                            		unknownUnited States
                                            		15169GOOGLEUSfalse

                                            Private

                                            IP
                                            192.168.2.16

                                            General Information

                                            Joe Sandbox version:40.0.0 Tourmaline
                                            Analysis ID:1467272
                                            Start date and time:2024-07-03 23:59:50 +02:00
                                            Joe Sandbox product:CloudBasic
                                            Overall analysis duration:
                                            Hypervisor based Inspection enabled:false
                                            Report type:full
                                            Cookbook file name:defaultwindowsinteractivecookbook.jbs
                                            Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                            Number of analysed new started processes analysed:18
                                            Number of new started drivers analysed:0
                                            Number of existing processes analysed:0
                                            Number of existing drivers analysed:0
                                            Number of injected processes analysed:0
                                            Technologies:
                                            • EGA enabled
                                            Analysis Mode:stream
                                            Analysis stop reason:Timeout
                                            Sample name:original (3).eml
                                            Detection:CLEAN
                                            Classification:clean2.winEML@26/16@42/342
                                            Cookbook Comments:
                                            • Found application associated with file extension: .eml

                                            Warnings

                                            • Exclude process from analysis (whitelisted): dllhost.exe
                                            • Excluded IPs from analysis (whitelisted): 52.113.194.132
                                            • Excluded domains from analysis (whitelisted): ecs.office.com, s-0005.s-msedge.net, ecs.office.trafficmanager.net, s-0005-office.config.skype.com, ecs-office.s-0005.s-msedge.net
                                            • Not all processes where analyzed, report is missing behavior information
                                            • Report size getting too big, too many NtQueryAttributesFile calls found.
                                            • Report size getting too big, too many NtQueryValueKey calls found.
                                            • VT rate limit hit for: original (3).eml

                                            LLM Input / Output

                                            InputOutput
                                            URL: https://www.clover.com/checkout/0552f742-a361-4d4b-a3ae-90d09d1e75d2 Model: Perplexity: mixtral-8x7b-instruct
                                            {"loginform": false,"urgency": false,"captcha": false,"reasons": ["The webpage does not contain a login form as there is no explicit request for sensitive information such as passwords, email addresses, usernames, phone numbers or credit card numbers (CVV).","The text does not create a sense of urgency as it does not contain phrases such as 'Click here to view document', 'To view secured document click here', or 'Open the link to see your invoice'.","The webpage does not contain a CAPTCHA or any other anti-robot detection mechanism."]}
                                            Title: Web Checkout | Clover OCR: ROSWELL-CHAVES COUNTY ED Invoice Request Invoice creation July 3, 2024 Invoice number 4QZ55FDBG25Z4 Subtotal $250.00 $7.50 Tip $257.50 Total Card Information pay $257.50 you agree to Clover's Terms of By paying,
                                            URL: https://www.clover.com/checkout/0552f742-a361-4d4b-a3ae-90d09d1e75d2 Model: Perplexity: mixtral-8x7b-instruct
                                            {"loginform": false,"urgency": false,"captcha": false,"reasons": ["The webpage does not contain a login form as there is no explicit request for sensitive information such as passwords, email addresses, usernames, phone numbers or credit card numbers (CVV).","The text does not create a sense of urgency as it does not contain phrases such as 'Click here to view document', 'To view secured document click here', or 'Open the link to see your invoice'.","The webpage does not contain a CAPTCHA or any other anti-robot detection mechanism."]}
                                            Title: Web Checkout | Clover OCR: ROSWELL-CHAVES COUNTY ED Invoice Request Invoice creation July 3, 2024 Invoice number 4QZ55FDBG25Z4 Subtotal $250.00 $7.50 Tip $257.50 Total pay Card Information Card Number MWYY Zip pay $257.50 you agree to Clover's Terms of By paying,
                                            URL: https://www.clover.com/checkout/0552f742-a361-4d4b-a3ae-90d09d1e75d2 Model: Perplexity: mixtral-8x7b-instruct
                                            {"loginform": false,"urgency": false,"captcha": false,"reasons": ["The webpage does not contain a login form as there is no explicit request for sensitive information such as passwords, email addresses, usernames, phone numbers or credit card numbers (CVV).","The text does not create a sense of urgency as it does not contain phrases such as 'Click here to view document', 'To view secured document click here', or 'Open the link to see your invoice'.","The webpage does not contain a CAPTCHA or any other anti-robot detection mechanism."]}
                                            Title: Web Checkout | Clover OCR: ROSWELL-CHAVES COUNTY ED Invoice Request Invoice creation July 3, 2024 Invoice number 4QZ55FDBG25Z4 Subtotal $250.00 $7.50 Tip $257.50 Total Pay Buy with Card Information Card Number MWYY Zip pay $257.50 you agree to Clover's Terms of By paying,

                                            Created / dropped Files

                                            C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

                                            Download File
                                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                            File Type:data
                                            Category:dropped
                                            Size (bytes):338
                                            Entropy (8bit):3.461619070928607
                                            Encrypted:false
                                            SSDEEP:
                                            MD5:772E4C34B5880F794BBE8702B79211A0
                                            SHA1:3664C544BD339CB7B2CDD1D42A416670E3ED3F6F
                                            SHA-256:39166176D3862E84D3EFBF20CADDC6B4960B1191D7CC434FF6BA444118BAECD6
                                            SHA-512:5318BF00BF84BDC7736E1E4EBDC55281F9A72D34AB862D3E41931B0116B70B814F313C76159A1AEE19EF83007B8A7FF00F6EED022D2C44579ACB009652A63CBB
                                            Malicious:false
                                            Reputation:unknown
                                            Preview:p...... ........j;.e....(..................................................^SZ.. .........p.........$...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.d.i.s.a.l.l.o.w.e.d.c.e.r.t.s.t.l...c.a.b...".7.4.6.7.8.7.a.3.f.0.d.9.1.:.0."...

                                            C:\Users\user\AppData\Local\Microsoft\FORMS\FRMCACHE.DAT

                                            Download File
                                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                            File Type:data
                                            Category:dropped
                                            Size (bytes):231348
                                            Entropy (8bit):4.390878188821592
                                            Encrypted:false
                                            SSDEEP:
                                            MD5:A39C90AB1E6B29EE9C4428960F9364DC
                                            SHA1:E3F73A96384A8ACB1214968528CDD2060B0423B3
                                            SHA-256:B895BB3100B1B3A9B3673860573E58C8AE29598955B40348F3646EBE94F2CE3F
                                            SHA-512:49356726415085C3A67FD4F4E36A9E75E26A630D3EDFFD20BB794068196566EA29FCE7A2E5057412F1AD1E2A6B24BDA32661BFF91348427DF5FAF070BBFF86F7
                                            Malicious:false
                                            Reputation:unknown
                                            Preview:TH02...... ....[........SM01X...,...0_.[............IPM.Activity...........h...............h............H..h.......3.P...h............H..h\cal ...pDat...h.L..0...@......h95.9...........h........_`Rk...hu4.9@...I.lw...h....H...8.Wk...0....T...............d.........2h...............k...h.....XIF..!h.............. h...[....X.....#h....8.........$h........8....."h........`.....'h..............1h95.9<.........0h....4....Wk../h....h.....WkH..h8...p.......-h .............+h.5.9....................... ..............F7..............FIPM.Activity....Form....Standard....Journal Entry...IPM.Microsoft.FolderDesign.FormsDescription................F.k..........1122110020000000.GwwMicrosoft...This form is used to create journal entries.........kf...... ..........&...........(.......(... ...@.....................................................................................................................fffffffff........wwwwwwww.p....pp..............p...............pw..............pw..DDDDO..

                                            C:\Users\user\AppData\Local\Microsoft\FontCache\4\Catalog\ListAll.Json

                                            Download File
                                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                            File Type:JSON data
                                            Category:dropped
                                            Size (bytes):521377
                                            Entropy (8bit):4.9084889265453135
                                            Encrypted:false
                                            SSDEEP:
                                            MD5:C37972CBD8748E2CA6DA205839B16444
                                            SHA1:9834B46ACF560146DD7EE9086DB6019FBAC13B4E
                                            SHA-256:D4CFBB0E8B9D3E36ECE921B9B51BD37EF1D3195A9CFA1C4586AEA200EB3434A7
                                            SHA-512:02B4D134F84122B6EE9A304D79745A003E71803C354FB01BAF986BD15E3BA57BA5EF167CC444ED67B9BA5964FF5922C50E2E92A8A09862059852ECD9CEF1A900
                                            Malicious:false
                                            Reputation:unknown
                                            Preview:{"MajorVersion":4,"MinorVersion":40,"Expiration":14,"Fonts":[{"a":[4294966911],"f":"Abadi","fam":[],"sf":[{"c":[1,0],"dn":"Abadi","fs":32696,"ful":[{"lcp":983041,"lsc":"Latn","ltx":"Abadi"}],"gn":"Abadi","id":"23643452060","p":[2,11,6,4,2,1,4,2,2,4],"sub":[],"t":"ttf","u":[2147483651,0,0,0],"v":197263,"w":26215680},{"c":[1,0],"dn":"Abadi Extra Light","fs":22180,"ful":[{"lcp":983042,"lsc":"Latn","ltx":"Abadi Extra Light"}],"gn":"Abadi Extra Light","id":"17656736728","p":[2,11,2,4,2,1,4,2,2,4],"sub":[],"t":"ttf","u":[2147483651,0,0,0],"v":197263,"w":13108480}]},{"a":[4294966911],"f":"ADLaM Display","fam":[],"sf":[{"c":[536870913,0],"dn":"ADLaM Display Regular","fs":140072,"ful":[{"lcp":983040,"lsc":"Latn","ltx":"ADLaM Display"}],"gn":"ADLaM Display","id":"31965479471","p":[2,1,0,0,0,0,0,0,0,0],"sub":[],"t":"ttf","u":[2147491951,1107296330,0,0],"v":131072,"w":26215680}]},{"a":[4294966911],"f":"Agency FB","fam":[],"sf":[{"c":[536870913,0],"dn":"Agency FB Bold","fs":54372,"ful":[{"lcp":9830

                                            C:\Users\user\AppData\Local\Microsoft\FontCache\4\PreviewFont\flat_officeFontsPreview_4_40.ttf

                                            Download File
                                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                            File Type:TrueType Font data, 10 tables, 1st "OS/2", 7 names, Microsoft, language 0x409, \251 2018 Microsoft Corporation. All Rights Reserved.msofp_4_40RegularVersion 4.40;O365
                                            Category:dropped
                                            Size (bytes):773040
                                            Entropy (8bit):6.55939673749297
                                            Encrypted:false
                                            SSDEEP:
                                            MD5:4296A064B917926682E7EED650D4A745
                                            SHA1:3953A6AA9100F652A6CA533C2E05895E52343718
                                            SHA-256:E04E41C74D6C78213BA1588BACEE64B42C0EDECE85224C474A714F39960D8083
                                            SHA-512:A25388DDCE58D9F06716C0F0BDF2AEFA7F68EBCA7171077533AF4A9BE99A08E3DCD8DFE1A278B7AA5DE65DA9F32501B4B0B0ECAB51F9AF0F12A3A8A75363FF2C
                                            Malicious:false
                                            Reputation:unknown
                                            Preview:........... OS/29....(...`cmap.s.,.......pglyf..&....|....head2..........6hheaE.@v.......$hmtx...........@loca.U.....8...Dmaxp........... name.P+........post...<...... .........b~1_.<...........<......r......Aa...................Q....Aa....Aa.........................~...................................................3..............................MS .@.......(...Q................. ...........d...........0...J.......8.......>..........+a..#...,................................................/...K.......z...............N......*...!...-...+........z.......h..%^..3...&j..+...+%..'R..+..."....................k......$A...,.......g...&...=.......X..&........*......&....B..(B...............#.......j...............+...P...5...@...)..........#...)Q...............*...{.. ....?..'...#....N...7......<...;>.............. ]...........5......#....s.......$.......$.......^..................+...>....H.......%...7.......6.......O...V...........K......"........c...N......!...............$...&...*p..

                                            C:\Users\user\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntities.bin

                                            Download File
                                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                            File Type:ASCII text, with very long lines (65536), with no line terminators
                                            Category:dropped
                                            Size (bytes):322260
                                            Entropy (8bit):4.000299760592446
                                            Encrypted:false
                                            SSDEEP:
                                            MD5:CC90D669144261B198DEAD45AA266572
                                            SHA1:EF164048A8BC8BD3A015CF63E78BDAC720071305
                                            SHA-256:89C701EEFF939A44F28921FD85365ECD87041935DCD0FE0BAF04957DA12C9899
                                            SHA-512:16F8A8A6DCBAEAEFB88C7CFF910BCCC71B76A723CF808B810F500E28E543112C2FAE2491D4D209569BD810490EDFF564A2B084709B02963BCAF6FDF1AEEC59AC
                                            Malicious:false
                                            Reputation:unknown
                                            Preview:51253fe60063c31af0d295afb42228b0:v2:2:1:1590:2:8479:76bd602437550e98c9043d06a55186ab7d95dea5a0e935a599f73e62a8c9b158e0afcb19351f6c353940c06a38172b94d18c02cf92bb8a80184eccca0392b259ab3e71dae73e491c7941997cb36ad4a198661f622dad478d840f66d530a0dde78acea3367f91fff62fbb3dc18faff0c708ad30edef5bea8b22c5fd782b770d8993386eaa784fd19a3c3e1db3b537b1a94d3d4fbd46f8df8fddf6d16611969fe0a97c50e0f3ac24750c93257cf5c161184aa7385800c87d803b339632a3d8ec7fe17a0afd83ce9e9d0e3f7b8d579637928a811f1f7e6d1887df2ddc7d4f752c4d600235e426c92c7bf8a1362f95457998cc0e5d4261f0efa4fada0f866dbcefb407dacab7a2914e91c2f08200f38c2d9d621962145b1464b0f204b326118a53ecdcab22bff005fdd5257c99a6dc51ac0600a49f2ef782396987e78c08b846dad5db55e8ccefffc64863bc2c3e90b95a09d25d0814a848c98fe01a82d4e30e6682dd546e12c45ca0d280a45295ab4bd632dafb070edfdc3c9e38313d5aeb195972986f8011b66817028fd8c78b67a0ac7e780eecc3fb6a31f5a025b8a9a3db278a98c0696aeaac739b18688b0f9c7d751bba02cc5f4e41853fb119b3c0c915059aaa92971244a1989124f12881ca88e6410df70b793a2c3a736ff4

                                            C:\Users\user\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntitiesUpdated.bin

                                            Download File
                                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                            File Type:ASCII text, with no line terminators
                                            Category:dropped
                                            Size (bytes):10
                                            Entropy (8bit):2.121928094887362
                                            Encrypted:false
                                            SSDEEP:
                                            MD5:D1E1DA51EFA312656F8C8463C426D7E6
                                            SHA1:2F021EFDF08BC82D00B9BE1B624FA0AC22074C8F
                                            SHA-256:CBC8510895384CCE6405104E8753D3F458591C885BA9C6FE66E927EF7CA8225B
                                            SHA-512:3279F85B78F5284C8713F6FBD08F4D0B476EE8BB19B6DACB760A346B27DDBF702DB0263CFA174EDD784AAB00373A154C2196D480F798675FADBB4DFC2BC061FB
                                            Malicious:false
                                            Reputation:unknown
                                            Preview:1720044020

                                            C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-journal

                                            Download File
                                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                            File Type:SQLite Rollback Journal
                                            Category:dropped
                                            Size (bytes):4616
                                            Entropy (8bit):0.1384465837476566
                                            Encrypted:false
                                            SSDEEP:
                                            MD5:2C112281853876D57C87073958CE1914
                                            SHA1:C5B2AC54F59778E9F933B92099A72E48C61E97F0
                                            SHA-256:55D6F8B5F476A02F5F62D5028DA86125E6BA765F7AC2D577878B906E0939B9C9
                                            SHA-512:2DE4C8A3616AB20646946ADFFC12128BD87FBB507D0543BFF0040C304DAED8AAAED7947EBA6EBA70E7A9BEF1D80310AB2FAC00706B1F62299DB24F737E336101
                                            Malicious:false
                                            Reputation:unknown
                                            Preview:.... .c.....=..?....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................SQLite format 3......@ ..........................................................................K.................................................................................................................................................................................................................................................................................................................................................................................................

                                            C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\33CUD2J1\open[1].gif

                                            Download File
                                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                            File Type:GIF image data, version 89a, 1 x 1
                                            Category:modified
                                            Size (bytes):43
                                            Entropy (8bit):3.0314906788435274
                                            Encrypted:false
                                            SSDEEP:
                                            MD5:325472601571F31E1BF00674C368D335
                                            SHA1:2DAEAA8B5F19F0BC209D976C02BD6ACB51B00B0A
                                            SHA-256:B1442E85B03BDCAF66DC58C7ABB98745DD2687D86350BE9A298A1D9382AC849B
                                            SHA-512:717EA0FF7F3F624C268ECCB244E24EC1305AB21557ABB3D6F1A7E183FF68A2D28F13D1D2AF926C9EF6D1FB16DD8CBE34CD98CACF79091DDDC7874DCEE21ECFDC
                                            Malicious:false
                                            Reputation:unknown
                                            Preview:GIF89a.............!.......,...........D..;

                                            C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\AN5UOLP8\R_only_3923939944900779299[1].png

                                            Download File
                                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                            File Type:PNG image data, 115 x 136, 8-bit/color RGBA, non-interlaced
                                            Category:dropped
                                            Size (bytes):3214
                                            Entropy (8bit):7.9152581277343526
                                            Encrypted:false
                                            SSDEEP:
                                            MD5:8CC34197FAE5B49864607AA153FA0C3C
                                            SHA1:E92E0AF7EC963178138AE92803418A03CDE66676
                                            SHA-256:891607CAA119DD70CAFAE73179F265EDC759E13BC1633837CEAD76B7A323643B
                                            SHA-512:36C7FDCA0596749D16F1A57610D6D547AEB0F7DFE2E0161CAD69CD40785EE8A7ADB224C2A5672201B882951E604C5319EC1B649E07907F8BC18B9243A51C671F
                                            Malicious:false
                                            Reputation:unknown
                                            Preview:.PNG........IHDR...s............<...UIDATx..wPUW..5n..)...n..l.Mv6.m..Xb.5..FMFMl......P.D.A...%DT...("..." J.."<:..~.3.Ex.w.{.^.o.7.'#...=...iCRt#m.O aJ.0.H.R$L.S..)E."aJ..f..D?g.i^S..(........LU....`.X{.....}a..zq......zI.WG.Q..6.s.....d.1.r..%g.Rum..`:{GS....R...~.....==.h...\JO.....zS.....P.1.;.Ie.5...A?...S.?..9........?.'.J.S.p.....A....D.(......0.......z8....T..k.0...wq..*..{.6...$L=(.)@uZ.A...%L=(....$..x......g.....x.TR^%a.A.;...t=...%L.....8..\.!a.A.ur.7>..|.S.z.../c.(.......9.L.........=.H.zQdh.b.$L..G.s.A%L;..s..J.z.'?..R.S/a.Y+.K.zQ.p..(.0..:....0...]#a>.......M.D...@./......o....W. .6..\).R^...H?r...=.2(;.&..E...t..nVP....+g........v.z:o........uG[..W..R.....F..9E....TVQ.`'......t...B...{....{.e^.I.........t...W8..8........h..M.(+..SAM..A.K...(..#.9..y.g7..m..&yK..J.r..J$.~.g.........>Z.#}.....J.Cg.PZn...V......c...R.zm.c........,.ak.3}.i.&..g..!...H......WT....Ud.....z..).,.R.b..aUh4.5.B.V.............[....Ix.....l....D.e).

                                            C:\Users\user\AppData\Roaming\Microsoft\Office\MSO3072.acl

                                            Download File
                                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                            File Type:data
                                            Category:dropped
                                            Size (bytes):30
                                            Entropy (8bit):1.2389205950315936
                                            Encrypted:false
                                            SSDEEP:
                                            MD5:E2BD58043A13A7220C1A4AD9AA411897
                                            SHA1:6F6AAA186334B5A36D0FB165FFB24E8D8B71EA0E
                                            SHA-256:0B69067B29F510E4025070CCA5C4150DE06CD5E24DB77F3C544DF1B6AEE0233A
                                            SHA-512:2056FCE5950530A48338C60A80805B50BF9D74D80101764F94EFE65CB7D8F2098E0E2B67FB5FBD7D22069ABB848FF48AC23A82DD45AB1C9CDD58D1E57C767733
                                            Malicious:false
                                            Reputation:unknown
                                            Preview:....n.........................

                                            C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

                                            Download File
                                            Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                            File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Jul 3 21:00:32 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                                            Category:dropped
                                            Size (bytes):2673
                                            Entropy (8bit):3.9885249012344612
                                            Encrypted:false
                                            SSDEEP:
                                            MD5:A3480F61ADEEB95BF7E0F159353BAA13
                                            SHA1:98847CDA3A3DD754DF4CBAFAD670E323FD24035E
                                            SHA-256:3E9695007AA0EF12E6BEFC232322ECB4245579A52B3678BF17C772649D48AE80
                                            SHA-512:3867941AE451858A7FEB3E66ACD6E5D0C17F62DF828E6CC170155B6B32588470440B997786026E34EBDE5D534008B4D057CF15205FA3ACCD736BC2A58F0E6D59
                                            Malicious:false
                                            Reputation:unknown
                                            Preview:L..................F.@.. ...$+.,....^..l....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.X......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............h.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                                            C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

                                            Download File
                                            Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                            File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Jul 3 21:00:32 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                                            Category:dropped
                                            Size (bytes):2675
                                            Entropy (8bit):4.00358871320216
                                            Encrypted:false
                                            SSDEEP:
                                            MD5:1FD988E269A8A6E7ADFB01ED3F9101C3
                                            SHA1:E047CB02BD6E21B37B18D3C8E03FE03BA2F3CF58
                                            SHA-256:2B835C920FC33A9953F677E1E90CFFBDCBC5D082AB71976D3FFB0664FC4DA472
                                            SHA-512:E45E76210C07D2D603A4754B1E2D54B4E67563735477627A29925940F883CD1D0F92FD4FA2DB4402ADCA5469E1DABAE1CE03AC535CE41B9B081B8C694B2D5D21
                                            Malicious:false
                                            Reputation:unknown
                                            Preview:L..................F.@.. ...$+.,.....r.l....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.X......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............h.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                                            C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

                                            Download File
                                            Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                            File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                                            Category:dropped
                                            Size (bytes):2689
                                            Entropy (8bit):4.011664778380474
                                            Encrypted:false
                                            SSDEEP:
                                            MD5:00D7F76B0D8C614EE809864B1319395F
                                            SHA1:A52E6FD38EC777EF61DF9D844E64422EFA34C8DC
                                            SHA-256:4C228169F040E7FAD767905750AE5CB2B8B3A124C84AFFBD22818430589438EB
                                            SHA-512:4DB00B0CDF5C3A3C5A8D631B6CAE4219436463CA15D782B8DC0308E3DA6BE78F5009C2DEC049B4869BA8740FA05F790CDE5825AE0471BDBB5BFCCE442C6A6689
                                            Malicious:false
                                            Reputation:unknown
                                            Preview:L..................F.@.. ...$+.,.....Y.04...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.X......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VFW.E...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............h.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                                            C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

                                            Download File
                                            Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                            File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Jul 3 21:00:32 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                                            Category:dropped
                                            Size (bytes):2677
                                            Entropy (8bit):4.002657869217015
                                            Encrypted:false
                                            SSDEEP:
                                            MD5:DB57DE30BC823DC3BC034B4954A7BF32
                                            SHA1:30A7F5657BFE000C6B2CC9C3239A71511F9EE0B5
                                            SHA-256:E9C6D5550227768F1A5F9ACDC7E95D5F55EF0C06A8FAADADC326604C040D73B4
                                            SHA-512:7BAAFD8AAD3089A1153BD75DB837712DA9A5747C08667807E0C5476CEB71CF1CCA10DDFE569D3AE324238B5CF74A3A377A207EA722E71F04FA70E146C71765F2
                                            Malicious:false
                                            Reputation:unknown
                                            Preview:L..................F.@.. ...$+.,.....0.l....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.X......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............h.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                                            C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

                                            Download File
                                            Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                            File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Jul 3 21:00:32 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                                            Category:dropped
                                            Size (bytes):2677
                                            Entropy (8bit):3.9903801945851485
                                            Encrypted:false
                                            SSDEEP:
                                            MD5:9CB8A15D8EDE9DDD4A96D6DBB2F4A7C6
                                            SHA1:B92C3A0F1FA386C1094804649A6BA23DCA697B29
                                            SHA-256:BF127C24F9DC1BB5561AE4D6BD3A2FCE991320B42B2B667C80B68A4D9BA0A804
                                            SHA-512:760FB1D050680DE9692F287AD02F5D402B13A36FA7A9DF9C6BAEC808ECD045DBAA4862A99456D673E7937372E4E5FA059EFF8C70DDC2649E24C7D6F4FF3399D7
                                            Malicious:false
                                            Reputation:unknown
                                            Preview:L..................F.@.. ...$+.,.....w.l....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.X......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............h.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                                            C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

                                            Download File
                                            Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                            File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Jul 3 21:00:32 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                                            Category:dropped
                                            Size (bytes):2679
                                            Entropy (8bit):4.0008258426861
                                            Encrypted:false
                                            SSDEEP:
                                            MD5:3874D4CDB0EE144F0B1291D64DF6ED4F
                                            SHA1:1E8F85708178C3152774503930755C5E5448DF32
                                            SHA-256:9EBE2956E5B309355461CA740069D44CADBDD0F9C38D3F74E9292D905ADD9FFE
                                            SHA-512:4C3D984E11D6767FDD45F27D74A461893BD5C3835A838A885F44525B4ACA008B9E77F7BF4DA1E2F29D4577CE4EA718FA9100E740951D83A8AA23EF6A4B85667A
                                            Malicious:false
                                            Reputation:unknown
                                            Preview:L..................F.@.. ...$+.,....}l.l....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.X......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............h.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                                            Static File Info

                                            General

                                            File type:SMTP mail, ASCII text, with very long lines (443), with CRLF line terminators
                                            Entropy (8bit):5.988394949476589
                                            TrID:
                                            • E-Mail message (Var. 1) (20512/2) 100.00%
                                            File name:original (3).eml
                                            File size:157'692 bytes
                                            MD5:8d76f9f95d7346c886503af3f774cf1a
                                            SHA1:13aa40ba54e9776e22b14e16b2d09e796218885e
                                            SHA256:f0847d37e306f5fd2b2c0115732a9e49222ffd810c8b6a57ea41e188a1ef8d0e
                                            SHA512:4d58f3aabcfcb5523d8af15f8160a6ede084a833b43278ee0f4a835f775b4c24427331a375cc64e053729659ade583e0132e8f1798ddd4fc8ab1948801fb3888
                                            SSDEEP:1536:ReeiLlNprg/68YZnzFmTEu1p5I9p1swU9AGwNjcVnyFssaT7xHM93/510fnNCkKT:ReLN66bnmEuYswv1OGh/sOT
                                            TLSH:94F3091643C23BA798B49974FC17FB3B73580D8E8753507A686B689A8D0CD9617F23C8
                                            File Content Preview:Return-Path: <broach@plateautel.com>..Received: from NAM11-DM6-obe.outbound.protection.outlook.com (mail-dm6nam11on2113.outbound.protection.outlook.com [40.107.223.113]).. by inbound-smtp.us-east-1.amazonaws.com with SMTP id ls0t8b866t0c9kgoingbmpcibmu11p

                                            Static Mail

                                            General

                                            Subject:[Phish Alert] You have an invoice from ROSWELL-CHAVES COUNTY ED for $257.50
                                            From:Becky Roach <broach@plateautel.com>
                                            To:"9f39fdb7-5601-4ea7-9716-c172e4198525@phisher.knowbe4.com" <9f39fdb7-5601-4ea7-9716-c172e4198525@phisher.knowbe4.com>
                                            Cc:
                                            BCC:
                                            Date:Wed, 03 Jul 2024 21:42:44 +0000
                                            Communications:
                                            • You don't often get email from noreply@clover.com. Learn why this is important<https://aka.ms/LearnAboutSenderIdentification> CAUTION: This email originated from outside of the organization. Do not click links or open attachments unless you recognize the sender and know the content is safe. [Merchant Logo] ROSWELL-CHAVES COUNTY ED 220 N MAIN STREET, ROSWELL, NM 88201 5756221975 Your payment is due August 2, 2024 Due by August 2, 2024 $257.50 Pay $257.50 <https://www.clover.com/checkout/0552f742-a361-4d4b-a3ae-90d09d1e75d2> ________________________________ Invoice #4QZ55FDBG25Z4 Created July 3, 2024 Bill to: broach@plateautel.com<mailto:broach@plateautel.com> Becky Roach "Plateau Telecommunications - FY 2025 Annual Membership Dues " ________________________________ Subtotal $250.00 Tip $7.50 Total $257.50 ________________________________ Pay $257.50 <https://www.clover.com/checkout/0552f742-a361-4d4b-a3ae-90d09d1e75d2> Secure payments powered by Clover View the Clover Privacy Policy <https://www.clover.com/privacy-policy>
                                            Attachments:
                                            • phish_alert_sp2_2.0.0.0.eml

                                            Headers

                                            Key Value
                                            Return-Path<broach@plateautel.com>
                                            Receivedfrom SA1PR15MB4482.namprd15.prod.outlook.com ([fe80::ff16:146c:aa3a:7cab]) by SA1PR15MB4482.namprd15.prod.outlook.com ([fe80::ff16:146c:aa3a:7cab%7]) with mapi id 15.20.7741.017; Wed, 3 Jul 2024 21:42:45 +0000
                                            Received-SPFpass (spfCheck: domain of plateautel.com designates 40.107.223.113 as permitted sender) client-ip=40.107.223.113; envelope-from=broach@plateautel.com; helo=NAM11-DM6-obe.outbound.protection.outlook.com;
                                            Authentication-Resultsamazonses.com; spf=pass (spfCheck: domain of plateautel.com designates 40.107.223.113 as permitted sender) client-ip=40.107.223.113; envelope-from=broach@plateautel.com; helo=NAM11-DM6-obe.outbound.protection.outlook.com; dkim=pass header.i=@plateautel.com; dmarc=pass header.from=plateautel.com;
                                            X-SES-RECEIPTAEFBQUFBQUFBQUFIQnlPQVAycStoWUZEU3R6NkVWVGhUdXhrMVMxNXBDNTFxbmdpNld0RWdlb3NxZkxwbkV3NStucCsyalBXZm5MTWE4NDRUMTI4dk45N3krV0VqU29kMnBhbndTNUdzd1pVMVpvY203MWRkUEtTSUdEdEpna2dQaEV0TCtZQkdEajVkNkJDSkt0NTdjSFhQZ1ZyeW5iWXZ2L2UrZ1BncmltSlE2RHYwRW1LdE96Rk5UcG11dHo4aDZPemdTR1lBN0ZwclJ2TWIwUnRsSUFPdnNHWXpsaGVEcDEraWNUdlJ2T0JWL3doMXlMaVFEcjNudlNNcTY4ZVdkTUEveHdyTXVlSGN0TjRHMWthYzVsaURhRGxwc25FUHBRc0dwQWxaRkwwNklUS21kVHFnSGc9PQ==
                                            X-SES-DKIM-SIGNATUREa=rsa-sha256; q=dns/txt; b=ZcgjWNpaNOSXxvbhpyJdKkcDEp2uex67iCJ75/IlPhwuSudDYahenQ4MzUzw7Ydjh8MhMvdl+UFatlLrysMrOMRMBJjkDsqc/xKoDvdHdZ2ma0XCcPX5Mp8eIxsqmhgEQ6pqLVubiF+KpWySeR5v/1oWj1+dwOgRxkFoSFrM7+U=; c=relaxed/simple; s=ug7nbtf4gccmlpwj322ax3p6ow6yfsug; d=amazonses.com; t=1720042971; v=1; bh=X1cagTTn/tjT8XNTnGxaajJ0xOIUO62vMXIocToijAI=; h=From:To:Cc:Bcc:Subject:Date:Message-ID:MIME-Version:Content-Type:X-SES-RECEIPT;
                                            ARC-Seali=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=awCMh9pq/qCBh3QwsuBgj2ZrivsxGVHwEhYTXUcpxSz1ckPr2pygu0DNs9p2qvcC+1uLUnpWNwYrPLxr1KFQ0LwKvzqFrycn9AUxsDTuTaD1j9jZN+FPk/7ijIOvwFKw82qM5J85zwI0HtCwlt+2KCJyHCeDUr8HNKks7pIJHQl7cZjhI5TjdQa23AHCLrTtfLQJETOsSNfwIP/FU2J4M4BoEoaZe54mm6kknjV+CwjB/6UJ5i8vN3WF6HPNKJmSIVxYXIr5dtTvSqheVqWie25+dTjceQch2YQyCuZgAEY2rv2yR/zQWYmlAODolHR25fDfMXXeT9SYdXUIffuGkQ==
                                            ARC-Message-Signaturei=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=3dF42hOi8j1Yw7pllPiO/HrxTfUqLc7LVOYlTHTdRec=; b=hpNYVUFoCyTH7VMLs7lwdjM36FrlKEJaXS1W+KInQXXkHidXcZsLvBYW5wV5E4YT9slgOzRo/tvMRNlNlP31/l0zT6koXj/ZqmnMdlaRUooIGpdV2acfeLfic04Mi1Z0t40UuO/GxlYEBSwcKixMlaNGIxmlAkL0FOrpi4SM1bPc72DS54jzAVK8g7Vu//HJkyxOpvMPMKQl0HlUeudBWClz++MD+217fBwsja0DQO6fy9JMQ7hnU6F/5L/cwhe8d5jwSyDiM+bxG6ZVue+s5odDZ1dq+t/oEJUuWYsHP9ojU4Vahu3qSW8Wa3dokISNwD48pGYaKu81hOSUi4EJwA==
                                            ARC-Authentication-Resultsi=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=plateautel.com; dmarc=pass action=none header.from=plateautel.com; dkim=pass header.d=plateautel.com; arc=none
                                            DKIM-Signaturev=1; a=rsa-sha256; c=relaxed/relaxed; d=plateautel.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=3dF42hOi8j1Yw7pllPiO/HrxTfUqLc7LVOYlTHTdRec=; b=SybYTqTfYIXbaFtsrAI9jI91akxM0Ebqaz7rws9e61CzT7n6ZPLHgRNBE2BlAk1vvGHx1RHHACNKWbQIP4fHF9lz1dEgQ7VJyNTcWP8vhpCSf1HVH8pC5Qi6aDDG91v8fuqSMxwfHGkLyCr8gPuza5brsF4ANkKFmUVBJGiM9sU=
                                            FromBecky Roach <broach@plateautel.com>
                                            To"9f39fdb7-5601-4ea7-9716-c172e4198525@phisher.knowbe4.com" <9f39fdb7-5601-4ea7-9716-c172e4198525@phisher.knowbe4.com>
                                            Subject[Phish Alert] You have an invoice from ROSWELL-CHAVES COUNTY ED for $257.50
                                            Thread-Topic[Phish Alert] You have an invoice from ROSWELL-CHAVES COUNTY ED for $257.50
                                            Thread-IndexAQHazZHw1sZmNQj1BEuyirEv44N2uw==
                                            DateWed, 03 Jul 2024 21:42:44 +0000
                                            Message-ID <SA1PR15MB448274F0F2A1178754817945A5DD2@SA1PR15MB4482.namprd15.prod.outlook.com>
                                            Accept-Languageen-US
                                            Content-Languageen-US
                                            X-MS-Has-Attachyes
                                            X-MS-TNEF-Correlator
                                            authentication-resultsdkim=none (message not signed) header.d=none;dmarc=none action=none header.from=plateautel.com;
                                            x-ms-publictraffictypeEmail
                                            x-ms-traffictypediagnosticSA1PR15MB4482:EE_|SA0PR15MB3917:EE_
                                            x-ms-office365-filtering-correlation-ida645b0db-cb17-4ac2-98ed-08dc9ba91305
                                            x-ms-exchange-senderadcheck1
                                            x-ms-exchange-antispam-relay0
                                            x-microsoft-antispam BCL:0;ARA:13230040|366016|376014|69100299015|1800799024|38070700018|3613699012;
                                            x-microsoft-antispam-message-info L7wiJNL0SCTnz/5jpkCTHXexamIQuGVEE1lDFYmiizv8g8RtfaQD5t19BX3rMqaQuVg+UmzDCmf4969wg3kdhwo06rk/XsLo62IwS76iGmtHu++sCv1CXzwF/qEbANsH71kcaIiMlaoMM5hp9cVG+EHb/PjK3fcfMFYM6C4lXVxlzmMDfKLTWYEfakTuSxmJcLt/tTIywkRtYIRxZNEBWkPJSWnA1CiIHENZxf6JWWX1XSqcN2zFxWmKC0llFqfXeMGV/jisWAdSjvG0c2YbxlV+5wv/i4rJ8cn1DpPPRb5s5+C39J62e+kypE6TrxOqunRnXJwG74GIEC4+EsvjX/bwrXzUvDZ+/7uzC+/N7vCYmDS/0fYmFTjObyeNYLmMaqF6IrMZXI9KShgIvEmlMwbOHE7+c/bsSEYIf040pxjF4cA8mzTqeNbgtIFJDiSGT7KT3MT16gJrF5eIMAXlDCJQ2u8KXhYPKUPwmx6dhuZ7fh45AjQHNWb1CUDA8DAuzLxfCjv3ntp+MkA0FTFsmTLWLeC23aXkckA3py1yYxx9x+InwoYaXiLihHzkAUikH8sgGvjPOkOPclgvSB/iwCxxTdRDS7lRYWfTXE0vuLMemJ8coXvWngabc1ATuch4T04U5C3eHmGL71+t8TrRNLzRe3EjVxiZGfZAL1y4z7tyxYbjhjZvXzNU77E0EXhzWOGeR+esye0arC1LzoyIJjOKILh5AzxTmma0nG9rcwiFY8EY4goWP9FnonudjERRYNLJX0Vw40r1yMyL167ovz7O1iAv6ALPMbg7rSAaSb8F+K9w3RCUQayJb/m1jqIg7IBIENL97pucg51bQYF23ANB0LfH5TGTazizjadqecQEX7H3rUXSB2rHRUmRNcfThMa3CQsc5Wq87EP79i/bzk7igamezzkyVEPDssUXNOT0jY1WPIUngutybSPSHqSyMglmKf7HBi1cQPn/OWDkcv0DRyYGU3LJcxh86NeYrwjYEuJ4LrT4Z9YO8MrnfyiSAYe1BCLQT0/bzatnZd3vvGGg84LN+G7rvKWI0ZvIHykQd/5LwXaMMtL1j04bvXYKP+s9sJewy6uXwhdW0K5FwMWftmHyVTHK2+eWM0CxBqMJLQnRJivxp3jlwDRCWhv3ZMbq3GquQbSaSvsD0wuAgps/6XXQxCDlORJkXmr3QKoEgSwDv3yhdesYRqLqRzIZ7NP55hUyF9i9xjc0E+DWShpLVWp4WYQcN3yTwLwKrmVBZRB+xmPwqk9y3MhGABQ3Z4Ftht7dsnTCLzE0AURxBs4IXfFqldEkBykOVlRb7Ls379NHr2qjPXVP9qYq2u3W
                                            x-forefront-antispam-report CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:SA1PR15MB4482.namprd15.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(366016)(376014)(69100299015)(1800799024)(38070700018)(3613699012);DIR:OUT;SFP:1102;
                                            x-ms-exchange-antispam-messagedata-chunkcount1
                                            x-ms-exchange-antispam-messagedata-0 quJQdcoDf1HtsbjjTXALN5+llVp7eZGRHPGav+gmaXweIHQk6HJyJhBjeyAofbpx26h9sMQskoyq1gu67gLFWcEZuD/GpTjpYvgNv6JmBioFcxylBW7fxc4ITKLwyvuTHYC2Sm5jq8tSAzHichMwWe7r3FtTvz6akRCT41ai72Ua+5mbSxBj6uER8UPW/nFfKFqkDkdRW13Z4Ca8WvotmwkH9DhE8do6Kvv8uqN20Hd0kYibRr4gqoAzG3pXTfuDuoObmsV03lHZ5LaOeEDSI9g7PUB3oZFi19Xtp324x7TuUcfzeOWuBlLs48PSAkyaNw3Glf0OZKQUWlGH4RaJZntitjwRHQ+Dkb1v/8pMzE7RDsR6tqjC6kWS7EtTcBJMdDalIi5dkmC3+QCON4NB5UvienpZ5yZDzTYbSclCL6NTWSW7XlXaUcn0c50eESNW5kqDsABMbWuRIARf6Cr6WfiNbppPRwQPQqLSLkJC8pbmmx8Uj4rgN9zDieA/dgkxaeAIYdNadhlFU64eLjisdiAKRUOURZSInXY31i1E6mik6/g7ysHm0ZS6aXFizRHVn607vn/7tCAsaRaOMAMw76jXajUEAeWPEZwuhRw6T8jpHt99ZW3or6ucz02G+MKY0j2IDkMhO2WpmYjI6A7CjTPtf2+vZCia23RdT1CZCUvkk4JSUn/J4eUk+zORwM/NXO/DZd1l9nJC7VOKGoaIoQZk904q/oehLGEfOd3S9onow2qaDTIKKlvcQxoN1X7fscxYEcv5cbWsnnoMi7Tnwmc4uBBsJK8GDjFD8BaVvA4IHVWgMYObJMT4OfC76+WTWmUtzKWCRUWNAP7v4B1wwxGUv7f2Q8q3F9ENNGutShOphQKmygn7ex8JzVrztXwZBNZpE7/JVw8SMa9pn09jO7G+k5R5hlDrP5jR8a9TZvpR1jU0cF3X+FdFqHpiIeLdgAiuiW7AWMhOAoO53pOp0qfVBddpiXmxmumYU9/FAlq76Me97am4Pql7LeXYDRtFas7qZhkBVqWxhbSjDVGhxyUAFMNjGXSLcruWqr9EEudmXiedkv2QPjxMiGNf8pOxZEQvXxHh7Apx+l/TjhLQ0DUYjBh5aLhP61jNGwS89hsLVKwg1Meq9rGUmtKM9qqV8SBm/kDfimiV1VFjQjbp12NRWgYfNqLXusC7y4O08bGsiVu4WjzxAOS6Cg3JCZf1mxGifSqjBgTTpANJ+XTqnmBQFYm0TPW0/4W4MI0koxH5VdU/7SSaBspE39rvF1gt7plqQk+z0uLOtQuYDFcsSi+4DcBw/siHbuRAT2Pp/MBdbbEqo5we1dS1TQ4r/LaCCtmobCEcPtyH8iaDE0LCaKuBzXg0BYJWzgeyjPRcHAVG7FBSXyfwKfRWEYn4lLCzmQEGaI2tCPYpPTuczDWc8jt+DTknNd1wwi2BFEgpAMOYgtHanFatmBpZaL9cThSVBBZ7kbLXekwcl7SVl+g3wHJT9BWKUe15RsW/Kkm0pb0ll1ldl3hUScD3ajsrz1Jlmdk8HVXugeo3XfqBBQtUNY1uMG5o0rayaYTDUVOZzV3v2URbVJT74cNfXPV+rSXJ
                                            Content-Typemultipart/mixed; boundary="_004_SA1PR15MB448274F0F2A1178754817945A5DD2SA1PR15MB4482namp_"
                                            MIME-Version1.0
                                            X-OriginatorOrgplateautel.com
                                            X-MS-Exchange-CrossTenant-AuthAsInternal
                                            X-MS-Exchange-CrossTenant-AuthSourceSA1PR15MB4482.namprd15.prod.outlook.com
                                            X-MS-Exchange-CrossTenant-Network-Message-Ida645b0db-cb17-4ac2-98ed-08dc9ba91305
                                            X-MS-Exchange-CrossTenant-originalarrivaltime03 Jul 2024 21:42:44.3147 (UTC)
                                            X-MS-Exchange-CrossTenant-fromentityheaderHosted
                                            X-MS-Exchange-CrossTenant-idc66eaad3-4231-4d3b-873b-e9d98588a49e
                                            X-MS-Exchange-CrossTenant-mailboxtypeHOSTED
                                            X-MS-Exchange-CrossTenant-userprincipalname0HfvNQaXwkq/0L3oiKTRgh3Hno9gUyHIUXgNbBk0JF0nrj3QlwYEUJMqvxYjim9NCJ+3pt6keFbCZjdQS6/3Ww==
                                            X-MS-Exchange-Transport-CrossTenantHeadersStampedSA0PR15MB3917

                                            File Icon

                                            Icon Hash:46070c0a8e0c67d6