Edit tour

Windows Analysis Report
phish_alert_sp2_2.0.0.0 - 2024-10-14T143610.340.eml

Overview

General Information

Sample name:	phish_alert_sp2_2.0.0.0 - 2024-10-14T143610.340.eml
Analysis ID:	1533532
MD5:	1d4079e26e68e03bcf15e84051360cf8
SHA1:	a5ee44215c94a70fc29b8dccd7fda64d10373d46
SHA256:	bfe70b7b3faeb21d584d40fe063a97f1853be53142b0dc56dedcf2ce09c03d30
Infos:

Detection

Score:	48
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

AI detected landing page (webpage, office document or email)

AI detected landing page (webpage, office document or email) (A)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Office Autorun Keys Modification

Stores files to the Windows start menu directory

Classification

Process Tree

System is w10x64_ra

OUTLOOK.EXE (PID: 7116 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\user\Desktop\phish_alert_sp2_2.0.0.0 - 2024-10-14T143610.340.eml" MD5: 91A5292942864110ED734005B7E005C0)

ai.exe (PID: 6240 cmdline: "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "01E8992E-80A1-413E-9AC1-6078684384B2" "268F9226-BCD4-4F11-B91D-5F5EA72A954B" "7116" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx" MD5: EC652BEDD90E089D9406AFED89A8A8BD)

chrome.exe (PID: 5492 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www.amazon.com/a/c/r/x0bcRZ2VMef4tPrE77VklgIkN MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 936 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 --field-trial-handle=1956,i,13138437261821206712,16573193690381845994,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7712 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www.amazon.com/gp/f.html?C=LLJFP8MEWM3T&K=10INX0DJ82T68&M=urn:rtn:msg:20241014162056cb2436f68d33494c8b835aab7bc0p0na&R=205E5DHOCDFPV&T=C&U=https%3A%2F%2Fwww.amazon.com%2Fa%2Fc%2Fr%2Fx0bcRZ2VMef4tPrE77VklgIkN%3Fref_%3Dpe_44305210_579583930&H=0ZPAOSVC9DMZ7WONQOAFMWIIXQ8A&ref_=pe_44305210_579583930 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7888 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2024 --field-trial-handle=1932,i,4034252152245162802,13656653743359908747,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Sigma Signatures

Sigma detected: Office Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 , EventID: 13, EventType: SetValue, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE, ProcessId: 7116, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Addins\OneNote.OutlookAddin\1

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Source: https://www.amazon.com/a/c/r/x0bcRZ2VMef4tPrE77VklgIkN	HTTP Parser: No favicon
Source: https://www.amazon.com/a/c/r/x0bcRZ2VMef4tPrE77VklgIkN	HTTP Parser: No favicon
Source: https://www.amazon.com/a/c/r/x0bcRZ2VMef4tPrE77VklgIkN?ref_=pe_44305210_579583930	HTTP Parser: No favicon
Source: https://www.amazon.com/a/c/r/x0bcRZ2VMef4tPrE77VklgIkN	HTTP Parser: No favicon
Source: https://www.amazon.com/a/c/r/x0bcRZ2VMef4tPrE77VklgIkN?ref_=pe_44305210_579583930	HTTP Parser: No favicon

Source: unknown	HTTPS traffic detected: 40.126.32.136:443 -> 192.168.2.16:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.16:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.32.136:443 -> 192.168.2.16:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.16:49747 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.136
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.136
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.136
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.136
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.136
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.136
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.136
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.136
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.136
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.136
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.136
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.136
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.136
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.136
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.136
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.136
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.136
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.136
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.136
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.136
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.136
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.136
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.136
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.136
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.136
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.136
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.136
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.136
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.136

Source: global traffic	DNS traffic detected: DNS query: www.amazon.com
Source: global traffic	DNS traffic detected: DNS query: images-na.ssl-images-amazon.com
Source: global traffic	DNS traffic detected: DNS query: m.media-amazon.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443

Source: unknown	HTTPS traffic detected: 40.126.32.136:443 -> 192.168.2.16:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.16:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.32.136:443 -> 192.168.2.16:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.16:49747 version: TLS 1.2

Source: classification engine

Classification label: mal48.winEML@24/36@14/93

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

File created: C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

File created: C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20241014T1437530760-7116.etl

Source: unknown	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\user\Desktop\phish_alert_sp2_2.0.0.0 - 2024-10-14T143610.340.eml"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "01E8992E-80A1-413E-9AC1-6078684384B2" "268F9226-BCD4-4F11-B91D-5F5EA72A954B" "7116" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www.amazon.com/a/c/r/x0bcRZ2VMef4tPrE77VklgIkN
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 --field-trial-handle=1956,i,13138437261821206712,16573193690381845994,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "01E8992E-80A1-413E-9AC1-6078684384B2" "268F9226-BCD4-4F11-B91D-5F5EA72A954B" "7116" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www.amazon.com/a/c/r/x0bcRZ2VMef4tPrE77VklgIkN
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 --field-trial-handle=1956,i,13138437261821206712,16573193690381845994,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www.amazon.com/gp/f.html?C=LLJFP8MEWM3T&K=10INX0DJ82T68&M=urn:rtn:msg:20241014162056cb2436f68d33494c8b835aab7bc0p0na&R=205E5DHOCDFPV&T=C&U=https%3A%2F%2Fwww.amazon.com%2Fa%2Fc%2Fr%2Fx0bcRZ2VMef4tPrE77VklgIkN%3Fref_%3Dpe_44305210_579583930&H=0ZPAOSVC9DMZ7WONQOAFMWIIXQ8A&ref_=pe_44305210_579583930
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2024 --field-trial-handle=1932,i,4034252152245162802,13656653743359908747,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www.amazon.com/gp/f.html?C=LLJFP8MEWM3T&K=10INX0DJ82T68&M=urn:rtn:msg:20241014162056cb2436f68d33494c8b835aab7bc0p0na&R=205E5DHOCDFPV&T=C&U=https%3A%2F%2Fwww.amazon.com%2Fa%2Fc%2Fr%2Fx0bcRZ2VMef4tPrE77VklgIkN%3Fref_%3Dpe_44305210_579583930&H=0ZPAOSVC9DMZ7WONQOAFMWIIXQ8A&ref_=pe_44305210_579583930
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2024 --field-trial-handle=1932,i,4034252152245162802,13656653743359908747,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8

Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: apphelp.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: c2r64.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: userenv.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: msasn1.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: cryptsp.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: rsaenh.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: gpapi.dll

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{F959DBBB-3867-41F2-8E5F-3B8BEFAA81B3}\InprocServer32

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Window found: window name: SysTabControl32

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Common

Persistence and Installation Behavior

AI detected landing page (webpage, office document or email)

Source: https://www.amazon.com/a/c/r/x0bcRZ2VMef4tPrE77VklgIkN	LLM: Page contains button: 'Continue' Source: '0.1.pages.csv'
Source: https://www.amazon.com/a/c/r/x0bcRZ2VMef4tPrE77VklgIkN?ref_=pe_44305210_579583930	LLM: Page contains button: 'Continue' Source: '1.4.pages.csv'

AI detected landing page (webpage, office document or email) (A)

Source: https://www.amazon.com/a/c/r/x0bcRZ2VMef4tPrE77VklgIkN	LLM: Page contains button: 'Continue' Source: '0.1.pages.csv'
Source: https://www.amazon.com/a/c/r/x0bcRZ2VMef4tPrE77VklgIkN?ref_=pe_44305210_579583930	LLM: Page contains button: 'Continue' Source: '1.4.pages.csv'

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

File Volume queried: C:\Windows\SysWOW64 FullSizeInformation

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Process information queried: ProcessInformation

Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe

Queries volume information: C:\Program Files (x86)\Microsoft Office\root\Office16\AI\WordCombinedFloatieLreOnline.onnx VolumeInformation

Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	2 Browser Extensions	1 Process Injection	1 Masquerading	OS Credential Dumping	1 Process Discovery	Remote Services	Data from Local System	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	1 DLL Side-Loading	1 Process Injection	LSASS Memory	13 System Information Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 Registry Run Keys / Startup Folder	1 Registry Run Keys / Startup Folder	1 DLL Side-Loading	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact

Name	IP	Active	Malicious	Reputation
www.google.com	142.250.185.100	true	false	unknown
c.media-amazon.com	13.32.47.116	true	false	unknown
d3ag4hukkh62yn.cloudfront.net	99.86.8.42	true	false	unknown
media.amazon.map.fastly.net	151.101.129.16	true	false	unknown
www.amazon.com	unknown	unknown	false	unknown
m.media-amazon.com	unknown	unknown	false	unknown
images-na.ssl-images-amazon.com	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://www.amazon.com/a/c/r/x0bcRZ2VMef4tPrE77VklgIkN?ref_=pe_44305210_579583930	true		unknown
https://www.amazon.com/a/c/r/x0bcRZ2VMef4tPrE77VklgIkN	true		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
52.113.194.132	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.250.184.195	unknown	United States	15169	GOOGLEUS	false
142.250.186.35	unknown	United States	15169	GOOGLEUS	false
1.1.1.1	unknown	Australia	13335	CLOUDFLARENETUS	false
99.86.8.42	d3ag4hukkh62yn.cloudfront.net	United States	16509	AMAZON-02US	false
108.138.1.219	unknown	United States	16509	AMAZON-02US	false
52.109.89.18	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
20.189.173.2	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.250.185.100	www.google.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
2.19.126.160	unknown	European Union	16625	AKAMAI-ASUS	false
13.32.47.116	c.media-amazon.com	United States	16509	AMAZON-02US	false
151.101.129.16	media.amazon.map.fastly.net	United States	54113	FASTLYUS	false
142.250.184.238	unknown	United States	15169	GOOGLEUS	false
2.19.225.143	unknown	European Union	16625	AKAMAI-ASUS	false
52.109.76.243	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
66.102.1.84	unknown	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.16

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1533532
Start date and time:	2024-10-14 20:37:21 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	17
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled
Analysis Mode:	stream
Analysis stop reason:	Timeout
Sample name:	phish_alert_sp2_2.0.0.0 - 2024-10-14T143610.340.eml
Detection:	MAL
Classification:	mal48.winEML@24/36@14/93
Cookbook Comments:	Found application associated with file extension: .eml

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, SgrmBroker.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 52.109.89.18, 52.109.76.243, 52.113.194.132, 2.19.126.160, 2.19.126.151
Excluded domains from analysis (whitelisted): ecs.office.com, omex.cdn.office.net, fs.microsoft.com, prod.configsvc1.live.com.akadns.net, ctldl.windowsupdate.com, weu-azsc-config.officeapps.live.com, prod.roaming1.live.com.akadns.net, eur.roaming1.live.com.akadns.net, s-0005-office.config.skype.com, neu-azsc-000.roaming.officeapps.live.com, ecs-office.s-0005.s-msedge.net, roaming.officeapps.live.com, s-0005.s-msedge.net, config.officeapps.live.com, osiprod-neu-buff-azsc-000.northeurope.cloudapp.azure.com, officeclient.microsoft.com, ecs.office.trafficmanager.net, omex.cdn.office.net.akamaized.net, europe.configsvc1.live.com.akadns.net, a1864.dscd.akamai.net
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
VT rate limit hit for: phish_alert_sp2_2.0.0.0 - 2024-10-14T143610.340.eml

LLM Input / Output

Input	Output
URL: Email Model: claude-3-haiku-20240307	```json { "contains_trigger_text": true, "trigger_text": "There's an order ready for your approval", "prominent_button_name": "Approve or Deny", "text_input_field_labels": [ "When", "Device", "Near" ], "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false }

URL: Email Model: claude-3-haiku-20240307	```json { "brands": [ "Amazon" ] }
	```json { "brands": [ "Amazon" ] }
URL: Email Model: jbxai	{ "brands":["Amazon"], "text":"MARK JOHNSON, There's an order ready for your approval When: Oct 14, 2024 12:20 PM Eastern Daylight Time Device: Fire HD 10 (11th Gen) Near: Connecticut, United States Approve or Deny. Is it safe to follow this link? The link provided in this email starts with \"https://www.amazon.com\". If you prefer, copy the following link and paste it into a browser to view. https://www.amazon.com/a/c/r/x0bcRZ2VMef4tPrE77VkIgIkN", "contains_trigger_text":true, "trigger_text":"Approve or Deny.", "prominent_button_name":"unknown", "text_input_field_labels":"unknown", "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://www.amazon.com/a/c/r/x0bcRZ2VMef4tPrE77VklgIkN Model: claude-3-haiku-20240307	```json { "contains_trigger_text": true, "trigger_text": "There's an order ready for your approval", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false }

URL: https://www.amazon.com/a/c/r/x0bcRZ2VMef4tPrE77VklgIkN Model: claude-3-haiku-20240307	```json { "contains_trigger_text": true, "trigger_text": "To secure your account, tap 'Continue' and confirm.", "prominent_button_name": "Continue", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": true, "has_urgent_text": false, "has_visible_qrcode": false }

URL: https://www.amazon.com/a/c/r/x0bcRZ2VMef4tPrE77VklgIkN Model: jbxai	{ "brands":["Amazon"], "text":"There's an order ready for your approval", "contains_trigger_text":true, "trigger_text":"There's an order ready for your approval", "prominent_button_name":"unknown", "text_input_field_labels":"unknown", "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://www.amazon.com/a/c/r/x0bcRZ2VMef4tPrE77VklgIkN Model: jbxai	{ "brands":["Amazon"], "text":"There's an order ready for your approval", "contains_trigger_text":true, "trigger_text":"Are you sure?", "prominent_button_name":"Continue", "text_input_field_labels":["To secure your account, tap 'Continue' and confirm."], "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://www.amazon.com/a/c/r/x0bcRZ2VMef4tPrE77VklgIkN Model: claude-3-haiku-20240307	```json { "brands": [ "Amazon" ] }
	```json { "brands": [ "Amazon" ] }
URL: https://www.amazon.com/a/c/r/x0bcRZ2VMef4tPrE77VklgIkN Model: claude-3-haiku-20240307	```json { "brands": [ "Amazon" ] }
	```json { "brands": [ "Amazon" ] }
URL: https://www.amazon.com/a/c/r/x0bcRZ2VMef4tPrE77VklgIkN Model: gpt-4o	```json{ "legit_domain": "amazon.com", "classification": "wellknown", "reasons": [ "The URL 'www.amazon.com' matches the legitimate domain name for the brand 'Amazon'.", "Amazon is a well-known global e-commerce brand.", "There are no suspicious elements in the URL such as misspellings, extra characters, or unusual domain extensions.", "The domain name is fully matching with the legitimate domain name associated with Amazon." ], "riskscore": 1}
URL: www.amazon.com Brands: Amazon Input Fields: u, n, k, n, o, w, n
URL: https://www.amazon.com/a/c/r/x0bcRZ2VMef4tPrE77VklgIkN?ref_=pe_44305210_579583930 Model: claude-3-haiku-20240307	```json { "contains_trigger_text": true, "trigger_text": "There's an order ready for your approval", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": true, "has_visible_qrcode": false }

URL: https://www.amazon.com/a/c/r/x0bcRZ2VMef4tPrE77VklgIkN?ref_=pe_44305210_579583930 Model: jbxai	{ "brands":["Amazon"], "text":"There's an order ready for your approval", "contains_trigger_text":true, "trigger_text":"There's an order ready for your approval", "prominent_button_name":"unknown", "text_input_field_labels":"unknown", "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://www.amazon.com/a/c/r/x0bcRZ2VMef4tPrE77VklgIkN?ref_=pe_44305210_579583930 Model: claude-3-haiku-20240307	```json { "brands": [ "Amazon" ] }
	```json { "brands": [ "Amazon" ] }
URL: https://www.amazon.com/a/c/r/x0bcRZ2VMef4tPrE77VklgIkN?ref_=pe_44305210_579583930 Model: claude-3-haiku-20240307	```json { "contains_trigger_text": true, "trigger_text": "To secure your account, tap 'Continue' and confirm.", "prominent_button_name": "Continue", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": true, "has_urgent_text": false, "has_visible_qrcode": false }

URL: https://www.amazon.com/a/c/r/x0bcRZ2VMef4tPrE77VklgIkN?ref_=pe_44305210_579583930 Model: jbxai	{ "brands":["Amazon"], "text":"There's an order ready for your approval", "contains_trigger_text":true, "trigger_text":"There's an order ready for your approval", "prominent_button_name":"Continue", "text_input_field_labels":["To secure your account, tap 'Continue' and confirm."], "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://www.amazon.com/a/c/r/x0bcRZ2VMef4tPrE77VklgIkN?ref_=pe_44305210_579583930 Model: claude-3-haiku-20240307	```json { "brands": [ "Amazon" ] }
	```json { "brands": [ "Amazon" ] }
URL: https://www.amazon.com/a/c/r/x0bcRZ2VMef4tPrE77VklgIkN?ref_=pe_44305210_579583930 Model: gpt-4o	```json{ "legit_domain": "amazon.com", "classification": "wellknown", "reasons": [ "The URL 'www.amazon.com' matches the legitimate domain name for the brand 'Amazon'.", "Amazon is a well-known global e-commerce brand.", "There are no suspicious elements in the URL such as misspellings, extra characters, or unusual domain extensions.", "The URL structure is simple and does not contain any additional words or hyphens that could indicate phishing." ], "riskscore": 1}
URL: www.amazon.com Brands: Amazon Input Fields: u, n, k, n, o, w, n

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\FORMS\FRMCACHE.DAT

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	231348
Entropy (8bit):	4.378827043397039
Encrypted:	false
SSDEEP:
MD5:	DFC2A10D76F37CEF867918FCE679ABF4
SHA1:	665A82AE1527D55B1EEA5B26EA5246A6DF4484F9
SHA-256:	10C6DA19CFDE8E2AB9A1A8C9C20724059FAD9C86463C46FB1CBE771CBDDD6984
SHA-512:	DB5FF82A0DE61B4BAF5FC03CB7745CB6A62460628FEFA9E62E8419DF3CADB088C9C6D4226646F518165166061C38E29D3B1B6A2F71BAAFAB02A08C7A81A43153
Malicious:	false
Reputation:	unknown
Preview:	TH02...... ..h #h.......SM01X...,...0..#h...........IPM.Activity...........h...............h............H..hl.?.....}......h........P...H..h\cal ...pDat...h....0....?....h..}............h........_`Pk...hy.}.@...I.lw...h....H...8.Uk...0....T...............d.........2h...............k..............!h.............. hH.......?...#h....8.........$hP.......8....."hp&.......'....'h..............1h..}.<.........0h....4....Uk../h....h.....UkH..h`...p...l.?...-h .........?...+h..}.....`.?......... ...... ..............F7..............FIPM.Activity....Form....Standard....Journal Entry...IPM.Microsoft.FolderDesign.FormsDescription................F.k..........1122110020000000....Microsoft...This form is used to create journal entries.........kf...... ..........&...........(.......(... ...@.....................................................................................................................fffffffff........wwwwwwww.p....pp..............p...............pw..............pw..DDDDO..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntities.bin

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	322260
Entropy (8bit):	4.000299760592446
Encrypted:	false
SSDEEP:
MD5:	CC90D669144261B198DEAD45AA266572
SHA1:	EF164048A8BC8BD3A015CF63E78BDAC720071305
SHA-256:	89C701EEFF939A44F28921FD85365ECD87041935DCD0FE0BAF04957DA12C9899
SHA-512:	16F8A8A6DCBAEAEFB88C7CFF910BCCC71B76A723CF808B810F500E28E543112C2FAE2491D4D209569BD810490EDFF564A2B084709B02963BCAF6FDF1AEEC59AC
Malicious:	false
Reputation:	unknown
Preview:	51253fe60063c31af0d295afb42228b0:v2:2:1:1590:2:8479:76bd602437550e98c9043d06a55186ab7d95dea5a0e935a599f73e62a8c9b158e0afcb19351f6c353940c06a38172b94d18c02cf92bb8a80184eccca0392b259ab3e71dae73e491c7941997cb36ad4a198661f622dad478d840f66d530a0dde78acea3367f91fff62fbb3dc18faff0c708ad30edef5bea8b22c5fd782b770d8993386eaa784fd19a3c3e1db3b537b1a94d3d4fbd46f8df8fddf6d16611969fe0a97c50e0f3ac24750c93257cf5c161184aa7385800c87d803b339632a3d8ec7fe17a0afd83ce9e9d0e3f7b8d579637928a811f1f7e6d1887df2ddc7d4f752c4d600235e426c92c7bf8a1362f95457998cc0e5d4261f0efa4fada0f866dbcefb407dacab7a2914e91c2f08200f38c2d9d621962145b1464b0f204b326118a53ecdcab22bff005fdd5257c99a6dc51ac0600a49f2ef782396987e78c08b846dad5db55e8ccefffc64863bc2c3e90b95a09d25d0814a848c98fe01a82d4e30e6682dd546e12c45ca0d280a45295ab4bd632dafb070edfdc3c9e38313d5aeb195972986f8011b66817028fd8c78b67a0ac7e780eecc3fb6a31f5a025b8a9a3db278a98c0696aeaac739b18688b0f9c7d751bba02cc5f4e41853fb119b3c0c915059aaa92971244a1989124f12881ca88e6410df70b793a2c3a736ff4

C:\Users\user\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntitiesUpdated.bin

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	10
Entropy (8bit):	2.9219280948873623
Encrypted:	false
SSDEEP:
MD5:	310FBD36FFABF9F097DD8C594161DCF2
SHA1:	E13ED9E247A30D7C885904CDFEE18AEEBAC82921
SHA-256:	2FDB6C4F833584BC34ED8A7D6DC28ED5C60B8760336F210A64849C5137947670
SHA-512:	B0D42C67F656E55E023BD67D399C3BB2C5606982C0AD1B1CCABD47EB85740F73D5F6ED1B43CE06A4D8F0B8CA392ADADBD72A06D91183C3DB236D6B77D5AE6803
Malicious:	false
Reputation:	unknown
Preview:	1728931076

C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\1263EA7F-B69A-426D-9B5D-7E143308BF19

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	178099
Entropy (8bit):	5.290536417797002
Encrypted:	false
SSDEEP:
MD5:	1101C058319A3EB067030F89DB9D6A1D
SHA1:	5420ADA8CC190274B540EBB6249854209C806F56
SHA-256:	4DCDC73742E2F19110CDA86D87C254FDD10B8F631D7303AA19C5A202DB8B1554
SHA-512:	F37E44D4A518281980A795EBEBD59E98F61D4BA647488FAB8A8649C60869A51DD6C53EF68C15F036E574287629F1D41071C2B5C664432186BC2382EA878A3AFC
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8"?>..<o:OfficeConfig xmlns:o="urn:schemas-microsoft-com:office:office">.. <o:services o:GenerationTime="2024-10-14T18:37:55">.. Build: 16.0.18204.40137-->.. <o:default>.. <o:ticket o:headerName="Authorization" o:headerValue="{}" />.. </o:default>.. <o:service o:name="Research">.. <o:url>https://word-edit.officeapps.live.com/we/rrdiscovery.ashx</o:url>.. </o:service>.. <o:service o:name="ORedir">.. <o:url>https://o15.officeredir.microsoft.com/r</o:url>.. </o:service>.. <o:service o:name="ORedirSSL">.. <o:url>https://o15.officeredir.microsoft.com/r</o:url>.. </o:service>.. <o:service o:name="ClViewClientHelpId" o:authentication="1">.. <o:url>https://[MAX.BaseHost]/client/results</o:url>.. <o:ticket o:policy="MBI_SSL_SHORT" o:idprovider="1" o:target="[MAX.AuthHost]" o:headerValue="Passport1.4 from-PP='{}&p='" />.. <o:ticket o:idprovider="3" o:headerValue="Bearer {}" o:resourceId="[

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	SQLite 3.x database, last written using SQLite version 3034001, writer version 2, read version 2, file counter 2, database pages 1, cookie 0, schema 0, largest root page 1, unknown 0 encoding, version-valid-for 2
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	0.09304735440217722
Encrypted:	false
SSDEEP:
MD5:	D0DE7DB24F7B0C0FE636B34E253F1562
SHA1:	6EF2957FDEDDC3EB84974F136C22E39553287B80
SHA-256:	B6DC74E4A39FFA38ED8C93D58AADEB7E7A0674DAC1152AF413E9DA7313ADE6ED
SHA-512:	42D00510CD9771CE63D44991EA10C10C8FBCF69DF08819D60B7F8E7B0F9B1D385AE26912C847A024D1D127EC098904784147218869AE8D2050BCE9B306DB2DDE
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................K.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-journal

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	4616
Entropy (8bit):	0.1384465837476566
Encrypted:	false
SSDEEP:
MD5:	FFC6230887E17AECBEEAF3DB72333B83
SHA1:	DCE231AB92D4E91E4FB7FCE1ADFA2B87353518D0
SHA-256:	7A5DC495E86F05A66A294F87CDB4B71D902583169A83F879A6262206A21B5131
SHA-512:	DE72557F623557D57F27D344C7937A2A81E4149193FE4337013FBDF0734E37E0F0DDCDD7F90D99CD258A7021FBCD989328FB7485228CA1F3C6AC22E052F315E2
Malicious:	false
Reputation:	unknown
Preview:	.... .c........\....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................SQLite format 3......@ ..........................................................................K.................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-shm

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.0447824104283491
Encrypted:	false
SSDEEP:
MD5:	2B59ECDAB849E80977B799FF57EDBE74
SHA1:	8C7E3CE237B39171A41ECDFAE38E404F225C74CF
SHA-256:	96E3506121263E0558C662125CEE0F7265D81E6FA8FA07B2EC1E9A3197823CC8
SHA-512:	24FB9D248FCEE2A869C28F14B751E916A3479C30BC7FE980BE2A7FDB97C4D540E25E5EABA0AE7F315B85EEC5D0C63AF7106C8118CAF3DE1DCB60378AE79F6E0A
Malicious:	false
Reputation:	unknown
Preview:	..-.....................kEj..L....OT.Q..=.:.@0.e..-.....................kEj..L....OT.Q..=.:.@0.e........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-wal

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	modified
Size (bytes):	45352
Entropy (8bit):	0.3937694664183705
Encrypted:	false
SSDEEP:
MD5:	B0DC540AEC13B72F481752F871F3AE18
SHA1:	AD36891E6593BD9A56EEA40E71CAA20F04DC3AE6
SHA-256:	3B49B6EA6F9C898CE44DDD5CC95CD159072AD91EFB5B08346CD85A87A3A349FC
SHA-512:	8F746D7C2743B20AE59D7C3A40E5CEAC03FC5F73C15AE1A497055021D7351639D4CB39EF7C9F29EA76960F61D4003D7690466020A8452E942C564255940BF173
Malicious:	false
Reputation:	unknown
Preview:	7....-............OT.Q..)6.,..............OT.Q..C..r....SQLite format 3......@ ..........................................................................K.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{6206218B-D2B7-458D-9A7B-E3A79FA7A234}.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	7428
Entropy (8bit):	4.253424002716362
Encrypted:	false
SSDEEP:
MD5:	2AEA5845CF40B1C5F18904AC9FB4685D
SHA1:	B5A7570C17ADDC39063AE678501D8D8E79BFA69C
SHA-256:	A83EE91BBF6585FB144A419DDF41EEBAEDC7A75B19CFE0E83EDD16374C4945AC
SHA-512:	4483A7AB215514CC4EBCD9AE3108352B4555976A5C3E27B41E13B0DB03EAC6D04234A4523C91A128FC2EC89EE72E6B7AF10D69B32160259763EEEA118A2FBC89
Malicious:	false
Reputation:	unknown
Preview:	....C.A.U.T.I.O.N.:. .......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................4...8...D...t...v...x...z......................................................................................................................................................................~....................................................$..$.If....:V.......t.....6......4........4........a...........$..$.If......6.!v..h.#v....:V.......t.....6......5.......4........4........a.......$..$.If........!v..h.#v....:V.......t.....6......5.......4........4........a........

C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1728931073955941500_50CB7BD8-7747-4E2C-9B34-18C2252FC158.log

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	ASCII text, with very long lines (28726), with CRLF line terminators
Category:	dropped
Size (bytes):	20971520
Entropy (8bit):	0.16175862184147075
Encrypted:	false
SSDEEP:
MD5:	9042D0C7392FC7BEF536F79D4F0B3549
SHA1:	0A740EEA8BA0010B116C7AE6F7421D047E9E86F9
SHA-256:	22007B0CF329B158628B43741E65C59BC731EFC66CBABE11A94DC0F440DB7FB7
SHA-512:	14489F8CC33A989BC799902C9B22F313ED238558191D46B795D151DECC58F7A217EE25957D89382EBA744AA67F1030A714C79E62FC7D23F9BE18C1DDE6C2390A
Malicious:	false
Reputation:	unknown
Preview:	Timestamp.Process.TID.Area.Category.EventID.Level.Message.Correlation..10/14/2024 18:37:53.998.OUTLOOK (0x1BCC).0x1BD0.Microsoft Outlook.Telemetry Event.b7vzq.Medium.SendEvent {"EventName":"Office.Text.GDIAssistant.HandleCallback","Flags":30962256044949761,"InternalSequenceNumber":21,"Time":"2024-10-14T18:37:53.998Z","Contract":"Office.System.Activity","Activity.CV":"2HvLUEd3LE6bNBjCJS/BWA.4.9","Activity.Duration":17,"Activity.Count":1,"Activity.AggMode":0,"Activity.Success":true,"Data.GdiFamilyName":"","Data.CloudFontStatus":6,"Data.CloudFontTypes":256}...10/14/2024 18:37:54.014.OUTLOOK (0x1BCC).0x1BD0.Microsoft Outlook.Telemetry Event.b7vzq.Medium.SendEvent {"EventName":"Office.Text.ResourceClient.Deserialize","Flags":30962256044949761,"InternalSequenceNumber":23,"Time":"2024-10-14T18:37:54.014Z","Contract":"Office.System.Activity","Activity.CV":"2HvLUEd3LE6bNBjCJS/BWA.4.10","Activity.Duration":9434,"Activity.Count":1,"Activity.AggMode":0,"Activity.Success":true,"Data.JsonFileMajorVe

C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1728931073956895200_50CB7BD8-7747-4E2C-9B34-18C2252FC158.log

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	20971520
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	8F4E33F3DC3E414FF94E5FB6905CBA8C
SHA1:	9674344C90C2F0646F0B78026E127C9B86E3AD77
SHA-256:	CD52D81E25F372E6FA4DB2C0DFCEB59862C1969CAB17096DA352B34950C973CC
SHA-512:	7FB91E868F3923BBD043725818EF3A5D8D08EBF1059A18AC0FE07040D32EEBA517DA11515E6A4AFAEB29BCC5E0F1543BA2C595B0FE8E6167DDC5E6793EDEF5BB
Malicious:	false
Reputation:	unknown
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20241014T1437530760-7116.etl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	modified
Size (bytes):	102400
Entropy (8bit):	4.4691144909553895
Encrypted:	false
SSDEEP:
MD5:	AB162C7481B8708EF423684612C2292E
SHA1:	63588D1A68FF96F05A0186189188F4806C2708DC
SHA-256:	E76A5B4F91370146ACD69552BA093F250A068BE2AFEC1A4CCA185A8FA2680451
SHA-512:	457E7FBA19356B02F9A21D29AABDA2380B977B69783CB49BDB55786CE0E1C0EBCB9945C3A7EDC403919CF803C668E4CED15B4A741C0B6A3FF5E348B8C33E7339
Malicious:	false
Reputation:	unknown
Preview:	............................................................................`.............+.h...................eJ..............Zb..2...................................,...@.t.z.r.e.s...d.l.l.,.-.1.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.1.1.1.............................................................{..Y............+.h...........v.2._.O.U.T.L.O.O.K.:.1.b.c.c.:.3.6.3.f.c.0.5.f.5.f.4.c.4.9.0.4.9.1.2.e.b.1.1.5.c.1.4.9.a.f.3.e...C.:.\.U.s.e.r.s.\.c.a.l.i.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.O.u.t.l.o.o.k. .L.o.g.g.i.n.g.\.O.U.T.L.O.O.K._.1.6._.0._.1.6.8.2.7._.2.0.1.3.0.-.2.0.2.4.1.0.1.4.T.1.4.3.7.5.3.0.7.6.0.-.7.1.1.6...e.t.l.......P.P...........+.h...........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Office\MSO3072.acl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	30
Entropy (8bit):	1.2389205950315936
Encrypted:	false
SSDEEP:
MD5:	A2E5FFFE5E9D71A8B80197CD4F83B1DA
SHA1:	FB98C3B4DE8581ECB86CC2281C27119B59A50CA8
SHA-256:	95E7F6A76505708FB698F0BDD27293AFD6AC1F4F82CEBD7FDE7A6E96D41D2543
SHA-512:	ABE38834F57EC8632F119A7052FF984F78AAE2238425E09A95E444DCD3AD63ABB8CEEDBAE6E39C23C6BBFC24B0565E919BFC9B6F900089E944DCF2109B2B0390
Malicious:	false
Reputation:	unknown
Preview:	....J.........................

C:\Users\user\AppData\Roaming\Microsoft\Outlook\NoEmail.srs

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.670299540857104
Encrypted:	false
SSDEEP:
MD5:	69BD1819CD4D72D3507874843A07ECFF
SHA1:	9F7920299FD2EE209BDAEBB24EE331158890C1BA
SHA-256:	A1F399F37D685C63CF84246AB5D07C791135E3CA23C2D155B7DDEABF95C77791
SHA-512:	BB6563D9ACF45EDE45821DCB96217E40CF75FDADDFE5E0DB72E327DE5979AE6FAF0F27AC4D25DA81BD58AC14E3BFB0A94DB4128A6DD3801492E0B2DAE4DEBA41
Malicious:	false
Reputation:	unknown
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Oct 14 17:38:07 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2673
Entropy (8bit):	3.989333018646853
Encrypted:	false
SSDEEP:
MD5:	D33B66D67B651FFF03530DCD01AC068F
SHA1:	401EF509F4E47A5B6DBB89070CE67B7338DC4896
SHA-256:	69CB28509134DD56BD2493CAD111947BD17F02C8AFFAE797E2AC5A8A184CE199
SHA-512:	8128C4B99BC076F144B3181BE2F0DA0A875698FB2C654118BF966BC8D9D2B9BCA3A40F200B40F87E0E975DD6533414A27E609616EFD07FC27CAEFC670C0D233C
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,......s6h...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.INY......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VNY.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VNY.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VNY............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VNY............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........0MY).....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Oct 14 17:38:07 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2675
Entropy (8bit):	4.004408741056881
Encrypted:	false
SSDEEP:
MD5:	C267E9DD68EF87D8A2C1A3BAFB81922E
SHA1:	E6BD622EDE3F5AB448888D3DDF08672D0B741232
SHA-256:	F800592982C2312A0FBD25E250C730ED391AF7F45DF13BC51487CCEF09407C58
SHA-512:	14C52EADAF170229145285AB3584BF90D016F8CF404F277BF471773FEBAA2F6089CB63FC8E169857C8DCE418246BA144C74B9CB2A5DA27F63FA10A875F925729
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,......d6h...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.INY......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VNY.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VNY.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VNY............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VNY............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........0MY).....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2689
Entropy (8bit):	4.0121747577446065
Encrypted:	false
SSDEEP:
MD5:	5B8A24BDC59F6D9FDAF81EBEA4591D6A
SHA1:	1B0FAF4FB4090E33DF12C5874E62C122C429A0E3
SHA-256:	42929EF5341E79A1A081512391241218B34CE4DFF879253B53FD49CA885DB823
SHA-512:	10C12D6CB31EA5AA08B2DA9BFFDF2A3CD06E96693CDE336DAF4AA3F7DB3A147031A70AC047B61B6D1CE02BF0295637A236391FA906A90D5C5C57524DB3F50CAA
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.....Y.04...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.INY......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VNY.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VNY.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VNY............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VFW.E...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........0MY).....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Oct 14 17:38:07 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	4.0029476935313735
Encrypted:	false
SSDEEP:
MD5:	9B52CF3F64F0724CE62FB73153974CAE
SHA1:	8E258D23D5D32941D42F56988E87E83941ACCDB3
SHA-256:	85F8AEDEA91EFD95B223C5DD39DAEFC8259D4B0F22882C24FAED671DBB18E0C9
SHA-512:	4D36F3E92FCD30694FAC73C1D7304FFA9C9D61B83D4765582115BE4CB0C20131FE8C943460FD2F46D4E81D99F585235D4135DF6B0C9266CD6EDBAAAA42D69891
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,....5.^6h...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.INY......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VNY.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VNY.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VNY............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VNY............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........0MY).....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Oct 14 17:38:07 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9904651186656004
Encrypted:	false
SSDEEP:
MD5:	FC611CC03F4B28A072269ED3D5BD8759
SHA1:	D7B111F34B10C90C653E850B3DA3B30454C09ED1
SHA-256:	6E3C5E7DFE70E082F81787A5DF6FA096105E4867800AB4FB701858855E254725
SHA-512:	E661DC196F011BD0F99417B684E2B9D9849513D8FC0B4F98EEEADD3D3260C4E667D79662C25CB0545A7BE3C91BA4BBA8EAD7BCF8646A4AE20CCAB587F2AB61AC
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.....}l6h...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.INY......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VNY.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VNY.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VNY............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VNY............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........0MY).....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Oct 14 17:38:07 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.9993957720526105
Encrypted:	false
SSDEEP:
MD5:	CC117B64A71DAF9BB7AD30F01D170DA4
SHA1:	6CB90AAE63F005F8D1B84C9CA19F0ADA624DBD0E
SHA-256:	88E2C87DEA68ED78504DC35CA95830091689C4981CED75354FCA2F3C7B63C858
SHA-512:	1BEC0507067C919D3806D8EDD172FE437A0CC7D4D814861C3C51B72AC83516DE71ADCF05AB96AA3578D0242617D193113445911BB78381E55CFCF2C71E9048D7
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,......V6h...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.INY......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VNY.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VNY.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VNY............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VNY............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........0MY).....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\Documents\Outlook Files\Outlook Data File - NoEmail.pst

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	Microsoft Outlook email folder (>=2003)
Category:	dropped
Size (bytes):	271360
Entropy (8bit):	2.687898590456985
Encrypted:	false
SSDEEP:
MD5:	2B1C9A18DC4A68AF8F9A09FF94530222
SHA1:	EF5B5BAE1B5BE6E260C90162DF7ABD5C50357D94
SHA-256:	0D858A14EBEBE4975DF90794FC926D74BE3507DEADB2FC25BBE296B2B0057C56
SHA-512:	61CF13FD52FA5CE8623F993AF1BEFB55167FB1EDE56AA58F878380C80A46FA3512A6B10BFEA465DE40C0FE4F44171FAFF479CF05C734DFAA5F9943CFA13368A7
Malicious:	false
Reputation:	unknown
Preview:	!BDN.h..SM......\...............>......._................@...........@...@...................................@...........................................................................$.......D......@...............=........j......:....................................................................................................................................................................................................................................................................................................1H...;.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	2.971838935993398
Encrypted:	false
SSDEEP:
MD5:	0B2C250D656657A256B62F28EB942127
SHA1:	E04B5D98A1F83CE123F5C789405D16EBD66AB792
SHA-256:	CF87C6E5CE1F0CF6D2B84DB65CD3ECC8851DDE44228CC2FAB963E55FAC0F4C5E
SHA-512:	E5E37910992EBE8E1B2EBF525A5F880E9FEAA44E5FE4242D7906E97339C1D77F4240A7FA476B8825389CAA0F6371DEFCCB71F917F8D5133FBFC97CFD13941018
Malicious:	false
Reputation:	unknown
Preview:	.. XC...`............).-h.....................#.!BDN.h..SM......\...............>......._................@...........@...@...................................@...........................................................................$.......D......@...............=........j......:....................................................................................................................................................................................................................................................................................................1H...;..).-h........B............#.........................................................................................................................................................................................................................................................................................................................................................................................................

Chrome Cache Entry: 77

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 17448, version 1.655
Category:	downloaded
Size (bytes):	17448
Entropy (8bit):	7.988215424387779
Encrypted:	false
SSDEEP:
MD5:	48B83F7B9CF25C402AC0946A957F74BA
SHA1:	80FF7ABA37DD1FF5A6B90233A19E3A780A96DC2F
SHA-256:	E27466D19D5B9459F659FACA4609650719F1AA6E9ABCD5BAB91E1A3BA63AC2F0
SHA-512:	43CF9FB0EDFAECE5D3B3ED390C18383D7126D3551B2008FF6ACC8D37887603FAB5011DB63117496D275417C1C5326FF537011F97468ECDE2CA1973AEBB209343
Malicious:	false
Reputation:	unknown
URL:	https://m.media-amazon.com/images/S/sash/2SazJx$EeTHfhMN.woff2
Preview:	wOF2......D(..........C.........................?FFTM..8.....@.`..~.....<....6.$..F..<.. ..N..a?webf......6m....{w..V...=...f.B.8`...f...........5..1.)4(R.+..$C..t.1......OP..{......"e...OrB.t<.d..0H....V[ "PL.%C.+.x. .,....p..Z2fd..w%Q..........,..BG^...;.......Jl...[.E:......?.?D..y.m...Q.......'./VD+;I..b.:.U.-..y~n..[0....9.H.....'.lt.(..F...#E...&..&....+1>.....5..\.Y..l...8..5.5...t..P......j#....i."...Z....s't..{px.......:.R!..Kk.e...8+... ....s.sJ.......&\..........3{..j.i.u{....(..h.Z6.9[5.M....T..........$2..6.\|.={....)[,.7_..gC.""b..1.a:..." -&..$.}?.v.!.&.!.U..J&E..zs.....Y?..a.....HZ.x.....Ud.;3....X.....V...Mc&..~.n%...2........]GL...Nzea...S.hDCzH..o...\\|...q..\|.N.h@Z.[...c..X..... @.r.. ..B4..9........x..(9%.....rN..s..\|.;..[7.]y....~u.7..E.zc..../1..M.1..b~..........I.[c.pXyC._KJ..ry.Y....a..._....j.JQ...'..9E..M..4.g......@6... 0..8.<mo..S.....`o.ED.....r...Iut...(!... A$.....""-....T.....;..( (^......_=..+..8mQ..o.S............

Chrome Cache Entry: 78

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 27920, version 1.19661
Category:	downloaded
Size (bytes):	27920
Entropy (8bit):	7.99242211313595
Encrypted:	true
SSDEEP:
MD5:	0F85A003B4D8AFBFEDD8118278061C34
SHA1:	245045FA7DE5DF027437F47209A5ADD3B48108A1
SHA-256:	AFF8DAE3B2DD2A0FD5C5CE60670CBBCA15A1F5BFAFCD70D13AD002EF920920F3
SHA-512:	69206330B785407D74A86D2916A13BC1311DC52218BE3B9F4629971E540D9C2FA6ECE1B2AF82404858242728B6F4079677187D3DED6524C550B2B4F8FD42E8B4
Malicious:	false
Reputation:	unknown
URL:	https://m.media-amazon.com/images/S/sash/Dv1WQ5DdeMS5qP7.woff2
Preview:	wOF2......m.......C...l...L.......................z......\.`..J.........4..-.6.$..<..`.. ..8. ..[T#...G..L......p.....t..9M.~.yVJ.../.n.U%.L......r..c...PU....7... ......P.F.c.),..b..Z.[m..f.B....}...x,..I..Fe.....n..;......Jv+......7......^.[%;...N.........)......1@..........&.....t.].1....B.}.>.}8Y.\|...../.....n.M......$....k5.K.....Ju+isv........b.$.q.`...EF.IV.'O....z....+0..-....}.......8.c...8D.1C....%...Hlb.X61s..m..f,.6....s..)%.cD...6..`.d......Q... ..(....xr..66.z.z6.J=..._{.>7.]..`.$....R..91C.lBC.....M....V.../q..D....c:...FP..X.$."xP.;........ .F..I.kNm...."T..O.M.u...M/....}...,..-O..@)Pt.(....g{dO..1..o.L...<...Mx..v...F.H...L.........f\H_..}....M.6.BN........3}.X9..s...w.N..b#......:w...`...".=.......i0....7S.......T?...s.J.'...UN.{Fr..5...^....4.k..#L>V.'.s..;6.]........x..q..\|\|\|...D.J...r.y8..O....$....>.?.q...A.?..\|jn$5.". .K9.?....1.1T"..=0Y..CS...]..O_.L-.m...8.....eW.w>H.Lfs...v.b0;;...8......!.g......%..P....

Chrome Cache Entry: 79

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 21508, version 1.0
Category:	downloaded
Size (bytes):	21508
Entropy (8bit):	7.989562036604764
Encrypted:	false
SSDEEP:
MD5:	49A8476C4C1CBBE861D58EE73146477F
SHA1:	FAC44C6A6EB11604F6CB0A9901566FAFC93080E3
SHA-256:	5D2E0937AFADFE093EB3FFDB36AC561DA423F81A9DFBC0A875CE29D32584B6F4
SHA-512:	485419C61167DE6851CC9D9A73B5F9691F6D01465AE81670F7C82A0F97D5C60F67F7A174A1C0094BD51411E00E6D3AC0A69D9ED7DDFBB959E09F46491945D915
Malicious:	false
Reputation:	unknown
URL:	https://m.media-amazon.com/images/S/sash/VjTR4RqBzY0mUYx.woff2
Preview:	wOF2......T...........S.........................?FFTM......Z..^.`..j...e.....P..:..X..6.$..,. .."..`..6...'..v.$.......`...An..T..@.....z;.....t.Q.>.U..nD......!M...pY..5.>kL.L....d..........D..v g..= O.."......+...B..2._.h;..:......./.F/.>=.....~...<%..Na..p.6..e.x..jY.'..\`......T?.#..#PJ..-...V.U5-...1....Z...c~V..E..Y.QF...C.y...}y..h..E.N...tc..d.j_D.u..l....d...=...R.mRv!.....{.\..W!G...b....c..2..Eg.IqS>>....S=...$..(.k....Bu2T@>._....\|....jl..\|.._.tq...; s.~.x.!.dD..+.P..p...v2;..Z...D=.0eE...$.........o...]...T..''z;..61.S=.1.p./j.T....;qw\q..C.+...Qp.......e.v..G..M.8e..h....%....v.t..z....k; E....._>.&.../..?{..P("%w...!...vB._S....Z..X......'...n.kU.}.....J..<..2..........0..^....F.... u.:D..W/...3@.,..U.:s...w..lU.][...TO.....GB..%..........c..j.......%...0..<.W....d).z0.7L.&..1eJ.'K...Y.~...{vW.(K):c..\.l.^....3....C.1.J$...@..]R..j..u...}._].._:..}......6\..O.o.:.t$.....2$\....;@....>..J.*].\|..S.._... .NY..(...k..

Chrome Cache Entry: 80

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 619 x 577, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	28598
Entropy (8bit):	7.946117721484674
Encrypted:	false
SSDEEP:
MD5:	AA9067518A5C2167AB0C50E91647E2AE
SHA1:	A340943F4584CCBD156E53AD45E802217710113E
SHA-256:	48FE67856B7307F9F319C9E8524546A1910D3DB3F45B3AB14C2EFD37EE862F20
SHA-512:	562732A97368888F781DF3BEEDD16307CE477CDCDFCC7776CA7E926718DA8ACCF098B24AEFE3FA0401C8ABD68FC62777FF2CD81EC6F4E1F2C9E8F3DA0FEB4521
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...k...A......{.....sRGB.......opIDATx...xUU.....;..3.i:.@h"`...X.....B....z..Q..E.P@z.....H1.8.$..\.o......Svy...>..;$..}.....E.qT.R.b..!..BB.b..tX.5)...+.i.<..B.+].9...&...j...~..}V....._.u....-...B.K.....]...............o.......qM...!....y..{..U.T....;.O..B.!..../J.;..[v..HE>m...R..D..u.2...x..\...?...%.[..;Z.=.4.!..b..R._..j9.B....ef..z.\...}$.t.D.}......S'..B.)sT......-.4....!;H.a..}"r..y........A.!....P.7/.h.eei.l.~.H1...G.B.].s?'......B.!$.-.s.}.E:f....HX}.v...1.>.}EJ.....B.!.#......W.b....V........^..2...#..BH.9..e....7{.l73.#o.Cz9.9.v....!..._....A'Y.Y&..E.L%n....R..v..3yZ.!....Pi../......!F..."..T.q{...Y<..B.."..o.\|......*.`..b.6D...M.!.X<%.."ic.m...;^PX'.......O;!..b..E...6g...L..).xKE...r..@.!..4.....\|...N/..._.....V.B.!..~.\......=D...m....Q.)..BH........&..."..".....&.9..BH.#7./....0"../#..S..ky..!.. ...n+.ZK....j......l....E.!..[......2...7o.!......W.e....B.!H...\....r.o"!........].....$.......H.j..L......h.

Chrome Cache Entry: 83

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 29240, version 1.19661
Category:	downloaded
Size (bytes):	29240
Entropy (8bit):	7.993601718527624
Encrypted:	true
SSDEEP:
MD5:	C58D60F633A61A473A746505B4373194
SHA1:	32110B329B0FF64B386960BCEC4E61964EDEAA17
SHA-256:	823E37B5143B1B90333E54B872BDB8D40B9F12AD98547D30874FA6350D09A9F3
SHA-512:	800F34827D7913082944F2F3C58D978CB58042B4C198A0CBD773D676245281D17DC58246BDA9F75504C340C19AA5E5B603BC790184F4FD3655319BAA56720343
Malicious:	false
Reputation:	unknown
URL:	https://m.media-amazon.com/images/S/sash/ozb5-CLHQWI6Soc.woff2
Preview:	wOF2......r8......I8..q...L.......................z......x.`..J.........d..L.6.$..4..\.. ..8. ..[.'q...6.D....2u{..9..6...g.h......a..H.=;......2..A....d..d..K..1.t.9.t.D.../r.p...c.n...27.0...&.<H.ye.7.=y..H..2-.../}.S.y..6.&...F.$.o.........Th?.K.o...FB.&...aC...NW.v'...m..e.Y<Sq..I...M..._.}.....+.).F.9KP._R.."aE].ox..E`..G..........>y.I.+J .d..V....4.m%...5.,........{...ED.B.`.1.....NW.9.1.."\T......E.@..bv........H.6i;.@...lS..K..U..j...#.r.f.1.Y.b.0.8.."&....rz...Y.m.:PJRQ...Z.....jf^.@...i...i.O\...^...J.P......l/.?g.a_3...q...a.!h....x./..M&...}.W&..H.I%.@.p......9.`@C...H.P@..QT.\|Q9...7..P......7A,.B^B..'..Z.M..s..N.(b:v...nC.i...E.E..i..iK5.......?.G.O.m..1...W......+m'.0~.o....+.cG..m>..3.!-.LV.S#...l..^oC...>g.s...G........juHE.p.,t...D..........AL@...t.}o..>a...>.j.....%gO\8....($.?...r..t..ILBZ.@'..6...C,...6.v...Hc.#.MP..V.qY..a$....h74;&Rd".e.n.K.K....@....4TM..O.........r.B4fvI.0<....z.....44).$.{....z..9X.AF....A.p

Chrome Cache Entry: 84

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (776)
Category:	downloaded
Size (bytes):	338942
Entropy (8bit):	5.377397017457609
Encrypted:	false
SSDEEP:
MD5:	C8C63005E5685422975D6FD0F122081D
SHA1:	A3235C77E499BE1E421626874D60A52901C9E4A3
SHA-256:	20E15D023893FEA42887AE854C1FD7AD3135279AD589B31D8FDE0CD270D1A970
SHA-512:	A4ADB58B7B2A9EDF7D3F9042F7C6FAC3B4E49D0AA6BCF071FCAB93135BEAEEBEA6F8911951681721A02C8B7B1DB23537281F0766305AD3CD2B5FB436F1D1D2BF
Malicious:	false
Reputation:	unknown
URL:	"https://images-na.ssl-images-amazon.com/images/I/61XKxrBtDVL._RC%7C11Y+5x+kkTL.js,51106gSDnJL.js,11yKORv-GTL.js,11giXtZCwVL.js,01+z+uIeJ-L.js,01VRMV3FBdL.js,21SDJtBU-PL.js,012FVc3131L.js,11rRjDLdAVL.js,51H19hJRYrL.js,11kWu3cNjYL.js,11tMohjWmVL.js,11OREnu1epL.js,11wcWdhrnDL.js,21ssiLNIZvL.js,0190vxtlzcL.js,51+N26vFcBL.js,01JYHc2oIlL.js,31R9m8rig5L.js,01ezj5Rkz1L.js,11+RxVdhNcL.js,31o2NGTXThL.js,01rpauTep4L.js,01KFkXJxMTL.js_.js?AUIClients/AmazonUI"
Preview:	/. jQuery JavaScript Library v1.6.4. http://jquery.com/.. Copyright 2011, John Resig. Dual licensed under the MIT or GPL Version 2 licenses.. http://jquery.org/license.. Includes Sizzle.js. http://sizzlejs.com/. Copyright 2011, The Dojo Foundation. Released under the MIT, BSD, and GPL Licenses... Amazon elects to use jQuery and Sizzle under the MIT license... Date: Mon Sep 12 18:54:48 2011 -0400. Sizzle CSS Selector Engine. Copyright 2011, The Dojo Foundation. Released under the MIT, BSD, and GPL Licenses.. More information: http://sizzlejs.com/./.(function(N){var r=window.AmazonUIPageJS\|\|window.P,p=r._namespace\|\|r.attributeErrors,C=p?p("AmazonUIjQuery","AmazonUI"):r;C.guardFatal?C.guardFatal(N)(C,window):C.execute(function(){N(C,window)})})(function(N,r,p){r.navigator&&r.navigator.userAgent&&N.declare("jQuery",function(){function C(a,b,d){if(d===p&&1===a.nodeType)if(d="data-"+b.replace(gb,"-$1").toLowerCase(),d=a.getAttribute(d),"string"===typeof d){try{d="true"===d?!0:"false"===

Chrome Cache Entry: 85

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 17336, version 1.655
Category:	downloaded
Size (bytes):	17336
Entropy (8bit):	7.986832176880709
Encrypted:	false
SSDEEP:
MD5:	B39E082C6B983705892045FD87E0B9A8
SHA1:	9CC1BB64EB270135F1ADF3A4881C2EE5E7C37BE5
SHA-256:	CB0F25CA005489D2399434C33762F291BD8746714EAE3AA72DE20ACA08EDC458
SHA-512:	DDBB8B598854DD829BEFB27641B1C56F23FCE55283D3FA33F0BFDA1C3B38CE7DC03A799E84902C580BA8A54361D33A49038368C96D9FCDE6A50FE83514774D17
Malicious:	false
Reputation:	unknown
URL:	https://m.media-amazon.com/images/S/sash/WOnTLzkiaEccV7F.woff2
Preview:	wOF2......C...........CS........................?FFTM..8.....@.`..~........!.6.$..F..<.. .....a?webf...5l.......?..`..0p....{..Tj....?%........X.....,..UU.o.J(x...g.HK.I..EW.....<...o.RS.,.D.[Xv.s^SW.<..Y0...@..e...t...J$%?..BGb.axC.....hc.P...z7/.m...=!........LET.K...N....W..DOc.x~..>!...."V...D..v."..tQ.t.?OG..y3.../.F..qB.%..@..\..y.2w.7GKB..7).1..p^u...MJ...O.D......m..3..1....5..,...!..x\|8Xo.y.!..A w.T...'2.M^&/''...V.D.Hl......$..D".JeR.L..d"t...6}.c.2.Zkx.....!A%.q...b....$XJ..SJ...01&..X.../.@..n....o...........ow.......$.RB.7...L.Ip.........dOU.......O.w.....Y.[k[.^MR ...v...6...>.........uYZ[.-k...Y.L.@...j...../r..`g>..C..R.rw%..`...p.&q..)(.......z...-H..N....)rI%.B..C.B..K...u...2.E.t.g.>....?..7._....Z.~....t.'.bj.`.\|M.g..fi.X..D.HU.e.Yz..t....dk.t.0...1r.R.v.E.........}....I.?.....%.T.;.`!,.o....B..^.z....b.!BB$Dd.....a}.j!.+..A.A...4"M#"..9..el......A.j..#?"...}...."..#...8k..._.x..\|...c........5.H...."-..a.p.p?..b..K....~.*..

Chrome Cache Entry: 86

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (23900)
Category:	downloaded
Size (bytes):	180988
Entropy (8bit):	5.02624081385034
Encrypted:	false
SSDEEP:
MD5:	57C6E9B1176EC402644759138C2789D4
SHA1:	A5721FA2112B9AC5BF24DAE2011A3EAAA7ABBE04
SHA-256:	227227E725825D15D777D52DB691B81386E7CB0E329F7E87BB51916BBCFCCA83
SHA-512:	8CD9F4628D07C6BC5819E5BE3548A043F511C93AF46BD3D2B258008F82A0060162DB887408E1B3A85AE6CB821F3E0B2113BF4B1B8709880559BF09E99B327F20
Malicious:	false
Reputation:	unknown
URL:	"https://images-na.ssl-images-amazon.com/images/I/11EIQ5IGqaL._RC%7C01ZTHTZObnL.css,41wZkyTaWoL.css,31Y8m1dzTdL.css,013z33uKh2L.css,017DsKjNQJL.css,0131vqwP5UL.css,41EWOOlBJ9L.css,11TIuySqr6L.css,01ElnPiDxWL.css,11bGSgD5pDL.css,01Dm5eKVxwL.css,01IdKcBuAdL.css,01y-XAlI+2L.css,21N4kUH7pxL.css,01oDR3IULNL.css,41CYNGpGlrL.css,01XPHJk60-L.css,114y0SIP+yL.css,21aPhFy+riL.css,11gneA3MtJL.css,21fecG8pUzL.css,01ulGzBW88L.css,01CFUgsA-YL.css,31C80IiXalL.css,11qour3ND0L.css,11gKCCKQV+L.css,11061HxnEvL.css,11oHt2HYxnL.css,013RDhw9hoL.css,11JQtnL-6eL.css,116v6uYvN6L.css,11jtXRmppwL.css,01QrWuRrZ-L.css,21zuRztKjtL.css,11QyqG8yiqL.css,11K24eOJg4L.css,11F2+OBzLyL.css,01890+Vwk8L.css,11Y05DTEL6L.css,01cbS3UK11L.css,21F85am0yFL.css,01giMEP+djL.css_.css?AUIClients/AmazonUI"
Preview:	button,input,select,textarea{font-family:inherit}h1,h2,h3,h4,h5,h6{padding:0;margin:0}h1,h2,h3,h4{padding-bottom:4px}h1,h2,h3,h4{text-rendering:optimizeLegibility}h1:last-child,h2:last-child,h3:last-child,h4:last-child{padding-bottom:0}h1.a-spacing-none,h2.a-spacing-none,h3.a-spacing-none,h4.a-spacing-none{padding-bottom:0}h1 .a-size-base,h1 .a-size-mini,h1 .a-size-small,h1.a-size-base,h1.a-size-mini,h1.a-size-small,h2 .a-size-base,h2 .a-size-mini,h2 .a-size-small,h2.a-size-base,h2.a-size-mini,h2.a-size-small,h3 .a-size-base,h3 .a-size-mini,h3 .a-size-small,h3.a-size-base,h3.a-size-mini,h3.a-size-small,h4 .a-size-base,h4 .a-size-mini,h4 .a-size-small,h4.a-size-base,h4.a-size-mini,h4.a-size-small{padding-bottom:0}h1,h2{padding-bottom:4px}h3,h4{padding-bottom:4px}.a-size-medium .a-row.a-size-base,h1 .a-row.a-size-base,h2 .a-row.a-size-base,h3 .a-row.a-size-base,h4 .a-size-large .a-row.a-size-base{padding-top:1px}.a-size-base .a-row.a-size-base{padding-top:0}.a-size-micro{font-size:10px;l

Chrome Cache Entry: 87

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 16616, version 1.655
Category:	downloaded
Size (bytes):	16616
Entropy (8bit):	7.986966282975233
Encrypted:	false
SSDEEP:
MD5:	4AFCD3B79B78D33386F497877A29C518
SHA1:	CC7EBAA05A2CD3B02C0929AC0475A44AB30B7EFA
SHA-256:	CDED49F94FC16DC0A14923975E159FBF4B14844593E612C1342C9E34E2F96821
SHA-512:	2DC9FFF1D57D5529C9C7BFF26FA9F3F94ADC47E9CEF51D782E55ECF93045200140706AB5816DFD4A0B49B8DB2263320FA2F0FA31A04E12D0C91FEA79B127255D
Malicious:	false
Reputation:	unknown
URL:	https://m.media-amazon.com/images/S/sash/pDxWAF1pBB0dzGB.woff2
Preview:	wOF2......@........l..@.........................?FFTM..8..z..@.`..~.....P..9.6.$..F..<.. ..,..a?webf....5l.F..VU..#7.Q...d......k...r....{.T....2KuI.1.+j...(..kvf8...7.+.&.....t..!Z..C...>..=.....v.9_.% .L.....z..........0.e....;.7>.d..S..[..&/....=.9w.n...=.FH.h$...<....s.s.F..`...c....@...}.MP.@.A`T+..J.,F..XT....@..c......TH....OZ..u.....V..u..g...#..~"...Df.\M..-...n.Cu..{f..@.b{B...x......2..;.B...Ah.).....m...Q`!V.IH.pG...T.mb..p.[.v....Z=..P...I.,....m....;..Hva.*..@..x..:.....=&'G. ..0.....Mi...LC...t6..N5..m.........TH.....mY#..g..#.$...7..}...cS{..!.'..n..3...0......lw..D.,l..x...hH.I..lZ.]...4h/..>-A...wAv....W..KeYj{.V[c..d...d/..1.g.(:..5......h.(;@..........0..]+my.qdQ.>..JGu5.v2.3/.)..h.I2.P.. ....P..l......UU..#.d......R..x...)..d...2.....ov..%'..R5.97jA.._...m#..:.Z..r..5.!1.a.`..o.\<.4..j..._.......+Y)E......."A$..-._........c.C-.\....C../C..>..;T.@K...aB.o}t.>..~...>............uP\|..\\|.....1.. x....-%.....<>.$M..(..e......Un.rf0

Chrome Cache Entry: 88

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 512 x 256, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	21550
Entropy (8bit):	7.91806209600598
Encrypted:	false
SSDEEP:
MD5:	9E8500E037B11113FAB1203FD5FC3225
SHA1:	8A38DE74DE61C0B7310EA41A0737FF5FF79B27EC
SHA-256:	678178853400CF330B026757894259C3B246F35BF350A18FA2CE3F4BE4FE6F78
SHA-512:	9966C8428DDBFF463FC59919B1071BCC1BAB64D9BFC6C2F6A4A6EDEA3DC380D39573542D75EAF717EE4C5CAA6FC5F65E2BD3ACEBEAD4DF63AA69FCE23C865008
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............N>U....PLTEGpL.6:.98. ;. ;.0:.79.:.DgOd{.9. ;. ;ACFdddgkkdddeff.7y......;..k.Oz.H.%<.4;...ccclww...F.j.J..>@CFJ..O./;.2...)..9..,,.....?O......."..(....%.rc.D@.8!.".).....'......\|n....B>..........rj.@.............#..(...dM....0..!..#........F..$..#.......................-..,...................."..$..#..#..#..#........#..#..$...........................)}.)}.)}.......)}.)}....)}.)}.)}.,}N.-O./R.,N.-....JJ..I..H..K..J...<..=..yH..H...<..<...###......@@@...$/=.........lxx`...<H...G6.G6.H6.G6......r%.f&.e..JS.........-8D#/>;?D%(+6C:?C=?B/:F$..%1@...&{..p.@..:?D>.....J........g...g:..<.........................................lxx..T..U...g..?@A=@B>@B?@AAAA@@A@@A>@CC...=C<..6d..]..]...U.........<..............=.................'...........3>H.Z......tRNS.t...&<_.....>.o..(.)..#.N....g.zOf.C....[=.7........J................{T...)......_a..)..F6\|C.Ro.l.........7\..y.....Z..A.........~.].................................%.^...p.....

Chrome Cache Entry: 89

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 16460, version 1.655
Category:	downloaded
Size (bytes):	16460
Entropy (8bit):	7.987708256804987
Encrypted:	false
SSDEEP:
MD5:	15E17F26C664EE0518F82972282E6FF3
SHA1:	46B91BDA68161C14E554A779643EF4957431987B
SHA-256:	4065B43BA3DB8DA5390BA0708555889F78E86483FE0226EF79EA22D07C306B89
SHA-512:	54EADB53589C5386A724C8EEA2603481EBB23E7062FD7BFAB0EAFE55C9E1344F96320259412FB0DC7A6F5B6E09B32F6907F9AAA66BCA5812D45157E3771C902F
Malicious:	false
Reputation:	unknown
URL:	https://m.media-amazon.com/images/S/sash/KFPk-9IF4FqAqY-.woff2
Preview:	wOF2......@L..........?.........................?FFTM..8..j..@.`..~.....h..i.6.$..F..<.. .....a?webf..}...6..........n.......fE.q. ..Y...9.2d.$.}[..0.H....j.k....U..#"-SM.t..."D....+....t.8f...s...g636\|..g._.....EB.T.!.B..!..y...k....Ya..G~.Y.;+....)...k...=it.........k_.^.z.#.).).....Y?....}..&N.s....1..=A.FXSG...`C...00..5l..#6...w....-...hkJ. .-...$D..1j..F.]..ny^..]..:.\...2......^n...5P......_.6..k..2..K..i......y....K...?..6...q>.. .....a9...........4/.c.E.........q...8N..$.$....z.?.d..v.QmY..D....s...:Y...S.\|..\|...[..@...4...V..n..s....t....A....\.v..X...M..O4.!=$..35m1\..wT"..w.c.s(...]t.?....."Q....1(.p..%0<-v..b.^R.)E:$..0<.....R.B.TY...K..n\..{#...kd.-.8..#.........t;..3.....IT[..2.L...........H..$..._.j.....b<B..uN.,*....k....@.k.k.....[.........6....U.1bDDD..Qu....R..+a......^.iS..qb.^..U.uU.sj..-<D....H..Y.J..[......8....V}........}.$^...CE..jc. d`.^..q..Nw.....`...1...S19.u....`H..WT.1.....y...c.A..op`..V..I....

Chrome Cache Entry: 92

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 23220, version 1.0
Category:	downloaded
Size (bytes):	23220
Entropy (8bit):	7.992386121959413
Encrypted:	true
SSDEEP:
MD5:	3A49BFC56868E37D88AF0A8C98502AF0
SHA1:	70056995A9F3A8AF43162ECB4D14399F0A1258F2
SHA-256:	2931B4FEF361FB14CEBE167B5C0827F3C00D0651B4AE34AF1EBDA1BCC261C254
SHA-512:	9C1CFEA187895BD8B0532609EF338497BB803689BEB7D71C2FBA06CBA3F9FBDF8FDC2623E7C448A544930744204458D323927FEF8C0CF190D12AB8BA58F62BEA
Malicious:	false
Reputation:	unknown
URL:	https://m.media-amazon.com/images/S/sash/KwhNPG8Jz-Vz2X7.woff2
Preview:	wOF2......Z...........ZJ........................?FFTM......l..^.`..j.V..e.....$....X..6.$..,. ..\..`..A[].q.m...6...D...ql.. R....@....y.Q...9Ie.m..E....!".T@?F....%H..e....a.BSK0wu....2%...q..v.E6.-.IT........Ne...=...........q....N'"+..NV..:.j...w...d.KR..::.G.......`.<n.......d..{..(....y.........M..rlN.d.'..Z{.....`.@..U.Y1...dvX.....?......>....5.....}..915'...........<y2..N.....2.flbmQ..L.d.$v..T@....m..........N.@ST@Q%`......V~..h...k.[.J;.3...."Y....o.e.B.)yWb.=.]00..6.(q.7.o.h..a~....#4}iK.s)}U.RC[zh......z....b...BX.9~N.u2Y...<.$>(..B.%..AP.K.....{..B.+[......>...>U.6.O.,.9Gm....v..._.9..?...*Tcw...\|...?>xw..OE.=n...'.C.......Z..P./....RP..YU.....Q...b.uU_.:..Zj/.3.x.uj..Zw!..A.+\...i.b.Q.O._.s.p.s.6.?.p.<}e..,@A.^.._.%(.<...A."x.p.j......8.....S.....?[=.....R@..E7..m..3.z...<.h....0..H3.y&........j. w...7..j.L..K.N..R...?.j.._.=....Ai..v..!........FU....&..M.....rfH..iR#... ...Jk../.9.\|..].8.m..M.H..f....U..V.Q"....T\f0.

Chrome Cache Entry: 93

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 400 x 900, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	16237
Entropy (8bit):	7.914373477606932
Encrypted:	false
SSDEEP:
MD5:	52B8D386D2B1D407C71A4AE966B61ADD
SHA1:	B962650FFFC15637F0D9F57C332702459F084B7B
SHA-256:	D47C1E50DB91BB597B75EDC63362CD0C568E4F5F15A3F8BE1B6ADFF24E89E447
SHA-512:	C6B69AF93D0683324A86CBEE5575E42A293C8588267C49034D1CC9AB3635034897838F9D5EA665B694C90D72CFE2B3F462CAD907CC74749E9AF863A90D233998
Malicious:	false
Reputation:	unknown
URL:	https://m.media-amazon.com/images/S/sash/McBZv0ZvnbehkIx.png
Preview:	.PNG........IHDR................Z....gAMA......a.....sRGB.........PLTE....j..j.....i....fJ.nU.....i.....j..j............._bg[ajD`e.k..j..i.. ..i....\..i."'+.j.......j....................i.&+1otzMT[.i..........NSZbgl.i.jpw..E.... ...HOW.....j....bde...KQY........OTS344^ch....j.........adh............2.....eefZ`f.j.......{..{..ejr..........s.........i...biq`fnOSY....................fff.....f...........w.!!!fff...bhp.u..u..Y.'..PUY.....488.u.588.H.........F..............c.../.....tz.............1.................J.!!!..c.l.......q.m..v;d..D..Vx..../8A......#*1/8@.....\333...`gofffPW`.....%......KR[]dl.u.dkr.....dT[dX_g............kqx................7>A.].......Y..<........+4>.j..................}..UUU......?GP.{.............uK....7.'..rx~..R../~.....y.s.....%....W.........t...Y.{{I...YY...........tRNS.A4............b.H..[eo6..'..Q.......Q....a.w...`....w.a.A.5...q/.{I...e..X.^.......p....q..~......R.w...6........Gc........\|......Z......

Chrome Cache Entry: 94

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 4 icons, 48x48, 32 bits/pixel, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	17542
Entropy (8bit):	2.247918084411713
Encrypted:	false
SSDEEP:
MD5:	CA6619B86C2F6E6068B69BA3AADDB7E4
SHA1:	C44A1BB9D14385334EB851FBB0AFB19D961C1EE7
SHA-256:	17D02E2DB6DBEDB95DD449D06868C147AC2C3B5371497BCB9407E75336A99E09
SHA-512:	30F8F8618BFBCD57925411E6860A10B6AD9A60F2A6B08D35C870EA3F4CEC4692596A937FF1457CEFF5847D5DA2B86CEBA0200706625E28C56A2455E6A8C121D3
Malicious:	false
Reputation:	unknown
Preview:	......00.... ..%..F... .... ......%........ ......6........ .h....@..(...0...`..... ......%.........................................E...................................................................................................................................................?...................................$...........................................................................................................................................................................................B............................................................................r...P..........................................................................................9...............-........................................................r...................................................>......................................................................$..............................................................................................................................

Static File Info

General

File type:	RFC 822 mail, ASCII text, with very long lines (2521), with CRLF line terminators
Entropy (8bit):	5.946815047251555
TrID:	E-Mail message (Var. 5) (54515/1) 100.00%
File name:	phish_alert_sp2_2.0.0.0 - 2024-10-14T143610.340.eml
File size:	15'511 bytes
MD5:	1d4079e26e68e03bcf15e84051360cf8
SHA1:	a5ee44215c94a70fc29b8dccd7fda64d10373d46
SHA256:	bfe70b7b3faeb21d584d40fe063a97f1853be53142b0dc56dedcf2ce09c03d30
SHA512:	7eb8ea2ef8db9d7de15e351d264f7dfdad6e623a1d205c6a9e3b024c2ae5e41aac74e2c78b46b4d3530c81c920decf690e8c9e31ae6255019edcbcc0da929d53
SSDEEP:	192:9aNipuIvMmttdPvayIncmyRwzfyZ/JdcDQACs28zWo+dAGAhCzj7t7hxoz3Pwrol:9aNGrJt3t/xdcY/sW1+/0+kUeBenCs
TLSH:	70625AD1AE0531B626B4ABC4D8317E52D3D0586F97F2A4C0BD9E8692EF8D43413123BE
File Content Preview:	Received: from SA1PR22MB5044.namprd22.prod.outlook.com.. (2603:10b6:806:3c9::10) by SN7PR22MB4126.namprd22.prod.outlook.com with.. HTTPS; Mon, 14 Oct 2024 16:21:06 +0000..Received: from SJ0PR05CA0148.namprd05.prod.outlook.com.. (2603:10b6:a03:33d::33) by

Static Mail

General

Subject:	[EXTERNAL] amazon.com: Purchase attempt
From:	"amazon.com" <account-update@amazon.com>
To:	Mark Johnson <markj@infra-metals.com>
Cc:
BCC:
Date:	Mon, 14 Oct 2024 16:20:56 +0000
Communications:	CAUTION: This email originated from outside the organization. Do not click links or open attachments unless you recognize the sender and know the content is safe. MARK JOHNSON,There's an order ready for your approvalWhen: Oct 14, 2024 12:20 PM Eastern Daylight Time Device: Fire HD 10 (11th Gen) Near: Connecticut, United States Approve or Deny. Is it safe to follow this link?The link provided in this email starts with https://www.amazon.com. If you prefer, copy the following link and paste it into a browser to view. https://www.amazon.com/a/c/r/x0bcRZ2VMef4tPrE77VklgIkN body { margin:0; color:#333; } a { text-decoration:none; color:#006699; } p { margin:0px; } img { border:0; margin:0; text-align: center; } #title p{ font-size:15px; font-family: "Amazon Ember", Arial, sans-serif; } CAUTION: This email originated from outside the organization. Do not click links or open attachments unless you recognize the sender and know the content is safe. MARK JOHNSON,There's an order ready for your approvalWhen: Oct 14, 2024 12:20 PM Eastern Daylight Time Device: Fire HD 10 (11th Gen) Near: Connecticut, United States Approve or Deny. Is it safe to follow this link?The link provided in this email starts with https://www.amazon.com. If you prefer, copy the following link and paste it into a browser to view. https://www.amazon.com/a/c/r/x0bcRZ2VMef4tPrE77VklgIkN CAUTION: This email originated from outside the organization. Do not click links or open attachments unless you recognize the sender and know the content is safe. CAUTION: MARK JOHNSON,There's an order ready for your approvalWhen: Oct 14, 2024 12:20 PM Eastern Daylight Time Device: Fire HD 10 (11th Gen) Near: Connecticut, United States Approve or Deny. Is it safe to follow this link?The link provided in this email starts with https://www.amazon.com. If you prefer, copy the following link and paste it into a browser to view. https://www.amazon.com/a/c/r/x0bcRZ2VMef4tPrE77VklgIkN MARK JOHNSON,There's an order ready for your approvalWhen: Oct 14, 2024 12:20 PM Eastern Daylight Time Device: Fire HD 10 (11th Gen) Near: Connecticut, United States Approve or Deny. Is it safe to follow this link?The link provided in this email starts with https://www.amazon.com. If you prefer, copy the following link and paste it into a browser to view. https://www.amazon.com/a/c/r/x0bcRZ2VMef4tPrE77VklgIkN MARK JOHNSON,There's an order ready for your approvalWhen: Oct 14, 2024 12:20 PM Eastern Daylight Time Device: Fire HD 10 (11th Gen) Near: Connecticut, United States Approve or Deny. Is it safe to follow this link?The link provided in this email starts with https://www.amazon.com. If you prefer, copy the following link and paste it into a browser to view. https://www.amazon.com/a/c/r/x0bcRZ2VMef4tPrE77VklgIkN MARK JOHNSON,There's an order ready for your approvalWhen: Oct 14, 2024 12:20 PM Eastern Daylight Time Device: Fire HD 10 (11th Gen) Near: Connecticut, United States Approve or Deny. Is it safe to follow this link?The link provided in this email starts with https://www.amazon.com. If you prefer, copy the following link and paste it into a browser to view. https://www.amazon.com/a/c/r/x0bcRZ2VMef4tPrE77VklgIkN MARK JOHNSON,There's an order ready for your approvalWhen: Oct 14, 2024 12:20 PM Eastern Daylight Time Device: Fire HD 10 (11th Gen) Near: Connecticut, United States Approve or Deny. Is it safe to follow this link?The link provided in this email starts with https://www.amazon.com. If you prefer, copy the following link and paste it into a browser to view. https://www.amazon.com/a/c/r/x0bcRZ2VMef4tPrE77VklgIkN MARK JOHNSON,There's an order ready for your approvalWhen: Oct 14, 2024 12:20 PM Eastern Daylight Time Device: Fire HD 10 (11th Gen) Near: Connecticut, United States Approve or Deny. Is it safe to follow this link?The link provided in this email starts with https://www.amazon.com. If you prefer, copy the following link and paste it into a browser to view. https://www.amazon.com/a/c/r/x0bcRZ2VMef4tPrE77VklgIkN MARK JOHNSON,There's an order ready for your approvalWhen: Oct 14, 2024 12:20 PM Eastern Daylight Time Device: Fire HD 10 (11th Gen) Near: Connecticut, United States Approve or Deny. Is it safe to follow this link?The link provided in this email starts with https://www.amazon.com. If you prefer, copy the following link and paste it into a browser to view. https://www.amazon.com/a/c/r/x0bcRZ2VMef4tPrE77VklgIkN MARK JOHNSON, MARK JOHNSON, MARK JOHNSON, There's an order ready for your approval There's an order ready for your approval There's an order ready for your approval When: Oct 14, 2024 12:20 PM Eastern Daylight Time Device: Fire HD 10 (11th Gen) Near: Connecticut, United States When: Oct 14, 2024 12:20 PM Eastern Daylight Time Device: Fire HD 10 (11th Gen) Near: Connecticut, United States When: Oct 14, 2024 12:20 PM Eastern Daylight Time Device: Fire HD 10 (11th Gen) Near: Connecticut, United States When: Oct 14, 2024 12:20 PM Eastern Daylight Time Device: Fire HD 10 (11th Gen) Near: Connecticut, United States When: Oct 14, 2024 12:20 PM Eastern Daylight Time When: Oct 14, 2024 12:20 PM Eastern Daylight Time Device: Fire HD 10 (11th Gen) Device: Fire HD 10 (11th Gen) Near: Connecticut, United States Near: Connecticut, United States Approve or Deny. Approve or Deny. Approve or Deny. https://www.amazon.com/gp/f.html?C=LLJFP8MEWM3T&K=10INX0DJ82T68&M=urn:rtn:msg:20241014162056cb2436f68d33494c8b835aab7bc0p0na&R=205E5DHOCDFPV&T=C&U=https%3A%2F%2Fwww.amazon.com%2Fa%2Fc%2Fr%2Fx0bcRZ2VMef4tPrE77VklgIkN%3Fref_%3Dpe_44305210_579583930&H=0ZPAOSVC9DMZ7WONQOAFMWIIXQ8A&ref_=pe_44305210_579583930 Is it safe to follow this link?The link provided in this email starts with https://www.amazon.com. If you prefer, copy the following link and paste it into a browser to view. https://www.amazon.com/a/c/r/x0bcRZ2VMef4tPrE77VklgIkN Is it safe to follow this link?The link provided in this email starts with https://www.amazon.com. If you prefer, copy the following link and paste it into a browser to view. https://www.amazon.com/a/c/r/x0bcRZ2VMef4tPrE77VklgIkN Is it safe to follow this link?The link provided in this email starts with https://www.amazon.com. If you prefer, copy the following link and paste it into a browser to view. https://www.amazon.com/a/c/r/x0bcRZ2VMef4tPrE77VklgIkN Is it safe to follow this link? The link provided in this email starts with https://www.amazon.com. If you prefer, copy the following link and paste it into a browser to view. The link provided in this email starts with https://www.amazon.com. If you prefer, copy the following link and paste it into a browser to view. https://www.amazon.com/a/c/r/x0bcRZ2VMef4tPrE77VklgIkN
Attachments:

Headers

Key	Value
Received	from a13-64.smtp-out.amazonses.com (a13-64.smtp-out.amazonses.com [54.240.13.64]) by infra-metals-com-1.fortimailcloud.com with ESMTPS id 49EGKwFe2212461-49EGKwFf2212461 (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384 bits=256 verify=OK) for <MARKJ@INFRA-METALS.COM>; Mon, 14 Oct 2024 12:20:58 -0400
Authentication-Results	spf=fail (sender IP is 154.52.4.131) smtp.mailfrom=bounces.amazon.com; dkim=pass (signature was verified) header.d=amazon.com;dmarc=pass action=none header.from=amazon.com;compauth=pass reason=100
Received-Spf	Fail (protection.outlook.com: domain of bounces.amazon.com does not designate 154.52.4.131 as permitted sender) receiver=protection.outlook.com; client-ip=154.52.4.131; helo=infra-metals-com-1.fortimailcloud.com;
Authentication-Results-Original	infra-metals-com-1.fortimailcloud.com; spf=pass (fortimailcloud.com: domain of 20241014162056cb2436f68d33494c8b835aab7bc0p0na-C38OX993MKS91E@bounces.amazon.com designates 54.240.13.64 as permitted sender) smtp.mailfrom=20241014162056cb2436f68d33494c8b835aab7bc0p0na-C38OX993MKS91E@bounces.amazon.com; dkim=pass header.i=@amazon.com dkim=pass header.i=@amazonses.com; dmarc=pass header.from=amazon.com;
Dkim-Signature	v=1; a=rsa-sha256; q=dns/txt; c=relaxed/simple; s=ug7nbtf4gccmlpwj322ax3p6ow6yfsug; d=amazonses.com; t=1728922857; h=Date:From:To:Message-ID:Subject:MIME-Version:Content-Type:Feedback-ID; bh=x/7k7+uUySeME6NuDHMZf+Mq/SJlkgsC/BGZZpbE9wY=; b=uAX3g/s9mJpmFIsQXX7zbvW+grkexO3Rj8iyfFvuLh2YoPIpaZg0hwvmjdDpc1ef BjI/vSEL2lPsQrUnxUdhJ8m3eMzKI0AV42Ix0a5EnsYOBi6ZgaNzNAJbnyvkvmT7cqW 5OLu1k/7lPhyiG5ow3n0WxKCrXOGWVaHuVlhnnDc=
Date	Mon, 14 Oct 2024 16:20:56 +0000
From	"amazon.com" <account-update@amazon.com>
To	Mark Johnson <markj@infra-metals.com>
Message-Id	<010001928bd52db8-9ae8b36d-3718-4b7d-8aea-8826af6acabf-000000@email.amazonses.com>
Subject	[EXTERNAL] amazon.com: Purchase attempt
MIME-Version	1.0
Content-Type	multipart/mixed; boundary="----sinikael-?=_1-17289272397200.023669104294110177"
X-Amazon-Mail-Relay-Type	notification
Bounces-To	20241014162056cb2436f68d33494c8b835aab7bc0p0na-C38OX993MKS91E@bounces.amazon.com
X-Amazon-Metadata	CA=C38OX993MKS91E-CU=ARN7R7COEJPH4
X-Original-Messageid	<urn.rtn.msg.20241014162056cb2436f68d33494c8b835aab7bc0p0na@1728922856875.>
Feedback-Id	579583930::1.us-east-1.ZHcGJK6s+x+i9lRHKog4RW3tECwWIf1xzTYCZyUaiec=:AmazonSES
X-Ses-Outgoing	2024.10.14-54.240.13.64
X-Feas-Dkim	Valid
X-Feas-Client-Ip	54.240.13.64
X-Fe-Last-Public-Client-Ip	54.240.13.64
X-Fe-Envelope-From	20241014162056cb2436f68d33494c8b835aab7bc0p0na-C38OX993MKS91E@bounces.amazon.com
X-Fe-Policy-Id	0:1:1:SYSTEM
Return-Path	20241014162056cb2436f68d33494c8b835aab7bc0p0na-C38OX993MKS91E@bounces.amazon.com
X-Ms-Exchange-Organization-Expirationstarttime	14 Oct 2024 16:20:59.7712 (UTC)
X-Ms-Exchange-Organization-Expirationstarttimereason	OriginalSubmit
X-Ms-Exchange-Organization-Expirationinterval	1:00:00:00.0000000
X-Ms-Exchange-Organization-Expirationintervalreason	OriginalSubmit
X-Ms-Exchange-Organization-Network-Message-Id	bcb00ccd-3bf0-48b8-5719-08dcec6c30b7
X-Eopattributedmessage	0
X-Eoptenantattributedmessage	5f5cb6f5-df48-4a8e-a3b9-2628e6d26c56:0
X-Ms-Exchange-Organization-Messagedirectionality	Incoming
X-Ms-Publictraffictype	Email
X-Ms-Traffictypediagnostic	CO1PEPF000042AC:EE_\|SA1PR22MB5044:EE_\|SN7PR22MB4126:EE_
X-Ms-Exchange-Organization-Authsource	CO1PEPF000042AC.namprd03.prod.outlook.com
X-Ms-Exchange-Organization-Authas	Anonymous
X-Ms-Office365-Filtering-Correlation-Id	bcb00ccd-3bf0-48b8-5719-08dcec6c30b7
X-Ms-Exchange-Atpmessageproperties	SA\|SL
X-Ms-Exchange-Organization-Scl	-1
X-Microsoft-Antispam	BCL:3;ARA:13230040\|69100299015\|13012899012\|12012899012\|13102899012\|5082899009\|5073199012\|32142699015\|82310400026\|5062899012\|3092899012\|4092899012\|3072899012\|2092899012;
X-Forefront-Antispam-Report	CIP:154.52.4.131;CTRY:US;LANG:en;SCL:-1;SRV:;IPV:NLI;SFV:NSPM;H:infra-metals-com-1.fortimailcloud.com;PTR:relaysjc20.fortimailcloud.com;CAT:NONE;SFS:(13230040)(69100299015)(13012899012)(12012899012)(13102899012)(5082899009)(5073199012)(32142699015)(82310400026)(5062899012)(3092899012)(4092899012)(3072899012)(2092899012);DIR:INB;
X-Ms-Exchange-Crosstenant-Originalarrivaltime	14 Oct 2024 16:20:59.6150 (UTC)
X-Ms-Exchange-Crosstenant-Network-Message-Id	bcb00ccd-3bf0-48b8-5719-08dcec6c30b7
X-Ms-Exchange-Crosstenant-Id	5f5cb6f5-df48-4a8e-a3b9-2628e6d26c56
X-Ms-Exchange-Crosstenant-Authsource	CO1PEPF000042AC.namprd03.prod.outlook.com
X-Ms-Exchange-Crosstenant-Authas	Anonymous
X-Ms-Exchange-Crosstenant-Fromentityheader	Internet
X-Ms-Exchange-Transport-Crosstenantheadersstamped	SA1PR22MB5044
X-Ms-Exchange-Transport-Endtoendlatency	00:00:07.2696795
X-Ms-Exchange-Processed-By-Bccfoldering	15.20.8048.020
X-Microsoft-Antispam-Mailbox-Delivery	ucf:0;jmr:0;auth:0;dest:I;ENG:(910001)(944506478)(944626604)(920097)(930097)(140003);
X-Microsoft-Antispam-Message-Info	ZTzosi2wTBEsA8Ay4mqfugPlSv3UrzjLJ726piRV5yeXddOgn5GpS0X9img1Ow2cWgDhm5gOlr48CAexbDc21tDoddvGtzupO7vj/Pf9oa5rFI9scsWtoWZt5ixL26xpUKunL8H4rYuRcKUu5jbQ1tEIH0EG9tjvuf6Ti3D6O1y97thxQjMDofUjcWYfao9RvjtWulz9VpaT8uO2OlTxZR6QJ4u3GRCoPX/J21opWeRbaJ0kRjQu/WRA80wQWekrh3kdlu+kqCfJfzA1vbsF7RlbsyfgOygAYhXsoy+iTWDtQ9+GZ9LtqQGT+Otj3r3xV7nrrL68Zc2AyvLrATXqxPfTK7EflhaZSg/SIbQyt4S7KSInRxyfCdrDzaSM+i3nPpuV8fzZZiP3I5td++KefSF6wprJp2TfFnwF9Zm0ZHi9n15KMjmV1G7JELHSDsynKfp1HkPCKNbasRY2GdQaOl2wCBvlyaqaXrP9HG+fQy5fE/iwuZgX2ruTZGAphnrY9gdcz97fySpXtFujv7onyg1qc3RkBwUztXTjfy1EbllJAyjFFsTLxMwRcl6lJ9uDBt3wvYT5LZQheKSd5vBcWnHU1P5sUw+iYFK7OesstrjJ22dYcdOdO1luwaAhi5QtvKOBUTcJwQeuRNeL7pEkvEdFRw7MYrt0C0qPsyUbEO+OUjgDE6ZbXTif7q9r6t1lHnn3KwiXMvzTWGC3JgvRB5qugvMCwXI/QZ6x9mfVR9oe4kv6P/x18wd0pKhdkDqaBBlV9kBVfhkfMTVm1699UAqbYSWMCALGVEejPdvgkct5Y6NFOmEavIOrebFIImwuR+dc1nJ0dBQ0fyDfqs258uNUnxZFUilcXKe5x15a5972AW1jHZ9yvMoxSZ6zCjm0th5aH/2bQZjdD8bd4WhD89wnMPyvf0kAe4tPWuR26apEtAxbjEp/WWciv73RfvuG1eXvNDhlqVnOxUnFYDFu5JNdwTPA954Pek4kJrUB5XSAlTXp6gI+pZeR6Iw8SSjq6PJk2C0ha9mUn/mJghQ8c/jPhgooBAcowRZ47siAZsctdDXhGpGmgmu4ZFcfLpbMiMbXPKUZWtf8xGElzQjBZgqogWfPwcO7jUWFi8LIvmiWl+xHCmGFpi0f/zCS5HeB+p/TGMk6iHTu4PJ2TiJvWsI7oV2rWmD+WHILs9CXoEoqFHEtrrevdjPGwBq4UvHmR3u1qDH1QmONgujiJOoMa8IHbPW6hOM+TcFdgl+a12nAR8tlT05GTQgKMB24UX/PNgjIsyfERr/OytK/5tVJgJ/ajSZRtH1n7C2UXzWPns2BvjMbcIawZadrQjrowpJZJxkkU+6jsMyZKllF3WcYJs6Fxnl/7DD4Lb4NtRDNMgx6td2QWg1cihlseVPMXXzobEAe+wdjMmbbx7rHsTwZ+j2cTPLop9m26wwXyT02r/tNOCZw8tSxq6CIoOwmJ6fqWTr+szAxgwrrJ5itu7bvCMy3hSXeiikzekMmviOkm8aO77Bnlag8tuyb2f8dPWnjt7jmS7OHYg1KH9T6eHpUNhzB9LKhRAttX5dIxcnbsC+ennimF2aw0aU2aRetGTazeIXel78R5ufqqF1qM5FvJN1ZUq+B+HaDnEChvLSaDExECtuXaioDbUeyr+ixLnswJ5KG1WIeFw8oTF+vhJ1Z+ZAnNC1rBOXo2Nah6+fnxVXjJLmthpBbZgPnnjfFsVvpuGgpTlgdv9iUCKNzxqPOlnknIIxWLPMsBUnfLsXbzDfRoWWbU2yaEx4bnwzUGss/KVlNKwMJJ0koQH+iraQSjhoXZcetK1H0M3IYAb48xhDd8Ro17ugVxyL2RsJ5eUAmpc2xTaCIu/uHbJvw2Jwm3yeIhqIQ8szfYDjsANCSnWoHPSInLFk1RYU5Ik/Xi2PPVPwV4Ng+4ZMQgT9hO9KDrXStgWIEFb+pHEose7LntuOcfhDjwjoAe1rkEOHcr+WjytCOM7BIzAES+qnf9eg/mZJpqcsWiDvO7nAsmmQfVeYxJ70CHypnmgaLbEJSODNafgybeQbTaoRVrXtunoN9JscaV6laz4x76uYYmb90zjUUpLKOJr8xaeo+69ClO7KH+nD979fK3gHcjAbzw/34+NV22KGCp3ROjAXIJNC10qFpPLPo4/QLRgeYThxlX19r5PaeNN5cheKEVk7GqZhyPCHki8iJsMuY/sEMRlK6wRpCOdO/MoqmtCCXUqKXKxs6JVdIAglsuQN1PhL0nTtII6BPzoFqkYm9KuUoTSsfPJ0QkQe0+kX06Zh3dUMazLbFg9oImOuRvvqP2ZlzvAdGb7zSTBhhzAyBycMoLnrhrIe3W9euw0+AK1Z4kh4ey0KeDXucOCv3UaL+a1lVpFieNM0Rol9gHtpYNYPb6nHS3he6+JXXmqdZ0alGBCQP8itX6SRIBiHl6rdgkHuNpQghIoacBdMPHFRDpHIAcbLm9mW6esCqTozFBPf/nNTYYwgMPUxS1+yf+rVYLy0nMT3bbA==
Content-Transfer-Encoding	7bit

File Icon


Icon Hash:	46070c0a8e0c67d6

Description:	Adversaries may abuse Internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality and customize aspects of Internet browsers. They can be installed directly or through a browser's app store and generally have access and permissions to everything that the browser can access.
Tactics:	Persistence
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Process: Process Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report phish_alert_sp2_2.0.0.0 - 2024-10-14T143610.340.eml

Overview

General Information

Detection

Signatures

Classification

Process Tree

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

LLM Input / Output

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\FORMS\FRMCACHE.DAT

C:\Users\user\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntities.bin

C:\Users\user\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntitiesUpdated.bin

C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\1263EA7F-B69A-426D-9B5D-7E143308BF19

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-journal

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-shm

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-wal

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{6206218B-D2B7-458D-9A7B-E3A79FA7A234}.tmp

C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1728931073955941500_50CB7BD8-7747-4E2C-9B34-18C2252FC158.log

C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1728931073956895200_50CB7BD8-7747-4E2C-9B34-18C2252FC158.log

C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20241014T1437530760-7116.etl

C:\Users\user\AppData\Roaming\Microsoft\Office\MSO3072.acl

C:\Users\user\AppData\Roaming\Microsoft\Outlook\NoEmail.srs

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

C:\Users\user\Documents\Outlook Files\Outlook Data File - NoEmail.pst

C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp

Chrome Cache Entry: 77

Chrome Cache Entry: 78

Chrome Cache Entry: 79

Chrome Cache Entry: 80

Chrome Cache Entry: 83

Chrome Cache Entry: 84

Chrome Cache Entry: 85

Chrome Cache Entry: 86

Chrome Cache Entry: 87

Chrome Cache Entry: 88

Chrome Cache Entry: 89

Windows Analysis Report
phish_alert_sp2_2.0.0.0 - 2024-10-14T143610.340.eml