Edit tour

Windows Analysis Report
[EXT] [ #ENCRYPT ] WSRB 401k, Trustee to Trustee Transfer form.eml

Overview

General Information

Sample name:	[EXT] [ #ENCRYPT ] WSRB 401k, Trustee to Trustee Transfer form.eml
Analysis ID:	1542233
MD5:	5ed87452cd07f3e7b18a993bb8e1dc40
SHA1:	3ece036066abbaaaf6de33645a052020ee064c97
SHA256:	2d85e78b8d2bd29319bf471a416b4cf345bb4604751c2c61665919c12ac6e125
Infos:

Detection

Score:	48
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

AI detected landing page (webpage, office document or email)

AI detected potential phishing Email

HTML body contains low number of good links

Queries the volume information (name, serial number etc) of a device

Sigma detected: Office Autorun Keys Modification

Sigma detected: Suspicious Office Outbound Connections

Stores files to the Windows start menu directory

Classification

Process Tree

System is w10x64_ra

OUTLOOK.EXE (PID: 7020 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\user\Desktop\[EXT] [ #ENCRYPT ] WSRB 401k, Trustee to Trustee Transfer form.eml" MD5: 91A5292942864110ED734005B7E005C0)

ai.exe (PID: 3048 cmdline: "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "B62173A3-FEB3-4A49-A24A-B9FD2BFF2033" "E84C2B5B-9E87-49F0-ADD6-BEC394FECE63" "7020" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx" MD5: EC652BEDD90E089D9406AFED89A8A8BD)

chrome.exe (PID: 544 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://securemail.stewardpartners.com/formpostdir/securereader?id=R_CgcnaABuXrVdTOEY9kny1MG0EPFHnM&brand=91cc822e1b32228 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6888 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 --field-trial-handle=1740,i,16221330726832473798,4578500359290334111,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Sigma Signatures

Sigma detected: Office Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 , EventID: 13, EventType: SetValue, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE, ProcessId: 7020, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Addins\OneNote.OutlookAddin\1

Sigma detected: Suspicious Office Outbound Connections

Source: Network Connection

Author: X__Junior (Nextron Systems): Data: DestinationIp: 192.168.2.16, DestinationIsIpv6: false, DestinationPort: 49709, EventID: 3, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE, Initiated: true, ProcessId: 7020, Protocol: tcp, SourceIp: 184.28.90.27, SourceIsIpv6: false, SourcePort: 443

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Source: https://securemail.stewardpartners.com/formpostdir/securereader?id=R_CgcnaABuXrVdTOEY9kny1MG0EPFHnM&brand=91cc822e1b32228	HTTP Parser: Number of links: 0
Source: https://securemail.stewardpartners.com/securereader/registration.jsf	HTTP Parser: Number of links: 0

Source: https://securemail.stewardpartners.com/formpostdir/securereader?id=R_CgcnaABuXrVdTOEY9kny1MG0EPFHnM&brand=91cc822e1b32228	HTTP Parser: <input type="password" .../> found
Source: https://securemail.stewardpartners.com/securereader/registration.jsf	HTTP Parser: <input type="password" .../> found

Source: https://securemail.stewardpartners.com/formpostdir/securereader?id=R_CgcnaABuXrVdTOEY9kny1MG0EPFHnM&brand=91cc822e1b32228	HTTP Parser: No favicon
Source: https://securemail.stewardpartners.com/formpostdir/securereader?id=R_CgcnaABuXrVdTOEY9kny1MG0EPFHnM&brand=91cc822e1b32228	HTTP Parser: No favicon
Source: https://securemail.stewardpartners.com/securereader/registration.jsf	HTTP Parser: No favicon
Source: https://securemail.stewardpartners.com/securereader/registration.jsf	HTTP Parser: No favicon
Source: https://securemail.stewardpartners.com/securereader/registration.jsf	HTTP Parser: No favicon
Source: https://securemail.stewardpartners.com/securereader/registration.jsf	HTTP Parser: No favicon
Source: https://securemail.stewardpartners.com/securereader/registration.jsf	HTTP Parser: No favicon

Source: https://securemail.stewardpartners.com/formpostdir/securereader?id=R_CgcnaABuXrVdTOEY9kny1MG0EPFHnM&brand=91cc822e1b32228	HTTP Parser: No <meta name="author".. found
Source: https://securemail.stewardpartners.com/formpostdir/securereader?id=R_CgcnaABuXrVdTOEY9kny1MG0EPFHnM&brand=91cc822e1b32228	HTTP Parser: No <meta name="author".. found
Source: https://securemail.stewardpartners.com/securereader/registration.jsf	HTTP Parser: No <meta name="author".. found
Source: https://securemail.stewardpartners.com/securereader/registration.jsf	HTTP Parser: No <meta name="author".. found
Source: https://securemail.stewardpartners.com/securereader/registration.jsf	HTTP Parser: No <meta name="author".. found
Source: https://securemail.stewardpartners.com/securereader/registration.jsf	HTTP Parser: No <meta name="author".. found
Source: https://securemail.stewardpartners.com/securereader/registration.jsf	HTTP Parser: No <meta name="author".. found

Source: https://securemail.stewardpartners.com/formpostdir/securereader?id=R_CgcnaABuXrVdTOEY9kny1MG0EPFHnM&brand=91cc822e1b32228	HTTP Parser: No <meta name="copyright".. found
Source: https://securemail.stewardpartners.com/formpostdir/securereader?id=R_CgcnaABuXrVdTOEY9kny1MG0EPFHnM&brand=91cc822e1b32228	HTTP Parser: No <meta name="copyright".. found
Source: https://securemail.stewardpartners.com/securereader/registration.jsf	HTTP Parser: No <meta name="copyright".. found
Source: https://securemail.stewardpartners.com/securereader/registration.jsf	HTTP Parser: No <meta name="copyright".. found
Source: https://securemail.stewardpartners.com/securereader/registration.jsf	HTTP Parser: No <meta name="copyright".. found
Source: https://securemail.stewardpartners.com/securereader/registration.jsf	HTTP Parser: No <meta name="copyright".. found
Source: https://securemail.stewardpartners.com/securereader/registration.jsf	HTTP Parser: No <meta name="copyright".. found

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.16:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.16:49749 version: TLS 1.2

Source: chrome.exe

Memory has grown: Private usage: 1MB later: 29MB

Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.69
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.69
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27

Source: global traffic	DNS traffic detected: DNS query: securemail.stewardpartners.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 49698 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49698
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49809 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.16:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.16:49749 version: TLS 1.2

Source: classification engine

Classification label: mal48.winEML@17/31@10/111

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Program Files\Google\Chrome\Application\Dictionaries

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

File created: C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

File created: C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20241025T1121300368-7020.etl

Source: unknown	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\user\Desktop\[EXT] [ #ENCRYPT ] WSRB 401k, Trustee to Trustee Transfer form.eml"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "B62173A3-FEB3-4A49-A24A-B9FD2BFF2033" "E84C2B5B-9E87-49F0-ADD6-BEC394FECE63" "7020" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "B62173A3-FEB3-4A49-A24A-B9FD2BFF2033" "E84C2B5B-9E87-49F0-ADD6-BEC394FECE63" "7020" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 --field-trial-handle=1740,i,16221330726832473798,4578500359290334111,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 --field-trial-handle=1740,i,16221330726832473798,4578500359290334111,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: apphelp.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: c2r64.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: userenv.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: msasn1.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: cryptsp.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: rsaenh.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: gpapi.dll

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{F959DBBB-3867-41F2-8E5F-3B8BEFAA81B3}\InprocServer32

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Window found: window name: SysTabControl32

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Common

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries

Source: [EXT] [ #ENCRYPT ] WSRB 401k, Trustee to Trustee Transfer form.eml

Static file information: File size 2357312 > 1048576

Persistence and Installation Behavior

AI detected landing page (webpage, office document or email)

Source: Email

LLM: Email contains prominent button: 'click here'

AI detected potential phishing Email

Source: Email

LLM: Detected potential phishing email: The email contains multiple suspicious elements typical of phishing attempts, including urgency and time-sensitive actions

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

File Volume queried: C:\Windows\SysWOW64 FullSizeInformation

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Process information queried: ProcessInformation

Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe

Queries volume information: C:\Program Files (x86)\Microsoft Office\root\Office16\AI\WordCombinedFloatieLreOnline.onnx VolumeInformation

Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	2 Browser Extensions	1 Process Injection	3 Masquerading	OS Credential Dumping	1 Process Discovery	Remote Services	Data from Local System	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	1 DLL Side-Loading	1 Process Injection	LSASS Memory	13 System Information Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 Registry Run Keys / Startup Folder	1 Registry Run Keys / Startup Folder	1 DLL Side-Loading	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 Extra Window Memory Injection	1 Extra Window Memory Injection	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction

Name	IP	Active	Malicious	Reputation
www.google.com	142.250.186.68	true	false	unknown
pe-008bcd01.gslb.pphosted.com	148.163.146.225	true	false	unknown
securemail.stewardpartners.com	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://securemail.stewardpartners.com/formpostdir/securereader?id=R_CgcnaABuXrVdTOEY9kny1MG0EPFHnM&brand=91cc822e1b32228	false		unknown
https://securemail.stewardpartners.com/securereader/registration.jsf	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.186.68	www.google.com	United States	15169	GOOGLEUS	false
52.113.194.132	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.250.185.99	unknown	United States	15169	GOOGLEUS	false
142.250.186.67	unknown	United States	15169	GOOGLEUS	false
1.1.1.1	unknown	Australia	13335	CLOUDFLARENETUS	false
172.217.18.14	unknown	United States	15169	GOOGLEUS	false
173.194.76.84	unknown	United States	15169	GOOGLEUS	false
20.189.173.23	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
52.109.28.46	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
148.163.146.225	pe-008bcd01.gslb.pphosted.com	United States	26211	PROOFPOINT-ASN-US-WESTUS	false
184.28.90.27	unknown	United States	16625	AKAMAI-ASUS	false
142.250.186.138	unknown	United States	15169	GOOGLEUS	false
172.217.16.142	unknown	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.16

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1542233
Start date and time:	2024-10-25 17:20:56 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	14
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled
Analysis Mode:	stream
Analysis stop reason:	Timeout
Sample name:	[EXT] [ #ENCRYPT ] WSRB 401k, Trustee to Trustee Transfer form.eml
Detection:	MAL
Classification:	mal48.winEML@17/31@10/111
Cookbook Comments:	Found application associated with file extension: .eml

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, SgrmBroker.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 52.109.28.46
Excluded domains from analysis (whitelisted): fs.microsoft.com, config.officeapps.live.com, prod.configsvc1.live.com.akadns.net, officeclient.microsoft.com, europe.configsvc1.live.com.akadns.net, uks-azsc-config.officeapps.live.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
VT rate limit hit for: [EXT] [ #ENCRYPT ] WSRB 401k, Trustee to Trustee Transfer form.eml

LLM Input / Output

Input	Output
URL: Model: claude-3-5-sonnet-latest	{ "explanation": [ "The email contains multiple suspicious elements typical of phishing attempts, including urgency and time-sensitive actions", "The email claims to be 'secure' but uses generic external links that could redirect to malicious sites", "The subject line contains unusual formatting with '[#ENCRYPT]' which is often used in phishing to create false legitimacy" ], "phishing": true, "confidence": 8 }
Is this email content a phishing attempt? Please respond only in valid JSON format: Email content converted to JSON: { "date": "Thu, 24 Oct 2024 16:30:33 +0000", "subject": "[EXT] [ #ENCRYPT ] WSRB 401k, Trustee to Trustee Transfer form", "communications": [ "CAUTION: This email originated from outside of the organization. Do not click links or open attachments unless you recognize the sender and know the content is safe.\n\n[cid:171717588619970717-100001] [cid:171717588619970717-100002]\nThis is a secure message.\nClick here<https://securemail.stewardpartners.com/formpostdir/securereader?id=R_CgcnaABuXrVdTOEY9kny1MG0EPFHnM&brand=91cc822e1b32228> by 2025-10-24 16:30 UTC to read your message.\nAfter that, open the attachment.\nMore Info<https://securemail.stewardpartners.com/securereader/help.jsf?lang=enus>\nDisclaimer: This email and its content are confidential and intended solely for the use of the addressee. Please notify the sender if you have received this email in error or simply delete it.\nSecured by Proofpoint Encryption, Copyright 2009-2024 Proofpoint, Inc. All rights reserved.\n" ], "from": "Loura Oswald <loura.oswald@stewardpartners.com>", "to": "Bryan Stanwood <Bryan.Stanwood@wsrb.com>" }
URL: Email Model: claude-3-haiku-20240307	```json { "contains_trigger_text": true, "trigger_text": "Click here by 2025-10-24 16:30 UTC to read your message. After that, open the attachment.", "prominent_button_name": "Click here", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": true, "has_visible_qrcode": false }

URL: Email Model: claude-3-haiku-20240307	```json { "brands": [ "Steward Partners" ] }
	```json { "brands": [ "Steward Partners" ] }
URL: https://securemail.stewardpartners.com/formpostdir/securereader?id=R_CgcnaABuXrVdTOEY9kny1MG0EPFHnM&brand=91cc822e1b32228 Model: claude-3-haiku-20240307	```json { "contains_trigger_text": true, "trigger_text": "Create your account to read secure email.", "prominent_button_name": "Continue", "text_input_field_labels": [ "Email Address:", "First Name:", "Last Name:", "Password:", "Confirm Password:", "Validation Code:" ], "pdf_icon_visible": false, "has_visible_captcha": true, "has_urgent_text": false, "has_visible_qrcode": false }

URL: https://securemail.stewardpartners.com/formpostdir/securereader?id=R_CgcnaABuXrVdTOEY9kny1MG0EPFHnM&brand=91cc822e1b32228 Model: claude-3-haiku-20240307	```json { "brands": [ "Steward Partners" ] }
	```json { "brands": [ "Steward Partners" ] }
URL: https://securemail.stewardpartners.com/formpostdir/securereader?id=R_CgcnaABuXrVdTOEY9kny1MG0EPFHnM&brand=91cc822e1b32228 Model: gpt-4o	```json{ "legit_domain": "stewardpartners.com", "classification": "unknown", "reasons": [ "The URL 'securemail.stewardpartners.com' is a subdomain of 'stewardpartners.com', which suggests it could be a legitimate service provided by Steward Partners.", "The brand 'Steward Partners' is not widely recognized as a 'wellknown' brand, hence classified as 'unknown'.", "The domain 'stewardpartners.com' matches the brand name 'Steward Partners', indicating a potential legitimate association.", "The URL does not contain suspicious elements such as misspellings, extra characters, or unusual domain extensions.", "The presence of input fields such as 'Email Address', 'Password', and 'Validation Code' is typical for secure mail services, but also common in phishing sites." ], "riskscore": 3}
URL: securemail.stewardpartners.com Brands: Steward Partners Input Fields: Email Address:, First Name:, Last Name:, Password:, Confirm Password:, Validation Code:
URL: https://securemail.stewardpartners.com/securereader/registration.jsf Model: claude-3-haiku-20240307	```json { "contains_trigger_text": true, "trigger_text": "We have sent a validation code to your email address. Please check your inbox for the code and enter it below. If you did not receive it and need another code:Click here", "prominent_button_name": "Continue", "text_input_field_labels": [ "Email Address:", "First Name:", "Last Name:", "Password:", "Confirm Password:", "Validation Code:" ], "pdf_icon_visible": false, "has_visible_captcha": true, "has_urgent_text": false, "has_visible_qrcode": false }

URL: https://securemail.stewardpartners.com/securereader/registration.jsf Model: claude-3-haiku-20240307	```json { "brands": [ "Steward Partners" ] }
	```json { "brands": [ "Steward Partners" ] }
URL: https://securemail.stewardpartners.com/securereader/registration.jsf Model: gpt-4o	```json{ "legit_domain": "stewardpartners.com", "classification": "unknown", "reasons": [ "The URL 'securemail.stewardpartners.com' is a subdomain of 'stewardpartners.com', which suggests it could be a legitimate service provided by Steward Partners.", "The brand 'Steward Partners' is not widely recognized as a well-known brand, hence classified as 'unknown'.", "The domain name matches fully with the brand name, which is a good indicator of legitimacy.", "The presence of input fields such as 'Email Address', 'Password', and 'Validation Code' is typical for secure login or registration pages, but it also requires caution.", "No suspicious elements like misspellings or unusual domain extensions were found in the URL." ], "riskscore": 3}
URL: securemail.stewardpartners.com Brands: Steward Partners Input Fields: Email Address:, First Name:, Last Name:, Password:, Confirm Password:, Validation Code:
URL: https://securemail.stewardpartners.com/securereader/registration.jsf Model: claude-3-haiku-20240307	```json { "contains_trigger_text": true, "trigger_text": "We have sent a validation code to your email address. Please check your inbox for the code and enter it below. If you did not receive it and need another code:Click here", "prominent_button_name": "Continue", "text_input_field_labels": [ "Email Address:", "First Name:", "Last Name:", "Password:", "Confirm Password:", "Validation Code:" ], "pdf_icon_visible": false, "has_visible_captcha": true, "has_urgent_text": false, "has_visible_qrcode": false }

URL: https://securemail.stewardpartners.com/securereader/registration.jsf Model: claude-3-haiku-20240307	```json { "contains_trigger_text": true, "trigger_text": "Create your account to read secure email.", "prominent_button_name": "Continue", "text_input_field_labels": [ "Email Address:", "First Name:", "Last Name:", "Password:", "Confirm Password:", "Validation Code:" ], "pdf_icon_visible": false, "has_visible_captcha": true, "has_urgent_text": false, "has_visible_qrcode": false }

URL: https://securemail.stewardpartners.com/securereader/registration.jsf Model: claude-3-haiku-20240307	```json { "brands": [ "Steward Partners" ] }
	```json { "brands": [ "Steward Partners" ] }
URL: https://securemail.stewardpartners.com/securereader/registration.jsf Model: claude-3-haiku-20240307	```json { "brands": [ "Steward Partners" ] }
	```json { "brands": [ "Steward Partners" ] }
URL: https://securemail.stewardpartners.com/securereader/registration.jsf Model: gpt-4o	```json{ "legit_domain": "stewardpartners.com", "classification": "unknown", "reasons": [ "The URL 'securemail.stewardpartners.com' is a subdomain of 'stewardpartners.com', which appears to be a legitimate domain for the brand 'Steward Partners'.", "The brand 'Steward Partners' is not widely recognized, hence classified as 'unknown'.", "The URL does not contain any suspicious elements such as misspellings, extra characters, or unusual domain extensions.", "The presence of input fields such as 'Email Address', 'Password', and 'Validation Code' is typical for secure mail services, but it requires caution.", "The domain name fully matches the brand name, which is a good indicator of legitimacy." ], "riskscore": 3}
URL: securemail.stewardpartners.com Brands: Steward Partners Input Fields: Email Address:, First Name:, Last Name:, Password:, Confirm Password:, Validation Code:
URL: https://securemail.stewardpartners.com/securereader/registration.jsf Model: gpt-4o	```json{ "legit_domain": "stewardpartners.com", "classification": "unknown", "reasons": [ "The URL 'securemail.stewardpartners.com' is a subdomain of 'stewardpartners.com', which appears to be a legitimate domain for the brand 'Steward Partners'.", "The brand 'Steward Partners' is not widely recognized as a 'wellknown' brand, hence classified as 'unknown'.", "The URL does not contain any suspicious elements such as misspellings, extra characters, or unusual domain extensions.", "The presence of input fields such as 'Email Address', 'Password', and 'Validation Code' is typical for secure mail services, but it requires careful consideration of the context and security measures in place." ], "riskscore": 3}
URL: securemail.stewardpartners.com Brands: Steward Partners Input Fields: Email Address:, First Name:, Last Name:, Password:, Confirm Password:, Validation Code:
URL: https://securemail.stewardpartners.com/securereader/registration.jsf Model: claude-3-haiku-20240307	```json { "contains_trigger_text": true, "trigger_text": "Create your account to read secure email.", "prominent_button_name": "Continue", "text_input_field_labels": [ "Email Address:", "First Name:", "Last Name:", "Password:", "Confirm Password:", "Validation Code:" ], "pdf_icon_visible": false, "has_visible_captcha": true, "has_urgent_text": false, "has_visible_qrcode": false }

URL: https://securemail.stewardpartners.com/securereader/registration.jsf Model: claude-3-haiku-20240307	```json { "brands": [ "Steward Partners" ] }
	```json { "brands": [ "Steward Partners" ] }
URL: https://securemail.stewardpartners.com/securereader/registration.jsf Model: gpt-4o	```json{ "legit_domain": "stewardpartners.com", "classification": "unknown", "reasons": [ "The URL 'securemail.stewardpartners.com' is a subdomain of 'stewardpartners.com', which appears to be a legitimate domain for the brand 'Steward Partners'.", "The brand 'Steward Partners' is not widely recognized as a well-known brand, hence classified as 'unknown'.", "The URL does not contain any suspicious elements such as misspellings, extra characters, or unusual domain extensions.", "The presence of input fields such as 'Email Address', 'Password', and 'Validation Code' is typical for secure mail services, but it requires careful consideration of the context and security measures in place." ], "riskscore": 3}
URL: securemail.stewardpartners.com Brands: Steward Partners Input Fields: Email Address:, First Name:, Last Name:, Password:, Confirm Password:, Validation Code:

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\FORMS\FRMCACHE.DAT

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	231348
Entropy (8bit):	4.38886367993291
Encrypted:	false
SSDEEP:
MD5:	7DCAABFF208E16333B2E761BFD204B3A
SHA1:	884C7E4897F133533BDD960D817AC93FA121FA22
SHA-256:	FEE5D48A6127F53F7B727CA86DE6F395302EA3AEEB03CFC1A80EBEEDC42FF712
SHA-512:	F29B8BCB924858014C0756D367DC62EC7CC9B208AE2330313CD9AC529B82D104E6C907265D69D2032FF1F3E5DEFE36046E8D861907DCAD16C4F5A3FB0A8DB7AA
Malicious:	false
Reputation:	unknown
Preview:	TH02...... .p.#..&......SM01X...,....0...&..........IPM.Activity...........h...............h............H..h4.......<......h........8...H..h\cal ...pDat...hH/..0..........h...f...........h........_`Mk...h...f@...I.lw...h....H...8.Rk...0....T...............d.........2h...............k..D...........!h.............. h.uo...........#h....8.........$h8.......8....."h..............'h..............1h...f<.........0h....4....Rk../h....h.....RkH..h...p...4.....-h ............+h...f....(........... ...... ..............F7..............FIPM.Activity....Form....Standard....Journal Entry...IPM.Microsoft.FolderDesign.FormsDescription................F.k..........1122110020000000....Microsoft...This form is used to create journal entries.........kf...... ..........&...........(.......(... ...@.....................................................................................................................fffffffff........wwwwwwww.p....pp..............p...............pw..............pw..DDDDO..

C:\Users\user\AppData\Local\Microsoft\FontCache\4\CatalogCacheMetaData.xml

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	XML 1.0 document, ASCII text, with very long lines (2139), with no line terminators
Category:	modified
Size (bytes):	2139
Entropy (8bit):	5.070587706440185
Encrypted:	false
SSDEEP:
MD5:	F5EC29D20CDECAC245EEF78DB6E35814
SHA1:	3C9E376E511E9910FC7482B9DAB518CCB5D49668
SHA-256:	6DAF3FEE275407F4E1FF2B268C1145386C8E9E096C76C473599B97AADFE59BB6
SHA-512:	0957576E06AA8F7A49AC9D8B2B774098D67108684B1991E58EB3FFA12F8CF43226BC7C2118D0EEA3651AB8A5F17391AA9F3EFF371B1CDFBC3A5FA2624DF70524
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?><root><version>1</version><Count>14</Count><Resource><Id>Aptos_26215680</Id><LAT>2023-10-06T09:25:29Z</LAT><key>29939506207.ttf</key><folder>Aptos</folder><type>4</type></Resource><Resource><Id>Aptos_45876480</Id><LAT>2023-10-06T09:25:29Z</LAT><key>27160079615.ttf</key><folder>Aptos</folder><type>4</type></Resource><Resource><Id>Aptos Narrow_26215424</Id><LAT>2023-10-06T09:25:29Z</LAT><key>31558910439.ttf</key><folder>Aptos Narrow</folder><type>4</type></Resource><Resource><Id>Aptos Display_26215680</Id><LAT>2023-10-06T09:25:29Z</LAT><key>23001069669.ttf</key><folder>Aptos Display</folder><type>4</type></Resource><Resource><Id>Aptos Narrow_45876224</Id><LAT>2023-10-06T09:25:29Z</LAT><key>24153076628.ttf</key><folder>Aptos Narrow</folder><type>4</type></Resource><Resource><Id>Aptos Display_45876480</Id><LAT>2023-10-06T09:25:29Z</LAT><key>30264859306.ttf</key><folder>Aptos Display</folder><type>4</type></Resource><Resource><Id>Aptos_

C:\Users\user\AppData\Local\Microsoft\FontCache\4\CloudFonts\Lato\25090817022.ttf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	TrueType Font data, 16 tables, 1st "GPOS", 30 names, Macintosh, Copyright (c) 2011-2015 by tyPoland Lukasz Dziedzic (http://www.typoland.com/) with Reserved Fon
Category:	dropped
Size (bytes):	656568
Entropy (8bit):	6.571486522102043
Encrypted:	false
SSDEEP:
MD5:	8D72101CAD1547BED5BA3105041EEEAE
SHA1:	29EB192629B0BBB41A7B7F49AB2AEC82D4261921
SHA-256:	D636E4683231F931EDA222D588E944D082BFD3BDBA02F928BEE461C0F185B251
SHA-512:	BE6667E1F6A50E23ADA324B52FB614CA82848600A82F6EDC4EC881A3C5F5D9F0477580AF2421F42B94E1B529E07DDDA7D2D9231B128D93056B4A327D63FE7222
Malicious:	false
Reputation:	unknown
Preview:	............GPOS.l.?......6rGSUBl..x...L..$lOS/2j..........`cmapP.....1$....cvt :(....R ....fpgm......E.....gasp............glyfBd.....H....head...........6hhea.......D...$hmtx...%....../<loca+.....S.../@maxp...j...h... name.I`.........post.1.Y....... prepo.i:..Qd..............._.<...........y.....a.d.....}.m...................V.........}...................................P.`.w.............T.......x.......x.......Y.&................P......!....tyPL.........V.....W .............. ...'.-.........J...H...E.......8._.8._.................k.....^.........0...1.b.M...-....... .......A...........A.^.A.^...`.........A._.....=.B.=.B.......-.........J.................5...A...A.J.D.`.....T...T. .T...T.z.T.\|.T.`.V.`.V.a.W.l.R. .S. .S.../.$./.../.3./.../.../.y.1.y.1.x.1.y.1.x.1.y.1.x.1.x.1.y.1...1.../...1...1...1...1...1...1...1.y.1...1.../.2.1...1.../.Y./...1...>.`.V.\...\...\.....q...=.......c.................i.+.....m...\...\...n.T.m.K...T.a...a...`.V.....b.C.b.C.8.C.9.C.....8.1...+...)....._.+

C:\Users\user\AppData\Local\Microsoft\FontCache\4\CloudFonts\Lato\28221965252.ttf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	TrueType Font data, 16 tables, 1st "GPOS", 30 names, Macintosh, Copyright (c) 2011-2015 by tyPoland Lukasz Dziedzic (http://www.typoland.com/) with Reserved Fon
Category:	dropped
Size (bytes):	656544
Entropy (8bit):	6.544527043014445
Encrypted:	false
SSDEEP:
MD5:	79203A1947440EDE448A384841980E3C
SHA1:	A3A53A436BAAF6DC2E7A05F05866A761C214692B
SHA-256:	8A0AACE75D33794EECE4B28187BFC1DF0BBD2888B5D8A56E01788C8D65D16BE1
SHA-512:	097CD16A3A037B4257FC02B4C5EFE1ACA0B316AB96BB73FFB59ABA243B32A45E0CFD1D760C7C4C238C4CF949E22BCE22A67C757556314F1147DB76798022919B
Malicious:	false
Reputation:	unknown
Preview:	............GPOS.u....$..4.GSUBl..x...4..$lOS/2k..........`cmapP.....1$....cvt <.....R ....fpgm......E.....gasp............glyf..r}...H....head.C.........6hhea...n...D...$hmtx^JN......./<loca,.....S.../@maxp...w...h... nameJ.....h....post.6.c....... prepo.i:..Qd............P..._.<...........y.....a.c.J.........................V.....J.......................................P.`.w.............g.......x.......x.......c.2................P......!....tyPL.........V.....W .............. ...F..........m...k...J...%...+.M.+.M.........~...~...l.....K.........Q...Q.f.[...[......./.......b...........P.K.P.K.s.M.........P.L.....I...I..................m...6...=.........(...1...1.S.3.o.z...C...C.;.C...C...C...C.o.E.o.E.p.G.u.@.,.B.,.B...).K.)...).U.).D.)...)............................9..8.).8..8..8..8..8..8..9.....9....).......O.)...).... .1.o.E.h.z.h...h.....`...B.....-.U.........-.z.-.z...'...}...z.h.z.h.z.}.C.\|.1...C.p.z.p.z.o.E...z.o.1.o.1.`.1.a.1...z.[.*..."...!...$.~."

C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\09D3CCF6-3DE3-4EC4-B85F-CAA71956B115

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	178267
Entropy (8bit):	5.290268288189072
Encrypted:	false
SSDEEP:
MD5:	4872EE626CD73A6C9BF63FBB29E265E8
SHA1:	40167FCE4682B3804A86691062661F68738A69FC
SHA-256:	6318C95194D9DA73A1084ED76CB841AF1B360FB81CC044A5D1ED0974E13D9B0A
SHA-512:	61AF4E460AE001195DE576FABDF56D23A7C1D5BF4FBDF1675AF4AD014CB53812604DBF1E3BDEF2C0643B8B3FE364B6A9EE7C2A7EB86BC83E814EABC8EDD01B97
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8"?>..<o:OfficeConfig xmlns:o="urn:schemas-microsoft-com:office:office">.. <o:services o:GenerationTime="2024-10-25T15:21:32">.. Build: 16.0.18209.40127-->.. <o:default>.. <o:ticket o:headerName="Authorization" o:headerValue="{}" />.. </o:default>.. <o:service o:name="Research">.. <o:url>https://word-edit.officeapps.live.com/we/rrdiscovery.ashx</o:url>.. </o:service>.. <o:service o:name="ORedir">.. <o:url>https://o15.officeredir.microsoft.com/r</o:url>.. </o:service>.. <o:service o:name="ORedirSSL">.. <o:url>https://o15.officeredir.microsoft.com/r</o:url>.. </o:service>.. <o:service o:name="ClViewClientHelpId" o:authentication="1">.. <o:url>https://[MAX.BaseHost]/client/results</o:url>.. <o:ticket o:policy="MBI_SSL_SHORT" o:idprovider="1" o:target="[MAX.AuthHost]" o:headerValue="Passport1.4 from-PP='{}&p='" />.. <o:ticket o:idprovider="3" o:headerValue="Bearer {}" o:resourceId="[

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\3A460E51.dat

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	GIF image data, version 89a, 90 x 68
Category:	dropped
Size (bytes):	1984
Entropy (8bit):	7.69368813786086
Encrypted:	false
SSDEEP:
MD5:	9440BB3FD1093DFE90F1220E35D4844B
SHA1:	24F5CCD4B4628350A46CBA41CE03C8AEBD20763C
SHA-256:	4234C8947994F3E0EE8831357FE39B0A7C27B82356ABFA3C075B46FA7B37D541
SHA-512:	9D0C74F7F17A07304CF31085CEEADE035B3754B0D1349BEBF39A8A4B6259C6644D1A27E1DAF9078D88FEF296B312A00874A01F9DD40D6C509B7F0B44862F9693
Malicious:	false
Reputation:	unknown
Preview:	GIF89aZ.D........:^.:_.;`.;a.=`.<b.=c.>`.>c.>d.?e.?f.=b.@c.Ad.Ah.Bi.Bi.Bj.Ck.Cl.Dl.Dm.En.Fn.Fo.Gp.Hr.Is.@c.Ae.Ce.De.Df.Dg.Ch.Gi.Gj.Hh.Jl.Kw.Lx.My.Nz.O\|.P}.Q~.R. Mn!Nm"No$Oo%Qq%Rq&Rs'Tr)Ut+Vv.Xx4\{5^{7_}8_\|:b..S..T..U..X..Y..[..[..\..]..]..^..^.._..`..a..b..e..f..l..l..l..n..n..o..p..q..r..s..u..v.-_.`.)k.3f.9c.?f.)o.#t. w. x. x.!y.!z.!z."{."\|."\|."}."}."~.#~.#..@f.Di.Ej.Fl.Hm.Io.Jp.Lp.Mr.Qs.Rt.Vw.Wy.Yz.[\|.\}.]}.#..$..$..$..%..%..&..&..&..'..'..'..'..'..(..(..(..(..)....(..-.....1..1..3..9..1..5..8..:..;..<..=..?..?..>..d..h..i..j..l..p..q..s..v..z..\|..~..A..B..C..D..G..F..H..K..K..M..M..M..O..R..Q..S..V..T..V..Y..Z..X..\..].._..b..g..h..l..j..m..t..u..x..y..{...........................................................................................!.......,....Z.D........H......\....#J.H....3j.... C..I...(......0c.I.&...p.t.@..@...J.h..'Q.]...B#e.!......D.1.....].k...B>...Q...?....S.OB.k.%.....v."..g....e...S.AX....,p.P.?....T..Ay.b.........Pt4P.a

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\D2D48390.dat

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	PNG image data, 181 x 50, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	7292
Entropy (8bit):	7.93414043996828
Encrypted:	false
SSDEEP:
MD5:	FBB0BFEF661BB825D3A616C85E35E132
SHA1:	10187EE9CA737DBC13F2256B737AF05E710B7953
SHA-256:	F47E0D70D79DE1B843A99076F5C447EAC44A8CE2C893B811F23F06E4D0FD34AD
SHA-512:	A8334D8ED00CDC20D111D83CCDBB48C60A94F39C22D78155D6B22B282967F029CBC7DD62B6033A3DB035E78BE1E953EB4C1DE0B16F2A9490C03CDD9E60DFF826
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.......2............iCCPICC profile..(.}.=H.@.._S."..fPq.P..RE.K..`...Zu0.....$)...k........... ......"%./).......=...B..4./.h.e..q)._....c.!D!..'3.Yx..{..z..Y....Cj.d.O"...a.o..nZu..."+..9.A.$~..........lz.X$.J=..0+....qX.t..r....8k.....0X.W2\.9....D...4PA.."..H.~..?..S.R.U.#..j. ;~.?..Y...I.8..b...@`.h7m....'......Z...$....G..6pq..=.r..y...H~.B.....7..-0............o..C`.D.........3..~..;r...%.....bKGD..............pHYs...a...a..?.i....tIME....."........yIDATx..y.....w...;...%...bL.......P..`..O6.w..L.$.Sy.q..c..F...[...50.[.........,...Q.BOO...A..7....g...U.N...V.......z.-~...x..@#.!.T..C*sk..n.._...E.E!;N.............T_W.X.+.....r....-.>.S..T....~.f..`p..../............_1.v..j......jy.....".~..Z..cS.A.Sr.V1.Pjqc}]........\...........#cTKd<...8 .{.=.6.7........VW...........f...%.C...p....b...nU.d...7E...O.C...8.B....N..K.........V ..T0......=......@9.&0....."...,cc.....a!.._U.luL=.VW......{..X....#.x.d.GN......L...B.i....

C:\Users\user\AppData\Local\Temp\olkE26C.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1567532
Entropy (8bit):	6.077300367395362
Encrypted:	false
SSDEEP:
MD5:	9317A6DF2833E2C0C4C9597A1F2B86BC
SHA1:	EF3872636005E45F7A2A6B7939FE3CCFD7A68287
SHA-256:	627B009F2E4357A40D3896C150C0C335791144C0ED0BEF7A5EC3D099F5E38802
SHA-512:	20EBC4959229AD5AEAA8991A0C879A4638D7AE0F76158654EBEB6A8327A88294212F624700B13E60805FD5F3563A9A3F6E4E88A658DE684021673C46C747C85C
Malicious:	false
Reputation:	unknown
Preview:	TA04QNBshNodZPM2wrXcF49JDIC1MqKX..Ord6BNIZr2iHKPyVIgdBRLQJRVqKZi33KE4XxFLBffPG08HNmKy3KwAhunikD/GNTAIdynxJb7ic..b2l14TvwmicH5LrsHnfuSQgyZhn4CRQOfXVs8x5YjBX9gnykzRQNmeAZTaP32c1Fg1qNXlyuhpNM..aoKZNpOM/7tUuYA2OYhQI+yqeibTllaqWE2uf7vXvVORz6grVoKP1M1Cd4FNZT7rak3hQLvEAyiS..r8HHUehd7GGuYqNsARXXjCbZVaoy/9hz2yQH6LYAgVTVBvFIXDLHY5RX7ui6VZlOtwZuiuedJSIF..jmjimPErzYiuS1VCtG6vJGlp5cn/QNA8Np5pvDWLQhthbX24e+dp2qo8B1h1YDiaEIB5nNl6YgNg..zZKk7iRjC1Iwo7F8rkNIpdo0Mir1O0zxTG6W7d60Fzyr8JzhnIK7Zff3YYTn0l8SKdunEbGC5V+H..4ljDzLBA+oAa31LYWNzMcISnCmUnNYFZALQIaZ9krQ6bMgiLK8brDUvWZmDukNmJS3NbvY2+nrKx..vl4PK7VI9LKBIS4NMzU+9RD/fml/mNFGVQlRXroldSH4nsvUzZ88HP+YYuL+YxeSUOJTVaJfIzV0..QNl2WytsFKf71PWESg58CFdaILIDRh43Bi+106MIlL6Xb7TTF6c3Wk2RyVtk6CS5xPpuJREXxbhB..+HdpwmZb80ZFUfHZkbgJXWbsRP1GgeogzIshLlU8zwFzgDq8fDghxWOrXmJjAoz4G+aTebxYKlnD..SFU8tGXVhhWKc3v3A/164QMNpfkjFMKIRNXzmrHG1WWIl1C6t/cY1IGfDw1drN0DmyuAeosZfB6T..aNTqUPDBEo5/mW6JEhXyXeq3NOhzyZlSoRUVp7uSXQEEhexhVqqSuZ6PC/U3SmVzvgHhWu/ZV49w..q/0zLRNO3ctWhNt6QSsYsvpoG//+eh

C:\Users\user\AppData\Roaming\Microsoft\Office\MSO3072.acl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	30
Entropy (8bit):	1.2389205950315936
Encrypted:	false
SSDEEP:
MD5:	E7AFF205C8526933414A7CF1EB522B16
SHA1:	C005B346B8FB0411A8DE90FED9384249E694F344
SHA-256:	BEB3E08561F1839722A8DF25E40A2246EA67C019AB6CE7E6025F7614B45FED39
SHA-512:	5499057BFBE3936C494CBD6A13C67FC24EF02A0E2DD3E64B60582C23E3281581A8D7B71C7A544B749B324FEF56E7D674F61B43817E39CCBBEB81A246991D8E00
Malicious:	false
Reputation:	unknown
Preview:	..............................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 25 14:21:47 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2673
Entropy (8bit):	3.986892650946437
Encrypted:	false
SSDEEP:
MD5:	058C90F770FDD622F2E905092B6606AB
SHA1:	52C1291B69D4C9934852169E43218DD418306158
SHA-256:	F401148285103C7B34DDADC7FB00CE8B1E18600173A3003EC3D3287AF426F598
SHA-512:	3EDBADFCD919F87097FA8EE4BEA63D3DD7EA7534D04FF44443790A7A5AE0662F0C67F7F9B4B45642742F9BC655FD977484DE91CFB7515FA5065B7E004D2C9FC8
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,....\.{..&..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IYY.z....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VYY.z....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VYY.z....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VYY.z..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VYY.z...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............8......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 25 14:21:47 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2675
Entropy (8bit):	4.003131032708293
Encrypted:	false
SSDEEP:
MD5:	632B5224920021200BDDA1C4169F4E0F
SHA1:	B8301A2B3EADE2E033E25C0A1E7C6B7AADE67EDA
SHA-256:	F63B4333E86C03B34178650B2C89EB85B626A962BA43F0914D80CA7007A705AD
SHA-512:	B132F2DB3CB8807E7F1B70C9B4ADB68F2DB7EFA1EC9ECADF728E8DE676DD0224D7D76D33B59830E1958E525778629BCA5ABCBA9DEFCF51662724FCBB1A431CC4
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,....-.n..&..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IYY.z....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VYY.z....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VYY.z....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VYY.z..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VYY.z...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............8......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2689
Entropy (8bit):	4.0125371218323815
Encrypted:	false
SSDEEP:
MD5:	FE5429721A6BFCD74CCD2EBE70FB0AA5
SHA1:	625926F8E309007BC84152A45CBF12E3ACDF4A23
SHA-256:	A1CFA6EEBFE75D38BE0A377BF43E70713FC84001573583ADDAF9C9F09E4B43A8
SHA-512:	F7B19E60ABBA438BFA768CA47B2FBDFCC64117CEBBA6A2D68E967D0F3950F397A65772FDFB298B06130EA164204AA9E4AA173594F8B4ADF80C5D256417461E27
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.....Y.04...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IYY.z....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VYY.z....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VYY.z....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VYY.z..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VFW.E...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............8......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 25 14:21:47 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	4.001493999208809
Encrypted:	false
SSDEEP:
MD5:	6EF46F2A2361131612BDED870B306004
SHA1:	18293000E43F9CACF08FE7784614ABB98E3C8EAD
SHA-256:	A2C4E614D82A726074B48A1BC2E6AB08C278C19623D59A31F59FD2F2EBCE98EA
SHA-512:	ADDA7897DAD72E4C04D165161004673E140D7A5390D6F1EF836FF8797E3C19DCBA286C210C663BD1C1DC3979CAE9B4E6DDBC251D6BBC9804680493F1DF0B8E67
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,......h..&..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IYY.z....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VYY.z....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VYY.z....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VYY.z..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VYY.z...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............8......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 25 14:21:47 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.992558984900108
Encrypted:	false
SSDEEP:
MD5:	E544A85582EBB47A71C4298C0235528D
SHA1:	ED1A89F05B376FAD7F4F8A89063475F85D7AF042
SHA-256:	A3423B8F6AF8A82CE5558A10345D64BCAA885CA1C7C3EB40CAD215EBCB3F3D1C
SHA-512:	7BF5F44D45072FCCD32015C9858499B88382ADA74BF8ABA3B4194DBD948EF61E790BB414D8FA91325E535A68F8488837CF917C247F3D0144AC5E51A4C43E7A94
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,......u..&..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IYY.z....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VYY.z....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VYY.z....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VYY.z..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VYY.z...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............8......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 25 14:21:47 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	4.000543787823358
Encrypted:	false
SSDEEP:
MD5:	9926DD248B0125CDD7A03AA33F9F2933
SHA1:	76044FE82CF6BE202A2871AEABD980FE13B6F109
SHA-256:	7B063D00E3D2651961E6384ADE207CD12ED9554AEC4342E10DD224BFF9250D63
SHA-512:	926D4773D36998AB7802903DB3CD854266DB9CD15070D5D7B1430C45E0BFFD1E883B11FC3670573E5B5E82B6AC96C96CDA80F70272478B8E00E38E84EDC29B64
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,....I{^..&..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IYY.z....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VYY.z....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VYY.z....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VYY.z..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VYY.z...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............8......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Chrome Cache Entry: 102

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (836)
Category:	downloaded
Size (bytes):	11245
Entropy (8bit):	4.758782059181795
Encrypted:	false
SSDEEP:
MD5:	176A20C0960D21D947DD73EA1C0A51EA
SHA1:	DDE3A87837E952B58D809819BB68416CA9D338A0
SHA-256:	B1694952EB11D67F4AD94F70099F8AA77BA4BD5494E56EB8AA0A104D3F0D1194
SHA-512:	A44B652286F182D5038852736AB823B4D572EF8577B10A59FD9D8701637505A632E4AE2CE066368E6A5DAC0AE237FC574D153F0D14A76FF7D0B7729036837B2D
Malicious:	false
Reputation:	unknown
URL:	https://securemail.stewardpartners.com/securereader/javax.faces.resource/primeicons/primeicons.css.jsf?ln=primefaces&v=13.0.0&e=13.0.0
Preview:	@font-face{font-family:'primeicons';font-display:block;src:url("/securereader/javax.faces.resource/primeicons/primeicons.eot.jsf?ln=primefaces&v=13.0.0&e=13.0.0");src:url("/securereader/javax.faces.resource/primeicons/primeicons.eot.jsf?ln=primefaces&v=13.0.0&e=13.0.0#iefix") format('embedded-opentype'),url("/securereader/javax.faces.resource/primeicons/primeicons.woff2.jsf?ln=primefaces&v=13.0.0&e=13.0.0") format('woff2'),url("/securereader/javax.faces.resource/primeicons/primeicons.woff.jsf?ln=primefaces&v=13.0.0&e=13.0.0") format('woff'),url("/securereader/javax.faces.resource/primeicons/primeicons.ttf.jsf?ln=primefaces&v=13.0.0&e=13.0.0") format('truetype'),url("/securereader/javax.faces.resource/primeicons/primeicons.svg.jsf?ln=primefaces&v=13.0.0&e=13.0.0#primeicons") format('svg');font-weight:normal;font-style:normal}..pi{font-family:'primeicons';speak:none;font-style:normal;font-weight:normal;font-variant:normal;text-transform:none;line-height:1;display:inline-block;-webkit-fon

Chrome Cache Entry: 104

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	112
Entropy (8bit):	5.00779278162261
Encrypted:	false
SSDEEP:
MD5:	4DC5A73376B99D78D3CBA9453201A0A8
SHA1:	EAE38D44B31BD45E25F4994B1C58B9F0BDD0F2A6
SHA-256:	282B5DCBA70C5A720861A242F9269DD895580A96F5C6603224D07C752B2D577A
SHA-512:	F0B7788E73F08CFBE3C45444B0A0C3381AF32887A0518EB50B386E38023B5D19784BD971AE7FDED49B5BDE1654D3B81EFCC32C49182ABEF64EB2B76F471200F5
Malicious:	false
Reputation:	unknown
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISLAneC2P83rqHTRIFDZA08QsSBQ0qAeMMEgUNfhkhWBIFDQ_712cSBQ3ZFN9F?alt=proto
Preview:	ClAKCw2QNPELGgQIAxgBCgsNKgHjDBoECAUYAQoeDX4ZIVgaBAhMGAIqEQgKUg0KAyEjQBABGP////8PCgsND/vXZxoECF8YAgoHDdkU30UaAA==

Chrome Cache Entry: 106

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (512)
Category:	dropped
Size (bytes):	2200
Entropy (8bit):	5.373605249965219
Encrypted:	false
SSDEEP:
MD5:	EBBDCD998F7D31B97970C181175EA15E
SHA1:	4B533E6664B1B05A1CD6856CC6A1A13E950AAAE6
SHA-256:	07E976B30A2A597705DA161FFDA9B65DD83385AEB2B4F6AE9C0A3568BD75CBBD
SHA-512:	4F62F3884EF7C3C8EBF120429D1CB1AB89C3D6C8B37D7C120A234EDA9F3FDA65B11FF0B264F799DB83C45BBCC276AF7A517EC0595FFFE6C8267C41AADF73E285
Malicious:	false
Reputation:	unknown
Preview:	(function(a){function l(c){"string"===typeof c.data&&(c.data={keys:c.data});if(c.data&&c.data.keys&&"string"===typeof c.data.keys){var m=c.handler,k=c.data.keys.toLowerCase().split(" ");c.handler=function(b){if(this===b.target\|\|!(a.hotkeys.options.filterInputAcceptingElements&&a.hotkeys.textInputTypes.test(b.target.nodeName)\|\|a.hotkeys.options.filterContentEditable&&a(b.target).attr("contenteditable")\|\|a.hotkeys.options.filterTextInputs&&-1<a.inArray(b.target.type,a.hotkeys.textAcceptingInputTypes))){var f=."keypress"!==b.type&&a.hotkeys.specialKeys[b.which],e=String.fromCharCode(b.which).toLowerCase(),d="",g={};a.each(["alt","ctrl","shift"],function(p,h){b[h+"Key"]&&f!==h&&(d+=h+"+")});b.metaKey&&!b.ctrlKey&&"meta"!==f&&(d+="meta+");b.metaKey&&"meta"!==f&&-1<d.indexOf("alt+ctrl+shift+")&&(d=d.replace("alt+ctrl+shift+","hyper+"));f?g[d+f]=!0:(g[d+e]=!0,g[d+a.hotkeys.shiftNums[e]]=!0,"shift+"===d&&(g[a.hotkeys.shiftNums[e]]=!0));e=0;for(var n=k.length;e<n;e++)if(g[k[e]])return m.apply(t

Chrome Cache Entry: 107

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (577)
Category:	downloaded
Size (bytes):	57270
Entropy (8bit):	5.435937467221443
Encrypted:	false
SSDEEP:
MD5:	BAEBBFA4D3F24BCB2EA0E28E209B9855
SHA1:	450C976FA4223EB0D694D6CB37DEBEAA405F780C
SHA-256:	9E4240C6D605CE70D795E0171575C9978B258383BEB7ECA62E931C746A49DB85
SHA-512:	EE8BE9A996A06526E0D65285C1A5BF4ECF4C51BBC4B6AF1088032810A894CD4BF64E14756F5311618A0A736C6064332071285ACD066E35AACCC46CF2986F4BAF
Malicious:	false
Reputation:	unknown
URL:	https://securemail.stewardpartners.com/securereader/javax.faces.resource/core.js.jsf?ln=primefaces&v=13.0.0&e=13.0.0
Preview:	(function(a){"function"===typeof define&&define.amd?define(["jquery"],function(c){return a(c)}):"object"===typeof module&&"object"===typeof module.exports?module.exports=a(require("jquery")):a(window.jQuery)})(function(a){function c(b){void 0===b&&(b=window.navigator.userAgent);b=b.toLowerCase();var d=/(edge)\/([\w.]+)/.exec(b)\|\|/(opr)[\/]([\w.]+)/.exec(b)\|\|/(chrome)[ \/]([\w.]+)/.exec(b)\|\|/(iemobile)[\/]([\w.]+)/.exec(b)\|\|/(version)(applewebkit)[ \/]([\w.]+).(safari)[ \/]([\w.]+)/.exec(b)\|\|/(webkit)[ \/]([\w.]+).(version)[ \/]([\w.]+).(safari)[ \/]([\w.]+)/.exec(b)\|\|./(webkit)[ \/]([\w.]+)/.exec(b)\|\|/(opera)(?:.version\|)[ \/]([\w.]+)/.exec(b)\|\|/(msie) ([\w.]+)/.exec(b)\|\|0<=b.indexOf("trident")&&/(rv)(?::\| )([\w.]+)/.exec(b)\|\|0>b.indexOf("compatible")&&/(mozilla)(?:.*? rv:([\w.]+)\|)/.exec(b)\|\|[],e=/(ipad)/.exec(b)\|\|/(ipod)/.exec(b)\|\|/(windows phone)/.exec(b)\|\|/(iphone)/.exec(b)\|\|/(kindle)/.exec(b)\|\|/(silk)/.exec(b)\|\|/(android)/.exec(b)\|\|/(win)/.exec(b)\|\|/(mac)/.exec(b)\|\|/(linux)/.e

Chrome Cache Entry: 108

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 8 x 8
Category:	downloaded
Size (bytes):	79
Entropy (8bit):	4.003649478784567
Encrypted:	false
SSDEEP:
MD5:	4C69EEE876E3130B6951BA08FD6EB67C
SHA1:	884FD33D52C7EA30F04E8732A364A22DDB760F7D
SHA-256:	CB61290F2FAD07BA1668C99FFF76B88C2910924860B2FD71547BAA3A4451B62F
SHA-512:	8C4FEED2A343E384775B5D4F90442287252374A0D029B14C2E89B6C5FA388BC0F8E5C54FDEDFD154E99A046516CCAF9E982A2B4E628247C3FD07BD42C4FCCA31
Malicious:	false
Reputation:	unknown
URL:	https://securemail.stewardpartners.com/securereader/images/BangBullet.gif
Preview:	GIF89a..........ff...................!.......,...........H...@...l,.... .Q..$.;

Chrome Cache Entry: 109

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (962)
Category:	downloaded
Size (bytes):	495726
Entropy (8bit):	5.161103805507685
Encrypted:	false
SSDEEP:
MD5:	E1EB3E2F976E2B595B30EE27A1662592
SHA1:	53EC17AFE052A7DEE85216B7C712D8807FE474FA
SHA-256:	5E62D02878F20EDF82ADD5659F856F20103102629D46124545A4F0D18998F0FD
SHA-512:	293C6C7A06DFE8516AC97498E99FAE7DDB25700127A45C9B2FB26857C107E9FB9020ACAA271C42BD83E4D66B88ABD688DBB38B6CCC44B60034685B9E42755CAE
Malicious:	false
Reputation:	unknown
URL:	https://securemail.stewardpartners.com/securereader/javax.faces.resource/components.js.jsf?ln=primefaces&v=13.0.0&e=13.0.0
Preview:	PrimeFaces.dialog\|\|(PrimeFaces.dialog={},PrimeFaces.dialog.DialogHandler={openDialog:function(a){var b=this.findRootWindow(),c=a.sourceComponentId+"_dlg";if(!b.document.getElementById(c)){var d=function(){for(var k=window,l=[];k.frameElement;){var m=k.parent;if(void 0===m.PF)break;k=k.frameElement;for(var n=[];k&&void 0!==k.tagName;k=k.parentNode){if(k.id&&!/\s/.test(k.id)){n.unshift(k.id);n.unshift("#");n.unshift(" \x3e ");break}else if(k.className){var p=k.className.split(" "),q=[],r;for(r in p)p.hasOwnProperty(r)&&.p[r]&&(q.unshift(p[r]),q.unshift("."));q.unshift(k.tagName);p=q.join("");q=$(k.parentNode).find(p);1<q.length&&n.unshift(":eq("+q.index(k)+")");n.unshift(p)}else q=$(k.parentNode).find(k.tagName),1<q.length&&n.unshift(":eq("+q.index(k)+")"),n.unshift(k.tagName);n.unshift(" \x3e ")}k=n.slice(1).join("");l.unshift(k);k=m}return l}(),e=a.options.widgetVar;e\|\|(e=a.sourceComponentId.replace(/:/g,"_")+"_dlgwidget");var f=$('\x3cdiv id\x3d"'+c+'" class\x3d"ui-dialog ui-widget ui

Chrome Cache Entry: 110

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format, TrueType, length 128612, version 2.10
Category:	downloaded
Size (bytes):	128612
Entropy (8bit):	7.992355830336478
Encrypted:	true
SSDEEP:
MD5:	03ADBB294261977089607CDEA10B520C
SHA1:	4DD8B4AD179F3F9B64EC980418F2C9D354A9983D
SHA-256:	D79149C9559597EFFB066E4ED38C2C4B429C88D0420725C296D52C40363EAF68
SHA-512:	5C40F0B1B41B832854E786AE3B6E9FAC4DAC0ED82F7FE3F6B3B8CB5034224DFDA5C2E6FB1B45D04F7CCEF7BA0FB48FD005B9FA527E72700088F9093A952025C4
Malicious:	false
Reputation:	unknown
URL:	https://securemail.stewardpartners.com/securereader/fonts/sourcesanspro-regular.ttf.woff
Preview:	wOFF.......d......\|H........................BASE.......:...:....DSIG...T............GDEF..v....x....$..GPOS..y...QM......;.GSUB...T......<Z....OS/2...$...Y...`]..cmap...8...X..6....[cvt ..,........"..fpgm..+........s.Y.7gasp..v.............glyf..?....w..R,e...head.......6...6.l.Yhhea.......!...$...Zhmtx...........`...\loca..-........d.f.Xmaxp....... ... ...zname..Nd...j...<...post..S..."...K.C3.oprep..,....S...V.c...........E.8_.<...........g.........:...o..............x.c`d``...=....V..8...".}...~................v...............s....x.c`f\|.8.......).....B3.1.1.E.Y..Y...X....3.%.............w.....o0.00...1>`.......\|..Y...x..ypV..../$.KX..[.B..Y..a....AY..Hpt...n(b.F..q:.:v:.eZE...:...uZ5.6#.K.q0,Q#1(U^...>?#....43.9w{w=..s..[d.._C.....uv........\|....Z.i.C..)..o.5p;.c..../#m......."A_.`..2..,..s..H.i.";J..'Rd.K...FZe....e>&.JM0Ijl.d..5..\|...15..7..7.Gv.d.'%C.f.......c.{.] Y.=k..a.....E...\..hp^.6K.I....f"?..a.\|E..La.."...s..=G.......I:...'..`......b{....:Y

Chrome Cache Entry: 113

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 8 x 8
Category:	downloaded
Size (bytes):	64
Entropy (8bit):	4.440413476123046
Encrypted:	false
SSDEEP:
MD5:	08563EA7B7B4F4488302CC85B21E4992
SHA1:	38C7C24638EE35C10A544F0401FB1270C0CD6D3A
SHA-256:	749F13D9A507A80A7ACC85A5AD8C4CEE027BB31EBEA982D259A9256802009922
SHA-512:	DC05FF3243A053DF87292C9416AF5C1DC95587910DD8732607E4D6C952DF9B056F55FA19C396F8C0CA13AD7DA4613AF10C975EFE7AFEAF7A4610F2FD0154D7E3
Malicious:	false
Reputation:	unknown
URL:	https://securemail.stewardpartners.com/securereader/images/TipClose.gif
Preview:	GIF89a.........lg_I......!.......,..............f..^Zm......P..;

Chrome Cache Entry: 117

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (2377), with CRLF, LF line terminators
Category:	downloaded
Size (bytes):	109060
Entropy (8bit):	4.8645184756072055
Encrypted:	false
SSDEEP:
MD5:	4456235FAAF313A49F29A1A4A0DC85E8
SHA1:	3994708A11B511A3CBC0C47F16DAB6B3AC0CAAC7
SHA-256:	7EB8163AEC4673721885C381E7A3AF32028F9A94196B2306D90EF53E087B3F29
SHA-512:	C22A8D6610C60655F5372C3F94A3FEE8C03FE41273C249B5216C7F42613BD589C0213B399051637EB87FCE36EB8897DF3802002E36E6F54B2F0B13CD95F16CCC
Malicious:	false
Reputation:	unknown
URL:	https://securemail.stewardpartners.com/securereader/javax.faces.resource/components.css.jsf?ln=primefaces&v=13.0.0&e=13.0.0
Preview:	.ui-helper-hidden-accessible input,.ui-helper-hidden-accessible select{-webkit-transform:scale(0);-moz-transform:scale(0);transform:scale(0)}.ui-shadow{-moz-box-shadow:0 5px 10px rgba(0,0,0,0.8);-webkit-box-shadow:0 5px 10px rgba(0,0,0,0.8);box-shadow:0 5px 10px rgba(0,0,0,0.8)}.ui-overlay-visible{visibility:visible}ui-overlay-visible {visibility:visible !important}.ui-overlay-hidden{visibility:hidden}.ui-overlay-hidden {visibility:hidden !important}.ui-overflow-hidden{overflow:hidden}.ui-reset{margin:0;padding:0;border:0;outline:0;text-decoration:none;font-size:100%;list-style:none}..ui-datepicker .ui-datepicker-current.ui-priority-secondary{opacity:1}.ui-icon-blank{background-position:16px 16px}.ui-transparent-pixel{content:url(data:image/gif;base64,R0lGODlhAQABAIAAAP///wAAACH5BAEAAAAALAAAAAABAAEAAAICRAEAOw==)}@media only all{th.ui-column-p-6,td.ui-column-p-6,th.ui-column-p-5,td.ui-column-p-5,th.ui-column-p-4,td.ui-column-p-4,th.ui-column-p-3,td.ui-column-p-3,th.ui-column-p-2,td.ui

Chrome Cache Entry: 119

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 8 x 8
Category:	downloaded
Size (bytes):	64
Entropy (8bit):	4.431150438178646
Encrypted:	false
SSDEEP:
MD5:	0099E0458F743BD64142F6BC36E00E0D
SHA1:	90C3E270B87CE28789925391972647697AE458D9
SHA-256:	3A085E20C4C690FCAB707C3492923DA12EF0D9911EACA70C7978C5595B1E546B
SHA-512:	93D376DF2E289169ECFBB76375ADE021A75A819195B7C44337EB76E67D9E3839E492270479EC955FD184290B9CF57E59B0A2086A0453C04CEA1CDE141D07432D
Malicious:	false
Reputation:	unknown
URL:	https://securemail.stewardpartners.com/formpostdir/images/CheckBullet.gif
Preview:	GIF89a...................!.......,............`.....bV..C.f..;

Chrome Cache Entry: 122

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65446), with CRLF line terminators
Category:	downloaded
Size (bytes):	87462
Entropy (8bit):	5.262170977462
Encrypted:	false
SSDEEP:
MD5:	4FCF018B5C604C47AE980185CF0167C2
SHA1:	FA4AB55B154A5A4C4EF55CFAD51A2A2D4407AF61
SHA-256:	32B42F9BC813DD6BAD1B45129EADE1DF8DD1463908F79505209FBFA1AA71018A
SHA-512:	3EA648F880DCC7BD96685650B232213A6D1056DEA2C698C1A3A09F14DF04AC4C13E06AD5966341A597280D432AA94AFF0C51A39A77FF3602E7754BCD65FC9464
Malicious:	false
Reputation:	unknown
URL:	https://securemail.stewardpartners.com/securereader/javax.faces.resource/jquery/jquery.js.jsf?ln=primefaces&v=13.0.0&e=13.0.0
Preview:	/! jQuery v3.7.0 \| (c) OpenJS Foundation and other contributors \| jquery.org/license /..!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery requires a window with a document");return t(e)}:t(e)}("undefined"!=typeof window?window:this,function(ie,e){"use strict";var oe=[],r=Object.getPrototypeOf,ae=oe.slice,g=oe.flat?function(e){return oe.flat.call(e)}:function(e){return oe.concat.apply([],e)},s=oe.push,se=oe.indexOf,n={},i=n.toString,ue=n.hasOwnProperty,o=ue.toString,a=o.call(Object),le={},v=function(e){return"function"==typeof e&&"number"!=typeof e.nodeType&&"function"!=typeof e.item},y=function(e){return null!=e&&e===e.window},C=ie.document,u={type:!0,src:!0,nonce:!0,noModule:!0};function m(e,t,n){var r,i,o=(n=n\|\|C).createElement("script");if(o.text=e,t)for(r in u)(i=t[r]\|\|t.getAttribute&&t.getAttribute(r))&&o.setAttribute(r,i);n.head.appendChild(o).parentNode.remov

Chrome Cache Entry: 124

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (65445), with no line terminators
Category:	downloaded
Size (bytes):	201284
Entropy (8bit):	4.9265701597161495
Encrypted:	false
SSDEEP:
MD5:	A5AB2DC518B0D42515E6A1E15A685D7D
SHA1:	E13C12BFB6601829379237F6B7EADA2E118C9AD4
SHA-256:	B9C3C98034B050BEE4D23D6CE791FAF5AA4AA7E0ED74C91A30860675BC41D68F
SHA-512:	618FA3C96ACBBC03317A0094E5C687A9F693D4494F1B3DA60D0448559397515AF804F837833FF22756A422D4393ACEFA25260EFC981E7A944CB3E249352A6148
Malicious:	false
Reputation:	unknown
URL:	https://securemail.stewardpartners.com/securereader/javax.faces.resource/theme.css.jsf?ln=primefaces-saga&v=13.0.0&e=13.0.0
Preview:	.:root{--surface-a:#ffffff;--surface-b:#f8f9fa;--surface-c:#e9ecef;--surface-d:#dee2e6;--surface-e:#ffffff;--surface-f:#ffffff;--text-color:#495057;--text-color-secondary:#6c757d;--primary-color:#2196F3;--primary-color-text:#ffffff;--font-family:-apple-system, BlinkMacSystemFont, Segoe UI, Roboto, Helvetica Neue, Arial, Noto Sans, sans-serif, Apple Color Emoji, Segoe UI Emoji, Segoe UI Symbol, Noto Color Emoji;--surface-0: #ffffff;--surface-50: #FAFAFA;--surface-100: #F5F5F5;--surface-200: #EEEEEE;--surface-300: #E0E0E0;--surface-400: #BDBDBD;--surface-500: #9E9E9E;--surface-600: #757575;--surface-700: #616161;--surface-800: #424242;--surface-900: #212121;--gray-50: #FAFAFA;--gray-100: #F5F5F5;--gray-200: #EEEEEE;--gray-300: #E0E0E0;--gray-400: #BDBDBD;--gray-500: #9E9E9E;--gray-600: #757575;--gray-700: #616161;--gray-800: #424242;--gray-900: #212121;--content-padding:1rem;--inline-spacing:0.5rem;--border-radius:4px;--surface-ground:#f8f9fa;--surface-section:#ffffff;--surface-card:#f

Chrome Cache Entry: 93

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (723)
Category:	dropped
Size (bytes):	146627
Entropy (8bit):	5.274790444019661
Encrypted:	false
SSDEEP:
MD5:	0C9DDB8165ABFCA0A01CD315BDDC2AB1
SHA1:	22DDE76B5E49B02C2AC0FDDF907F6ACB931B82B8
SHA-256:	4A593495AC64FBFCA6EE84DB57A6B68266EEDFE9DB5D173244508CB6A31CA057
SHA-512:	BAD57ACEDFAC7D2BF6D77A518A6CD5BAB43169120BD13E9D49E96D4D7F598D2BD76F62AAA4709C1DA3F703D897ACE034B400A6BFE61C8FDCAD2186DD7A4F0219
Malicious:	false
Reputation:	unknown
Preview:	/. jQuery UI - v1.13.2 - 2022-07-19. http://jqueryui.com. Includes: widget.js, position.js, data.js, disable-selection.js, focusable.js, form-reset-mixin.js, jquery-patch.js, keycode.js, labels.js, scroll-parent.js, tabbable.js, unique-id.js, widgets/draggable.js, widgets/droppable.js, widgets/resizable.js, widgets/selectable.js, widgets/sortable.js, widgets/mouse.js, widgets/slider.js, effect.js, effects/effect-blind.js, effects/effect-bounce.js, effects/effect-clip.js, effects/effect-drop.js, effects/effect-explode.js, effects/effect-fade.js, effects/effect-fold.js, effects/effect-highlight.js, effects/effect-puff.js, effects/effect-pulsate.js, effects/effect-scale.js, effects/effect-shake.js, effects/effect-size.js, effects/effect-slide.js, effects/effect-transfer.js. Copyright jQuery Foundation and other contributors; Licensed MIT /.(function(e){"function"===typeof define&&define.amd?define(["jquery"],e):e(jQuery)})(function(e){function w(a){return null==a?a+"":"object"===typeof

Chrome Cache Entry: 95

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (47254), with no line terminators
Category:	dropped
Size (bytes):	47254
Entropy (8bit):	5.200712489482322
Encrypted:	false
SSDEEP:
MD5:	1EE5300441F6D2204173FDE1C4ACA985
SHA1:	2DE2565C49F7548EFD6BF3F48751994A870B1200
SHA-256:	A1D563139C7AFA362C35519099D7018C09A72C05952CAE3CA5ED3C277C5554F2
SHA-512:	9155637FC8BAC573EC106B8DA46A98316822B80267D56EA5A3F6CA61EF5E3A0919729A43D404B0BEB8832DF329B2CBBC1B5DC587B21A0471E4CD540F82229517
Malicious:	false
Reputation:	unknown
Preview:	if(!((jsf&&jsf.specversion&&jsf.specversion>=23000)&&(jsf.implversion&&jsf.implversion>=3))){var jsf={};jsf.ajax=function(){var eventListeners=[];var errorListeners=[];var delayHandler=null;var isIE=function isIE(){if(typeof isIECache!=="undefined"){return isIECache}isIECache=document.all&&window.ActiveXObject&&navigator.userAgent.toLowerCase().indexOf("msie")>-1&&navigator.userAgent.toLowerCase().indexOf("opera")==-1;return isIECache};var isIECache;var getIEVersion=function getIEVersion(){if(typeof IEVersionCache!=="undefined"){return IEVersionCache}if(/MSIE ([0-9]+)/.test(navigator.userAgent)){IEVersionCache=parseInt(RegExp.$1)}else{IEVersionCache=-1}return IEVersionCache};var IEVersionCache;var isAutoExec=function isAutoExec(){try{if(typeof isAutoExecCache!=="undefined"){return isAutoExecCache}var autoExecTestString="<script>var mojarra = mojarra \|\| {};mojarra.autoExecTest = true;<\/script>";var tempElement=document.createElement("span");tempElement.innerHTML=autoExecTestString;var

Chrome Cache Entry: 98

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	downloaded
Size (bytes):	1150
Entropy (8bit):	5.223148900731864
Encrypted:	false
SSDEEP:
MD5:	A05A05DCD6158CC4F8701173734F484A
SHA1:	FEEF99DC27E3DB5BF07A255B8EE509CCCACFF245
SHA-256:	CA9A42575D5AD76A2915ED24034A512413392423BC5EC029B4605AEE7EDF5D46
SHA-512:	635E76CBF85BC1E9AF0168A9B87D2085CBC68BEDEB07116DF062C2AAEA0F105D37378E37D881A8AED91EA3C0DFAF700BD6CD628620C5DCEEA6626EB3547E902C
Malicious:	false
Reputation:	unknown
URL:	https://securemail.stewardpartners.com/favicon.ico
Preview:	............ .h.......(....... ..... .............................................................................................D..................................................d.................................................P...................................................@.....S..K..0.......................................................f..........................................................P....................................6.....j...........................................n......................f............................I.............{........................................^.......................i................................!.....:............./...................................{..............j...........................................................................-..`..M..v...@.........

Chrome Cache Entry: 99

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 30180, version 1.0
Category:	downloaded
Size (bytes):	30180
Entropy (8bit):	7.99017292096811
Encrypted:	true
SSDEEP:
MD5:	C0929A1E055F2CEB5C889501C24A24E1
SHA1:	55A4B2A5F02E362405D8D874903AF0B5F6A6C15D
SHA-256:	3824BE5040322C884634028B8CDFB1716912128CC4A1D38B4C7A93FFEA2A6879
SHA-512:	32F32159EFFF6AFD4B06A8AD10C8306A94617F2497552995950AC6D936993F7A03C50CEB02C4DD57C0F9560ABC4748AFFF8ABC0951E87436A76C8ED88B1BEAD0
Malicious:	false
Reputation:	unknown
URL:	https://securemail.stewardpartners.com/securereader/javax.faces.resource/primeicons/primeicons.woff2.jsf?ln=primefaces&v=13.0.0&e=13.0.0
Preview:	wOF2......u.......%...u.........................?FFTM....`..j..............6.$..4. ..=..n....d...Awp\.*.H.n.T../.....1.....2.[.)....$Q.9D.D.........b..>4.:...5q....Z...&.....7S,..y...m1.q.l..&1..Ba....}......T{./....P.h.Z.)-......+_.....F....~..>..{./...J`=..........+A.....f...uq.8.`...<...n.IH yI ..f.a.L ..y.k%a(c;..E.'....VE+..U[G.8f.8...k..n.&w{.bM0.....3.j....$'&_}.....J...P.?u}.....N........T.A.\fn..i..p`...M...L"..v.......7t...5.".J...R.m? .!.....0.]$..$ h.5l..[%R.........F...%.>..@.+...].....A!QT...B..@{9N.swUHm...>.\|...u=.I.<.........r.ooHm.&+#m..Y.L..L.M...7..;..2.X......._{.9.<....k+.....A.0l_.......].......k..1....p..Io.(.7...^.W~C...4...>...M....a...8.w (...$(..vT.X$...n....R_@.....i.w.....R...>,om....,[.S.=.a...j..%\..l...............a.P.....R..i.dn".DBa)m.}.vu1W^kC..u.hC..j..w.........1...R....(......@...E..... ......[..........i.VQ...$.rc....e...a%:0..e..;..O.@].<..+...$m..H...;......*:........~.../..t.^..!g..<..8{.(....r.

Static File Info

General

File type:	RFC 822 mail, Unicode text, UTF-8 (with BOM) text, with very long lines (347), with CRLF line terminators
Entropy (8bit):	5.735657092600356
TrID:	Text - UTF-8 encoded (3003/1) 100.00%
File name:	[EXT] [ #ENCRYPT ] WSRB 401k, Trustee to Trustee Transfer form.eml
File size:	2'357'312 bytes
MD5:	5ed87452cd07f3e7b18a993bb8e1dc40
SHA1:	3ece036066abbaaaf6de33645a052020ee064c97
SHA256:	2d85e78b8d2bd29319bf471a416b4cf345bb4604751c2c61665919c12ac6e125
SHA512:	920246feda5ef1b01277cb7c4ed56e774c69edfd4cf75ee9210940743329b0dd98121858d64000c6c211ce5e4b205f7459b71894a89167f0cf3d53ba2c12e248
SSDEEP:	24576:y5DgKfgd5dkNygDKUbxxn+wVQyu2A7A9iZBHf5pHe6e8Hqs1NS6IB0yHLNwLgrN6:yFOkxr7Du24iiZBPHye1sxN5w
TLSH:	1BB5012544C43BD4CA28672DE07E361ED7F0164B486A76C9EBB3AD0E7FB6D4808271B5
File Content Preview:	...Received: from SJ0PR01MB7249.prod.exchangelabs.com (::1) by.. BL0PR01MB5108.prod.exchangelabs.com with HTTPS; Thu, 24 Oct 2024 16:30:50.. +0000..Received: from DS7PR05CA0106.namprd05.prod.outlook.com (2603:10b6:8:56::24) by.. SJ0PR01MB7249.prod.exchang

Static Mail

General

Subject:	[EXT] [ #ENCRYPT ] WSRB 401k, Trustee to Trustee Transfer form
From:	Loura Oswald <loura.oswald@stewardpartners.com>
To:	Bryan Stanwood <Bryan.Stanwood@wsrb.com>
Cc:	Mark Hwee <mark.hwee@stewardpartners.com>
BCC:	Mark Hwee <mark.hwee@stewardpartners.com>
Date:	Thu, 24 Oct 2024 16:30:33 +0000
Communications:	CAUTION: This email originated from outside of the organization. Do not click links or open attachments unless you recognize the sender and know the content is safe. [cid:171717588619970717-100001] [cid:171717588619970717-100002] This is a secure message. Click here<https://securemail.stewardpartners.com/formpostdir/securereader?id=R_CgcnaABuXrVdTOEY9kny1MG0EPFHnM&brand=91cc822e1b32228> by 2025-10-24 16:30 UTC to read your message. After that, open the attachment. More Info<https://securemail.stewardpartners.com/securereader/help.jsf?lang=enus> Disclaimer: This email and its content are confidential and intended solely for the use of the addressee. Please notify the sender if you have received this email in error or simply delete it. Secured by Proofpoint Encryption, Copyright 2009-2024 Proofpoint, Inc. All rights reserved.
Attachments:	SecureMessageAtt.html

Headers

Key	Value
Received	from CO6PR20MB3634.namprd20.prod.outlook.com ([fe80::fa37:6525:9d73:4087]) by CO6PR20MB3634.namprd20.prod.outlook.com ([fe80::fa37:6525:9d73:4087%3]) with mapi id 15.20.8093.014; Thu, 24 Oct 2024 16:30:33 +0000
From	Loura Oswald <loura.oswald@stewardpartners.com>
To	Bryan Stanwood <Bryan.Stanwood@wsrb.com>
CC	Mark Hwee <mark.hwee@stewardpartners.com>
Subject	[EXT] [ #ENCRYPT ] WSRB 401k, Trustee to Trustee Transfer form
Thread-Topic	[EXT] [ #ENCRYPT ] WSRB 401k, Trustee to Trustee Transfer form
Thread-Index	AdsmMba0Mp0I1KDHQHqgiBEIO+GgXQ==
Date	Thu, 24 Oct 2024 16:30:33 +0000
Message-ID	<CO6PR20MB363416F112551FC08DDEEF8D834E2@CO6PR20MB3634.namprd20.prod.outlook.com>
Accept-Language	en-US
Content-Language	en-US
X-MS-Exchange-Organization-AuthAs	Anonymous
X-MS-Exchange-Organization-AuthSource	DS3PEPF0000C381.namprd04.prod.outlook.com
X-MS-Has-Attach	yes
X-MS-Exchange-Organization-Network-Message-Id	c61281dc-2aaa-4a00-6fb9-08dcf4493490
X-MS-Exchange-Organization-SCL	1
X-MS-TNEF-Correlator
X-MS-Exchange-Organization-RecordReviewCfmType	0
received-spf	Pass (protection.outlook.com: domain of stewardpartners.com designates 148.163.146.225 as permitted sender) receiver=protection.outlook.com; client-ip=148.163.146.225; helo=mx0a-008bcd01.pphosted.com; pr=C
x-ms-publictraffictype	Email
arc-seal	i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=u9D6I8w8HVAy8MloeXoeJ/ZP4NkedPD2UPwlyUcpvCTbx1brLcJ4DJLNTe3RjEk7GGIFcTbZO3OhWWye7Vks5J8E7bAEcina0grNZhzffCQOWYsSDGAGi9jmaBPsCvmYFVjgD7j+H47u93/nqu4vaA35U/1DgiPaDs1GNE/AqY6+JJ3J1JDq/g0BA9fWFF8djf3Mh4J/TsaLODC2LFXKDiPTnQyVk0mbiuVMtWld3YTBwUlSrrcEibn9Cz4i5Ambr7hjBnToGmEWFrdqLZNK0wDtlorlcJ7N87SF+hNBqryioXEwhjRzOJkDLm62YiNopV9LtLjSkrjMCiyQni4+aw==
arc-message-signature	i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=detNfJ6PLnJVw48RyzuxtpEj+h3Yoemh66XWJkVuYAg=; b=enDObs8J85KORAszN/ZaTaqnYPfPfwUPUF4/frAkD8TugefTusb2sTQHGFgXUGpG5wSD9RP0Tdj7eYPX+IxGI8rXdUsYOnWvfFqmStSqHABO4mBFgpi14v8GGMHlPyfi0oGeFAOdlg5EdR4PhjkjR438zh5t/NAQj9pL+dc92gYJjpTvujQmF75vPKRfD4g57ZHAeE9CMertRCY7WrvZJ9LVNgT851vNDS8K/lW6XWJwwxGApEoMaav1gB9nTOgvqBrqyEFcGtVIM9gIhLfryBB2SiiCORjaOSDaOZPij/0tYsHLuLK1ZeOXiT22ZoWNTjRCIw1rdqMO+pZJmxi4Jw==
arc-authentication-results	i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=stewardpartners.com; dmarc=pass action=none header.from=stewardpartners.com; dkim=pass header.d=stewardpartners.com; arc=none
dkim-signature	v=1; a=rsa-sha256; c=relaxed/relaxed; d=stewardpartners.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=detNfJ6PLnJVw48RyzuxtpEj+h3Yoemh66XWJkVuYAg=; b=V9v+Nfzimb16t7ujczzRN6mwe+3980IweW27bSDmSjBTKodVet7h9KlLDvG4GOvscxQTGX17hCvSfQugs/cJicp3GhI4r/o6/FRTH+Eu+vL2J4WGpnOLfp7zTbscBDKQ7PBmHVrWSwHhfRy7VocGQQPwhUi2JDeqOcK9rRqsCJEx3Oo3bT3CbgSjJhowTkhQb7DbqVaDBcJdz67bGlHzFMT+bR9OVcrqILIBhsYAblM/lnMwnnqoINvA/vbsGOHEUaGsG3ElckFe7Oir5Y2CxCQPFqH61Jeb7iA/+ijdrfFvckgTq5PEMz0EUAVU3lle9bfS/A4Jn/G7aGgZjUbbDw==
authentication-results	spf=pass (sender IP is 148.163.146.225) smtp.mailfrom=stewardpartners.com; dkim=pass (signature was verified) header.d=stewardpartners.com;dmarc=pass action=none header.from=stewardpartners.com;compauth=pass reason=100
x-ms-office365-filtering-correlation-id	c61281dc-2aaa-4a00-6fb9-08dcf4493490
x-ms-traffictypediagnostic	CO6PR20MB3634:EE_\|IA1PR20MB4930:EE_\|DS3PEPF0000C381:EE_\|SJ0PR01MB7249:EE_\|BL0PR01MB5108:EE_
x-forefront-antispam-report	CIP:148.163.146.225;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:mx0a-008bcd01.pphosted.com;PTR:mx0a-008bcd01.pphosted.com;CAT:NONE;SFS:(13230040)(4073199012)(35042699022)(5073199012)(30052699003)(8096899003)(4076899003);DIR:INB;
x-ms-exchange-senderadcheck	1
x-microsoft-antispam	BCL:0;ARA:13230040\|4073199012\|35042699022\|5073199012\|30052699003\|8096899003\|4076899003;
x-ms-exchange-crosstenant-network-message-id	c61281dc-2aaa-4a00-6fb9-08dcf4493490
x-ms-exchange-crosstenant-originalarrivaltime	24 Oct 2024 16:30:42.7376 (UTC)
x-ms-exchange-crosstenant-fromentityheader	Internet
x-ms-exchange-crosstenant-id	a445b146-2a78-4930-ad1f-792c9971b2fc
x-ms-exchange-transport-crosstenantheadersstamped	SJ0PR01MB7249
x-ms-exchange-transport-endtoendlatency	00:00:08.2443376
x-ms-exchange-processed-by-bccfoldering	15.20.8114.002
x-microsoft-antispam-untrusted	BCL:0;ARA:13230040\|1800799024\|376014\|366016\|38070700018;
x-microsoft-antispam-message-info-original	gLIQ2qqXNkQPtiXbkgOYgOdeXoK2Vl1lE90ymuMTkOw0+5yxZJ24RRgy9Fj1j7JIKRDN5VT95XD2SGsVqOWDc3mdVRsZpJ0QweCqmSAiWaBOu0u3rgrXQfiURnl2BDyp02LhN8KpJ/Nftb3japkz8b2LyGi1dltHaZwfk3XV6ssSFHtkCvCUaxHZ7PPjl7UewwvQqOkHc9KgYxX/M/llXdLhL+ZsHN4UlKipe1Om2MCvKFJq4P86Tykgx2rfyUIy4huOw6Hc2anLY8yUBZKwtJKTPJ9vTPLBc5rjADgSy1YuquzYpJOle+whxBDZwjwTvVjjRm3EjTU//M7+rU5u6ZtccpV2GnZC/jNp5eOl/4ufiacmGy5shHQa4u4BlNKSx1MPSnL8/srEk7dTiM8UX/izzkjarOoKZsXFIaTa3hjN+MjxmxgMvreLOcIz3WEga7bEFeEsN8ZhcnpfwkehAYtTQ8ZqAY44vYNK2ZqU3bxE9QVDy3GFBTrNnkzh0L4Aze5UewpL2K+bghZUbDBvHpwaPhGrIjnYvg0pHBVnSSNv8Aw+UKAmbbXW/e79gD/BntU6sluBFn2RSVYtHaL+3aidnQXQ46Tstez/DceK+49lbb4lZa7pIWdbYcJm+bqcs9jVfkwbViyqEDwic5BJFu/p6cRVv4Bouizy3leT/EYkRpol+rtqMoW+idVz8RvKj2WP7w98u9PeO6EF+7HXpZHqLNLaHqWnKr8LtTG/hDSRA62eUNaXTNNA8xpK//yovV+r7VYKBG8zKCbfJilYFS9o1adtBMmuZx0vZNGb4KUGA0/K8pPoN39kwWqMEqjrghKmLOxInp9F/emrY6UtLPwWxiRFmCIWuHg/C2aZlMWfo546X1cydAShjO0wjq6oVrhC9Ca5sIrOK18Sfo83dI+uT6Y6LinftlyqFx0B4roorZuwxc7wDaDWzKNxubSLH1pdOoZ/53Ay2BHE9z9G2vFFS8KfEP4mA4TNS4Ykmldle7rccng0xl+JUst419hMAjwuj4a4qH7wF0o/I6WC4E1Wzpyjz4rg0yvVtFfbWoWXO9O0/phj09pfxlfpipgfzJP4BPcnhSAuAPdmsBN63WJrBD0cVUynf+rnDS2KPvH85DZ4ldyr7zwN1oooDvfNs+gFm6kBeh3AsbETf1dEM109frEu4lwzG/Q6LMlvCoq2QyUxBOdpb/KD0CSZVdbX6e+u+fcm9xRbbYzzGdduET1EVKBZBg+oIxc5X/WC3pPKPz/MlRMjWfOppUgPxe2f
x-forefront-antispam-report-untrusted	CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:CO6PR20MB3634.namprd20.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(1800799024)(376014)(366016)(38070700018);DIR:OUT;SFP:1102;
x-eopattributedmessage	0
x-eoptenantattributedmessage	a445b146-2a78-4930-ad1f-792c9971b2fc:0
x-ms-exchange-transport-crosstenantheadersstripped	DS3PEPF0000C381.namprd04.prod.outlook.com
x-ms-office365-filtering-correlation-id-prvs	bc5bdd94-ecdc-49af-5418-08dcf4492ebd
x-ms-exchange-atpmessageproperties	SA
x-ms-exchange-crosstenant-authas	Anonymous
x-ms-exchange-crosstenant-authsource	DS3PEPF0000C381.namprd04.prod.outlook.com
x-ms-exchange-antispam-relay	0
x-proofpoint-orig-guid	JHoQPgqxNR1gu5YteRvA7JRHdFJlsdTc
x-proofpoint-guid	JHoQPgqxNR1gu5YteRvA7JRHdFJlsdTc
x-proofpoint-virus-version	vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1051,Hydra:6.0.680,FMLib:17.12.62.30 definitions=2024-10-24_15,2024-10-24_02,2024-09-30_01
X-Microsoft-Antispam-Mailbox-Delivery	ucf:0;jmr:0;auth:0;dest:I;ENG:(910001)(944506478)(944626604)(4955320)(920097)(930097)(140003);
X-Microsoft-Antispam-Message-Info	L2xTLjH8aiKe9BrCw6XrfFGjhN71pBDZ/9O4LbGOxwusRtp9KajaRgqdD39x78EpPviwyHHvS5WuZmozdOeJUTh0q4a4DrSbM8rfGxh8a99+cf4rxsUxzaGOjm2M4oPABK619AwK7m91UyhuMcJDoxyV7z3ZZex4ldvGyp3JU2tf4cZ4y7E9bH+EeymkivZvG/xYLBPm9XeEww97WWC/nJJS48WrswDIKpvZEnjJBI8YXGvIKWoLi8EXvVj6NDVlen4UjXiDUwIGV7Aqw3Ov+UOESwkm8TU9Ef0cGTOIeaktsatN+6uti3jX6VXSR2THUNCVg/Emz0ppNCEhG/QYPoggWE4dEs2NZvLmOAY8D9oWF2XoatinwTrEL85GtnEvjOn7vYupRynmgvHIEZY70AdBeLaUuFaIL8mDhxahbuTLUuMYqMZeNpOZFOcQ2Szi3XgQ4qgEKI7Lkc4RrCmBAh3Aua0Sqn7KQ0CZhGL7/AkYbp4zWnO8iStvthgx4ywZMEiSgtMhIb2k4hf7Itcr61fbnBH/llJl6Bs1elCqFLWJGrC+diYQj146PXkyFki4y5L/jqOp2243k2oge4bKtIdhsarygQBpJcAclaJXyMy/D3PX3O7po1SDYatJebtqQd1Nw7wMCl+G4cT3v3hGFfBAsddQhAMD9CRzc5IOxJ7E7oWtmu1hPp98wRqC1lH2/geGWIjwrMNDmoV5OG5KuPwoJEYIxgyB9SbC1xUfpeE+oSm/X2p10zHuyQBZ2F/tPGHxQgR/IntktoM7Ud2ZN6C1tV/UwS0MIIx+SYI6L8vCJ24hr5IlxXoSNQKD1ZWhCWHmu3qXnMuzkQ5Gi/2HlmiNjYoF+I0KBwSSTK3iibv2q0MeRLLb85JBaEBEJFMRodXAGnDxpdozpW1L/BQArGdSxjcZ0JSE7eVD4AJo4fan3en9p4vgxWbsLAUZL5ySWn7YJU73Y+K4uA5+4gIMuVaSakTSVM1FZGXGf0B5x/W3E3qhmggVON77tYFaVBHH8WkWwKuJm9+OodohPnK/IfZXo5aHghbi411xoz+oUz58Z90Y5twkKSuJy8v/4wLVh6DnKmhIEEil65sICQFktKVGyS/QlOfuIaEnoGMADyyc6n/CPznK/Pif9ltmGahnoNNudAtiMSwJlOApF728mqrrHef90SXfez8ZPWtrp2yhsUpjmrjriCH4eM4ht8eo/vmsSqYAy/pQHZBtjCVE3yVqTZmSEILhmgXY/WHOhxgyAiUsHZb9LMNZDtK9fazS90ufhD/1JLhpCZSSCrDuubixk174p6/43SZetI8nXsSNNcEqivB1FewObSYgo8HieCMyIEECerzEIt7CfZjgRkJwtq88p5UkdJ1gzFORrpFuMaeGTfgYnjDWXiqsaSKHtkU83u+2HrNAeECPTWOSkMgIlXlkUZm+7SgZZKZXKRqYQ5SUxQ6HjelPOAos0QYMTANFA4KKqA9Gl/VsLQNKc7vFrQ6TVdaK6gMQyCP+PJmYAIMtdeCjcVDv+rgSNhXU8ZlFy1Hpqk0TGYE2ckjxE1A2WOZ9oqYMfSzCbsewIgMmFot4xAoerf+Xq4sR6KqOvjkOfOThUE3+ybuNHufeELfnMyVjqNdHn2xDqlrq9W1FmFeNIAe5/Q4l2oMFQQz/ph27PVWfl8jkN22YDnaEsnfSYOyLSLJ/CckhuQuZ5nD4sECt/k9hFsYSIHH2i5IkB4vjZl4f59ARQVsDnsU1xW9O8hTAI3aPrxWCZEFQK/wgRDmEE2FbqFgkBChjG9cR4LWG+7CPriT9QkFuW918PKYbVvBpiCv/2EpMx9HPdzw8+vhZWjQfqh00BwVqs2n77Odz4H5CZTS7da14d1AMr0n4/DHnhQGvYKWpFep3Y/GD3TSq/lWklARGcN6Q74hf7CSQ9P2MMKXwDotKQEVKoeuFfFy9Lej9MCJtXwfjB45Tn1v97Ykfn09ILdD2YSI5Y3rYmgPywYx65gXRMKffDo4OWDRWhtrlQNwnk+XgexVV0JUJSsdpLNr3cqKVAfnj
Content-Type	multipart/mixed; boundary="_007_CO6PR20MB363416F112551FC08DDEEF8D834E2CO6PR20MB3634namp_"
MIME-Version	1.0

File Icon


Icon Hash:	46070c0a8e0c67d6

Description:	Adversaries may abuse Internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality and customize aspects of Internet browsers. They can be installed directly or through a browser's app store and generally have access and permissions to everything that the browser can access.
Tactics:	Persistence
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Process: Process Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report [EXT] [ #ENCRYPT ] WSRB 401k, Trustee to Trustee Transfer form.eml

Overview

General Information

Detection

Signatures

Classification

Process Tree

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Software Vulnerabilities

Networking

System Summary

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

LLM Input / Output

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\FORMS\FRMCACHE.DAT

C:\Users\user\AppData\Local\Microsoft\FontCache\4\CatalogCacheMetaData.xml

C:\Users\user\AppData\Local\Microsoft\FontCache\4\CloudFonts\Lato\25090817022.ttf

C:\Users\user\AppData\Local\Microsoft\FontCache\4\CloudFonts\Lato\28221965252.ttf

C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\09D3CCF6-3DE3-4EC4-B85F-CAA71956B115

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\3A460E51.dat

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\D2D48390.dat

C:\Users\user\AppData\Local\Temp\olkE26C.tmp

C:\Users\user\AppData\Roaming\Microsoft\Office\MSO3072.acl

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Chrome Cache Entry: 102

Chrome Cache Entry: 104

Chrome Cache Entry: 106

Chrome Cache Entry: 107

Chrome Cache Entry: 108

Chrome Cache Entry: 109

Chrome Cache Entry: 110

Chrome Cache Entry: 113

Chrome Cache Entry: 117

Chrome Cache Entry: 119

Chrome Cache Entry: 122

Chrome Cache Entry: 124

Chrome Cache Entry: 93

Chrome Cache Entry: 95

Chrome Cache Entry: 98

Chrome Cache Entry: 99

Static File Info

Windows Analysis Report
[EXT] [ #ENCRYPT ] WSRB 401k, Trustee to Trustee Transfer form.eml