Edit tour

Windows Analysis Report
FW+Review_&_sign_Docu+#31617+Contract_Agreement+Docusign+Licensing+Board+Of+Directors.pdf.eml

Overview

General Information

Sample name:	FW+Review_&_sign_Docu+#31617+Contract_Agreement+Docusign+Licensing+Board+Of+Directors.pdf.eml
Analysis ID:	1549755
MD5:	2ffde7e2118b65b66b0e5f6831f40f7c
SHA1:	9ba692f1ad4195f495a26d135e945c804d804161
SHA256:	e22341f81e3a60479a4845b2d5861b5e0489061c327a80e0b518c25eae08d4f9
Infos:

Detection

Score:	48
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

AI detected potential phishing Email

Suspicious MSG / EML detected (based on various text indicators)

Creates a window with clipboard capturing capabilities

Queries the volume information (name, serial number etc) of a device

Sigma detected: Office Autorun Keys Modification

Stores files to the Windows start menu directory

Classification

Process Tree

System is w10x64_ra

OUTLOOK.EXE (PID: 6444 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\user\Desktop\FW+Review_&_sign_Docu+#31617+Contract_Agreement+Docusign+Licensing+Board+Of+Directors.pdf.eml" MD5: 91A5292942864110ED734005B7E005C0)

ai.exe (PID: 6612 cmdline: "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "62404FB1-A7EC-47E8-9A3E-27638A36B779" "3508D706-33CB-4BC9-B528-995603735495" "6444" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx" MD5: EC652BEDD90E089D9406AFED89A8A8BD)

chrome.exe (PID: 5564 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://us-east-2.protection.sophos.com/?d=docusign.net&u=aHR0cHM6Ly9uYTIuZG9jdXNpZ24ubmV0L1NpZ25pbmcvRW1haWxTdGFydC5hc3B4P2E9MDY5NzQ0M2QtYzdhZi00NTZjLTg5OWItNjAzNTE0MGE2YmNmJmV0dGk9MjQmYWNjdD1lOTgzNzk5Ny03MTA2LTQxMDQtODA5OS1jZTlkNjJkMmEzNWImZXI9YmE0YzJlYjItODA0Mi00YzE2LWI3MmItNDliMzUwNTM1YWFi&p=m&i=NjAwMDRkYmNjNzQ1NDY0ODkyYTNlZmQw&t=UWg3cytBZTBvSnBHaXkvMDFhSjIzaE1iNEx4NmNneHBwSjkrRVZNOXg3dz0=&h=e31e2a87bb4847f999cfc79b960b4445&s=AVNPUEhUT0NFTkNSWVBUSVaRXvLxh7UTuVLmlaqXvLZH__URHKprSyEr4bUyaFsVWg MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 3684 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 --field-trial-handle=1848,i,11495232999529898620,9285025850973625208,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6960 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://us-east-2.protection.sophos.com/?d=docusign.net&u=aHR0cHM6Ly9uYTIuZG9jdXNpZ24ubmV0L1NpZ25pbmcvRW1haWxTdGFydC5hc3B4P2E9MDY5NzQ0M2QtYzdhZi00NTZjLTg5OWItNjAzNTE0MGE2YmNmJmV0dGk9MjQmYWNjdD1lOTgzNzk5Ny03MTA2LTQxMDQtODA5OS1jZTlkNjJkMmEzNWImZXI9YmE0YzJlYjItODA0Mi00YzE2LWI3MmItNDliMzUwNTM1YWFi&p=m&i=NjAwMDRkYmNjNzQ1NDY0ODkyYTNlZmQw&t=UWg3cytBZTBvSnBHaXkvMDFhSjIzaE1iNEx4NmNneHBwSjkrRVZNOXg3dz0=&h=e31e2a87bb4847f999cfc79b960b4445&s=AVNPUEhUT0NFTkNSWVBUSVaRXvLxh7UTuVLmlaqXvLZH__URHKprSyEr4bUyaFsVWg MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 3252 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2108 --field-trial-handle=1900,i,4394306939958957270,12270451096704553597,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Sigma Signatures

Sigma detected: Office Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: 1, EventID: 13, EventType: SetValue, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE, ProcessId: 6444, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Addins\SearchToolbarsDisabled

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Phishing

Suspicious MSG / EML detected (based on various text indicators)

Source: MSG / EML

OCR Text: Docusign Licensing Board Of Directors sent you a document to review and sign. REVIEW DOCUMENT Docusign - Licensing Board Of Directors renee@placementsource.com Docusign Licensing Board Of Directors Do Not Share This Email This email contains a secure link to Docusign. Please do not share this email, link, or access code with others. Alternate Signing Method Visit Docusign.com, click 'Access Documents', and enter the security code: 0697443DC7AF456C899B6035140A6BCF2 About Docusign Sign documents electronically in just minutes. It's safe, secure, and legally binding. Whether you're in an office, at home, on-the-go -- or even across the globe -- Docusign provides a professional trusted solution for Digital Transaction Management TM Questions about the Document? If you need to modify the document or have questions about the details in the document, please reach out to the sender by emailing them directly. Stop receiving this email Report this email or read more about Declining to sign and Managing notifications. If you have trouble signing, visit "How to Sign a Document" on our Docusign Support Center, or browse our Docusign Community for more information. u Download the Docusign App This message was sent to you by Docusign - Licensing Board Of Directors who is using the Docusign Electronic Signature Service. If you would rather not receive email from this sender you may contact the sender with your request.

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

File opened: C:\Program Files (x86)\Microsoft Office\root\vfs\SystemX86\MSVCR100.dll

Source: unknown

HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.16:49745 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.75
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.75
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.75
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.75
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.75
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.75
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.75
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.221.95
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.75
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.221.95
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.75
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.75
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.75

Source: global traffic	DNS traffic detected: DNS query: us-east-2.protection.sophos.com
Source: global traffic	DNS traffic detected: DNS query: na2.docusign.net
Source: global traffic	DNS traffic detected: DNS query: docucdn-a.akamaihd.net
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: api.mixpanel.com

Source: unknown	Network traffic detected: HTTP traffic on port 49698 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49698
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701

Source: unknown

HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.16:49745 version: TLS 1.2

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Window created: window name: CLIPBRDWNDCLASS

Source: classification engine

Classification label: mal48.phis.winEML@26/41@16/162

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

File created: C:\Program Files (x86)\Microsoft Office\root\vfs\Common AppData\Microsoft\Office\Heartbeat\HeartbeatCache.xml

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

File created: C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

File created: C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20241105T1849180168-6444.etl

Source: unknown	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\user\Desktop\FW+Review_&_sign_Docu+#31617+Contract_Agreement+Docusign+Licensing+Board+Of+Directors.pdf.eml"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "62404FB1-A7EC-47E8-9A3E-27638A36B779" "3508D706-33CB-4BC9-B528-995603735495" "6444" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "62404FB1-A7EC-47E8-9A3E-27638A36B779" "3508D706-33CB-4BC9-B528-995603735495" "6444" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://us-east-2.protection.sophos.com/?d=docusign.net&u=aHR0cHM6Ly9uYTIuZG9jdXNpZ24ubmV0L1NpZ25pbmcvRW1haWxTdGFydC5hc3B4P2E9MDY5NzQ0M2QtYzdhZi00NTZjLTg5OWItNjAzNTE0MGE2YmNmJmV0dGk9MjQmYWNjdD1lOTgzNzk5Ny03MTA2LTQxMDQtODA5OS1jZTlkNjJkMmEzNWImZXI9YmE0YzJlYjItODA0Mi00YzE2LWI3MmItNDliMzUwNTM1YWFi&p=m&i=NjAwMDRkYmNjNzQ1NDY0ODkyYTNlZmQw&t=UWg3cytBZTBvSnBHaXkvMDFhSjIzaE1iNEx4NmNneHBwSjkrRVZNOXg3dz0=&h=e31e2a87bb4847f999cfc79b960b4445&s=AVNPUEhUT0NFTkNSWVBUSVaRXvLxh7UTuVLmlaqXvLZH__URHKprSyEr4bUyaFsVWg
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 --field-trial-handle=1848,i,11495232999529898620,9285025850973625208,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://us-east-2.protection.sophos.com/?d=docusign.net&u=aHR0cHM6Ly9uYTIuZG9jdXNpZ24ubmV0L1NpZ25pbmcvRW1haWxTdGFydC5hc3B4P2E9MDY5NzQ0M2QtYzdhZi00NTZjLTg5OWItNjAzNTE0MGE2YmNmJmV0dGk9MjQmYWNjdD1lOTgzNzk5Ny03MTA2LTQxMDQtODA5OS1jZTlkNjJkMmEzNWImZXI9YmE0YzJlYjItODA0Mi00YzE2LWI3MmItNDliMzUwNTM1YWFi&p=m&i=NjAwMDRkYmNjNzQ1NDY0ODkyYTNlZmQw&t=UWg3cytBZTBvSnBHaXkvMDFhSjIzaE1iNEx4NmNneHBwSjkrRVZNOXg3dz0=&h=e31e2a87bb4847f999cfc79b960b4445&s=AVNPUEhUT0NFTkNSWVBUSVaRXvLxh7UTuVLmlaqXvLZH__URHKprSyEr4bUyaFsVWg
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 --field-trial-handle=1848,i,11495232999529898620,9285025850973625208,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://us-east-2.protection.sophos.com/?d=docusign.net&u=aHR0cHM6Ly9uYTIuZG9jdXNpZ24ubmV0L1NpZ25pbmcvRW1haWxTdGFydC5hc3B4P2E9MDY5NzQ0M2QtYzdhZi00NTZjLTg5OWItNjAzNTE0MGE2YmNmJmV0dGk9MjQmYWNjdD1lOTgzNzk5Ny03MTA2LTQxMDQtODA5OS1jZTlkNjJkMmEzNWImZXI9YmE0YzJlYjItODA0Mi00YzE2LWI3MmItNDliMzUwNTM1YWFi&p=m&i=NjAwMDRkYmNjNzQ1NDY0ODkyYTNlZmQw&t=UWg3cytBZTBvSnBHaXkvMDFhSjIzaE1iNEx4NmNneHBwSjkrRVZNOXg3dz0=&h=e31e2a87bb4847f999cfc79b960b4445&s=AVNPUEhUT0NFTkNSWVBUSVaRXvLxh7UTuVLmlaqXvLZH__URHKprSyEr4bUyaFsVWg
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2108 --field-trial-handle=1900,i,4394306939958957270,12270451096704553597,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://us-east-2.protection.sophos.com/?d=docusign.net&u=aHR0cHM6Ly9uYTIuZG9jdXNpZ24ubmV0L1NpZ25pbmcvRW1haWxTdGFydC5hc3B4P2E9MDY5NzQ0M2QtYzdhZi00NTZjLTg5OWItNjAzNTE0MGE2YmNmJmV0dGk9MjQmYWNjdD1lOTgzNzk5Ny03MTA2LTQxMDQtODA5OS1jZTlkNjJkMmEzNWImZXI9YmE0YzJlYjItODA0Mi00YzE2LWI3MmItNDliMzUwNTM1YWFi&p=m&i=NjAwMDRkYmNjNzQ1NDY0ODkyYTNlZmQw&t=UWg3cytBZTBvSnBHaXkvMDFhSjIzaE1iNEx4NmNneHBwSjkrRVZNOXg3dz0=&h=e31e2a87bb4847f999cfc79b960b4445&s=AVNPUEhUT0NFTkNSWVBUSVaRXvLxh7UTuVLmlaqXvLZH__URHKprSyEr4bUyaFsVWg
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2108 --field-trial-handle=1900,i,4394306939958957270,12270451096704553597,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: apphelp.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: c2r64.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: userenv.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: msasn1.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: cryptsp.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: rsaenh.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: gpapi.dll

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{529A9E6B-6587-4F23-AB9E-9C7D683E3C50}\InProcServer32

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Window found: window name: SysTabControl32

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Common

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

File opened: C:\Program Files (x86)\Microsoft Office\root\vfs\SystemX86\MSVCR100.dll

Persistence and Installation Behavior

AI detected potential phishing Email

Source: Email

LLM: Detected potential phishing email: The email contains suspicious formatting in the subject line with underscores and unusual capitalization typical of phishing attempts

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

File Volume queried: C:\Windows\SysWOW64 FullSizeInformation

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Process information queried: ProcessInformation

Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe

Queries volume information: C:\Program Files (x86)\Microsoft Office\root\Office16\AI\WordCombinedFloatieLreOnline.onnx VolumeInformation

Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Browser Extensions	1 Process Injection	2 Masquerading	OS Credential Dumping	1 Process Discovery	Remote Services	1 Clipboard Data	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	1 DLL Side-Loading	1 Process Injection	LSASS Memory	13 System Information Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 Registry Run Keys / Startup Folder	1 Registry Run Keys / Startup Folder	1 DLL Side-Loading	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact

Name	IP	Active	Malicious	Reputation
d1nhsro6ypf0az.cloudfront.net	143.204.215.60	true	false	unknown
www.google.com	142.250.185.132	true	false	high
api.mixpanel.com	107.178.240.159	true	false	high
us-east-2.protection.sophos.com	unknown	unknown	false	unknown
docucdn-a.akamaihd.net	unknown	unknown	false	high
na2.docusign.net	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://na2.docusign.net/Signing/Error.aspx?scope=ba0fee9b-986c-4cca-a56d-7397c0074a9a	false		unknown
https://na2.docusign.net/Signing/Error.aspx?scope=e922a41b-2737-432a-ab59-916c6835f1e4	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
52.113.194.132	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
162.248.185.181	unknown	United States	62856	DOCUS-6-PRODUS	false
35.186.241.51	unknown	United States	15169	GOOGLEUS	false
1.1.1.1	unknown	Australia	13335	CLOUDFLARENETUS	false
162.248.185.183	unknown	United States	62856	DOCUS-6-PRODUS	false
172.217.18.3	unknown	United States	15169	GOOGLEUS	false
142.250.185.132	www.google.com	United States	15169	GOOGLEUS	false
2.19.126.221	unknown	European Union	16625	AKAMAI-ASUS	false
20.189.173.27	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.251.168.84	unknown	United States	15169	GOOGLEUS	false
107.178.240.159	api.mixpanel.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.250.186.131	unknown	United States	15169	GOOGLEUS	false
184.28.90.27	unknown	United States	16625	AKAMAI-ASUS	false
143.204.215.60	d1nhsro6ypf0az.cloudfront.net	United States	16509	AMAZON-02US	false
172.217.18.110	unknown	United States	15169	GOOGLEUS	false
95.101.54.217	unknown	European Union	34164	AKAMAI-LONGB	false
95.101.54.105	unknown	European Union	34164	AKAMAI-LONGB	false
172.217.16.142	unknown	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.16

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1549755
Start date and time:	2024-11-06 00:48:46 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	17
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled
Analysis Mode:	stream
Analysis stop reason:	Timeout
Sample name:	FW+Review_&_sign_Docu+#31617+Contract_Agreement+Docusign+Licensing+Board+Of+Directors.pdf.eml
Detection:	MAL
Classification:	mal48.phis.winEML@26/41@16/162
Cookbook Comments:	Found application associated with file extension: .eml

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 52.113.194.132
Excluded domains from analysis (whitelisted): fs.microsoft.com, slscr.update.microsoft.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadFile calls found.
Report size getting too big, too many NtSetInformationFile calls found.
VT rate limit hit for: FW+Review_&_sign_Docu+#31617+Contract_Agreement+Docusign+Licensing+Board+Of+Directors.pdf.eml

LLM Input / Output

Input	Output
URL: Model: claude-3-5-sonnet-latest	{ "explanation": [ "The email contains suspicious formatting in the subject line with underscores and unusual capitalization typical of phishing attempts", "The sender claims to be DocuSign but uses an unusual email format 'dse_na2@docusign.net' and includes a suspicious security code format", "The email contains multiple redirected links through protection.sophos.com, which is unusual for legitimate DocuSign communications" ], "phishing": true, "confidence": 9 }
{ "date": "Tue, 05 Nov 2024 22:26:49 +0000", "subject": "FW: Review_&_sign_Docu: #31617 Contract_Agreement: Docusign Licensing Board Of Directors.pdf", "communications": [ "Ce message a t envoy de l'extrieur de l'organisation - This message was sent from outside your organization.\n\nI believe that the email that David received and forwarded to me is Spam. Please confirm.\n\nHeather Gordon, (she/her) CA, CPA., MAcc.\nManaging Principal, Finance & Administration\n\n286 Sanford Ave. N. 905.526.6700 x245\nWestinghouse HQ, 2nd Floor 416.723.9886\nHamilton, ON L8L 6A1 heatherg@mccallumsather.com\nmcCallumSather.com<https://eu-west-1.protection.sophos.com?d=mccallumsather.com&u=aHR0cDovL3d3dy5tY2NhbGx1bXNhdGhlci5jb20v&p=m&i=NjEwYjE2Y2U0Zjc0MWMwZTk2MmNlZjk5&t=NmsxendTVkNDU1MrQkVRR0JSUC9hMUI3WUJpbXlFVEkwMGIrZTRvVTN4Yz0=&h=f21097c3ff21461ca24d2bc9ab68e812&s=AVNPUEhUT0NFTkNSWVBUSVZepRahezh_GIycWZDQIVhBnwg07hL9dOfaurSPlgiveA>\n[cid:image002.png@01DB2FA7.E492A020]\n\n", "From: David Riley <davidr@mccallumsather.com>\nSent: November 5, 2024 12:49 PM\nTo: Heather Gordon <heatherg@mccallumsather.com>\nSubject: FW: Review_&_sign_Docu: #31617 Contract_Agreement: Docusign Licensing Board Of Directors.pdf\n\nFYI below is what was sent my way.\n\nCheers,\n\n\n\n\nDavid Riley, P. Eng., PMP, LEED AP BD+C\nSenior Associate, Mechanical Engineer\n\n286 Sanford Ave. N. 905.526.6700 x263\nWestinghouse HQ, 2nd Floor 905.516.0666\nHamilton, ON L8L 6A1 davidr@mccallumsather.com\n\nmcCallumSather.com<https://eu-west-1.protection.sophos.com?d=mcallumsather.com&u=aHR0cDovL3d3dy5tY2FsbHVtc2F0aGVyLmNvbS8=&p=m&i=NjEwYjE2Y2U0Zjc0MWMwZTk2MmNlZjk5&t=TFpsckJFVi94Q2F2VWNiQXhjV0dXM0hBa2lBMkdhbjA1d3Nsby9Sa1h3Yz0=&h=f21097c3ff21461ca24d2bc9ab68e812&s=AVNPUEhUT0NFTkNSWVBUSVZepRahezh_GIycWZDQIVhBnwg07hL9dOfaurSPlgiveA>\n\n[cid:image001.png@01DB2F81.0C1040C0]\n\n", "From: DocuSign System <dse_na2@docusign.net<mailto:dse_na2@docusign.net>>\nSent: October 31, 2024 1:12 PM\nTo: David Riley <davidr@mccallumsather.com<mailto:davidr@mccallumsather.com>>\nSubject: Review_&_sign_Docu: #31617 Contract_Agreement: Docusign Licensing Board Of Directors.pdf\n\n\n[Image removed by sender. DocuSign]\n[Image removed by sender.]\nDocusign - Licensing Board Of Directors sent you a document to review and sign.\n\n REVIEW DOCUMENT <https://us-east-2.protection.sophos.com?d=docusign.net&u=aHR0cHM6Ly9uYTIuZG9jdXNpZ24ubmV0L1NpZ25pbmcvRW1haWxTdGFydC5hc3B4P2E9MDY5NzQ0M2QtYzdhZi00NTZjLTg5OWItNjAzNTE0MGE2YmNmJmV0dGk9MjQmYWNjdD1lOTgzNzk5Ny03MTA2LTQxMDQtODA5OS1jZTlkNjJkMmEzNWImZXI9YmE0YzJlYjItODA0Mi00YzE2LWI3MmItNDliMzUwNTM1YWFi&p=m&i=NjAwMDRkYmNjNzQ1NDY0ODkyYTNlZmQw&t=UWg3cytBZTBvSnBHaXkvMDFhSjIzaE1iNEx4NmNneHBwSjkrRVZNOXg3dz0=&h=e31e2a87bb4847f999cfc79b960b4445&s=AVNPUEhUT0NFTkNSWVBUSVaRXvLxh7UTuVLmlaqXvLZH__URHKprSyEr4bUyaFsVWg>\n[Image removed by sender. Picture of Docusign - Licensing Board Of Directors]\nDocusign - Licensing Board Of Directors\nrenee@placementsource.com<mailto:renee@placementsource.com>\nDocusign Licensing Board Of Directors\n\nDo Not Share This Email\nThis email contains a secure link to Docusign. Please do not share this email, link, or access code with others.\n\nAlternate Signing Method\nVisit Docusign.com, click 'Access Documents', and enter the security code:\n0697443DC7AF456C899B6035140A6BCF2\n\nAbout Docusign\nSign documents electronically in just minutes. It's safe, secure, and legally binding. Whether you're in an office, at home, on-the-go -- or even across the globe -- Docusign provides a professional trusted solution for Digital Transaction Management.\n\nQuestions about the Document?\nIf you need to modify the document or have questions about the details in the document, please reach out to the sender by emailing them directly.\n\nStop receiving this email\nReport this email<https://us-east-2.protection.sophos.com?d=docusign.net&u=aHR0cHM6Ly9wcm90ZWN0LmRvY3VzaWduLm5ldC9yZXBvcnQtYWJ1c2U_ZT1BVXRvbWpwRmFrOUdsYlBMMHpGRmkxM1hvZTVVMEx4ODRFdmpsMnJaM0hJejlPMkpOWlZRc1AzYUlKWV85YkhGMmVacG9BUmdKUGJkV2RCeEFUb0JQWldRQVJaLUp3SDRwZW5uNzdsbk85OGR0OHB2YUZVRldjSi04WnpZVVZpaXRUaXRRdVFVc3A2akd4LUZKM2trX0ZqU3NMZ2pQMmhyckZ0YUpTSEhqNmY3SE44eVRINVQyOXRNNkNUdDlvSENsR0JIdUpJaFhocl9hSkcxVDR1N3RyLVF2bk5GV2IzUDBEZ1ZFTWVFeDJJa0NiNFdtbEd6NTh1XzBldFFaY0ZYeGt1VlBJMS02VHJicFZuOVREUF9zYUlURGIyQkZZSlpvSUs3V2dwLW56MVExdDlMVU96dU9kejQxLW9YSGNXdDdwSEw0Z0hDaTEyV01Ld1JncWtINjNIcmljcmdqT3BVZXFvYWdDY0JXS2R5UkJ0MXZ2R3NwXzZMcm9HeWZQOTctb25ZLVZiQTVHRHhicE5SVGdwSTRFSlM0TTFJa3JHWk5yTHEzalVQejlydlJCNUs3eEsycWQ3Y0NHRGR2RW13RkEmbGFuZz1lbg==&p=m&i=NjAwMDRkYmNjNzQ1NDY0ODkyYTNlZmQw&t=QldqMGgrWmpTSk4zUElPbTNFUWJZSHBtL0gySy9FNGYwaTRSaWFpUDg0OD0=&h=e31e2a87bb4847f999cfc79b960b4445&s=AVNPUEhUT0NFTkNSWVBUSVaRXvLxh7UTuVLmlaqXvLZH__URHKprSyEr4bUyaFsVWg> or read more about Declining to sign<https://us-east-2.protection.sophos.com?d=docusign.com&u=aHR0cHM6Ly9zdXBwb3J0LmRvY3VzaWduLmNvbS9lbi9ndWlkZXMvRGVjbGluaW5nLXRvLXNpZ24tRG9jdVNpZ24tU2lnbmVyLUd1aWRl&p=m&i=NjAwMDRkYmNjNzQ1NDY0ODkyYTNlZmQw&t=VEtMeDlKNEM1bUdmTUdZeE9kT3FFWERsQklWbWJSSU8xR1RHN2lFdTB0ND0=&h=e31e2a87bb4847f999cfc79b960b4445&s=AVNPUEhUT0NFTkNSWVBUSVaRXvLxh7UTuVLmlaqXvLZH__URHKprSyEr4bUyaFsVWg> and Managing notifications<https://us-east-2.protection.sophos.com?d=docusign.com&u=aHR0cHM6Ly9zdXBwb3J0LmRvY3VzaWduLmNvbS9lbi9hcnRpY2xlcy9Ib3ctZG8tSS1tYW5hZ2UtbXktZW1haWwtbm90aWZpY2F0aW9ucw==&p=m&i=NjAwMDRkYmNjNzQ1NDY0ODkyYTNlZmQw&t=RDBwdi9hVGJ0K1N4S1pvVlR3R3RHUTd6cEtwVXR0NmhWQlRnUFNvTDlxWT0=&h=e31e2a87bb4847f999cfc79b960b4445&s=AVNPUEhUT0NFTkNSWVBUSVaRXvLxh7UTuVLmlaqXvLZH__URHKprSyEr4bUyaFsVWg>.\n\nIf you have trouble signing, visit \"How to Sign a Document<https://us-east-2.protection.sophos.com?d=docusign.com&u=aHR0cHM6Ly9zdXBwb3J0LmRvY3VzaWduLmNvbS9zL2FydGljbGVzL0hvdy1kby1JLXNpZ24tYS1Eb2N1U2lnbi1kb2N1bWVudC1CYXNpYy1TaWduaW5nP2xhbmd1YWdlPWVuX1VTJnV0bV9jYW1wYWlnbj1HQkxfWFhfREJVX1VQU18yMjExX1NpZ25Ob3RpZmljYXRpb25FbWFpbEZvb3RlciZ1dG1fbWVkaXVtPXByb2R1Y3QmdXRtX3NvdXJjZT1wb3N0c2VuZA==&p=m&i=NjAwMDRkYmNjNzQ1NDY0ODkyYTNlZmQw&t=Zm4rUWtjVlVQbjBHbUVWVHJsNnI0WmgrdFRWd3YxMnd4Nlk1SlVQU1NjND0=&h=e31e2a87bb4847f999cfc79b960b4445&s=AVNPUEhUT0NFTkNSWVBUSVaRXvLxh7UTuVLmlaqXvLZH__URHKprSyEr4bUyaFsVWg>\" on our Docusign Support Center<https://us-east-2.protection.sophos.com?d=docusign.com&u=aHR0cHM6Ly9zdXBwb3J0LmRvY3VzaWduLmNvbS8=&p=m&i=NjAwMDRkYmNjNzQ1NDY0ODkyYTNlZmQw&t=K0dHSXgwbitTRm0vWkVhWExkU1h2bXpydTBNNnVaRXhiNVhPdnFTZWdMZz0=&h=e31e2a87bb4847f999cfc79b960b4445&s=AVNPUEhUT0NFTkNSWVBUSVaRXvLxh7UTuVLmlaqXvLZH__URHKprSyEr4bUyaFsVWg>, or browse our Docusign Community<https://us-east-2.protection.sophos.com?d=docusign.com&u=aHR0cHM6Ly9jb21tdW5pdHkuZG9jdXNpZ24uY29tL2VzaWduYXR1cmUtMTExP3V0bV9jYW1wYWlnbj1HQkxfVVNfUFJEX0FXQV8yNDA1X0NvbW11bml0eUNUQSZ1dG1fbWVkaXVtPWVtYWlsJnV0bV9zb3VyY2U9cG9zdHNlbmQ=&p=m&i=NjAwMDRkYmNjNzQ1NDY0ODkyYTNlZmQw&t=bVd0RCswbE1XaWRlMjhYYmVSR1JyWm4zS3ArWFVTOGlyOUZheU4xNUJvYz0=&h=e31e2a87bb4847f999cfc79b960b4445&s=AVNPUEhUT0NFTkNSWVBUSVaRXvLxh7UTuVLmlaqXvLZH__URHKprSyEr4bUyaFsVWg> for more information.\n\n[Image removed by sender.]Download the Docusign App <https://us-east-2.protection.sophos.com?d=docusign.com&u=aHR0cHM6Ly93d3cuZG9jdXNpZ24uY29tL2ZlYXR1cmVzLWFuZC1iZW5lZml0cy9tb2JpbGU_dXRtX2NhbXBhaWduPUdCTF9YWF9EQlVfVVBTXzIyMTFfU2lnbk5vdGlmaWNhdGlvbkVtYWlsRm9vdGVyJnV0bV9tZWRpdW09cHJvZHVjdCZ1dG1fc291cmNlPXBvc3RzZW5k&p=m&i=NjAwMDRkYmNjNzQ1NDY0ODkyYTNlZmQw&t=SVRMR1ErZmFkTmN6NUhZc2NYK1JyN0xwR2ZRZDBqcmlTOTgrMysrMXRYcz0=&h=e31e2a87bb4847f999cfc79b960b4445&s=AVNPUEhUT0NFTkNSWVBUSVaRXvLxh7UTuVLmlaqXvLZH__URHKprSyEr4bUyaFsVWg>\n\nThis message was sent to you by Docusign - Licensing Board Of Directors who is using the Docusign Electronic Signature Service. If you would rather not receive email from this sender you may contact the sender with your request.\n\n" ], "from": "Heather Gordon <heatherg@mccallumsather.com>", "to": "Quadbridge Support <support@quadbridge.com>", "attachements": [ "~WRD0000.jpg", "image001.png", "image002.png" ] }
URL: Email Model: claude-3-haiku-20240307	```json { "contains_trigger_text": true, "trigger_text": "Review_& _sign_Doc#:31617 Contract_Agreement: Docusign Licensing Board Of Directors.pdf", "prominent_button_name": "unknown", "text_input_field_labels": [ "To: Heather Gordon <heather@mccallumsather.com>", "Subject: FW: Review_& _sign_Doc#:31617 Contract_Agreement: Docusign Licensing Board Of Directors.pdf" ], "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false }

URL: Email Model: claude-3-haiku-20240307	```json { "brands": [ "McCallumSather" ] }
	```json { "brands": [ "McCallumSather" ] }
URL: https://na2.docusign.net/Signing/Error.aspx?scope=ba0fee9b-986c-4cca-a56d-7397c0074a9a Model: claude-3-haiku-20240307	```json { "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false }

URL: Model: claude-3-5-sonnet-latest	{ "typosquatting": false, "unusual_query_string": false, "suspicious_tld": false, "ip_in_url": false, "long_subdomain": false, "malicious_keywords": false, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": true, "brand_spoofing_attempt": false, "third_party_hosting": false }
URL: URL: https://na2.docusign.net
URL: https://na2.docusign.net/Signing/Error.aspx?scope=ba0fee9b-986c-4cca-a56d-7397c0074a9a Model: claude-3-haiku-20240307	```json { "brands": [ "Docusign" ] }
	```json { "brands": [ "Docusign" ] }

Created / dropped Files

C:\Program Files (x86)\Microsoft Office\root\vfs\Common AppData\Microsoft\OFFICE\Heartbeat\HeartbeatCache.xml

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	118
Entropy (8bit):	3.5700810731231707
Encrypted:	false
SSDEEP:
MD5:	573220372DA4ED487441611079B623CD
SHA1:	8F9D967AC6EF34640F1F0845214FBC6994C0CB80
SHA-256:	BE84B842025E4241BFE0C9F7B8F86A322E4396D893EF87EA1E29C74F47B6A22D
SHA-512:	F19FA3583668C3AF92A9CEF7010BD6ECEC7285F9C8665F2E9528DBA606F105D9AF9B1DB0CF6E7F77EF2E395943DC0D5CB37149E773319078688979E4024F9DD7
Malicious:	false
Reputation:	unknown
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.H.e.a.r.t.b.e.a.t.C.a.c.h.e./.>.

C:\Users\user\AppData\Local\Microsoft\FORMS\FRMCACHE.DAT

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	245980
Entropy (8bit):	4.205335220850129
Encrypted:	false
SSDEEP:
MD5:	C9BE63CA5A87FF70E4408179AEB47C96
SHA1:	3D475B169E646F03D8DEEF3ED2913B5EF36A3696
SHA-256:	3C1B7E9D35C18F53F1DD7A35DC42EEE9B1CCB5CB8BADE37E9C43E5EDB8DE79E8
SHA-512:	E98A411CF11072361D74D7638FA4E78E99B8EC42D3207AB50E331A0C2EC93BA945E34D35E44D6D13BD9BF562EF6114C73861BA89E8F22EB0E5112236526CB478
Malicious:	false
Reputation:	unknown
Preview:	TH02...... ..a:c./......SM01...........I./..........IPM.TaskRequest.Decline........h...............h............H..h\........M.....h........h.e.H..h\cal ...pDat...h..;.0..........hBU)...;........h........_`Pk...h.T).H...I.lw...h....P...8.Uk...0....\...............l.........2h...............k..d...........!h.............. h..s..........#h....8.........$hh.e.....@....."h.8e......7e...'h..............1hBU)...........0h.........Uk../h..........UkH..hHW;. ...\.....-h ...0.........+h.V).4...P.........#h(9<..... ..............FS..............FIPM.TaskRequest.Decline.Form.d.dStandard.PM.Task Decline.PM.IPM.Microsoft.FolderDesign.FormsDescription................F.k..........1111110000000000.icrMicrosoft.isThis form is used to decline a task request.........kf...... ..........&...........(.......(... ...@...............................................................................................................................D@..............D@x.............DG...p..........DH..www.wwp.....

C:\Users\user\AppData\Local\Microsoft\FontCache\4\CatalogCacheMetaData.xml

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	XML 1.0 document, ASCII text, with very long lines (2159), with no line terminators
Category:	modified
Size (bytes):	2159
Entropy (8bit):	5.106095130494358
Encrypted:	false
SSDEEP:
MD5:	C0B2D7784EC7A7E46057599506E94505
SHA1:	51009174685CB3D03B6AB160F98E75FF7D34A0C5
SHA-256:	4E8FF54A8481BF5B36FE7DB0ACE03FC9A58265FBA6A41FEACECA30AF2906A97C
SHA-512:	416786C099191190787BC1BCD5A22415E49F2C33192B1038C4E96D72D32E5FDE074B1FED2C900C5DDB32A41B9647A0196BEF170ECD151B57AE48AF5FA7F1982B
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?><root><version>1</version><Count>14</Count><Resource><Id>Aptos_26215680</Id><LAT>2024-11-05T23:49:41Z</LAT><key>29939506207.ttf</key><folder>Aptos</folder><type>4</type></Resource><Resource><Id>Aptos_45876480</Id><LAT>2023-10-06T09:25:29Z</LAT><key>27160079615.ttf</key><folder>Aptos</folder><type>4</type></Resource><Resource><Id>Aptos Narrow_26215424</Id><LAT>2023-10-06T09:25:29Z</LAT><key>31558910439.ttf</key><folder>Aptos Narrow</folder><type>4</type></Resource><Resource><Id>Aptos Display_26215680</Id><LAT>2023-10-06T09:25:29Z</LAT><key>23001069669.ttf</key><folder>Aptos Display</folder><type>4</type></Resource><Resource><Id>Aptos Narrow_45876224</Id><LAT>2023-10-06T09:25:29Z</LAT><key>24153076628.ttf</key><folder>Aptos Narrow</folder><type>4</type></Resource><Resource><Id>Aptos Display_45876480</Id><LAT>2023-10-06T09:25:29Z</LAT><key>30264859306.ttf</key><folder>Aptos Display</folder><type>4</type></Resource><Resource><Id>Aptos_

C:\Users\user\AppData\Local\Microsoft\FontCache\4\CloudFonts\Open Sans\21798841561.ttf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	TrueType Font data, digitally signed, 19 tables, 1st "DSIG", 26 names, Macintosh, Digitized data copyright \251 2010-2011, Google Corporation.Open SansRegular1.10;1ASC;OpenSans-R
Category:	dropped
Size (bytes):	217276
Entropy (8bit):	6.419567239266024
Encrypted:	false
SSDEEP:
MD5:	D7D5D4588A9F50C99264BC12E4892A7C
SHA1:	513966E260BB7610D47B2329DBA194143831893E
SHA-256:	13C03E22A633919BEB2847C58C8285FB8A735EE97097D7C48FD403F8294B05F8
SHA-512:	CE9F98208CD818E486A12848B2D64BD14E12D42D84B2E47436A3C4420A242583EEFC4A9B42401B51CC204146C6133645975682E4BB5D48527B3796770EFA3397
Malicious:	false
Reputation:	unknown
Preview:	...........0DSIG..D...;H...tGDEF.&....7(....GPOS.7.7..7H...8GSUB.+=...7.....OS/2.6.........`cmap............cvt .M..........fpgm~a.....<....gasp...#..7.....glyft8.K..$.../.head..cp...<...6hhea...s...t...$hmtx.5<.........kernT+.~..T....6loca)..........Vmaxp.C......... nameH.B.........post.C.l......&+prepC...................Ww.(_.<..........51......+.........b...........................{...............................V......./.\.......................3.......3.....f..................@. [...(....1ASC.@. ...........X ........H..... ...................#...5...+.3.......h...q.....^.R.^.=.j.V...h...?...T.!.........f.......d...^...+.......u...^...h...j.!...!.?...h...w...h.o...1.y...../.....}.....s...!.....}.......T.#.`.....'...9.......;.}.....;.}.....d.j.m...........h.......{.....R...........3.V.1.........s.^.......s...s.}.s.....b.'.............3.......q.........s.......s.D.....j.............9...1.'.......R...=.h.....H...h.....#.........?...{.....h...!.{...5...d...F...R...h...T...d.....m.....h

C:\Users\user\AppData\Local\Microsoft\FontCache\4\CloudFonts\Open Sans\23165521968.ttf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	TrueType Font data, digitally signed, 19 tables, 1st "DSIG", 26 names, Macintosh, Digitized data copyright \251 2010-2011, Google Corporation.Open SansBold1.10;1ASC;OpenSans-Bold
Category:	dropped
Size (bytes):	224452
Entropy (8bit):	6.418018034788758
Encrypted:	false
SSDEEP:
MD5:	F5331CB6372B6C0D8BAF2DD7E200498C
SHA1:	8387D4F8E061C264DC3AEBEBE6068B66E45D7C6F
SHA-256:	1B43DE2449D39B65FF6F63315D4AFDA585F72FBBEC2E3D9A56F59DE6C75149D3
SHA-512:	B534A27EE82942784155E087FF2A546AB6EAA7A6CDD1C449687B97DCEE2028D3ABF6F9B0A7459667797DFAEDA30C0342C01DB0F2826F7E80B6B9CCDC9902166A
Malicious:	false
Reputation:	unknown
Preview:	...........0DSIG..t:..WP...tGDEF.&....S0....GPOS.7.7..SP...8GSUB.+=...S.....OS/2.m.........`cmap............cvt .-..........fpgm.s.u...<....gasp......S$....glyf......%...K.head.%I....<...6hhea.).R...t...$hmtx$...........kernT+.~..p....6loca..`+.......Vmaxp.5......... nameo)8...'.....post.C.l..,...&+prep...k.................4S_.<..........B.......+.....................................y...............................X......./.\.......................3.......3.....f..................@. [...(....1ASC. . ...........X ........^..... ...................J.u.....+.-...X.5.?...R.!.....R...=.\.?...X.R.?...=.H.u.N.....J...y...N...N...#...d...H...7...H...B.H.u.R.?...X...X...X.....-.f.....`.....w.....{...d.....w.......B...h.P...............^.w.....^.w.H...h.^...).....3.......V.........1.....N.....3.B...J.....L...V.......\...\...\...).....B...q...q.}.....q.......B.....\.......\.......\.y./.B.....................7.'...h...'.R...X.....J.u.......R...q.....h.....j.......d.../...R...X...=...d.....m.\...X

C:\Users\user\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntities.bin

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	322260
Entropy (8bit):	4.000299760592446
Encrypted:	false
SSDEEP:
MD5:	CC90D669144261B198DEAD45AA266572
SHA1:	EF164048A8BC8BD3A015CF63E78BDAC720071305
SHA-256:	89C701EEFF939A44F28921FD85365ECD87041935DCD0FE0BAF04957DA12C9899
SHA-512:	16F8A8A6DCBAEAEFB88C7CFF910BCCC71B76A723CF808B810F500E28E543112C2FAE2491D4D209569BD810490EDFF564A2B084709B02963BCAF6FDF1AEEC59AC
Malicious:	false
Reputation:	unknown
Preview:	51253fe60063c31af0d295afb42228b0:v2:2:1:1590:2:8479:76bd602437550e98c9043d06a55186ab7d95dea5a0e935a599f73e62a8c9b158e0afcb19351f6c353940c06a38172b94d18c02cf92bb8a80184eccca0392b259ab3e71dae73e491c7941997cb36ad4a198661f622dad478d840f66d530a0dde78acea3367f91fff62fbb3dc18faff0c708ad30edef5bea8b22c5fd782b770d8993386eaa784fd19a3c3e1db3b537b1a94d3d4fbd46f8df8fddf6d16611969fe0a97c50e0f3ac24750c93257cf5c161184aa7385800c87d803b339632a3d8ec7fe17a0afd83ce9e9d0e3f7b8d579637928a811f1f7e6d1887df2ddc7d4f752c4d600235e426c92c7bf8a1362f95457998cc0e5d4261f0efa4fada0f866dbcefb407dacab7a2914e91c2f08200f38c2d9d621962145b1464b0f204b326118a53ecdcab22bff005fdd5257c99a6dc51ac0600a49f2ef782396987e78c08b846dad5db55e8ccefffc64863bc2c3e90b95a09d25d0814a848c98fe01a82d4e30e6682dd546e12c45ca0d280a45295ab4bd632dafb070edfdc3c9e38313d5aeb195972986f8011b66817028fd8c78b67a0ac7e780eecc3fb6a31f5a025b8a9a3db278a98c0696aeaac739b18688b0f9c7d751bba02cc5f4e41853fb119b3c0c915059aaa92971244a1989124f12881ca88e6410df70b793a2c3a736ff4

C:\Users\user\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntitiesUpdated.bin

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	10
Entropy (8bit):	2.5219280948873624
Encrypted:	false
SSDEEP:
MD5:	2F4CD1D46A2AAF30D95FD03F8EBC2480
SHA1:	14C677D8B3286C3458717E7D3307E7555BC40B5F
SHA-256:	99C1E3656618EE95281B08950F9527CE28DD60D924C695C1CD78EFDD6FDE4F0E
SHA-512:	B1DA6D02B9AF166F8A090C181F2B2BAEB8168F10D496D9342399E87F20AFF88B059075E84BB29A767498D7FF8AAF9459DB9709E7AEC4CA517E02CC6A3DB32457
Malicious:	false
Reputation:	unknown
Preview:	1730850583

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-shm

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.04595739460260245
Encrypted:	false
SSDEEP:
MD5:	427EFDE43E4EB5DF3C560F70434AA12D
SHA1:	AD3B6538739EBEFF049885588E3DBCD5530AC98F
SHA-256:	49F856B4CF91A8C4D28B456603A4DBE49BB82CEE69973801A1586DD203BF3923
SHA-512:	FB68ED4BA3095F6A35C027BF0CC6F6CFFB089FEB00DA825CC1C765AE46447B4E50AA78F0C39936C14799F3ED0B925ABB9A31134CD6848284B2E1DDA42F590F09
Malicious:	false
Reputation:	unknown
Preview:	..-......................W5.........Tu..M.].n.....-......................W5.........Tu..M.].n...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-wal

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	modified
Size (bytes):	49472
Entropy (8bit):	0.4828716941546744
Encrypted:	false
SSDEEP:
MD5:	13E757D3B023BF023840E5A6C65B99F8
SHA1:	435FD0B804049DA3F34DF1B3A910713972EA6826
SHA-256:	4885B766D06200A4FD43593440250E0FF01001DF6AD4C55B0B3D0CD5F34E53E7
SHA-512:	993EDD03B1ECADC834D3303E022F9259C2212F7E106572A39050F8FD960E2C5B9B32CB4834BE5A8D6C80FB07C0CA7BD7E3EB2A2D9FB7D2AF41F8679FB073A616
Malicious:	false
Reputation:	unknown
Preview:	7....-..............Tu....$w...............Tu..w.ir....SQLite format 3......@ .......................................................................... .............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\4422C340.dat

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 100x100, components 3
Category:	dropped
Size (bytes):	823
Entropy (8bit):	6.383036735600367
Encrypted:	false
SSDEEP:
MD5:	2C1B060229A914F2A90A8C7E3BE6EB40
SHA1:	03D8FB85556EDF397D8AFCAFC0B13F11ECBDE50C
SHA-256:	CB0628092DDEA96BB040221B5C793DBBB792A67D0621BDFBA170C07374D85801
SHA-512:	B69BB43B94BE309FBE7266F0DA6EF49667F171DA1EAE9019CACC717AC132BA673B45C895A6ECAA08880A8B1474A884B0225F688EF8EC6A56C9104EF89C12CD06
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....`.`.....C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222......d.d.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(..?..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\BAFDE77B.dat

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	PNG image data, 143 x 19, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4439
Entropy (8bit):	7.938042105122337
Encrypted:	false
SSDEEP:
MD5:	1BA4F3EE993F24EC7933A2788CCD27F9
SHA1:	1B5E8CBACB89D04E3A675A80A069740096523DD2
SHA-256:	330B7E281EAC65C52ED398BA46822AAD8B3D4483AE928FEE8BD628C4DFF7FAF7
SHA-512:	B153A8C55157C84BCE755FA5405DEF8D7CF4A8D55459D37EC4368A0C034809CD9EBE18B1051982CACE82A0E786B66C81E1028C0CF00164F5D59E46AC525C9B98
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...............^.....sRGB.........pHYs..........+......tEXtSoftware.Microsoft Office..5q....IDAThC.Z.xU...<.#7....G.L.C....B...?.."(exJ.Z..Xq..Q../........T.Z[(B.Tk......B......{.}..s.s.Or/I .h(.t......{.........._Skhh..BIEE..~..;wJEEE.g........t.s..Q.>.)u.^.J.{....3....2s.%.7.{....<-//.>.N-.cjkk...6..T..g...s.-ZD./_..b1.?.u.A..(....F".....2......d.S]=.`SS.. }.u.G........U...0q. .....W.1.......v.m.;....z6..;.a......$4m.L.R..R.[...!C..~....$.O...&O.,0F.c/D.....O......FQ.......!.T.....0....."..\../1.....SnO.$.r...7......OQ...[......xM^^.u.................._X....dY...H[[.E.9...y.,......^....q......_....6......n.....T....8]Q.....d2I,."y.....[....H......D4.u..j.[...........uC....:...gY..H$...!l....\|-.Io...m....k....._.0.MRDQ.................cV........`:..)...../.....c...VUU.....\|.._...x\.......H..{...}...<..0...<XS_...x.yl.t~..*/......3..s...\..UUC.......%I~.1:......P(8 .l[..Eg.0....<)I....v.....E.8m.4-. ....q`...........

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\C3B510E2.dat

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	PNG image data, 143 x 19, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4455
Entropy (8bit):	7.930765809965127
Encrypted:	false
SSDEEP:
MD5:	1B4B03188C32C942C91C9528F7A9B3DB
SHA1:	2879A72EE54B85018D167ED63D05B62554D5E806
SHA-256:	9841BCEFBF34CE38F013D88F9779CB575D893CB7EC37E1AB59148EE0D136BFBA
SHA-512:	980D3FA55AF255952A23C70ADA271B91E28891B11D1E4FD5DD1AE9DB69F6A14D0E40E7E585F85026BEFDD0F1EE8CBE96610E6383F2174B0AAAAF086D86A5D41F
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...............^.....sRGB.........pHYs..........+......tEXtSoftware.Microsoft Office..5q....IDAThC.Z.x..>..53.I.<.>....bi..`-J.....x....R.....1!nm..h.....hW"B[]/U..B."x...?........&......y.....\|...........B..ZGG.<..jkk.sm.M.....m......5..Xg.).=b..)5.\|.g.>..NF~4...L..wvvZ'3~.1]]..}>.k6....inn.....(I..3....=.s.....<#...Gm8...o...-.ht..!.\..w..q.<1........q..-.\|.(......,W....1.G:jjj~...a.d.=..$.2:.......\.{/%...0.c...SJ.PJ..u.{....p....g.....s9.&..."..}..e..8..]K~\|...pFY....=...aY._.,.....1.r..%...Y...=[]...$I".-+.y..U.`.a....gG....z".W.0`.>..K.rkd.}.(..:.,.Ng......k.WDQ...vMAx!.\...i.4..v..t..O..z.X7o..h..\......o...I......R...4..\|.g...o....Q..p8...4.......l.......u}e..*...$..F..%..%P...jv.=W.z6..6.g.......:.N.....$...An].!0.\|..-.....1..M.2....<..E......4.m......,(...i.e.#.O$f... .K++S...u..e.A.].a....y.P.;.x.y..tf.?...{o.7..,.a.......q..... .+l.....#_..x.S.tk<.[X.F....A...../...\....._Qb?.3.lS{[[[7.{..UWW.....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{BD2F59AC-6F6D-49EE-87C7-489FFF7EF623}.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	33800
Entropy (8bit):	3.780201502816776
Encrypted:	false
SSDEEP:
MD5:	FE82DFE419E355F8A8A489123954B839
SHA1:	7DEBD0722910AC9874654C8F67439D33B27B5313
SHA-256:	547FD8C186561B546273FD425416D32EDF1F30F62EB5BD6BC430CBBBEB4975CF
SHA-512:	4C55B9418865843380E314BEAEB696D563EDDAAEF1F9EE50B23277AE26B7F206B55EA53B5AB0D167A5961C3732DA488FAAD67DAC58DA026976B795F1FD36D991
Malicious:	false
Reputation:	unknown
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................n...............j...l...........f...........H...J...........b...d...v...x.................................................................................................................................................................................................................................................................................................................d...d.[$.\$.*...$..$.If........!v..h.#v....:V.......t.....6......5.......4........4........a..

C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1730850580577062800_C54C532E-C668-477A-BE27-B05DD8C1D118.log

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	ASCII text, with very long lines (28772), with CRLF line terminators
Category:	dropped
Size (bytes):	20971520
Entropy (8bit):	0.18648813665380534
Encrypted:	false
SSDEEP:
MD5:	99CDAC47255F6B7FDC03F34E767DBBF0
SHA1:	6BE255B64680579EE027D1013D11E3D400D008E7
SHA-256:	A8B4357D5301E6897BFEC3BC3FDC0EB8FC5E54861B329DD6D03FD94BA0B086AC
SHA-512:	9015038E1734345062C590421A20E5A55D750BB73600B04CE3E66ACB37AA20E77C4B0DF0BE4B18BF8BD63C1D9020F555E0B207EA9109219A4295B3CC13329CB6
Malicious:	false
Reputation:	unknown
Preview:	Timestamp.Process.TID.Area.Category.EventID.Level.Message.Correlation..11/05/2024 23:49:40.606.OUTLOOK (0x192C).0x1938.Microsoft Outlook.Telemetry Event.b7vzq.Medium.SendEvent {"EventName":"Office.Text.GDIAssistant.HandleCallback","Flags":30962256044949761,"InternalSequenceNumber":27,"Time":"2024-11-05T23:49:40.606Z","Contract":"Office.System.Activity","Activity.CV":"LlNMxWjGeke+J7Bd2MHRGA.4.11","Activity.Duration":11,"Activity.Count":1,"Activity.AggMode":0,"Activity.Success":true,"Data.GdiFamilyName":"","Data.CloudFontStatus":6,"Data.CloudFontTypes":256}...11/05/2024 23:49:40.622.OUTLOOK (0x192C).0x1938.Microsoft Outlook.Telemetry Event.b7vzq.Medium.SendEvent {"EventName":"Office.Text.ResourceClient.Deserialize","Flags":30962256044949761,"InternalSequenceNumber":29,"Time":"2024-11-05T23:49:40.622Z","Contract":"Office.System.Activity","Activity.CV":"LlNMxWjGeke+J7Bd2MHRGA.4.12","Activity.Duration":10719,"Activity.Count":1,"Activity.AggMode":0,"Activity.Success":true,"Data.JsonFileMajor

C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1730850580577976300_C54C532E-C668-477A-BE27-B05DD8C1D118.log

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	20971520
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	8F4E33F3DC3E414FF94E5FB6905CBA8C
SHA1:	9674344C90C2F0646F0B78026E127C9B86E3AD77
SHA-256:	CD52D81E25F372E6FA4DB2C0DFCEB59862C1969CAB17096DA352B34950C973CC
SHA-512:	7FB91E868F3923BBD043725818EF3A5D8D08EBF1059A18AC0FE07040D32EEBA517DA11515E6A4AFAEB29BCC5E0F1543BA2C595B0FE8E6167DDC5E6793EDEF5BB
Malicious:	false
Reputation:	unknown
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20241105T1849180168-6444.etl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	modified
Size (bytes):	106496
Entropy (8bit):	4.477217051604236
Encrypted:	false
SSDEEP:
MD5:	BC43E902D4253E4FA8E8B6244FDD0462
SHA1:	A1083D020D49423096ECEDA12F8B01C34A9DF904
SHA-256:	731AB35AF4AE80984C83F661E481FE78740E529AFDFC19F75FD3B0AB53652E6A
SHA-512:	85F1BF3E57AD60F11CA4773DCAA6127987FE1C0C0BEC21132970C07A168E012597502CA434BC770C9DDC69DA40B92029A5209A9329AF3038B31C1F0110B6CAAD
Malicious:	false
Reputation:	unknown
Preview:	............................................................................`...8...,......T./..................eJ..............Zb..2...................................,...@.t.z.r.e.s...d.l.l.,.-.1.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.1.1.1.............................................................jp.Y.............T./..........v.2._.O.U.T.L.O.O.K.:.1.9.2.c.:.5.e.4.8.d.d.1.2.2.0.0.f.4.e.9.b.a.6.e.5.4.8.e.5.0.d.0.c.b.9.3.4...C.:.\.U.s.e.r.s.\.c.a.l.i.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.O.u.t.l.o.o.k. .L.o.g.g.i.n.g.\.O.U.T.L.O.O.K._.1.6._.0._.1.6.8.2.7._.2.0.1.3.0.-.2.0.2.4.1.1.0.5.T.1.8.4.9.1.8.0.1.6.8.-.6.4.4.4...e.t.l.......P.P.8...,......T./..........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DF105685B541FF05F5.TMP

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.3613836054883338
Encrypted:	false
SSDEEP:
MD5:	679672A5004E0AF50529F33DB5469699
SHA1:	427A4EC3281C9C4FAEB47A22FFBE7CA3E928AFB0
SHA-256:	205D000AA762F3A96AC3AD4B25D791B5F7FC8EFB9056B78F299F671A02B9FD21
SHA-512:	F8615C5E5CF768A94E06961C7C8BEF99BEB43E004A882A4E384F5DD56E047CA59B963A59971F78DCF4C35D1BB92D3A9BC7055BFA3A0D597635DE1A9CE06A3476
Malicious:	false
Reputation:	unknown
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DF94EE4F805E25F5E6.TMP

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	unknown
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Office\MSO3072.acl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	30
Entropy (8bit):	1.2389205950315936
Encrypted:	false
SSDEEP:
MD5:	DADDDFB8AA99F5C5126E0451735222F2
SHA1:	B2DD833462FDE770F5FC4921DC8B95F2175C5160
SHA-256:	731DA9D65B38CE0382363A0641DC6614ABD4F550CB5861D3498C835726DB7FD8
SHA-512:	6070B1412F3906A8466B13F248E96C9ABD2485FC0A1C3B27AE8D5FD502FE91ACF8456E89AAF726CCC08B168C4B3E7E10B186AC4F5247A41FE3727C046571BE85
Malicious:	false
Reputation:	unknown
Preview:	....@-........................

C:\Users\user\AppData\Roaming\Microsoft\Outlook\NoEmail.srs

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.6693534339786389
Encrypted:	false
SSDEEP:
MD5:	B96ED41EEC42A789C2805E14F1CD34F4
SHA1:	907C65F9F67C07D8887BBA87F8CEE076AE39D361
SHA-256:	C15CCEB1D35C1C9E48206F4D90E51C225B37507EEFE408118A69DB19C3CDC1F6
SHA-512:	A810A19BBC58D10B64BB4EEDFC17C279676D28D28D3ABCD1CE0A420A40F489B77E9B3929F88F5BF16C0E7725E91B7EAF3E832467F2A95F658D073AED6C4F85EF
Malicious:	true
Reputation:	unknown
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Nov 5 22:49:53 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2673
Entropy (8bit):	3.975721393460288
Encrypted:	false
SSDEEP:
MD5:	C61D14B3FB13D2D4D09DF8445B1FE0A7
SHA1:	FCE3AEB95D09A4C0CBF7F3EFB42133D586E5179D
SHA-256:	202545C2FF6477DDDF5FC589942B5119503205D2CC00AFD1ADC75982240F8E13
SHA-512:	D6A0B5480F4FB94398D1ACBABE10C12107C92317238D8541A7BC516481B03D1F822B1DADE54A4E0F0FB4DED74E81318D63285624E454B241F62230E8A1185124
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.......h./..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IeY .....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VeY:.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VeY:.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VeY9............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VeY;............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............i.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Nov 5 22:49:53 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2675
Entropy (8bit):	3.993081211226115
Encrypted:	false
SSDEEP:
MD5:	0354C2F35B60A0554F62FC89CB0C7C61
SHA1:	D298AAA8B459D4936AA7F72010A6E4E7A6B9B25B
SHA-256:	BEBE1E39FB6ADFD55BA93A95ADC588F9C4E9C7FDEB102FA6A8FE95B0A8B22F12
SHA-512:	59ECA6EBA4FCAB3B17DFF47FA4E41A361C21B9B4B7C62B4084253E7A612A5AAD5B0EC399ACD12182F9A8681233D200003FC9E037442F8DA9B9A740D658A46163
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.....7.h./..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IeY .....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VeY:.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VeY:.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VeY9............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VeY;............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............i.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2689
Entropy (8bit):	4.000100514612161
Encrypted:	false
SSDEEP:
MD5:	074015081590907B448489C4A9BE1270
SHA1:	542D8455273B7D3B32A1D05B2AAA1028F16A904B
SHA-256:	283A73537A0FDB1AB7D4179C97EB08E0EEFCDF32366A4FD0826B6FA05A48772B
SHA-512:	2A6E84497FEB09AAA4DE1A21F8AED8198D64BEBB0E0C8CDEA591BA2C6874B669DC9861F96BF1FFF7EAC0F3C5B90492644AA42A3D34F2F486634A153B04D9592E
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.....Y.04...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IeY .....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VeY:.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VeY:.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VeY9............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VFW.E...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............i.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Nov 5 22:49:52 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9913740908859783
Encrypted:	false
SSDEEP:
MD5:	6D7FC0D594849ACEFABC4581FD983F29
SHA1:	D996911A49EEE0611380B84C2541BBEACB8BBE7B
SHA-256:	3120CB5BAA38DE113E796A58269351F605C767CE686C6654D9C2127C13819227
SHA-512:	2398EAF1407F4EF8DB3CD39936E35BE624C92F0F08540CA47A391A016D03923037ECBA929C1CE08E00ADA995DD9D5EFE6545A7309B26D2F2BEFA122C31E3935E
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.....!.h./..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IeY .....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VeY:.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VeY:.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VeY9............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VeY;............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............i.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Nov 5 22:49:53 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9771678210527464
Encrypted:	false
SSDEEP:
MD5:	B1E08DA89CBBCC296E430A776BEF6EBC
SHA1:	29BD60AA5EB26E5936B9D0997CFD9E628BBC50C9
SHA-256:	ABE785E4EEB08E5BDF3AB1300D90CCDEF6A0853751E7876CC9F6AC0C672A8520
SHA-512:	BBAF0B67F1DD687966B84E774445C643A19B050F2F7AB46AC7695A81E9C18C6FAAD011D7B4F9F7D8B25188966D9F0569173E1C13F3BC6D9802C60B5CA50B044A
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,....q..h./..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IeY .....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VeY:.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VeY:.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VeY9............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VeY;............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............i.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Nov 5 22:49:52 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.985276650936556
Encrypted:	false
SSDEEP:
MD5:	36679AECB10B450746F3D60583556E10
SHA1:	2409A46E1FD9F61D9B8536111C4E83A2EB2CAFE4
SHA-256:	36BA12B96A82D21EB9FA9C829D8643EF949391F162954FD006164A3814818CA7
SHA-512:	EAFE7A3CC0019E15719919F56FB205DD5C1C534B32A2981727DBC35A9D5DD642AF46C9D2693976DE8A5B55DBA1289A4A30887C2B880B2404E282F129DB5735AF
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,....r..h./..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IeY .....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VeY:.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VeY:.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VeY9............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VeY;............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............i.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\Documents\Outlook Files\Outlook Data File - NoEmail.pst

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	Microsoft Outlook email folder (>=2003)
Category:	dropped
Size (bytes):	271360
Entropy (8bit):	4.560375754905901
Encrypted:	false
SSDEEP:
MD5:	504BA090BC1B9B81784F217A9D480EAC
SHA1:	C9E6253CDDBCB8B426726B9C8B22D981CC8F6C36
SHA-256:	E4C207BEFA1259FD7633CBB564F4B00865071A6A2633E3787E649A9DD371B4D7
SHA-512:	704D5707B3D525617973566429CFA0EDC28C8A06E09FA1D4BD5D68FB349AF91EB6C66ECC0FF25BA5B4C71F9558BE29C32C5AAE1CE12E7322387F8A5CEE5FC163
Malicious:	true
Reputation:	unknown
Preview:	!BDN...`SM......\....*..................]................@...........@...@...................................@...........................................................................$.......D......@&....................................................................................................................................................................................................................................................................................................................................yyQ.).....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	262144
Entropy (8bit):	4.190340800807703
Encrypted:	false
SSDEEP:
MD5:	8B9C7C667DB249435321D820259C9201
SHA1:	2F487C5DE0DE4C51835FA345C63D1D03D9798B45
SHA-256:	D6B8D5A61953174987D0DC71665E9E819C70C3282D3F0913F93315702D25D417
SHA-512:	2B1179533087F8276DB703995CAF84C9740FDA46B37A0405B8E3CA4FDE8BE650988049E741E5025200383D987F0BB7F1B05C49F3F9205080A44416BC243AA2CB
Malicious:	true
Reputation:	unknown
Preview:	..Wr0...........,....V.S./.......D............#...........................................................~....................................................................................................................................................................................................................................................................................................................?.....................................................................................................................................6..D.........F0...........,....V.S./.......B............#.........................................................................................................................................................................................................................................................................................................................................................................................................

Chrome Cache Entry: 82

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with CRLF line terminators
Category:	downloaded
Size (bytes):	4739
Entropy (8bit):	4.736490039075709
Encrypted:	false
SSDEEP:
MD5:	4B86605C4B80FA75342703878E7DFF13
SHA1:	6EF59F904C58E88B3E143BA3DA464AFE63FDC188
SHA-256:	2F186CDFA13B6CA51F69D44BAC8A7D5B69E1D5409A68D21F5768A87C6DFDB3A1
SHA-512:	B493241426AB5A1B75D1455720E84AB27A2B7E176FDF782ECB14B26004F5553FD306DCAE14C17CE788891FDBCAE9A32A5E22CB187C6BCE66486B89A0E5028AD9
Malicious:	false
Reputation:	unknown
URL:	https://na2.docusign.net/Signing/StyleSheets/Framework.css
Preview:	/-----------------------/..../* needs brackets to swallow error on dev /..{..}..../ This file contains the styles needed for the 2014 rebrand /..html {.. / Prevent font suserng in landscape while allowing user zoom /.. / Use 100% here, NEVER none. See http://blog.55minutes.com/2012/04/iphone-text-resizing/ /.. -webkit-text-size-adjust: 100%;..}..body {.. margin: 0;.. background-image: none;.. background-color: #EAEAEA;.. font-family: "Helvetica Neue", Arial, sans-serif !important;..}...Header {.. display: none;..}...scroll-area {.. position: absolute;.. overflow: auto;.. overflow-x: hidden;.. top: 0;.. left: 0;.. right: 0;.. bottom: 0;.. min-width: 1024px;..}...scroll-area, .Border.scroll-area {.. overflow-x: auto;..}...scroll-container {.. border-bottom: none;.. position: static;..}...clear {.. clear: both;..}..../ site content - centered w/ max-width and padding */...site-content {.. margin: 0 auto;.. max-wid

Chrome Cache Entry: 83

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	3896
Entropy (8bit):	4.786686051422741
Encrypted:	false
SSDEEP:
MD5:	855476199961A10981ADCA7432CEC048
SHA1:	7995725A0CAC73EB6A2A1B5A8D5B162DBF47988E
SHA-256:	6DD60FAA0E35F2DFE342C452ED414A084D384D11793BD0F0EB03C2B1C6F1405C
SHA-512:	A9E61582FA18BCC1DD57DE8A7C194BAB0D6F733897F541A6E13B94906ADC115D65004F5A2649919FA8B8545F0C67C9313A14EAEAF42C34F630DA13CD38E17994
Malicious:	false
Reputation:	unknown
URL:	https://docucdn-a.akamaihd.net/olive/images/2.63.0/global-assets/ds-logo-inverse.svg
Preview:	<?xml version="1.0" encoding="utf-8"?>. Generator: Adobe Illustrator 28.1.0, SVG Export Plug-In . SVG Version: 6.00 Build 0) -->.<svg version="1.1" id="Layer_1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px".. viewBox="0 0 1200 241.4" style="enable-background:new 0 0 1200 241.4;" xml:space="preserve">.<style type="text/css">...st0{fill:#FFFFFF;}...st1{fill:#4C00FF;}...st2{fill:#FF5252;}.</style>.<g>..<g>...<g>....<path class="st0" d="M1169.2,109.7v78.7h-28.9v-73.5c0-17.9-7.7-27.9-22.7-27.9s-24.9,10.5-27.7,28.1c-0.8,4.2-1,10.7-1,24.4.....v48.8H1060v-125h25.6c0.1,1.1,0.7,12.3,0.7,13c0,0.9,1.1,1.4,1.8,0.8c10.6-8.4,22.3-16.2,38.6-16.2.....C1153.5,60.9,1169.2,79,1169.2,109.7z"/>....<path class="st0" d="M1013.4,63.4l-0.9,14.3c-0.1,0.9-1.2,1.4-1.8,0.8c-3.5-3.3-16.4-17.5-38.3-17.5c-31.4,0-54.5,27.1-54.5,63.9.....l0,0c0,37.3,22.9,64.5,54.5,64.5c21.1,0,34-13.7,36.4-16.7c0.7-0.8,2-0.3,2,0.7c-0.3,3.8-0.8,13.3-4,21.4.....c-4,10.2-13,19.7-31.1,19.7

Chrome Cache Entry: 84

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	downloaded
Size (bytes):	2048
Entropy (8bit):	4.886793296383126
Encrypted:	false
SSDEEP:
MD5:	3165AF715E6BA5CA2B00F9AB5277CC8C
SHA1:	99697540AAC85B979624E1A09483418A4C30BD11
SHA-256:	08034C30A67418DD7BFF599A0EA4ECB87315D485ADB3BD1774AFC36B33705317
SHA-512:	9B62C145664DA8EE0C6B8C719B7468848F1E1F87CBD9DAFBBF878FCCE9F72E5569A7FCA13C01FC408ADB6B8C5B4F2393BBB93B5077BA02CA816C2DE7937EFA5E
Malicious:	false
Reputation:	unknown
URL:	https://na2.docusign.net/Signing/StyleSheetsDev/ErrorExpired.css
Preview:	..btn {.. background: #111;.. border: 1px solid #111;.. border-radius: 2px;.. cursor: pointer;.. color: #fff;.. display: inline-block;.. font-family: "Maven Pro","Helvetica Neue",HelveticaNeue,Helvetica,Arial,sans-serif;.. font-size: 12px;.. letter-spacing: .6px;.. line-height: 1;.. min-width: 55px;.. margin: 0;.. padding: 7px 14px;.. position: relative;.. text-align: center;.. text-decoration: none!important;.. text-transform: uppercase;.. font-weight: bold;..}.....btn-main, .btn-main.disabled:hover, .btn-main[disabled]:hover {.. background: #ffc820;.. border-color: #ffc820;.. color: #333;..}.....btn-lg {.. font-size: 14px;.. padding: 9px 18px;..}.....expireActionDiv {.. float: left;.. width:50%;..}.....expireActionDiv .newLink {.. margin-left: 50px;..}.....expireActionAccountless{.. text-align: center;..}.....expireActionAccountless .newLink{..}.....freshLink {.. margin-top: 10px;..}.....expireActio

Chrome Cache Entry: 85

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format, CFF, length 34820, version 0.0
Category:	downloaded
Size (bytes):	34820
Entropy (8bit):	7.982902826695778
Encrypted:	false
SSDEEP:
MD5:	FD117C9EB999E35D64BE1515D5B2192D
SHA1:	B0FAE4091AC17A28C47AF531A9D5B73B4C35F6BD
SHA-256:	553582BE8A5D2779D1A9E9C3A6698FD4D365E01353D8876A7204DB68FCD1D12D
SHA-512:	24D51DBAFDE7E5B7B1486BA3800BC8ECBAF369A2D28BBBF15096C723DC565247F9B956E8D0F28EDB535313E1B26934DFC30AF0AF700B8CB57F02926B889B2177
Malicious:	false
Reputation:	unknown
URL:	https://docucdn-a.akamaihd.net/production/1ds/widgets/@ds/signing/24.10.63-1/fonts/maven-pro/MavenPro-Regular.woff
Preview:	wOFFOTTO...........<........................CFF ......S....{..."FFTM............Z...GDEF..X4....... ....GPOS..Xt..-....DiP}7GSUB..XT... ... l.t.OS/2.......I...`.[.8cmap.......\|....#G..head...0...3...6.h..hhea...d.......$....hmtx.......Q...X.xm.maxp..............P.name.......=...1.E.Lpost........... .j.fx.c`d```d8R!.0...+.7.....\|Y...o.....v...``....MM...x.c`d``../.H.....1.F..............P.....x.c`b..8.....u..1...<.f........p...).,fp`P...._......u05..X.......,......x.m.1O.@....aP.......K.B.N..&.......^...\......G../.Dc....{....\.......c.....p...u.c.W..q....q...2...gY.g.k.8...w.u.c...9n.Vu.7q..1...[.H.`...6..p."@...L.&.X....Cfg.I}..+..[.4G.q..>..Yn.4Y..v.....[...L...~.I..Rh.......Q%..Qh...u...8.N....q.c......z.9.9.....&/O...h..mR=..........ljr.. ......T....Sw`....x.c```f.`..F..8..1..,..........P..a)........L..(.(H).)().)X).QTz..........@....1.AU.+H(.UZBU2.................n...}.`...V=X.`.I...Q8.z....#..A.L.,.l...\.<.\|...B.".b...R.2.r...J.*.j...Z.:.z...F.&.f...

Chrome Cache Entry: 87

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	119869
Entropy (8bit):	4.18401975910281
Encrypted:	false
SSDEEP:
MD5:	ECE7A224F69AB2205D90900589AE1D05
SHA1:	3D861B816A5DA892C8A88D5755A5537C036239DE
SHA-256:	FFA8C6A4CE199BFD9E32B05E0E4DECE330C6A577FB3A0E8518291619C658C486
SHA-512:	EEF4BDD54AF95BE42224FFE605BB627293DAEA0C58A50B328ACC8B56040C81FDCB5EC8406F56856FC617A552E4D6DD28BB892467666889D27F03EE8BFCD16D7B
Malicious:	false
Reputation:	unknown
Preview:	/. DocuSign modified version of Mixpanel JS Library v2.2.1. * $initial_referer and $referer have been removed, as not to send any senstive information. * $initial_referring_domain and referring_domain have been retained.. . Mixpanel JS Library v2.2.1. . . * Copyright 2012, Mixpanel, Inc. All Rights Reserved. * http://mixpanel.com/. . Includes portions of Underscore.js. * http://documentcloud.github.com/underscore/. * (c) 2011 Jeremy Ashkenas, DocumentCloud Inc.. * Released under the MIT License.. /..// ==ClosureCompiler==.// @compilation_level ADVANCED_OPTIMIZATIONS.// @output_file_name mixpanel-2.2.min.js.// ==/ClosureCompiler==../.Will export window.mixpanel./../.SIMPLE STYLE GUIDE:..this.x == public function.this._x == internal - only use within this file.this.__x == private - only use within the class..Globals should be all caps./.(function(mixpanel) {. /. * Saved references to long variable names, so that closure compiler can. * minimize file size.. */. var

Chrome Cache Entry: 88

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 10 x 10, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2961
Entropy (8bit):	7.876188909726169
Encrypted:	false
SSDEEP:
MD5:	C863DB426897325CB4805B2C20F51F30
SHA1:	A426FE43F0CE1A489CE091CC27768CDCC2991210
SHA-256:	2A5179B8851C8E3DFC77D7DCB33B3963AFA037608336D6AE412ACAA38AD59D22
SHA-512:	90DA76303CDE0B81F183709D94DC96B5C3EA7B7766948AF5B81E1EBE4B887012FC611F6A0CFC50873E80AF7B73077F7CB8BD5F254A4F4848C632A68733522A68
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............2.....gAMA....\|.Q.... cHRM...........R...@..}y.....<.....s<.w...9iCCPPhotoshop ICC profile..H..wTT....wz..0..z..0... ..Q.f......Ml..@D...E......H..b!(.`.H.Pb0...dF.J\|yy.......g.s..{....$O../... .'..z8.W.G....x....0Y.A..@$/7.z........H..e..O...O.T...._..lN:K.."N.....3"..$..F../JP.rb.[.}..Q..d.[..S..l1..x{..#b.G...\N..o.X3I....[ql2.....$..8.x.......t..r.p../8...p...C...f.q....K.njm.{r2.8...?......).L^6..g.,.qm."[.Z[Z....~Q....7%.."....3......R..`.j...[.~.:.. w....!.$E}k...yh.y...Rm..333..........:..}.=#.v.....e...tq.X)I)B>==......<..8..X....9<QD.h..8Q.yl....sy....0.OZ.k.(...5..H....>.....yP..........:.8......p.........Lg....k.k...$.......t.!0.V..8.7....`.........2A....@.....JP..A#h.'@.8.....:....`....`......a!2D..!UH.2.. .d..A>P ..ECq...B.......Z....:.]..B..=h...~....L...2...........5p.......N..........:\|......@...QC.....!.H,.G6 .H9R.. ]H/r..A..w(......Q.(OT...JCm@..QGQ...-.(j...MF+...6h/.t.:.]..G7....w...7......Xa<1..

Chrome Cache Entry: 91

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	326
Entropy (8bit):	6.860674885804344
Encrypted:	false
SSDEEP:
MD5:	AFE00DB89CE086B91A541C227EDBF136
SHA1:	961B2EE6FB39C4D515BDC49EC1BA688B0916F104
SHA-256:	E11827C678AF8519E702F364E525AC34509CAD49F8D839677E089949EDDA060E
SHA-512:	85F265A917E83BA92FEDB2152FBFADA273FCFF2937A85B080641307FD2E61D0138493162883E016796C9F68062A01D79DA60F546EFC2CB1FB4078760EB3451F0
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....pHYs.................sRGB.........gAMA......a.....IDATx.....0...Uq...UP.\|..v.K.>.O`.$.[.B....'pvJ}..B..P.h...I.!.rs.%.$....O"r!.I.m....J..........U.. ..F[.....j4<...6.b6.T!x..Y..]..;._.,..........K.F..b.~.$..M.......M....,...i....*.z...x8."C.r.{.2~.~........x...B.G.6.....IEND.B`.

Chrome Cache Entry: 92

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (13479), with CRLF line terminators
Category:	downloaded
Size (bytes):	13579
Entropy (8bit):	5.27337657330958
Encrypted:	false
SSDEEP:
MD5:	2779F5D2F1F22353C726240E530016CC
SHA1:	2B3F380F212C8C64E79DB1F47FA25C114AFE6FBB
SHA-256:	16496529F57AC8915F194E00479B04AF942C33D7897BCFD9A55DD072BBEC1411
SHA-512:	14F4E6DB8D21EFA0A01DFE6AC5C6941807B3DA8875864D736476D480167A9C7B02E60E8BE19CC2F9526B3027684661F5B11D36D3A9D44096DF86B120AF8904E6
Malicious:	false
Reputation:	unknown
URL:	https://na2.docusign.net/Signing/client_scripts/jQuery/jquery-migrate-3.4.1.min.js
Preview:	/! jQuery Migrate v3.4.1 \| (c) OpenJS Foundation and other contributors \| jquery.org/license /.."undefined"==typeof jQuery.migrateMute&&(jQuery.migrateMute=!0),function(t){"use strict";"function"==typeof define&&define.amd?define(["jquery"],function(e){return t(e,window)}):"object"==typeof module&&module.exports?module.exports=t(require("jquery"),window):t(jQuery,window)}(function(s,n){"use strict";function e(e){return 0<=function(e,t){for(var r=/^(\d+)\.(\d+)\.(\d+)/,n=r.exec(e)\|\|[],o=r.exec(t)\|\|[],a=1;a<=3;a++){if(+o[a]<+n[a])return 1;if(+n[a]<+o[a])return-1}return 0}(s.fn.jquery,e)}s.migrateVersion="3.4.1";var t=Object.create(null);s.migrateDisablePatches=function(){for(var e=0;e<arguments.length;e++)t[arguments[e]]=!0},s.migrateEnablePatches=function(){for(var e=0;e<arguments.length;e++)delete t[arguments[e]]},s.migrateIsPatchEnabled=function(e){return!t[e]},n.console&&n.console.log&&(s&&e("3.0.0")&&!e("5.0.0")\|\|n.console.log("JQMIGRATE: jQuery 3.x-4.x REQUIRED"),s.migrateWarning

Chrome Cache Entry: 93

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65446), with CRLF line terminators
Category:	downloaded
Size (bytes):	89797
Entropy (8bit):	5.291128696884303
Encrypted:	false
SSDEEP:
MD5:	954F70F07F05742168ADCEBA796DDA72
SHA1:	EDF8A6A066F201B1FFAD32C585BD79C9982D4433
SHA-256:	4DA87C258ECA460D39CDB0F6158CBF69AF539D05A1D14F1BC011518511D02228
SHA-512:	66EE57172810E0002C308C1FD5FC008C1C64573602627CA0313D97742D830C72BB7D26DD3B069E1835C5E3D6F8721F856809EB9CCEF18CE8934FF7758F645717
Malicious:	false
Reputation:	unknown
URL:	https://na2.docusign.net/Signing/client_scripts/jQuery/jquery-3.6.4.min.js
Preview:	/! jQuery v3.6.4 \| (c) OpenJS Foundation and other contributors \| jquery.org/license /..!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery requires a window with a document");return t(e)}:t(e)}("undefined"!=typeof window?window:this,function(C,e){"use strict";var t=[],r=Object.getPrototypeOf,s=t.slice,g=t.flat?function(e){return t.flat.call(e)}:function(e){return t.concat.apply([],e)},u=t.push,i=t.indexOf,n={},o=n.toString,y=n.hasOwnProperty,a=y.toString,l=a.call(Object),v={},m=function(e){return"function"==typeof e&&"number"!=typeof e.nodeType&&"function"!=typeof e.item},x=function(e){return null!=e&&e===e.window},E=C.document,c={type:!0,src:!0,nonce:!0,noModule:!0};function b(e,t,n){var r,i,o=(n=n\|\|E).createElement("script");if(o.text=e,t)for(r in c)(i=t[r]\|\|t.getAttribute&&t.getAttribute(r))&&o.setAttribute(r,i);n.head.appendChild(o).parentNode.removeChild(o)}func

Chrome Cache Entry: 97

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	788
Entropy (8bit):	4.9019698351522845
Encrypted:	false
SSDEEP:
MD5:	CB4FD3AF4DEEBD7277FCD75A576BF633
SHA1:	71A7BC5DE0F92581F2A9F8DCED86578E01B4856C
SHA-256:	F6C29AE65E37D866FEFB836DB488C4D044414798EC995B2B69CD067949938DD9
SHA-512:	1507C60248859484296F0CF5D1D0AB73BA4B2522A8D05C37773E45AE57C381BFC1FBFC1E38C2F1EE4DB626C1E4AF8C973B38FAD6C5FD74A4423FD78CFEE47E85
Malicious:	false
Reputation:	unknown
URL:	https://docucdn-a.akamaihd.net/production/1ds/widgets/@ds/signing/24.10.63-1/css/font-faces.css?cs=7aa34814
Preview:	/ mix ins /..list-no-style {. list-style: none;. padding-left: 0;.}.@font-face {. font-family: 'Maven Pro';. src: url('../fonts/maven-pro/MavenPro-Regular.eot');. src: url('../fonts/maven-pro/MavenPro-Regular.eot?#iefix') format('embedded-opentype'), url('../fonts/maven-pro/MavenPro-Regular.woff') format('woff'), url('../fonts/maven-pro/MavenPro-Regular.ttf') format('truetype');. font-weight: normal;. font-style: normal;.}.@font-face {. font-family: 'Maven Pro';. src: url('../fonts/maven-pro/MavenPro-Bold.eot');. src: url('../fonts/maven-pro/MavenPro-Bold.eot?#iefix') format('embedded-opentype'), url('../fonts/maven-pro/MavenPro-Bold.woff') format('woff'), url('../fonts/maven-pro/MavenPro-Bold.ttf') format('truetype');. font-weight: bold;. font-style: normal;.}.

Chrome Cache Entry: 99

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	3728
Entropy (8bit):	4.718277261919778
Encrypted:	false
SSDEEP:
MD5:	EC396047518A7FEF11D53D1B4F6BE65B
SHA1:	E3BEC4CDAF5567641517A23019ADBFA2328B0A7F
SHA-256:	8F77CFC832517C619BC1B8D82A6A478EE18D97442B4C78B006B0286CEC91E1A8
SHA-512:	34AD62B5CC5EE5C950F340D65800102AE1CD06D34D24A611E7AC2CB9F23308AC96AC669D3B226C258DC6F862D985030EC3D5BB29609ECFEDF34E14F8F48529EB
Malicious:	false
Reputation:	unknown
URL:	https://docucdn-a.akamaihd.net/olive/images/2.63.0/global-assets/ds-logo-default.svg
Preview:	<?xml version="1.0" encoding="utf-8"?>. Generator: Adobe Illustrator 28.1.0, SVG Export Plug-In . SVG Version: 6.00 Build 0) -->.<svg version="1.1" id="Layer_1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px".. viewBox="0 0 1200 241.4" style="enable-background:new 0 0 1200 241.4;" xml:space="preserve">.<style type="text/css">...st0{fill:#4C00FF;}...st1{fill:#FF5252;}.</style>.<g>..<g>...<g>....<path d="M1169.2,109.7v78.7h-28.9v-73.5c0-17.9-7.7-27.9-22.7-27.9s-24.9,10.5-27.7,28.1c-0.8,4.2-1,10.7-1,24.4v48.8H1060v-125.....h25.6c0.1,1.1,0.7,12.3,0.7,13c0,0.9,1.1,1.4,1.8,0.8c10.6-8.4,22.3-16.2,38.6-16.2C1153.5,60.9,1169.2,79,1169.2,109.7z"/>....<path d="M1013.4,63.4l-0.9,14.3c-0.1,0.9-1.2,1.4-1.8,0.8c-3.5-3.3-16.4-17.5-38.3-17.5c-31.4,0-54.5,27.1-54.5,63.9l0,0.....c0,37.3,22.9,64.5,54.5,64.5c21.1,0,34-13.7,36.4-16.7c0.7-0.8,2-0.3,2,0.7c-0.3,3.8-0.8,13.3-4,21.4c-4,10.2-13,19.7-31.1,19.7.....c-14.9,0-28.1-5.7-40.6-17.9L920,217.3c13.7,15.5,35

Static File Info

General

File type:	RFC 822 mail, ASCII text, with very long lines (347), with CRLF line terminators
Entropy (8bit):	6.079721330623334
TrID:	E-Mail message (Var. 5) (54515/1) 100.00%
File name:	FW+Review_&_sign_Docu+#31617+Contract_Agreement+Docusign+Licensing+Board+Of+Directors.pdf.eml
File size:	89'457 bytes
MD5:	2ffde7e2118b65b66b0e5f6831f40f7c
SHA1:	9ba692f1ad4195f495a26d135e945c804d804161
SHA256:	e22341f81e3a60479a4845b2d5861b5e0489061c327a80e0b518c25eae08d4f9
SHA512:	8d6be9058b9ac76217f489d9392348189ffdd03bd636b7c3fab376ba67cd5be718db454255e1289387da7240c18c0255a1682c3880a85ef7dbb18902f43617c9
SSDEEP:	1536:mtMwejh3AeUKf/0zUzYpE28yj22iEEbx6UD5pH2kVElTbRjiFp85/D/:mtMwKh3tUQM4de9/yYspH2gElHVinsL
TLSH:	38935B909E902011F1770ACC72053E8F89A0BD9FA6E6CDD0B6ED716A5FDB027675334A
File Content Preview:	Received: from YQBPR0101MB9551.CANPRD01.PROD.OUTLOOK.COM.. (2603:10b6:c01:78::10) by YQBPR0101MB5079.CANPRD01.PROD.OUTLOOK.COM with.. HTTPS; Tue, 5 Nov 2024 22:27:15 +0000..Received: from YT1PR01CA0069.CANPRD01.PROD.OUTLOOK.COM (2603:10b6:b01:2d::8).. by

Static Mail

General

Subject:	FW: Review_&_sign_Docu: #31617 Contract_Agreement: Docusign Licensing Board Of Directors.pdf
From:	Heather Gordon <heatherg@mccallumsather.com>
To:	Quadbridge Support <support@quadbridge.com>
Cc:
BCC:
Date:	Tue, 05 Nov 2024 22:26:49 +0000
Communications:	Ce message a t envoy de l'extrieur de l'organisation - This message was sent from outside your organization. I believe that the email that David received and forwarded to me is Spam. Please confirm. Heather Gordon, (she/her) CA, CPA., MAcc. Managing Principal, Finance & Administration 286 Sanford Ave. N. 905.526.6700 x245 Westinghouse HQ, 2nd Floor 416.723.9886 Hamilton, ON L8L 6A1 heatherg@mccallumsather.com mcCallumSather.com<https://eu-west-1.protection.sophos.com?d=mccallumsather.com&u=aHR0cDovL3d3dy5tY2NhbGx1bXNhdGhlci5jb20v&p=m&i=NjEwYjE2Y2U0Zjc0MWMwZTk2MmNlZjk5&t=NmsxendTVkNDU1MrQkVRR0JSUC9hMUI3WUJpbXlFVEkwMGIrZTRvVTN4Yz0=&h=f21097c3ff21461ca24d2bc9ab68e812&s=AVNPUEhUT0NFTkNSWVBUSVZepRahezh_GIycWZDQIVhBnwg07hL9dOfaurSPlgiveA> [cid:image002.png@01DB2FA7.E492A020] From: David Riley <davidr@mccallumsather.com> Sent: November 5, 2024 12:49 PM To: Heather Gordon <heatherg@mccallumsather.com> Subject: FW: Review_&_sign_Docu: #31617 Contract_Agreement: Docusign Licensing Board Of Directors.pdf FYI below is what was sent my way. Cheers, David Riley, P. Eng., PMP, LEED AP BD+C Senior Associate, Mechanical Engineer 286 Sanford Ave. N. 905.526.6700 x263 Westinghouse HQ, 2nd Floor 905.516.0666 Hamilton, ON L8L 6A1 davidr@mccallumsather.com mcCallumSather.com<https://eu-west-1.protection.sophos.com?d=mcallumsather.com&u=aHR0cDovL3d3dy5tY2FsbHVtc2F0aGVyLmNvbS8=&p=m&i=NjEwYjE2Y2U0Zjc0MWMwZTk2MmNlZjk5&t=TFpsckJFVi94Q2F2VWNiQXhjV0dXM0hBa2lBMkdhbjA1d3Nsby9Sa1h3Yz0=&h=f21097c3ff21461ca24d2bc9ab68e812&s=AVNPUEhUT0NFTkNSWVBUSVZepRahezh_GIycWZDQIVhBnwg07hL9dOfaurSPlgiveA> [cid:image001.png@01DB2F81.0C1040C0] From: DocuSign System <dse_na2@docusign.net<mailto:dse_na2@docusign.net>> Sent: October 31, 2024 1:12 PM To: David Riley <davidr@mccallumsather.com<mailto:davidr@mccallumsather.com>> Subject: Review_&_sign_Docu: #31617 Contract_Agreement: Docusign Licensing Board Of Directors.pdf [Image removed by sender. DocuSign] [Image removed by sender.] Docusign - Licensing Board Of Directors sent you a document to review and sign. REVIEW DOCUMENT <https://us-east-2.protection.sophos.com?d=docusign.net&u=aHR0cHM6Ly9uYTIuZG9jdXNpZ24ubmV0L1NpZ25pbmcvRW1haWxTdGFydC5hc3B4P2E9MDY5NzQ0M2QtYzdhZi00NTZjLTg5OWItNjAzNTE0MGE2YmNmJmV0dGk9MjQmYWNjdD1lOTgzNzk5Ny03MTA2LTQxMDQtODA5OS1jZTlkNjJkMmEzNWImZXI9YmE0YzJlYjItODA0Mi00YzE2LWI3MmItNDliMzUwNTM1YWFi&p=m&i=NjAwMDRkYmNjNzQ1NDY0ODkyYTNlZmQw&t=UWg3cytBZTBvSnBHaXkvMDFhSjIzaE1iNEx4NmNneHBwSjkrRVZNOXg3dz0=&h=e31e2a87bb4847f999cfc79b960b4445&s=AVNPUEhUT0NFTkNSWVBUSVaRXvLxh7UTuVLmlaqXvLZH__URHKprSyEr4bUyaFsVWg> [Image removed by sender. Picture of Docusign - Licensing Board Of Directors] Docusign - Licensing Board Of Directors renee@placementsource.com<mailto:renee@placementsource.com> Docusign Licensing Board Of Directors Do Not Share This Email This email contains a secure link to Docusign. Please do not share this email, link, or access code with others. Alternate Signing Method Visit Docusign.com, click 'Access Documents', and enter the security code: 0697443DC7AF456C899B6035140A6BCF2 About Docusign Sign documents electronically in just minutes. It's safe, secure, and legally binding. Whether you're in an office, at home, on-the-go -- or even across the globe -- Docusign provides a professional trusted solution for Digital Transaction Management. Questions about the Document? If you need to modify the document or have questions about the details in the document, please reach out to the sender by emailing them directly. Stop receiving this email Report this email<https://us-east-2.protection.sophos.com?d=docusign.net&u=aHR0cHM6Ly9wcm90ZWN0LmRvY3VzaWduLm5ldC9yZXBvcnQtYWJ1c2U_ZT1BVXRvbWpwRmFrOUdsYlBMMHpGRmkxM1hvZTVVMEx4ODRFdmpsMnJaM0hJejlPMkpOWlZRc1AzYUlKWV85YkhGMmVacG9BUmdKUGJkV2RCeEFUb0JQWldRQVJaLUp3SDRwZW5uNzdsbk85OGR0OHB2YUZVRldjSi04WnpZVVZpaXRUaXRRdVFVc3A2akd4LUZKM2trX0ZqU3NMZ2pQMmhyckZ0YUpTSEhqNmY3SE44eVRINVQyOXRNNkNUdDlvSENsR0JIdUpJaFhocl9hSkcxVDR1N3RyLVF2bk5GV2IzUDBEZ1ZFTWVFeDJJa0NiNFdtbEd6NTh1XzBldFFaY0ZYeGt1VlBJMS02VHJicFZuOVREUF9zYUlURGIyQkZZSlpvSUs3V2dwLW56MVExdDlMVU96dU9kejQxLW9YSGNXdDdwSEw0Z0hDaTEyV01Ld1JncWtINjNIcmljcmdqT3BVZXFvYWdDY0JXS2R5UkJ0MXZ2R3NwXzZMcm9HeWZQOTctb25ZLVZiQTVHRHhicE5SVGdwSTRFSlM0TTFJa3JHWk5yTHEzalVQejlydlJCNUs3eEsycWQ3Y0NHRGR2RW13RkEmbGFuZz1lbg==&p=m&i=NjAwMDRkYmNjNzQ1NDY0ODkyYTNlZmQw&t=QldqMGgrWmpTSk4zUElPbTNFUWJZSHBtL0gySy9FNGYwaTRSaWFpUDg0OD0=&h=e31e2a87bb4847f999cfc79b960b4445&s=AVNPUEhUT0NFTkNSWVBUSVaRXvLxh7UTuVLmlaqXvLZH__URHKprSyEr4bUyaFsVWg> or read more about Declining to sign<https://us-east-2.protection.sophos.com?d=docusign.com&u=aHR0cHM6Ly9zdXBwb3J0LmRvY3VzaWduLmNvbS9lbi9ndWlkZXMvRGVjbGluaW5nLXRvLXNpZ24tRG9jdVNpZ24tU2lnbmVyLUd1aWRl&p=m&i=NjAwMDRkYmNjNzQ1NDY0ODkyYTNlZmQw&t=VEtMeDlKNEM1bUdmTUdZeE9kT3FFWERsQklWbWJSSU8xR1RHN2lFdTB0ND0=&h=e31e2a87bb4847f999cfc79b960b4445&s=AVNPUEhUT0NFTkNSWVBUSVaRXvLxh7UTuVLmlaqXvLZH__URHKprSyEr4bUyaFsVWg> and Managing notifications<https://us-east-2.protection.sophos.com?d=docusign.com&u=aHR0cHM6Ly9zdXBwb3J0LmRvY3VzaWduLmNvbS9lbi9hcnRpY2xlcy9Ib3ctZG8tSS1tYW5hZ2UtbXktZW1haWwtbm90aWZpY2F0aW9ucw==&p=m&i=NjAwMDRkYmNjNzQ1NDY0ODkyYTNlZmQw&t=RDBwdi9hVGJ0K1N4S1pvVlR3R3RHUTd6cEtwVXR0NmhWQlRnUFNvTDlxWT0=&h=e31e2a87bb4847f999cfc79b960b4445&s=AVNPUEhUT0NFTkNSWVBUSVaRXvLxh7UTuVLmlaqXvLZH__URHKprSyEr4bUyaFsVWg>. If you have trouble signing, visit "How to Sign a Document<https://us-east-2.protection.sophos.com?d=docusign.com&u=aHR0cHM6Ly9zdXBwb3J0LmRvY3VzaWduLmNvbS9zL2FydGljbGVzL0hvdy1kby1JLXNpZ24tYS1Eb2N1U2lnbi1kb2N1bWVudC1CYXNpYy1TaWduaW5nP2xhbmd1YWdlPWVuX1VTJnV0bV9jYW1wYWlnbj1HQkxfWFhfREJVX1VQU18yMjExX1NpZ25Ob3RpZmljYXRpb25FbWFpbEZvb3RlciZ1dG1fbWVkaXVtPXByb2R1Y3QmdXRtX3NvdXJjZT1wb3N0c2VuZA==&p=m&i=NjAwMDRkYmNjNzQ1NDY0ODkyYTNlZmQw&t=Zm4rUWtjVlVQbjBHbUVWVHJsNnI0WmgrdFRWd3YxMnd4Nlk1SlVQU1NjND0=&h=e31e2a87bb4847f999cfc79b960b4445&s=AVNPUEhUT0NFTkNSWVBUSVaRXvLxh7UTuVLmlaqXvLZH__URHKprSyEr4bUyaFsVWg>" on our Docusign Support Center<https://us-east-2.protection.sophos.com?d=docusign.com&u=aHR0cHM6Ly9zdXBwb3J0LmRvY3VzaWduLmNvbS8=&p=m&i=NjAwMDRkYmNjNzQ1NDY0ODkyYTNlZmQw&t=K0dHSXgwbitTRm0vWkVhWExkU1h2bXpydTBNNnVaRXhiNVhPdnFTZWdMZz0=&h=e31e2a87bb4847f999cfc79b960b4445&s=AVNPUEhUT0NFTkNSWVBUSVaRXvLxh7UTuVLmlaqXvLZH__URHKprSyEr4bUyaFsVWg>, or browse our Docusign Community<https://us-east-2.protection.sophos.com?d=docusign.com&u=aHR0cHM6Ly9jb21tdW5pdHkuZG9jdXNpZ24uY29tL2VzaWduYXR1cmUtMTExP3V0bV9jYW1wYWlnbj1HQkxfVVNfUFJEX0FXQV8yNDA1X0NvbW11bml0eUNUQSZ1dG1fbWVkaXVtPWVtYWlsJnV0bV9zb3VyY2U9cG9zdHNlbmQ=&p=m&i=NjAwMDRkYmNjNzQ1NDY0ODkyYTNlZmQw&t=bVd0RCswbE1XaWRlMjhYYmVSR1JyWm4zS3ArWFVTOGlyOUZheU4xNUJvYz0=&h=e31e2a87bb4847f999cfc79b960b4445&s=AVNPUEhUT0NFTkNSWVBUSVaRXvLxh7UTuVLmlaqXvLZH__URHKprSyEr4bUyaFsVWg> for more information. [Image removed by sender.]Download the Docusign App <https://us-east-2.protection.sophos.com?d=docusign.com&u=aHR0cHM6Ly93d3cuZG9jdXNpZ24uY29tL2ZlYXR1cmVzLWFuZC1iZW5lZml0cy9tb2JpbGU_dXRtX2NhbXBhaWduPUdCTF9YWF9EQlVfVVBTXzIyMTFfU2lnbk5vdGlmaWNhdGlvbkVtYWlsRm9vdGVyJnV0bV9tZWRpdW09cHJvZHVjdCZ1dG1fc291cmNlPXBvc3RzZW5k&p=m&i=NjAwMDRkYmNjNzQ1NDY0ODkyYTNlZmQw&t=SVRMR1ErZmFkTmN6NUhZc2NYK1JyN0xwR2ZRZDBqcmlTOTgrMysrMXRYcz0=&h=e31e2a87bb4847f999cfc79b960b4445&s=AVNPUEhUT0NFTkNSWVBUSVaRXvLxh7UTuVLmlaqXvLZH__URHKprSyEr4bUyaFsVWg> This message was sent to you by Docusign - Licensing Board Of Directors who is using the Docusign Electronic Signature Service. If you would rather not receive email from this sender you may contact the sender with your request.
Attachments:	~WRD0000.jpg image001.png image002.png

Headers

Key	Value
Received	from YT2PR01MB9780.CANPRD01.PROD.OUTLOOK.COM ([fe80::b34d:65fc:958b:d436]) by YT2PR01MB9780.CANPRD01.PROD.OUTLOOK.COM ([fe80::b34d:65fc:958b:d436%5]) with mapi id 15.20.8114.031; Tue, 5 Nov 2024 22:26:49 +0000
Authentication-Results	spf=pass (sender IP is 40.93.18.4) smtp.mailfrom=mccallumsather.com; dkim=fail (body hash did not verify) header.d=mccallumsather.onmicrosoft.com;dmarc=bestguesspass action=none header.from=mccallumsather.com;compauth=pass reason=109
Received-SPF	SoftFail (protection.outlook.com: domain of transitioning mccallumsather.com discourages use of 103.246.251.226 as permitted sender)
X-Sophos-Product-Type	Mailflow
X-Sophos-Email-ID	0aeb6846972c41ab9127ca624e341f4d
Authentication-Results-Original	dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=mccallumsather.com;
ARC-Seal	i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=Cx+UF5jMoYYsBEkb1VX6ssreUr3EVer9UJf1dlOPiqHWol6C68Owo803i4e6OWnk29LWf8ACNQPZ06eu2J5fBS4/DA+0P8aWC0C2MjUvet1l2+CcWuMfAaq49Nze01L/ZXUEj06zeu/z46otPVjkOu+pn1A0hjUjj/vZ9UqwFO510u/fx904cuVhFMWcrgzcpEzImFvSBGyGgvO7bXq/TKlgEvjmvEA6Zyhp8J95F4oH8CjzjYLBjw+xYUh3ug/qhWWDTYB5KHVgFr5k+kr0pc3/hNurjRZVKOwDCpC6B+iTPTw0dOWmsnuxwbhADA5cGgvnts2+PdnEl9zz/p2pEA==
ARC-Message-Signature	i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=D+RAVhRblJpcE9caHYV1mmNm+PT3jv/VLyWNjqoHXWs=; b=JJbDg+RiLFU/Z6QORkQYH+3LsqlPENg0V/bwK+NO1ysjTrXw9RJGrUKKNZvU0xGrtaaTO113qp71Y8IuVQVcn1ILRWPUiTcxzV5WJRPWx6QuKIjlnlRB+ThBl5/TZg2cgGi0awChv0xlMFsmnjKcSSpZC3wJC9MmNFL7EdAieqvzKdAcJgO4uKkwGDg7xl6Qi4+7HekSiL8RLp1HRo70psD2EahL+b6WNA7rvY1ZlcSyQJHHldgFRtmPrCRR8RgXF9qeD80YoY6qBYbN/ioAoqdkVQcWUcp60L1tHSWdXwkPUoVvXf38u0XtNEDr0EPyKeq8zs2K4yUMSplg8PiK/A==
ARC-Authentication-Results	i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=mccallumsather.com; dmarc=pass action=none header.from=mccallumsather.com; dkim=pass header.d=mccallumsather.com; arc=none
DKIM-Signature	v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; t=1730845609; s=v1; d=mail-dkim-us-east-2.prod.hydra.sophos.com; h=Content-Type:Date:Subject:To:From; bh=cAMagNGKB1e+QsUfpzsixFW+or0ALRwqgCAYHB4NvKg=; b=qqPhyDvdP1mW7+bkni60ojV1Fs8zly3YqLEE5yG797+i8w0mR7qS4YlGs08ZWcQP goK2xHOMDy6swSyM7LoOxCsOBPpZXQvjmdSIUC3nPPoB9lxGLhVjkH10J2qPjCV8Zb4 S2f7mOuLKLNz0KEbRL9Tq1CSy+u97/Tv8l4DKbb9PXZJYKTEyfYoGFzFJBKuK/nnpfV 6aiYkitEVCLU9gtOv49W1eTXNno5dyLUgDDSv9FuGrE1kwlfsDlUxpx0Mw+JPGLThnY f9iqZukr62X9zKJloD/cfsggi/sQyfEy5SpPDNutc499mL9o24z/kI53sC4CZb+3++y fHRSFSS9jQ==
X-MS-Exchange-Authentication-Results	spf=softfail (sender IP is 103.246.251.226) smtp.mailfrom=mccallumsather.com; dkim=pass (signature was verified) header.d=mail-dkim-us-east-2.prod.hydra.sophos.com;dmarc=none action=none header.from=mccallumsather.com;
From	Heather Gordon <heatherg@mccallumsather.com>
To	Quadbridge Support <support@quadbridge.com>
Subject	FW: Review_&_sign_Docu: #31617 Contract_Agreement: Docusign Licensing Board Of Directors.pdf
Thread-Topic	Review_&_sign_Docu: #31617 Contract_Agreement: Docusign Licensing Board Of Directors.pdf
Thread-Index	AQHbK7h/Qk4wv2JVE0qhT55oX4FY/7Ko/mYAgABNndA=
Date	Tue, 05 Nov 2024 22:26:49 +0000
Message-ID	<YT2PR01MB97804BD94B164D3100F859FFB8522@YT2PR01MB9780.CANPRD01.PROD.OUTLOOK.COM>
References	<e1fe96e2e1ea4be9aee9a236784b001e@docusign.net> <YT1PR01MB9338A2630767858B901D911AB4522@YT1PR01MB9338.CANPRD01.PROD.OUTLOOK.COM>
In-Reply-To	<YT1PR01MB9338A2630767858B901D911AB4522@YT1PR01MB9338.CANPRD01.PROD.OUTLOOK.COM>
Accept-Language	en-US
Content-Language	en-US
X-MS-Has-Attach	yes
X-MS-TNEF-Correlator
x-ms-traffictypediagnostic	YT2PR01MB9780:EE_\|YT3PR01MB8209:EE_\|TO1PEPF00005347:EE_\|YQBPR0101MB6473:EE_\|QB1PEPF00004E08:EE_\|YT3PR01MB9249:EE_\|YT2PEPF000001CB:EE_\|YQBPR0101MB9551:EE_\|YQBPR0101MB5079:EE_
X-MS-Office365-Filtering-Correlation-Id	239bd274-365f-4988-d4c8-08dcfde8fdc4
X-MS-Exchange-SenderADCheck	1
X-MS-Exchange-AntiSpam-Relay	0
X-Microsoft-Antispam-Untrusted	BCL:0; ARA:13230040\|240411011799012\|35042699022\|8096899003;
X-Microsoft-Antispam-Message-Info-Original	0EGRtpmNZWZe5FDdef/3DFPfH9L8Cw9JyKQr5FKmQkP7aEcsWsTkkupWK1SDhVDmgd6e/G/MYd3EAQZ6Y/yWzxmh7yzEM2BCT3TA0vF+1hNUtyFpJoNFfJzDMiEBhTdmlkCf71eO4oNTahYr1vhEFxe8ILeppmo86E2ONSHCSd3sy/KzJEf9FFPWEZghQYdxCMCmT0Wx6FPBXYHWlgAX7UZkmXpAw5r4VqasYCXGShcwZssav5hpHswMlnsoykxB4C8eMmZNOUlyCwldzwIYj61LF63Q0tr3eMWNIBllvTpe5U8j0qNjrJUBbn0nQOvVHbt53sDTUGwjXpjoWyNukH9rkaXe6omB1v92Tf6SMXRw3IvzDX8d1uh7qslrx4GFx4GF4X2V09u8n2i6es/cTlTo4UlsabMYpmvOcGNyUl7l2FxdPJ93g4dODUtieiCjoALVYv+khN/Dh40qLkqhj5GINg/1IYIsQzlS2oCEvgJv9yVBsPO038FfcwOjXyw3W8bamgOlvz0IWmVZOCaRMsdX0istvwcyF1SHw2ONl59KAVZHfJqsPcKxQo8JZVxSwvh6ETEvW6R/DLgWIJR3LgHc0QJh8L9Kkm4S8HoDRWSGaUV/W0Rd85DxpNiD6aSU20965EO60x6mEz3NchifOrpiV6cf39aOTzLK9ObckFNR+1fnyuhLeIGIJD14ypwe275zJE9eZRAwi704G4ck3vHLYEgfgRAzIl6lrt6hQeMZ2DSf2lBrVGVuaukcf45rjSglXCqyG1b24uEoXs6cAOex6ZIlWjARXDcOwmAciZnrZQl8QISzWwKwSHQP/AiY9hImx4DcREABABxiRjcDyGl43tFS0ohrVBsRwcs7e7USRVAgBP7GiAD6SgYqqp2ZeAoxdJcyFZcYPnywPiyVkJyUmFfmhRJAi0sf7jskSuxIE07dqbGZ9i7sfUgbnKqMISrsVzfeRCZpXshraTs37zDQRnHkyZyZhsRnI4xCjRireqfF8IYhZCvQGWNBeUhO80JWcSinzUhI/UErsxBPvM7hgsDEdeo2FAlAuwhVYhWqZKG4V0Vi0Y+pGqFDN4f4iv2c86mDe5EcTn9wTcWzK08rtJEUTnUIWaNT2Uodzp1cveLXaoBpeagQakz9X5RWqkfD8lcc8WtHT4IeEgKRt3fXmPIplbt5WmU6EYiPoHD+yMWRREJpS5xl+TsEBuCqSgxihZmiIxfgOyscI19ktT4hUNpAnPnDNgmgQ+tpdw6jHR12S4h4SCoINbAOnPC+SHmFql+7aWoEUsHMBJlgTmZ5Bhua7uSxWaor2lIHPH8jXCQ6XZybaMG9xjgwqZGf9DDLKs6glJwdLaRpDlxVh9EHgC+FosGkTp1rZyK7RPyjzawwvwdKKC0OQ+NzDsixAXUpxtH9yom5FYgahMkC4TaAl2wq+wUczclDUfI21YQINoJJEa0ncXT95mIl7i4F0HyIgeXmGTTmhfWScCIOabpZaG+Jq0fN89wv63c30pjAffVytzpCzAI61aETFv9aih0kiq1jg5gcTohw3uu4Q+4+nJ36vLao+3ncG3hJEoqnztPke6tqyqYt6spVxmyYrqwVkf3jNOWihPOnChqAR8P2iK7LgKL1+bf1w5B4rwyGTHIp/mKTrT/w7yQiERs7NubBdiBtZuU9I0jmDA+2LL5pQA/YF0F8psLjZo+4841ZZ/hPMZSCuNhd01EV6qBDySi3fmDBsOSdJE2Vo3pHqSNtugQ8sC6DIwbvaG8uBYD+uSDCj+XLOv87qnr8BvwwuFa8q//TlNWdryuCgVtUYWEvrT2J0etYRckJ7h5hka+JD8rEXl8Pp4bI1KrbMbLm
X-Forefront-Antispam-Report-Untrusted	CIP:52.101.189.137; CTRY:CA; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:YT3PR01CU008.outbound.protection.outlook.com; PTR:mail-canadacentralazon11020137.outbound.protection.outlook.com; CAT:NONE; SFS:(13230040)(240411011799012)(35042699022)(8096899003); DIR:INB;
Content-Type	multipart/related; boundary="_006_YT2PR01MB97804BD94B164D3100F859FFB8522YT2PR01MB9780CANP_"; type="multipart/alternative"
X-MS-Exchange-Transport-CrossTenantHeadersStamped	YQBPR0101MB9551
X-Sophos-Email	[eu-west-1] Antispam-Engine: 6.0.0, AntispamData: 2024.11.5.213615
X-LASED-From-ReplyTo-Diff	From:<ableone.com>:11
X-LASED-SpamProbability	0.081286
X-LASED-Hits	ARCAUTH_PASSED 0.000000, BODYTEXTH_SIZE_3000_MORE 0.000000, BODY_SIZE_10000_PLUS 0.000000, BODY_SIZE_25K_PLUS 0.000000, BODY_SIZE_50K_PLUS 0.000000, DKIM_SIGNATURE 0.000000, DQ_S_H 0.000000, HTML_70_90 0.100000, IMG_AR_1 0.000000, IMG_ATTACHED_2P 0.000000, IMP_FROM_NOTSELF 0.000000, INBOUND_SOPHOS 0.000000, INBOUND_SOPHOS_TOP_REGIONS 0.000000, IN_REP_TO 0.000000, JPG_COMMON_HEADER_ORDER 0.000000, JPG_PIXPERBYTE_HIGH 0.000000, JPG_SPAMMY_SEGMENT 0.000000, JPG_SPAMMY_Y_RESOLUTION 0.000000, JPG_SPAM_ATTACHED 0.000000, KNOWN_MTA_TFX 0.000000, LEGITIMATE_SIGNS 0.000000, MSG_THREAD 0.000000, MULTIPLE_ATTACHMENTS 0.000000, NO_FUR_HEADER 0.000000, NO_URI_HTTPS 0.000000, PNG_PIXPERBYTE_LOW 0.000000, REFERENCES 0.000000, SUPERLONG_LINE 0.050000, SUSP_DH_NEG 0.000000, SXL_IP_TFX_WM 0.000000, WEBMAIL_SOURCE 0.000000, __ANY_URI 0.000000, __ARCAUTH_DKIM_PASSED 0.000000, __ARCAUTH_DMARC_NONE 0.000000, __ARCAUTH_DMARC_PASSED 0.000000, __ARCAUTH_PASSED 0.000000, __ARC_SEAL_CV_FAIL 0.000000, __ARC_SEAL_MICROSOFT 0.000000, __ARC_SIGNATURE_MICROSOFT 0.000000, __ATTACH_CTE_BASE64 0.000000, __AUTH_RES_DKIM_PASS 0.000000, __AUTH_RES_ORIG_DKIM_NONE 0.000000, __AUTH_RES_ORIG_DMARC_NONE 0.000000, __AUTH_RES_PASS 0.000000, __BEC_SUBJ_KEYWORD 0.000000, __BODY_TEXT_X4 0.000000, __BOUNCE_NDR_SUBJ_EXEMPT 0.000000, __CID_8_DOT_8 0.000000, __CP_MEDIA_BODY 0.000000, __CP_URI_IN_BODY 0.000000, __CT 0.000000, __CTYPE_HAS_BOUNDARY 0.000000, __CTYPE_MULTIPART 0.000000, __CTYPE_MULTIPART_ALT 0.000000, __DOCUSIGN_REF 0.000000, __DQ_D_H 0.000000, __DQ_IP_FSO_LARGE 0.000000, __DQ_NEG_DOMAIN 0.000000, __DQ_NEG_HEUR 0.000000, __DQ_NEG_IP 0.000000, __DQ_S_DOMAIN_HD_10_P 0.000000, __DQ_S_DOMAIN_HD_1_P 0.000000, __DQ_S_DOMAIN_HD_20_P 0.000000, __DQ_S_DOMAIN_HD_5_P 0.000000, __DQ_S_DOMAIN_HIST_1 0.000000, __DQ_S_DOMAIN_MC_100_P 0.000000, __DQ_S_DOMAIN_MC_10_P 0.000000, __DQ_S_DOMAIN_MC_1K_P 0.000000, __DQ_S_DOMAIN_MC_1_P 0.000000, __DQ_S_DOMAIN_MC_50_P 0.000000, __DQ_S_DOMAIN_MC_5_P 0.000000, __DQ_S_DOMAIN_RE_49_L 0.000000, __DQ_S_DOMAIN_RE_99_L 0.000000, __DQ_S_DOMAIN_SP_0_P 0.000000, __DQ_S_HIST_1 0.000000, __DQ_S_HIST_2 0.000000, __DQ_S_IP_HD_10_P 0.000000, __DQ_S_IP_MC_100_P 0.000000, __DQ_S_IP_MC_10_P 0.000000, __DQ_S_IP_MC_1_P 0.000000, __DQ_S_IP_MC_5_P 0.000000, __DQ_S_IP_RE_0 0.000000, __DQ_S_IP_RE_49_L 0.000000, __DQ_S_IP_RE_4_L 0.000000, __DQ_S_IP_RE_99_L 0.000000, __DQ_S_IP_RE_9_L 0.000000, __DQ_S_IP_SC_1_P 0.000000, __DQ_S_IP_SC_5_P 0.000000, __EXTRA_MPART_TYPE_1 0.000000, __EXTRA_MPART_TYPE_N1 0.000000, __FILESHARE_PHRASE 0.000000, __FRAUD_MONEY_DENOMINATION 0.000000, __FUR_RDNS_OUTLOOK 0.000000, __HAS_ATTACHMENT 0.000000, __HAS_ATTACHMENT1 0.000000, __HAS_ATTACHMENT2 0.000000, __HAS_FROM 0.000000, __HAS_HTML 0.000000, __HAS_MSGID 0.000000, __HAS_REFERENCES 0.000000, __HAS_X_FF_ASR 0.000000, __HAS_X_FF_ASR_CAT 0.000000, __HAS_X_FF_ASR_SFV 0.000000, __HTML_BAD_END 0.000000, __HTML_BOLD 0.000000, __HTML_ENTITIES_X4 0.000000, __HTML_FONT_BLUE 0.000000, __HTML_TAG_DIV 0.000000, __IMG_ATTACHED 0.000000, __IMG_SIZE_1K_10K 0.000000, __IMP_FROM_NOTSELF 0.000000, __INBOUND_SOPHOS_EU_WEST_1 0.000000, __INTERNAL_SOPHOS 0.000000, __IN_REP_TO 0.000000, __JPG_AR_1 0.000000, __JPG_HEIGHT_100 0.000000, __JPG_SPAMMY_SEGMENT_2 0.000000, __JPG_SPAMMY_Y_RESOLUTION_3 0.000000, __JPG_WIDTH_100 0.000000, __JSON_HAS_MODELS 0.000000, __JSON_HAS_SCHEMA_VERSION 0.000000, __JSON_HAS_SENDER_AUTH 0.000000, __JSON_HAS_TENANT_DOMAINS 0.000000, __JSON_HAS_TENANT_ID 0.000000, __JSON_HAS_TENANT_SCHEMA_VERSION 0.000000, __JSON_HAS_TENANT_VIPS 0.000000, __JSON_HAS_TRACKING_ID 0.000000, __MAIL_CHAIN 0.000000, __MIME_ATTACHMENT_1_N 0.000000, __MIME_ATTACHMENT_N_2 0.000000, __MIME_ATTACHMENT_N_3 0.000000, __MIME_ATTACHMENT_N_4 0.000000, __MIME_HTML 0.000000, __MIME_TEXT_H 0.000000, __MIME_TEXT_H1 0.000000, __MIME_TEXT_H2 0.000000, __MIME_TEXT_P 0.000000, __MIME_TEXT_P1 0.000000, __MIME_TEXT_P2 0.000000, __MIME_VERSION 0.000000, __MSGID_32_64_CAPS 0.000000, __MTHREAT_0 0.000000, __MTL_0 0.000000, __MULTIPLE_URI_TEXT 0.000000, __PART_TYPE_HTML 0.000000, __PHISH_PHRASE10 0.000000, __PNG_WIDTH_100 0.000000, __RCVD_PASS 0.000000, __RDNS_WEBMAIL 0.000000, __REFERENCES 0.000000, __RUS_OBFU_PHONE 0.000000, __SANE_MSGID 0.000000, __SCAN_DETAILS 0.000000, __SCAN_DETAILS_SANE 0.000000, __SCAN_DETAILS_TL_0 0.000000, __SCAN_D_NEG 0.000000, __SCAN_D_NEG2 0.000000, __SCAN_D_NEG_HEUR 0.000000, __SCAN_D_NEG_HEUR2 0.000000, __STYLE_RATWARE_NEG 0.000000, __STYLE_TAG 0.000000, __SUBJ_ALPHA_NEGATE 0.000000, __SUBJ_ENDS_IN_FILE_EXT 0.000000, __SUBJ_FORWARD 0.000000, __TAG_EXISTS_BODY 0.000000, __TAG_EXISTS_HEAD 0.000000, __TAG_EXISTS_HTML 0.000000, __TAG_EXISTS_META 0.000000, __TO_MALFORMED_2 0.000000, __TO_NAME 0.000000, __TO_NAME_DIFF_FROM_ACC 0.000000, __TO_REAL_NAMES 0.000000, __URI_ENDS_IN_SLASH 0.000000, __URI_IN_BODY 0.000000, __URI_IN_BODY_HTTP_X10 0.000000, __URI_MAILTO 0.000000, __URI_NOT_IMG 0.000000, __URI_NO_PATH 0.000000, __URI_NS 0.000000, __URI_NS_NXDOMAIN 0.000000, __URI_REDIR 0.000000, __URI_WITHOUT_PATH 0.000000, __X_FF_ASR_SCL_NSP 0.000000, __X_FF_ASR_SFV_NSPM 0.000000
X-LASED-Impersonation	False
X-LASED-Spam	NonSpam
X-Sophos-Mailflow-Processing-Id	f1e2ab26d2fb49e0a89c6bb67212f649
X-EOPAttributedMessage	2
X-MS-Exchange-Transport-CrossTenantHeadersStripped	YT2PEPF000001CB.CANPRD01.PROD.OUTLOOK.COM
X-MS-Office365-Filtering-Correlation-Id-Prvs	3c4af8f0-77fa-4b42-281b-08dcfde8f578
X-EOPTenantAttributedMessage	7136a643-f43a-4e59-b470-0f0804af0ab7:1
X-MS-Exchange-Transport-CrossTenantHeadersPromoted	QB1PEPF00004E08.CANPRD01.PROD.OUTLOOK.COM
X-MS-Exchange-AtpMessageProperties	SA\|SL
Content-Transfer-Encoding	8bit
X-Sophos-Email-Scan-Details	27140d1e1540510e7e771140550e7d75
X-Sophos-SenderHistory	ip=52.101.189.137, fs=11439433, fso=11439433, da=224304235, mc=969, sc=8, hc=961, sp=1, re=0, sd=0, hd=19
X-Sophos-DomainHistory	d=mccallumsather.com, fs=52474150, fso=65947081, da=85047059, mc=3931, sc=0, hc=3931, sp=0, re=21, sd=0, hd=20
X-Sophos-MH-Mail-Info-Key	NFhqamN0MERHbXpLbTRmLTE3Mi4xOS4xLjEwNg==
Return-Path	heatherg@mccallumsather.com
X-MS-Exchange-Organization-ExpirationStartTime	05 Nov 2024 22:27:11.1542 (UTC)
X-MS-Exchange-Organization-ExpirationStartTimeReason	OriginalSubmit
X-MS-Exchange-Organization-ExpirationInterval	1:00:00:00.0000000
X-MS-Exchange-Organization-ExpirationIntervalReason	OriginalSubmit
X-MS-Exchange-Organization-Network-Message-Id	239bd274-365f-4988-d4c8-08dcfde8fdc4
X-MS-Exchange-Organization-MessageDirectionality	Incoming
X-MS-Exchange-SkipListedInternetSender	ip=[40.93.18.4];domain=YT3PR01CU008.outbound.protection.outlook.com
X-MS-Exchange-ExternalOriginalInternetSender	ip=[40.93.18.4];domain=YT3PR01CU008.outbound.protection.outlook.com
X-MS-PublicTrafficType	Email
X-MS-Exchange-Organization-AuthSource	YT2PEPF000001CB.CANPRD01.PROD.OUTLOOK.COM
X-MS-Exchange-Organization-AuthAs	Anonymous
X-MS-Exchange-Organization-SCL	-1
X-Microsoft-Antispam	BCL:0;ARA:13230040\|240411011799012\|2040899013\|34020700016\|82310400026\|35042699022\|8096899003;
X-Forefront-Antispam-Report	CIP:198.154.180.195;CTRY:CA;LANG:en;SCL:-1;SRV:;IPV:NLI;SFV:SKN;H:YT3PR01CU008.outbound.protection.outlook.com;PTR:mail-canadacentralazlp17010004.outbound.protection.outlook.com;CAT:NONE;SFS:(13230040)(240411011799012)(2040899013)(34020700016)(82310400026)(35042699022)(8096899003);DIR:INB;
X-MS-Exchange-CrossTenant-OriginalArrivalTime	05 Nov 2024 22:27:10.8730 (UTC)
X-MS-Exchange-CrossTenant-Network-Message-Id	239bd274-365f-4988-d4c8-08dcfde8fdc4
X-MS-Exchange-CrossTenant-Id	7136a643-f43a-4e59-b470-0f0804af0ab7
X-MS-Exchange-CrossTenant-AuthSource	YT2PEPF000001CB.CANPRD01.PROD.OUTLOOK.COM
X-MS-Exchange-CrossTenant-AuthAs	Anonymous
X-MS-Exchange-CrossTenant-FromEntityHeader	Internet
X-MS-Exchange-Transport-EndToEndLatency	00:00:04.2360372
X-MS-Exchange-Processed-By-BccFoldering	15.20.8137.018
X-Microsoft-Antispam-Mailbox-Delivery	ucf:0;jmr:0;auth:0;dest:I;ENG:(910001)(944506478)(944626604)(920097)(930097)(140003);
X-Microsoft-Antispam-Message-Info	jPaLq7mIQunrQJoxNyvPhiNpwPqF6WxVQaVQcHqO73AsmZh9qYFUS/z19mkJ4Gzg3+1+murii2inqi/SoHPaTwXj7vgpRV0d53UBaPzyGFd6Ym9tatLZD6blcfF+Pvj5iUtpKtWfMGiSdKvOgq5Md7JeYdwVNzITLw2Xlf/84m6KUpXU1cnaTkdxN5HOILQJyqPlYxv+E9znLL6RXe8eVs+DmycX9hg6tHB34UR9LORDXF5eqUDkkBqGx6+cGFY/QlBSCiR8quaWlau49c1F7YFAC7Xe6dZ1zN6Tx4Xjl+fbS9I81fgzZiIhh6Ebc9FMrQJYUqpl3MEU7kxwK6KCwAOyLx/VNLrpOPtciozZjx8AtWtJJqBgAJ7xV1KZUiTCzLOHqAxPVUmk2jONXIYU6EjvtaHAznHu1k/1RIxMS9q8THwX+abcEBgih1g3h/WarSzsNTz721JXj1bZbSaCrrqQ/MNi+O4KoBb1kzbUJ9MR4eUgcdwzn8uPQZchpPOW39XLIMRpH0bWkx+GVGRT8H7eFpWpx8q0gDcLsYBi5fNwU/7yTi1yXUur8XhP1GsXpsCw5AEwGNoDLU3CU82LR5cPNzLfbjhnfbjE3laMnLP5eYFF+ycDakOnuZa8b4DX3NVBr2TiE4j2+XjlyIC2ZHWH+v/8aELEZHnCdjCPwZZUQLuWTjtLPlF4ktnIzrS3uR2tj6mKEzW+zHSK+nmkdw3PjiwWJijQgoizD2IX1vAFOOgZXsF/lKZnVZFN3i6bVN6nEnvGWEZ4QbZ5Q0xCZcHUMUyBgGE0ZwNOLheuJYB/G02lCqiQsYALWGqXHGCAB4cObjxCV779BW68WWP1pquCNdBHvpZIz2eyUd13/9IpK4ezXu2nvBcIWMxz0NatxvOLJ613/aYGw5Er3PdcuE+xtpy0r/IypYwpTox0gYk/7mlQYySjfThtbVoAqL9vHFIDrRArwZcOK0pa+DWq6KTrZVmuPZZXdm3Lg0QrvJ+yYnyGvik9wOsT5hPxozielSSv66y7BSeTVk/NqiN2IWzMEtHEFKb+VzWzoUP0fykB+lqMDF1IFvd+JlguIRomRqU6zow6viZ63KPudUHDmaERIFvHbtjC91NEyjBwxYqyGz/uImyl+1EXh3DI8iS+CC3jpQFk4N8mmHo0oJ8kJTUgKk+TpbGXUd7kKXp5f2et7H6ARfacaQ+ec4XviuqwgpbkMRXbhZVdmE+j1f57U9j8NJr7gmVvwJ9Bkti6Ef01YoQ91MmFdLb9XS8L05BliQcEDFTFja6+lunJimu3pmmX5MsyF4ILLyzAdsnZ+raJe2N++vVPEDGYU/UD/fWmDQXdRTNk0sEbHAUcwZqN4a0rsKXaA+hz+unUtz/J/88rwIsQhVomTvbPEd4DD7ZbzMNTKYkiym/ZfmBmUHW2CN+WMy2AKHRshNFfQmuY/dEx86dPds4NAFuq5VbnS6Zdr3yXNeuCmb6+tcoCNtW1BjphHDVqysbdKYE88HpALfkHPghN1SmetK8SFjxOUreFvu8uwFy5sBZDM/d7aMqfucwR+0YN/bRm5gQkv5+x/4J3gdAGC0VD+4/kExAKqhpyzsqOX3VYbE+Jfzhf18XVaYBD2Zc8sJdIBjdjOpuiWLEwBGGRgb7Z15eSAlNkI+Lou8A9eALdXKlbnqhZGBsUMHfYqRicEWBO98xCuzF2N+rhoYdpM2UdiuRLQrJ7IE0RMGXVGzAZX1EhdemliR0pFpCeNIB7AdG3MbobHZXNtHJzQJQoICGsxfLz5Ix/vSTVu8OpbV803FtPMM60/XJEM+FlZlxl6ztgVw/x9zw5Pce1t/4PbvgRfGjakc/M6ITZ3dWIj2OVpLmVThaeYnNdLlOYS0XEOF3M2Soh0CkVt5cliRhuhuPSjaqKgZ3Djoi6a9s9jmrLQHOgCWJ2NMUfmcEuNNTxF8SAVIJK+QOQYSesQtQOLrw23Zn1sqfHU5xmvsJHKG80J7kVrPqdQ3N+8qSvzF6xQUxzWJZKUWPluonhciBuqYswIvttl5bNUPNbnQ0pvjHNjrXu6ogWrB6S4UX7QA6XSsNBQr3Fz4NaG3eNjiUPb07eC6cn6yHP3dsq684HCwkznyiS7Wo0kkeu0zwQrm/JwMqiWzlMvxH0DDjjN496J+1zCerKrt+b/WtK
MIME-Version	1.0

File Icon


Icon Hash:	46070c0a8e0c67d6

Description:	Adversaries may abuse Internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality and customize aspects of Internet browsers. They can be installed directly or through a browser's app store and generally have access and permissions to everything that the browser can access.
Tactics:	Persistence
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Process: Process Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report FW+Review_&_sign_Docu+#31617+Contract_Agreement+Docusign+Licensing+Board+Of+Directors.pdf.eml

Overview

General Information

Detection

Signatures

Classification

Process Tree

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

LLM Input / Output

Created / dropped Files

C:\Program Files (x86)\Microsoft Office\root\vfs\Common AppData\Microsoft\OFFICE\Heartbeat\HeartbeatCache.xml

C:\Users\user\AppData\Local\Microsoft\FORMS\FRMCACHE.DAT

C:\Users\user\AppData\Local\Microsoft\FontCache\4\CatalogCacheMetaData.xml

C:\Users\user\AppData\Local\Microsoft\FontCache\4\CloudFonts\Open Sans\21798841561.ttf

C:\Users\user\AppData\Local\Microsoft\FontCache\4\CloudFonts\Open Sans\23165521968.ttf

C:\Users\user\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntities.bin

C:\Users\user\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntitiesUpdated.bin

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-shm

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-wal

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\4422C340.dat

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\BAFDE77B.dat

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\C3B510E2.dat

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{BD2F59AC-6F6D-49EE-87C7-489FFF7EF623}.tmp

C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1730850580577062800_C54C532E-C668-477A-BE27-B05DD8C1D118.log

C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1730850580577976300_C54C532E-C668-477A-BE27-B05DD8C1D118.log

C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20241105T1849180168-6444.etl

C:\Users\user\AppData\Local\Temp\~DF105685B541FF05F5.TMP

C:\Users\user\AppData\Local\Temp\~DF94EE4F805E25F5E6.TMP

C:\Users\user\AppData\Roaming\Microsoft\Office\MSO3072.acl

C:\Users\user\AppData\Roaming\Microsoft\Outlook\NoEmail.srs

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

C:\Users\user\Documents\Outlook Files\Outlook Data File - NoEmail.pst

C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp

Chrome Cache Entry: 82

Chrome Cache Entry: 83

Chrome Cache Entry: 84

Chrome Cache Entry: 85

Windows Analysis Report
FW+Review_&_sign_Docu+#31617+Contract_Agreement+Docusign+Licensing+Board+Of+Directors.pdf.eml