Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
SPECIAL PARTY INVITATION FROM DON & LINDA HUFFMAN.msg

Overview

General Information

Sample name:SPECIAL PARTY INVITATION FROM DON & LINDA HUFFMAN.msg
Analysis ID:1559594
MD5:4808e757524494aa70a53c1fc51da08a
SHA1:f79e77711e9206e1d28036d04f60cbe85abab065
SHA256:81e838109a2562be17ef0c78a5ad1ccb623e7578b09f6da2f1f11f7ce0cd407b
Infos:

Detection

Score:48
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

AI detected potential phishing Email
AI detected suspicious URL
Creates a window with clipboard capturing capabilities
Queries the volume information (name, serial number etc) of a device
Sigma detected: Office Autorun Keys Modification
Sigma detected: Suspicious Office Outbound Connections
Stores files to the Windows start menu directory

Classification

Process Tree

  • System is w10x64_ra
  • OUTLOOK.EXE (PID: 6284 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /f "C:\Users\user\Desktop\SPECIAL PARTY INVITATION FROM DON & LINDA HUFFMAN.msg" MD5: 91A5292942864110ED734005B7E005C0)
    • ai.exe (PID: 3532 cmdline: "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "ABD39F87-8A75-4DCC-B530-28C12EDF1023" "94523D3A-4AF8-4A0E-8706-DBAFC190AC76" "6284" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx" MD5: EC652BEDD90E089D9406AFED89A8A8BD)
    • chrome.exe (PID: 4528 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://clicktime.cloud.postoffice.net/clicktime.php?U=https://punchmeetdirect.info/&E=mbaker%40firstfedweb.com&X=XID170CkgR4R5051Xd2&T=FF1001&HV=U,E,X,T&H=7657709960056573da15999e9daa042b06812829 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
      • chrome.exe (PID: 3952 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 --field-trial-handle=1976,i,358040738047237826,1585800261428372017,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
    • chrome.exe (PID: 4284 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://clicktime.cloud.postoffice.net/clicktime.php?U=https://punchmeetdirect.info/&E=mbaker%40firstfedweb.com&X=XID170CkgR4R5051Xd2&T=FF1001&HV=U,E,X,T&H=7657709960056573da15999e9daa042b06812829 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
      • chrome.exe (PID: 5924 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 --field-trial-handle=1920,i,17810555083446517996,17943394476834074122,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
    • chrome.exe (PID: 2460 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://clicktime.cloud.postoffice.net/clicktime.php?U=https://punchmeetdirect.info/&E=mbaker%40firstfedweb.com&X=XID170CkgR4R5051Xd2&T=FF1001&HV=U,E,X,T&H=7657709960056573da15999e9daa042b06812829 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
      • chrome.exe (PID: 4184 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 --field-trial-handle=1980,i,5823437227513229803,3242566091566292035,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
  • cleanup

Yara Signatures

⊘No yara matches

Sigma Signatures

Sigma detected: Office Autorun Keys Modification
Source: Registry Key setAuthor: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 , EventID: 13, EventType: SetValue, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE, ProcessId: 6284, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Addins\OneNote.OutlookAddin\1
Sigma detected: Suspicious Office Outbound Connections
Source: Network ConnectionAuthor: X__Junior (Nextron Systems): Data: DestinationIp: 192.168.2.16, DestinationIsIpv6: false, DestinationPort: 49716, EventID: 3, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE, Initiated: true, ProcessId: 6284, Protocol: tcp, SourceIp: 87.248.114.16, SourceIsIpv6: false, SourcePort: 443

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Phishing

barindex
AI detected potential phishing Email
Source: EmailJoe Sandbox AI: Detected potential phishing email: All invitation links redirect to a suspicious domain 'punchmeetdirect.info' instead of legitimate Punchbowl.com domain. The email uses urgency and social engineering by claiming to be from family members to encourage clicking. Multiple tracking parameters and redirects in URLs suggest sophisticated phishing infrastructure
AI detected suspicious URL
Source: EmailJoe Sandbox AI: AI detected Brand spoofing attempt in URL: https://clicktime.cloud.postoffice.net
Source: https://clicktime.cloud.postoffice.net/clicktime.php?U=https://punchmeetdirect.info/&E=mbaker%40firstfedweb.com&X=XID170CkgR4R5051Xd2&T=FF1001&HV=U,E,X,T&H=7657709960056573da15999e9daa042b06812829HTTP Parser: No favicon
Source: https://clicktime.cloud.postoffice.net/clicktime.php?U=https://punchmeetdirect.info/&E=mbaker%40firstfedweb.com&X=XID170CkgR4R5051Xd2&T=FF1001&HV=U,E,X,T&H=7657709960056573da15999e9daa042b06812829HTTP Parser: No favicon
Source: https://clicktime.cloud.postoffice.net/clicktime.php?U=https://punchmeetdirect.info/&E=mbaker%40firstfedweb.com&X=XID170CkgR4R5051Xd2&T=FF1001&HV=U,E,X,T&H=7657709960056573da15999e9daa042b06812829HTTP Parser: No favicon
Source: unknownHTTPS traffic detected: 87.248.114.16:443 -> 192.168.2.16:49718 version: TLS 1.2
Source: unknownHTTPS traffic detected: 87.248.114.16:443 -> 192.168.2.16:49717 version: TLS 1.2
Source: unknownHTTPS traffic detected: 87.248.114.16:443 -> 192.168.2.16:49719 version: TLS 1.2
Source: unknownHTTPS traffic detected: 87.248.114.16:443 -> 192.168.2.16:49716 version: TLS 1.2
Source: unknownHTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.16:49741 version: TLS 1.2
Source: chrome.exeMemory has grown: Private usage: 1MB later: 28MB
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownTCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknownTCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknownTCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknownTCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknownTCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknownTCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknownTCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknownTCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknownTCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknownTCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknownTCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknownTCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknownTCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global trafficDNS traffic detected: DNS query: ecp.yusercontent.com
Source: global trafficDNS traffic detected: DNS query: augloop.office.com
Source: global trafficDNS traffic detected: DNS query: clicktime.cloud.postoffice.net
Source: global trafficDNS traffic detected: DNS query: maxcdn.bootstrapcdn.com
Source: global trafficDNS traffic detected: DNS query: cdnjs.cloudflare.com
Source: global trafficDNS traffic detected: DNS query: www.google.com
Source: global trafficDNS traffic detected: DNS query: cloud.postoffice.net
Source: global trafficDNS traffic detected: DNS query: punchmeetdirect.info
Source: global trafficDNS traffic detected: DNS query: google.com
Source: unknownNetwork traffic detected: HTTP traffic on port 49733 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49744
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49743
Source: unknownNetwork traffic detected: HTTP traffic on port 49699 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49742
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49741
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49740
Source: unknownNetwork traffic detected: HTTP traffic on port 49727 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49704 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49743 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49762 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49746 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49739
Source: unknownNetwork traffic detected: HTTP traffic on port 49717 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49759 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49735
Source: unknownNetwork traffic detected: HTTP traffic on port 49753 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49734
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49733
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49732
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49699
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49730
Source: unknownNetwork traffic detected: HTTP traffic on port 49732 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49694
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49693
Source: unknownNetwork traffic detected: HTTP traffic on port 49742 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49749 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49729
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49727
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49726
Source: unknownNetwork traffic detected: HTTP traffic on port 49735 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49718 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49739 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49756 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49758 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49764
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49762
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49760
Source: unknownNetwork traffic detected: HTTP traffic on port 49693 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49741 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49729 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49748 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49760 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49764 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49745 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49719 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49719
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49718
Source: unknownNetwork traffic detected: HTTP traffic on port 49751 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49717
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49716
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49759
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49758
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49757
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49756
Source: unknownNetwork traffic detected: HTTP traffic on port 49757 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49734 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49754
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49753
Source: unknownNetwork traffic detected: HTTP traffic on port 49730 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49751
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49750
Source: unknownNetwork traffic detected: HTTP traffic on port 49694 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49726 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49740 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49747 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49744 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49716 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49750 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49749
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49748
Source: unknownNetwork traffic detected: HTTP traffic on port 49754 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49704
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49747
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49746
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49745
Source: unknownHTTPS traffic detected: 87.248.114.16:443 -> 192.168.2.16:49718 version: TLS 1.2
Source: unknownHTTPS traffic detected: 87.248.114.16:443 -> 192.168.2.16:49717 version: TLS 1.2
Source: unknownHTTPS traffic detected: 87.248.114.16:443 -> 192.168.2.16:49719 version: TLS 1.2
Source: unknownHTTPS traffic detected: 87.248.114.16:443 -> 192.168.2.16:49716 version: TLS 1.2
Source: unknownHTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.16:49741 version: TLS 1.2
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEWindow created: window name: CLIPBRDWNDCLASS
Source: classification engineClassification label: mal48.winMSG@43/43@58/171
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEFile created: C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEFile created: C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20241120T1150380600-6284.etl
Source: unknownProcess created: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /f "C:\Users\user\Desktop\SPECIAL PARTY INVITATION FROM DON & LINDA HUFFMAN.msg"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "ABD39F87-8A75-4DCC-B530-28C12EDF1023" "94523D3A-4AF8-4A0E-8706-DBAFC190AC76" "6284" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "ABD39F87-8A75-4DCC-B530-28C12EDF1023" "94523D3A-4AF8-4A0E-8706-DBAFC190AC76" "6284" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://clicktime.cloud.postoffice.net/clicktime.php?U=https://punchmeetdirect.info/&E=mbaker%40firstfedweb.com&X=XID170CkgR4R5051Xd2&T=FF1001&HV=U,E,X,T&H=7657709960056573da15999e9daa042b06812829
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 --field-trial-handle=1976,i,358040738047237826,1585800261428372017,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://clicktime.cloud.postoffice.net/clicktime.php?U=https://punchmeetdirect.info/&E=mbaker%40firstfedweb.com&X=XID170CkgR4R5051Xd2&T=FF1001&HV=U,E,X,T&H=7657709960056573da15999e9daa042b06812829
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 --field-trial-handle=1976,i,358040738047237826,1585800261428372017,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://clicktime.cloud.postoffice.net/clicktime.php?U=https://punchmeetdirect.info/&E=mbaker%40firstfedweb.com&X=XID170CkgR4R5051Xd2&T=FF1001&HV=U,E,X,T&H=7657709960056573da15999e9daa042b06812829
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 --field-trial-handle=1920,i,17810555083446517996,17943394476834074122,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://clicktime.cloud.postoffice.net/clicktime.php?U=https://punchmeetdirect.info/&E=mbaker%40firstfedweb.com&X=XID170CkgR4R5051Xd2&T=FF1001&HV=U,E,X,T&H=7657709960056573da15999e9daa042b06812829
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 --field-trial-handle=1920,i,17810555083446517996,17943394476834074122,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://clicktime.cloud.postoffice.net/clicktime.php?U=https://punchmeetdirect.info/&E=mbaker%40firstfedweb.com&X=XID170CkgR4R5051Xd2&T=FF1001&HV=U,E,X,T&H=7657709960056573da15999e9daa042b06812829
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 --field-trial-handle=1980,i,5823437227513229803,3242566091566292035,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://clicktime.cloud.postoffice.net/clicktime.php?U=https://punchmeetdirect.info/&E=mbaker%40firstfedweb.com&X=XID170CkgR4R5051Xd2&T=FF1001&HV=U,E,X,T&H=7657709960056573da15999e9daa042b06812829
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 --field-trial-handle=1980,i,5823437227513229803,3242566091566292035,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: apphelp.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: c2r64.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: userenv.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: msasn1.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: cryptsp.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: rsaenh.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: cryptbase.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: gpapi.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{F959DBBB-3867-41F2-8E5F-3B8BEFAA81B3}\InprocServer32
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEWindow found: window name: SysTabControl32
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Common
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEFile Volume queried: C:\Windows\SysWOW64 FullSizeInformation
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEFile Volume queried: C:\Windows\SysWOW64 FullSizeInformation
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information queried: ProcessInformation
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeQueries volume information: C:\Program Files (x86)\Microsoft Office\root\Office16\AI\WordCombinedFloatieLreOnline.onnx VolumeInformation
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management Instrumentation2
Browser Extensions		1
Process Injection		1
Masquerading		OS Credential Dumping1
Process Discovery		Remote Services1
Clipboard Data		2
Encrypted Channel		Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/Job1
DLL Side-Loading		1
DLL Side-Loading		1
Process Injection		LSASS Memory13
System Information Discovery		Remote Desktop ProtocolData from Removable Media1
Non-Application Layer Protocol		Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAt1
Registry Run Keys / Startup Folder		1
Registry Run Keys / Startup Folder		1
DLL Side-Loading		Security Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared Drive2
Application Layer Protocol		Automated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCronLogin Hook1
Extra Window Memory Injection		1
Extra Window Memory Injection		NTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput CaptureProtocol ImpersonationTraffic DuplicationData Destruction

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

⊘No Antivirus matches

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

NameIPActiveMaliciousAntivirus DetectionReputation
google.com
142.250.181.110
truefalse
    		high
    fd-geo-ec.gy1.b.yahoodns.net
    		87.248.114.16
    		truefalse
      		unknown
      cloud.postoffice.net
      		165.212.65.209
      		truefalse
        		high
        cdnjs.cloudflare.com
        		104.17.25.14
        		truefalse
          		high
          clicktime.cloud.postoffice.net
          		165.212.65.140
          		truefalse
            		high
            maxcdn.bootstrapcdn.com
            		104.18.11.207
            		truefalse
              		high
              www.google.com
              		142.250.181.68
              		truefalse
                		high
                augloop.office.com
                		unknown
                		unknownfalse
                  		high
                  punchmeetdirect.info
                  		unknown
                  		unknownfalse
                    		high
                    ecp.yusercontent.com
                    		unknown
                    		unknownfalse
                      		unknown

                      Contacted URLs

                      NameMaliciousAntivirus DetectionReputation
                      https://clicktime.cloud.postoffice.net/clicktime.php?U=https://punchmeetdirect.info/&E=mbaker%40firstfedweb.com&X=XID170CkgR4R5051Xd2&T=FF1001&HV=U,E,X,T&H=7657709960056573da15999e9daa042b06812829false
                        		unknown

                        World Map of Contacted IPs

                        • No. of IPs < 25%
                        • 25% < No. of IPs < 50%
                        • 50% < No. of IPs < 75%
                        • 75% < No. of IPs

                        Public IPs

                        IPDomainCountryFlagASNASN NameMalicious
                        52.113.194.132
                        		unknownUnited States
                        		8068MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                        172.217.19.238
                        		unknownUnited States
                        		15169GOOGLEUSfalse
                        165.212.65.209
                        		cloud.postoffice.netUnited States
                        		14454PERIMETER-ESECURITYUSfalse
                        1.1.1.1
                        		unknownAustralia
                        		13335CLOUDFLARENETUSfalse
                        172.217.17.35
                        		unknownUnited States
                        		15169GOOGLEUSfalse
                        52.111.252.7
                        		unknownUnited States
                        		8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                        52.111.252.16
                        		unknownUnited States
                        		8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                        216.58.208.234
                        		unknownUnited States
                        		15169GOOGLEUSfalse
                        165.212.65.140
                        		clicktime.cloud.postoffice.netUnited States
                        		14454PERIMETER-ESECURITYUSfalse
                        104.18.11.207
                        		maxcdn.bootstrapcdn.comUnited States
                        		13335CLOUDFLARENETUSfalse
                        8.8.8.8
                        		unknownUnited States
                        		15169GOOGLEUSfalse
                        52.109.68.129
                        		unknownUnited States
                        		8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                        74.125.205.84
                        		unknownUnited States
                        		15169GOOGLEUSfalse
                        239.255.255.250
                        		unknownReserved
                        		unknownunknownfalse
                        87.248.114.16
                        		fd-geo-ec.gy1.b.yahoodns.netUnited Kingdom
                        		43428YAHOO-ULSGBfalse
                        52.109.32.97
                        		unknownUnited States
                        		8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                        142.250.181.68
                        		www.google.comUnited States
                        		15169GOOGLEUSfalse
                        172.217.21.35
                        		unknownUnited States
                        		15169GOOGLEUSfalse
                        51.116.253.168
                        		unknownUnited Kingdom
                        		8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                        104.17.25.14
                        		cdnjs.cloudflare.comUnited States
                        		13335CLOUDFLARENETUSfalse

                        Private

                        IP
                        192.168.2.16

                        General Information

                        Joe Sandbox version:41.0.0 Charoite
                        Analysis ID:1559594
                        Start date and time:2024-11-20 17:49:59 +01:00
                        Joe Sandbox product:CloudBasic
                        Overall analysis duration:
                        Hypervisor based Inspection enabled:false
                        Report type:full
                        Cookbook file name:defaultwindowsinteractivecookbook.jbs
                        Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                        Number of analysed new started processes analysed:19
                        Number of new started drivers analysed:0
                        Number of existing processes analysed:0
                        Number of existing drivers analysed:0
                        Number of injected processes analysed:0
                        Technologies:
                        • EGA enabled
                        Analysis Mode:stream
                        Analysis stop reason:Timeout
                        Sample name:SPECIAL PARTY INVITATION FROM DON & LINDA HUFFMAN.msg
                        Detection:MAL
                        Classification:mal48.winMSG@43/43@58/171
                        Cookbook Comments:
                        • Found application associated with file extension: .msg

                        Warnings

                        • Exclude process from analysis (whitelisted): dllhost.exe, SgrmBroker.exe, svchost.exe
                        • Excluded IPs from analysis (whitelisted): 52.109.32.97, 52.113.194.132, 52.109.68.129, 52.111.252.16, 52.111.252.18, 52.111.252.15, 52.111.252.17, 51.116.253.168
                        • Excluded domains from analysis (whitelisted): fs.microsoft.com
                        • Not all processes where analyzed, report is missing behavior information
                        • Report size getting too big, too many NtCreateKey calls found.
                        • Report size getting too big, too many NtQueryValueKey calls found.
                        • VT rate limit hit for: SPECIAL PARTY INVITATION FROM DON & LINDA HUFFMAN.msg

                        Created / dropped Files

                        C:\Users\user\AppData\Local\Microsoft\FORMS\FRMCACHE.DAT

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                        File Type:data
                        Category:modified
                        Size (bytes):231348
                        Entropy (8bit):4.3973282993457286
                        Encrypted:false
                        SSDEEP:
                        MD5:8CC96E007F62461CF346D828A75F10D5
                        SHA1:3E4C0827251E0E2F2679EDB37433CB04F74A5A7A
                        SHA-256:ABF49F8D11DD4E5EFD9DAF0D9FAE6BB6C9B555419C5D09C1629815B6E5E1298B
                        SHA-512:21E353B55C5B30CB354A8EA4B2E1234AFC3D09B921773FFB5FEAA3358535F0984F59A69B7504648F6F6EDA67BA3C16C644FC3334A8B3E12A20438F13D1427B25
                        Malicious:false
                        Reputation:unknown
                        Preview:TH02...... ..UOGl;......SM01X...,.....>Gl;..........IPM.Activity...........h...............h............H..h|.x......3kB...h.........<..H..h\cal ...pDat...h....0....x....h|6.+...........h........_`Uk...h 1.+@...I.lw...h....H...8.Zk...0....T...............d.........2h...............k0.5.....3.....!h.............. h.1.....x...#h....8.........$h.<......8....."h........P.....'h..............1h|6.+<.........0h....4....Zk../h....h.....ZkH..h(...p...|.x...-h .........x...+h.7.+....p.x................. ..............F7..............FIPM.Activity....Form....Standard....Journal Entry...IPM.Microsoft.FolderDesign.FormsDescription................F.k..........1122110020000000.GwwMicrosoft...This form is used to create journal entries.........kf...... ..........&...........(.......(... ...@.....................................................................................................................fffffffff........wwwwwwww.p....pp..............p...............pw..............pw..DDDDO..

                        C:\Users\user\AppData\Local\Microsoft\FontCache\4\CatalogCacheMetaData.xml

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                        File Type:XML 1.0 document, ASCII text, with very long lines (1869), with no line terminators
                        Category:dropped
                        Size (bytes):1869
                        Entropy (8bit):5.085281087616408
                        Encrypted:false
                        SSDEEP:
                        MD5:F634F7511E8D7C275424AD677DD11A2A
                        SHA1:93B1AFA1876331E7EDD3A306DD24ECC4A77E0A26
                        SHA-256:F88D28EF2E60ED09AD9E591B68CC624EED0ED80E13C1BE571FD929263920A521
                        SHA-512:FD61389ADFCC0846C45EA861AE92520D203FBEC9992D27F091E228C924EAA225D7488B593E6E2E320C30CD8ED2DAD5BEC763323860F6C48881A11D99B21C6A5A
                        Malicious:false
                        Reputation:unknown
                        Preview:<?xml version="1.0" encoding="UTF-8" standalone="yes"?><root><version>1</version><Count>12</Count><Resource><Id>Aptos_26215680</Id><LAT>2024-11-20T16:50:42Z</LAT><key>29939506207.ttf</key><folder>Aptos</folder><type>4</type></Resource><Resource><Id>Aptos_45876480</Id><LAT>2024-11-20T16:50:43Z</LAT><key>27160079615.ttf</key><folder>Aptos</folder><type>4</type></Resource><Resource><Id>Aptos Narrow_26215424</Id><LAT>2023-10-06T09:25:29Z</LAT><key>31558910439.ttf</key><folder>Aptos Narrow</folder><type>4</type></Resource><Resource><Id>Aptos Display_26215680</Id><LAT>2023-10-06T09:25:29Z</LAT><key>23001069669.ttf</key><folder>Aptos Display</folder><type>4</type></Resource><Resource><Id>Aptos Narrow_45876224</Id><LAT>2023-10-06T09:25:29Z</LAT><key>24153076628.ttf</key><folder>Aptos Narrow</folder><type>4</type></Resource><Resource><Id>Aptos Display_45876480</Id><LAT>2023-10-06T09:25:29Z</LAT><key>30264859306.ttf</key><folder>Aptos Display</folder><type>4</type></Resource><Resource><Id>Aptos_

                        C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-shm

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                        File Type:data
                        Category:dropped
                        Size (bytes):32768
                        Entropy (8bit):0.045910747526247804
                        Encrypted:false
                        SSDEEP:
                        MD5:0268C274E7E7A48745B56A68B01A6F45
                        SHA1:DC3BAE72963DBBA5118D5CA64B7AEA6550032149
                        SHA-256:7B8416EE185BD55461379A78637C8A8C8B810DBAF17C272FBA1CC77E38DADB05
                        SHA-512:8FD730D7DA56D22C8F28258B58ACEDB03FFE66D0B95B958DAA639FD944A026510D21B39A33308BC74BF9F7878C8B97DF490A3132CAF8D2BD5716D98514B502AA
                        Malicious:false
                        Reputation:unknown
                        Preview:..-............................3.u,.Fp..wM>.x%....-............................3.u,.Fp..wM>.x%..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                        C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-wal

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                        File Type:SQLite Write-Ahead Log, version 3007000
                        Category:dropped
                        Size (bytes):49472
                        Entropy (8bit):0.4833220770477061
                        Encrypted:false
                        SSDEEP:
                        MD5:9AA596AD1E9B1AEBFB193343DF212BF8
                        SHA1:185ED29B31FC675269981F81145E8F7F523D3039
                        SHA-256:4977791428116D73F60EE4064D53DBA069F91A1721604BF500235967B3025B54
                        SHA-512:70F98201E0983A318BF85AF7E9130053C8B55A412CB038C879FC33A17B10DF564ED52C12931C74B00A9AF508ACAE6F5578DED282EA63523F807238E7C493D013
                        Malicious:false
                        Reputation:unknown
                        Preview:7....-...........u,.Fp....x.h............u,.Fp..[...U._SQLite format 3......@ .......................................................................... .............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                        C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\2E4E1DAE.dat

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                        File Type:PNG image data, 552 x 112, 8-bit colormap, interlaced
                        Category:dropped
                        Size (bytes):5637
                        Entropy (8bit):7.873176983890686
                        Encrypted:false
                        SSDEEP:
                        MD5:F942C43153E60BA7A140673F654FB851
                        SHA1:CBC5EB2F0E65102E1B71BD2092F0B23D2C073232
                        SHA-256:045D08295C09E4105BEBFB3878C7D1552146A5BF9CBF115771A8EA305E1932ED
                        SHA-512:915EA137EEE545F91D6C6A153C32B8F4AB18A72E22F9A47EBA3853D05140257DBAEFF8EDFBADCFB8E462EA9B5340806C246AAAE1966D27D153655ED92C5DDC8D
                        Malicious:false
                        Reputation:unknown
                        Preview:.PNG........IHDR...(...p.....t.K.....sRGB.........gAMA......a....sPLTE...1Z)5c.3e0.].5d05c/0a-2d/4d0.?.1\*5c.4e/3c16c/4b/5c02`-5](/^%*c*5c/5c05d06e13e0.q.1b-3d..f.6c05_*5d04`+1c*3a.1c.4f/4c00e+.T.5d/5d03d05b/5c04c/3c-._.$a$.T.3a-...$H.4e04d/5b.3d.5c/3d/-b-4`+4d/4c/5d04d02b/4a.3c.$H$5c0-`(4d/5c/4d06e/5c0'b'33.4a.1b'3e02a/.f.4e.3d04d/2c02_-([(4e03c04c/5d04d/6d-.\"1c,.\.5c.-i.3d//c+5d/3c/4e04c/2d02a.4c/(](3f&3e01b)3d/2d,4b.2d//_.2b+3c/4c02b/.U.4d0...4d/5c/...3b,5d/1b/5d04d/*]*3e03d/1b.5c.5c/4c.5d.5d/6d/0a,7^,5b.4a%*U*2b/4e04a-3b03Y&.3.3d/5d04b03c.3c/4d/4d11b,)`)3d/3d.3c+2a)-Z.6b05d.5d12c15b03f*6d/4c04e03d-4d02^+5d03d05c.6_-1d/4b/3c03b.3d.*U*4b03c.3`,4b13e03d.3d/3`0"U"3d.0g)4b0*\*4c.,_&5d04d0. .>....tRNS..i.&..I`..$..v...-..$.....>......$cRp.5...Y..\U......t...|'5p...e.x.s2...l......V.y.n3............;..5.n......QbQ.Ag.A.z....P......]..~...?..".F."..........4%.m;7.........#.O.8...m....JN...J.r%.$.(..n.k.....pHYs..!...!.........>IDATx^..eIU..Q...5 F........cD.s\............Y

                        C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\387F9BF8.dat

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                        File Type:PNG image data, 266 x 220, 8-bit/color RGBA, non-interlaced
                        Category:dropped
                        Size (bytes):10625
                        Entropy (8bit):7.949609233378373
                        Encrypted:false
                        SSDEEP:
                        MD5:B226D214AFF5D3B147AEA44B19EB45D8
                        SHA1:6C3A5445606BD03E52022CE846A57BDE8D4CCF48
                        SHA-256:E51A8086594B4090E19423F4C85A6E356AC2474C55658DA405875F7D05A911E2
                        SHA-512:AA5069AE4CDFF90DC97086539377598392C70C5EEAF4DC3F40799922D67397E7E441C628CE99631AD9294D24BC93EE14F67785120AA6AD09C41FFD34000DBD94
                        Malicious:false
                        Reputation:unknown
                        Preview:.PNG........IHDR................O....sRGB.........gAMA......a.....pHYs..!...!........).IDATx^...dE}..A|.]..E......`.W$~6..0..=.#..6.Qa.....W.1..D......k.."K.?bdY..`Ye...y....v...w.=u....._.:}....|..{N.._U}NUMwO..<..r...a...c^H...g.io;z....i.Q.w.v".F.ut..........ct.!......V.6.n...f.'.N-..I..:Apr.Z....C............=..aA._....E.1...Ct9.]./...m#.......d.Zhr.J[.z..Bx.......l.....PQ..RU.z..x....P.@.....C#{...I.F.......!.L...*.x<6..J.YTJ}{...,...z.....Zw ...1...2.(...Eae...x..V.......\}.Q.......+.x............n...a.z-.m..OU!..'.g.i.m.......h.S.....rO.IrC.l...}._v....N9....<.q....@.._..E...&.r.Z/..J!....?......}..=1..FE!.||l.Gj.."...%ys..jT...t..G...P<U..n<.5.|.........k...&.'.G...<.]j......[7.+.Q..{.Z.h,T........&.7.3jYV..z/.02C...J.8.:Oz.q0...{.)!.F.%.%.t...Mx.....0....7...jl.S~.R|.....j.T.)..._..O......V.4.T...;.{.<.....1t.)....).'.i.....~.7.?....oL...I..O9........7.hiX.....U{*..o.8....{;,.e).vcd3.`... .^......y...!...A..Oq..=.h`.p..1.f.<..<...

                        C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\3AB943F6.htm

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                        File Type:GIF image data, version 87a, 1 x 1
                        Category:dropped
                        Size (bytes):43
                        Entropy (8bit):3.0666130806898115
                        Encrypted:false
                        SSDEEP:
                        MD5:582F3592CC9473287F70FE583DFE7886
                        SHA1:692E6A105D4B4628723E323E90269A99AC085F14
                        SHA-256:376F6C554F20F590E06128798AF747506AF84676FFB235C768662B545450E62C
                        SHA-512:F3F8789BD2DE5DF24E4BED1CEAB44906D31FAF51C0BFF13B5997857892BFC5E61F8972D481C793039EF16ECD6E7D03A7B4FAF57D92CA81800F8AB4573F3A6BF4
                        Malicious:false
                        Reputation:unknown
                        Preview:GIF87a.............!.......,...........L..;

                        C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\3DCF7A8.htm

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                        File Type:PNG image data, 510 x 120, 8-bit/color RGBA, non-interlaced
                        Category:dropped
                        Size (bytes):25282
                        Entropy (8bit):7.955335101712337
                        Encrypted:false
                        SSDEEP:
                        MD5:652780CB7BD1ABB9A9B6549550B9FE4B
                        SHA1:3FB705E53E9041F60368C4F7893E9B5640D06A6E
                        SHA-256:2043CB1409508D6C811085CE14FA5F234F5D0BBB47C27D5ED15B2A1C95B5CD70
                        SHA-512:61926D8D2E62A88771A7AB40473F5C0F965D0C5E14266269AB6AB1C4CDB7EE8C247B2DA5FAFC58402F36915BDEB0CB3FB3C6A7A0711A3B8C8E81C59156AEC19E
                        Malicious:false
                        Reputation:unknown
                        Preview:.PNG........IHDR.......x.......T....gAMA......a...@.IDATx..}..fEu.|.]zo.J..D...l..n.h..5..5j.M.t.%.F...&.XQ.(*.Dl.(..,.-..l...3..3s...m.vwf.....9gN..{.{..N...e.z..+V.xv..~....}.....!,................F.L..|:L]+C^>5+..`./}..g-.RA....'.............}...<.<.<.<.<.<po...kE.O.....3'......6...t.3.....aQF.*...............p'`.....g...6..t......M?..;7.?/.#......It.r._).k....*8..Q.'......|..B@/.0'.....S.F.D.r.r.f..?sDr...7.1U...rB........a#j..$....u.f..j..Z .lC.d.|..N<..P\.^.E.Yh.={v.n..d.#3.h.....6b#.>....7.~1i.<Zz...D${fJ_...[n=.~.%K......q.-....-..f..6n.h.?...;A..>.-.6..yn.~...Y.&.y.a.Z..WW..+...._]....J...}l...-.+.Y#...R..D.......(.p..(....R.....b.m.g.2..P..~......m..w.../...m..(I.x.p...F..F.....\....0.....N..L.e.....\......?{..h.E.j....ue..-w.S...W/w.=G..C..&.c...c..................:. ......-...e.j.b.8.+./b.c.."...?.l./.l.mq=....J.K...dvV...4...;w../n..z.y...1......[.y.hU...S....+~-..>..h...\..R^.aR.M..4n'....N{u...D.y.?....A.8.9

                        C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\524BFB83.htm

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                        File Type:PNG image data, 435 x 96, 8-bit/color RGBA, non-interlaced
                        Category:dropped
                        Size (bytes):12899
                        Entropy (8bit):7.972125755610668
                        Encrypted:false
                        SSDEEP:
                        MD5:118252E0E9EAD67506B4BDD95BB126D1
                        SHA1:0AD6008FB3BE440DEFEF785A1B6917389C475060
                        SHA-256:A6EA47B4AD17889D8EBD3466D36B26316F017B737B637D53D08F6247CFCF663C
                        SHA-512:D0A266D9BD9ED797F89557469EBBF05B2185713DCCED020BB9015815901E7B8D66744D5FF8B44036C4E4DFE7C10062B85EC0D758A392EE180B103D142B36650D
                        Malicious:false
                        Reputation:unknown
                        Preview:.PNG........IHDR.......`......0......gAMA......a...2.IDATx..].|....;5.lc...\...........!@.......q...Q.'nI@`.......".....Wp..\..... ....|.98q.;.Wt."..~..y...f...$./V\.l.r...1..K(9.0.Q......b....R.TB.>T........;j..3.....}...."I.$....@...>...W.../T...Q6.B.d...E2J....(....^Uh.;...G..[2..H.$....@ ..&o...Q........@.R.....{EQ./.(.....%...H.$.q.@.Yu.........`.<#..Q....S..t.u.EU.Y.D@" .....@......Q.....0!..Y.V.y...Bg.\...&I.YyI.$....@. ._..\6BR.e.QZrdJ...F.e*..U.e}R.?...r......D@".M."62.T......1...%k.B..U.q.Gv.+...H.$...@....fFZ.?.7..b.H.F..>...U.E...iyyS..ez..D@" ....QQf..m....ud.`.{h........{,_.I,.'e..H.$.?u..:*.\...Pz;4jL;\`$..........0......D .......H..?3......_...fvO.].*..OI.&...........v......=.X..(mBu.u....R6..D@".SB &Ff..mc..g..S(.x.....[.P:4c..oc_Z).D@" .h...2.0cN.98.../.ck...b..(_.]..,......i...W...5.iU.?..[;</...&.4.......Z9................K.y...E...m;..g0...h.."..^.7../._.&&..8....~......9{h..f..!.KV...2I.$.aE`........@.HOo.8..U{R

                        C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\5FC8D5D7.dat

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                        File Type:PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
                        Category:dropped
                        Size (bytes):1649
                        Entropy (8bit):6.249308989292645
                        Encrypted:false
                        SSDEEP:
                        MD5:B30466201F9D88ABB240D8B578F04815
                        SHA1:DF67E70631A480B4CE68AE5F51D36CBB2B484DAD
                        SHA-256:ACA415DF8EA41388963B66983E337C07B8503423AD611CDEF20B6FD017ED3E4A
                        SHA-512:267B628F171D4CABFA0EFB7E1677A86CCA5ECF70F5840ADCD51E1B856EE92C53B93A5F625EDEC34C2A4F36D0C2DA733F1319CB39EAAF5B9F896A371456C44371
                        Malicious:false
                        Reputation:unknown
                        Preview:.PNG........IHDR... ... .....szz.....pHYs..........+..... iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c140 79.160451, 2017/05/06-01:08:21 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmp:CreatorTool="Adobe Photoshop CC 2018 (Macintosh)" xmp:CreateDate="2018-10-29T09:14:28+01:00" xmp:ModifyDate="2018-10-29T09:21:59+01:00" xmp:MetadataDate="2018-10-29T09:21:59+01:00" dc:format="image/png" photoshop:ColorMode="3" photoshop:ICCProfile="sRGB IEC61966-2.1" xmpMM:InstanceID="xmp.iid:1c4872f2-803d-4e4c-bb42-f8ea222a267a" xmpMM:DocumentID="xmp.did:1c4872f2-803d-4e4c-bb42-f8ea222a267a" xmpMM:Ori

                        C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\6C4D8389.y3RhnFQ--~D

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                        File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 524x372, components 3
                        Category:dropped
                        Size (bytes):12886
                        Entropy (8bit):7.830696502837574
                        Encrypted:false
                        SSDEEP:
                        MD5:134499057E183730ECC70A525CBD7B10
                        SHA1:453A47F729DAD9690A8F2D16F542D7D1A301BF6B
                        SHA-256:54ACD5467CF76F68C8FB5985CB26BA0B88D51C962F5EF4455E8CA834418BED17
                        SHA-512:46718FA673ECA97454412710EA6D6F9BCD8F545B3B47D2078064A1C6F102E3643F2D6BA79616A3A303A689003F156949D1B9ACFE764EE3948CC6AD99C4990A0C
                        Malicious:false
                        Reputation:unknown
                        Preview:......JFIF.............C.....................................%...#... , #&')*)..-0-(0%()(...C...........(...((((((((((((((((((((((((((((((((((((((((((((((((((......t...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..$.g.......W9......'J.b..[6.o.=k..fb[..M..@u....Z)(...........Z(....JZ@.QE.-....(...(...(...)i(....(...(...(...(...(...J.(...(...(...(...)(...(...%.S...C@..RP.E.P.Hh.4....)...!&..N.o-.>....k.U...3.bT:...=.&..I.l9..3.-`..,EV.%NEU...8...iA...L*.y.b.F...c$.......QIK@......ZJ(..RR..KIE.-.QH....@-.Q@..Q@..Q@..Q@.E%(...(...(...(...(4.RQE..QE..QE..QE..QI@..QL...O4.....Q.

                        C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\808FD4FD.dat

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                        File Type:PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
                        Category:dropped
                        Size (bytes):1731
                        Entropy (8bit):6.398040463872698
                        Encrypted:false
                        SSDEEP:
                        MD5:31A6D82252B782E1AC6C11600FD8C624
                        SHA1:7715CAF3EED49E96F4964939CA4CA10AA6857DFE
                        SHA-256:C1ADBDD80C8D69ADC420E12F78A98A0B8F8A43DBEF6CEAF31E5081B9962DBAD7
                        SHA-512:123DD7281A9E6CD09BEC4D5CE11FC2479ED6ACE67ED4B624B0B0495C6C067FB9B47632FDD94348C42C7BDD48DBBF0D785B6CB99E73712AE139992222ECE7193A
                        Malicious:false
                        Reputation:unknown
                        Preview:.PNG........IHDR... ... .....szz.....pHYs..........+..... iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c140 79.160451, 2017/05/06-01:08:21 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmp:CreatorTool="Adobe Photoshop CC 2018 (Macintosh)" xmp:CreateDate="2018-10-29T09:14:28+01:00" xmp:ModifyDate="2018-10-29T09:22:07+01:00" xmp:MetadataDate="2018-10-29T09:22:07+01:00" dc:format="image/png" photoshop:ColorMode="3" photoshop:ICCProfile="sRGB IEC61966-2.1" xmpMM:InstanceID="xmp.iid:d9a84fe0-c712-4c49-a7ca-171c792fff0c" xmpMM:DocumentID="xmp.did:d9a84fe0-c712-4c49-a7ca-171c792fff0c" xmpMM:Ori

                        C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\8EA47CC6.dat

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                        File Type:PNG image data, 66 x 74, 8-bit colormap, interlaced
                        Category:dropped
                        Size (bytes):1221
                        Entropy (8bit):7.348630153514487
                        Encrypted:false
                        SSDEEP:
                        MD5:772F379C2F5D7EA39DF9CAE3E922DE6C
                        SHA1:175CCF0D552E8DF76537170E29358C93A192EFAF
                        SHA-256:05238BCE970B7F813CEA7F921FF735312C9153EC3F547C1259116D255DC1D672
                        SHA-512:E0AD7431B3134E6B93C47EB909F5544A3E3C68ED0D8B56CA608830B95008CDAEB68F4E3E3AFF43A743010643712D1B146C2FCD7D6108F40DFFD53F2197CA6D4D
                        Malicious:false
                        Reputation:unknown
                        Preview:.PNG........IHDR...B...J.....O.B!....sRGB.........gAMA......a.....PLTE...".."........".....".."........"..!.....!.. ..!..". .. ..... ..".....".....".....". ...!..... ..!..!..#..". "..... ..!..!.....!.."..... ..".....!.. ..".....!.. ..... .."..!..!..".....!..... .."..!.."..!.."..... ..!.."..#..!..............!..".."..".....#. .,'....UtRNS....I...%]..k......t...$.4.5.@.._..y....s....Q...lF.".w...&d.K..}....0u..S.HL...,. @.z.....pHYs..!...!..........IDATHK..z.A..E..CL..K.@(..{...U.F.{{........F...9.8.(fC5B,>.p.aT0...P...F..:*.%........0......MioZA$..k55.DU.p%NG..-.|.........A....,...r.VQN.O ......R.....B....Kh1...7.O.r...B..cr..D..W..j..J....Ti.)0i6^....r.H.....1.u..@.r ..;.tq.t.../....6.y".K.>ox.x.~T>r....h...p...u...G..3.....C..k.....l...P...Py..aVkKI..qT*(...9.%Q.&.e>...Rq.<.X..h.v..Ty..N..I....A.....|Rt..$....v6r....=.....Mn1..r.......u....x...Z.G?:#.....c...........A..c.......u...*t.d.`?..'.rk.!....t@.x...%...4.....W....&'XNPNP.......\g;...".($.Q.

                        C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\A2DF9EDA.dat

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                        File Type:PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
                        Category:dropped
                        Size (bytes):1693
                        Entropy (8bit):6.360003493727701
                        Encrypted:false
                        SSDEEP:
                        MD5:728B8ABA94D88CC5555487E0527B0209
                        SHA1:F704FB5B562AE8955216CD363BAF9CAA87374569
                        SHA-256:094B77B6C3D2350E27E8A78863BBEFC32B42516002122116E66569FC46CDC0D1
                        SHA-512:6A4B75DC69AEADA174F6234FD374CA6C1AC923235AEB47BDF3E0CC20D7A39FDDB55B3D86684D60CA93BD9FAF2905E80F6F8C3C5BC5DD0D7DF86F0090485F43E7
                        Malicious:false
                        Reputation:unknown
                        Preview:.PNG........IHDR... ... .....szz.....pHYs..........+..... iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c140 79.160451, 2017/05/06-01:08:21 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmp:CreatorTool="Adobe Photoshop CC 2018 (Macintosh)" xmp:CreateDate="2018-10-29T09:14:28+01:00" xmp:ModifyDate="2018-10-29T09:22:19+01:00" xmp:MetadataDate="2018-10-29T09:22:19+01:00" dc:format="image/png" photoshop:ColorMode="3" photoshop:ICCProfile="sRGB IEC61966-2.1" xmpMM:InstanceID="xmp.iid:c8b34f84-8e37-4524-bfc8-a3343bcf5b40" xmpMM:DocumentID="xmp.did:c8b34f84-8e37-4524-bfc8-a3343bcf5b40" xmpMM:Ori

                        C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\C46585EC.dat

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                        File Type:PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
                        Category:dropped
                        Size (bytes):1860
                        Entropy (8bit):6.623899730306515
                        Encrypted:false
                        SSDEEP:
                        MD5:6D5AA0AF714319F04ABED5C1A94E29F1
                        SHA1:3D383727C84687FB097CB4E95C44CD8C1586A4E9
                        SHA-256:875CB6025FAD3912244185662A2A218BA2C65E151FEBF8033A1071D0B071085A
                        SHA-512:BEB1F11E47B053BC00904A7274EC746EFE58A1B1F39299CD15A24DFE79C7D0D228875415BE267F17721DCA78386A123353B21A1FB5DADD8958F991A4B53D732F
                        Malicious:false
                        Reputation:unknown
                        Preview:.PNG........IHDR... ... .....szz.....pHYs..........+..... iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c140 79.160451, 2017/05/06-01:08:21 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmp:CreatorTool="Adobe Photoshop CC 2018 (Macintosh)" xmp:CreateDate="2018-10-29T09:14:28+01:00" xmp:ModifyDate="2018-10-29T09:22:04+01:00" xmp:MetadataDate="2018-10-29T09:22:04+01:00" dc:format="image/png" photoshop:ColorMode="3" photoshop:ICCProfile="sRGB IEC61966-2.1" xmpMM:InstanceID="xmp.iid:88ed77f4-832b-4105-96d1-9ef05b800c86" xmpMM:DocumentID="xmp.did:88ed77f4-832b-4105-96d1-9ef05b800c86" xmpMM:Ori

                        C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\E1EFED13.dat

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                        File Type:PNG image data, 225 x 220, 8-bit/color RGBA, non-interlaced
                        Category:dropped
                        Size (bytes):13805
                        Entropy (8bit):7.9496219834249935
                        Encrypted:false
                        SSDEEP:
                        MD5:F78A23C400C84C81641A3A5E57243003
                        SHA1:A026B25B50D1AB8CF04227DEAA26C53A2937DA77
                        SHA-256:5E6716AED3454179B2DA5315E9EA26BEE3CACF032296E0A5C6893CD0CF57AAE9
                        SHA-512:907176115911F1A57B314EE41B5C5A289959EE179C1C4249F1A299052C3CAEC1EA9FF9F60AE6206C262FDE1B9A5AD754B35DB140D894B2D8FD3359D01324BBD3
                        Malicious:false
                        Reputation:unknown
                        Preview:.PNG........IHDR..............W......sRGB.........gAMA......a.....pHYs..!...!........5.IDATx^.g..U..Y...Yk.w.3..O3*"...M.n.d.Q@AT." ..P..3.#..AA........ .H.(...H..s.._..N..v......_...OU.:g.[7T.aH>f.f.......u..i}...z....z.&...&/;.e^n..R.$J.....h0T..s....>U..]w....!.y.F.....U&.s.Q`...j.......M..tQNfw5..C..k....i...."......*....T..5o...9s.EK..LX?...I..*a........I.;....f=:HL.d....~WJ.qTCj0D..H.Pq...@O5a?........^>.]./R.G.{.A\Q..1.W.&.v.......7j.=...X......)..y.Y...QCoHw..M..$Z.........8...k}...K..X..b......!./.a..q.V.M.MQSaH7.s.fJA...J..../.M...o`.<.Ny3f..H../...D..oi...q..+.a>....;...%R.DR.b.I...).Qf.G...OM.......0^.8F..U...H...I.......LWI.b'PgL...z...}.~K...(.o8a....R...:5.I...(.z...:.x..y.........!....U..p...k..4."...Y.1p.J.-.....^..$.I.?...8.>RSjH..r..K.)...-b.p.....\...xa.....K."*7.bC.R.S/K.<A......4g.|;...=F..."`.0..Oi.I..i.$..[_M.!..&.OR..F?5...X.W..`<1.O..W.w.4_~RSoH4..Y....$M:.C.vv..b..}...<......W.`H..H.&..u..~F...C<i..w..4/PY.bq>%..0..Fu

                        C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\F1D7BB99.dat

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                        File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 220x220, segment length 16, baseline, precision 8, 222x220, components 3
                        Category:dropped
                        Size (bytes):26564
                        Entropy (8bit):7.889636477834128
                        Encrypted:false
                        SSDEEP:
                        MD5:F1D56B102EC6E2431A761916DCC2F267
                        SHA1:48997AF373EE52ED1F470E10113E98B11BA77792
                        SHA-256:7ABCA5B9906BBA0C8D61A25D51075D5A723E4FB2A0CF5D4256BD4AF1F4A47673
                        SHA-512:E58E9F919B0F7D9EBE9C14594B92F1CE6996F15AA14EFC4FEC4F10E0F68312DECE7384871C2F7859A9FA6A55239DB0FA8E883D073637538F4053D072D76E0E8B
                        Malicious:false
                        Reputation:unknown
                        Preview:......JFIF.............C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....(...(....8.A<P.2.Z.{.-k^.|;..k...v...'..*..._...P?.9+.H...............}.].A.[yFF......6.105..3L..J....Q.....vI..8Z..EY-../...;.j.v.e.....ko...y.....'.=.|..R...b?......X|W.....8]VM.Jf..@.*..CHc?.U`?._................SV..5.../..G..P....4.=-..<.{2IzB...9BSr.5...)....?.|'..y.D..........-KA..ldh.....5.p........r+.j....i^."..f..ev./.2K[;...<...X..ktN....i.V?X>=..

                        C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{8DF620A4-404F-4668-A4E5-FE4F2BED226F}.tmp

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                        File Type:data
                        Category:dropped
                        Size (bytes):35096
                        Entropy (8bit):4.316648725670959
                        Encrypted:false
                        SSDEEP:
                        MD5:0500066C995C4156CDB532B54C656E25
                        SHA1:03E78BFA88EDE8AA8505815FEF3E0CEC9872A4E3
                        SHA-256:BC72D3810F43CDB1A92B454AECF8B7B0D09615334761185288CF9D572130B154
                        SHA-512:EA70058712368C06FA6BB92D9D42A60D05BC560F59DC8E434EC53A6983804A55E25762B917BBAC727020499ABA1C723B574642234012AC8241F5BDD4B3C9F98C
                        Malicious:false
                        Reputation:unknown
                        Preview:....L.u.i.s. .. ............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................ ...$...t.......h-.. ;...@...@...@..0E..2E...P..LQ..........................................................................................................................................................................................................................................................................................................................................................................................................

                        C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1732121438864112800_85883C4F-2985-45B4-904A-62F0670E1BC6.log

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                        File Type:ASCII text, with very long lines (28773), with CRLF line terminators
                        Category:dropped
                        Size (bytes):20971520
                        Entropy (8bit):0.2192093784014213
                        Encrypted:false
                        SSDEEP:
                        MD5:FCBC945CF8E5A326C2C021286277E084
                        SHA1:83D74336BF7D1D4253DB993650B6FDB2B54927BB
                        SHA-256:DD8249346219BBC4F95BD88D2E4E50236C1925170BB34A61A3FC92761AB4EAAC
                        SHA-512:F7B6E75CC41191245FC27453B6D15F93033DAE93634C6EB2B1F423817CD8E2D2884A3A26B22D702B23D5A25B60B9BCF28111EDC1FD4853831D3CF941BB2202A3
                        Malicious:false
                        Reputation:unknown
                        Preview:Timestamp.Process.TID.Area.Category.EventID.Level.Message.Correlation..11/20/2024 16:50:38.933.OUTLOOK (0x188C).0x18B4.Microsoft Outlook.Telemetry Event.b7vzq.Medium.SendEvent {"EventName":"Office.Text.GDIAssistant.HandleCallback","Flags":30962256044949761,"InternalSequenceNumber":22,"Time":"2024-11-20T16:50:38.933Z","Contract":"Office.System.Activity","Activity.CV":"TzyIhYUptEWQSmLwZw4bxg.4.9","Activity.Duration":13,"Activity.Count":1,"Activity.AggMode":0,"Activity.Success":true,"Data.GdiFamilyName":"","Data.CloudFontStatus":6,"Data.CloudFontTypes":256}...11/20/2024 16:50:38.949.OUTLOOK (0x188C).0x18B4.Microsoft Outlook.Telemetry Event.b7vzq.Medium.SendEvent {"EventName":"Office.Text.ResourceClient.Deserialize","Flags":30962256044949761,"InternalSequenceNumber":24,"Time":"2024-11-20T16:50:38.949Z","Contract":"Office.System.Activity","Activity.CV":"TzyIhYUptEWQSmLwZw4bxg.4.10","Activity.Duration":12931,"Activity.Count":1,"Activity.AggMode":0,"Activity.Success":true,"Data.JsonFileMajorV

                        C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1732121438864929300_85883C4F-2985-45B4-904A-62F0670E1BC6.log

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                        File Type:data
                        Category:dropped
                        Size (bytes):20971520
                        Entropy (8bit):0.0
                        Encrypted:false
                        SSDEEP:
                        MD5:8F4E33F3DC3E414FF94E5FB6905CBA8C
                        SHA1:9674344C90C2F0646F0B78026E127C9B86E3AD77
                        SHA-256:CD52D81E25F372E6FA4DB2C0DFCEB59862C1969CAB17096DA352B34950C973CC
                        SHA-512:7FB91E868F3923BBD043725818EF3A5D8D08EBF1059A18AC0FE07040D32EEBA517DA11515E6A4AFAEB29BCC5E0F1543BA2C595B0FE8E6167DDC5E6793EDEF5BB
                        Malicious:false
                        Reputation:unknown
                        Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                        C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20241120T1150380600-6284.etl

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                        File Type:data
                        Category:modified
                        Size (bytes):98304
                        Entropy (8bit):4.466872849730921
                        Encrypted:false
                        SSDEEP:
                        MD5:DFFE924A9D449997B99F2408C35E3B9F
                        SHA1:F8DB6C4BA1EE8E8D926AEB7CCAEF3FA9CE672158
                        SHA-256:E094D5D0C5BC2F560E6317690F0BEBD001D8AC91A526D5AB4AD7AE4C466C6AEC
                        SHA-512:FC3B6EF61259F4C11BD1BC1DEBB742B587F24A81510DA9EA8868C3200E3E6A6A42A533F8609C17BFADC7AEB6B543AFE3C14E082E4903825BF30A6A5EFD2082FD
                        Malicious:false
                        Reputation:unknown
                        Preview:............................................................................`..............Sl;..................eJ..............Zb..2...................................,...@.t.z.r.e.s...d.l.l.,.-.1.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.1.1.1...........................................................P....Y.............Sl;..........v.2._.O.U.T.L.O.O.K.:.1.8.8.c.:.9.7.3.2.2.e.9.2.c.b.d.d.4.2.0.c.a.3.8.c.7.c.7.3.9.e.9.f.4.3.f.b...C.:.\.U.s.e.r.s.\.c.a.l.i.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.O.u.t.l.o.o.k. .L.o.g.g.i.n.g.\.O.U.T.L.O.O.K._.1.6._.0._.1.6.8.2.7._.2.0.1.3.0.-.2.0.2.4.1.1.2.0.T.1.1.5.0.3.8.0.6.0.0.-.6.2.8.4...e.t.l.......P.P............Sl;..........................................................................................................................................................................................................................................................................................................

                        C:\Users\user\AppData\Local\Temp\prep_ram Files (x86)_Microsoft Office_root_Office16_AugLoop_bundle_js_V8_perf.cache

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                        File Type:data
                        Category:dropped
                        Size (bytes):538839
                        Entropy (8bit):5.985655346755509
                        Encrypted:false
                        SSDEEP:
                        MD5:C19A96C0B9C86DF26DA996E3AF9261CA
                        SHA1:941667779CEA9958DE3DDCD0AFC17772AFFBEE1B
                        SHA-256:1B1EA38A64467A64A269222E212ECD556101EBAC425D960EDBA83DE9CC9760A3
                        SHA-512:8FB7F6B172543A731108BE1140DFE2989450405C0FADDFAF79A3F68ABC1A399107E63E2D454BCCB8F9725846120347BC60DA825CDCC462FD3E186F0E11C464E6
                        Malicious:false
                        Reputation:unknown
                        Preview:RNWPREP...A..<.l.........8......z\.(#......rm}.y>.C.........b.@...P.Q.....uY||8.......$S.,..`......L`.....$S...`VY.....L`.....M.Rb.................c.@........... ...D..Qb.@......ey..`......Qb.@......my..`.....D..Qb..f.....Ip..`.....D..Qb"..\....af..`......Qb&.......fC..`.....D..Qb.@.....Nv..`......Qb2.......aI..`.....D..QbF@.....th..`......QbJ.6r....ZC..`.....D..QbR.......Co..`f....D..Qbb.t.....nt..`.....D..Qbj.......fa..`.....D..Qbz.h.....kd..`.....D..Qb.../....iR..`.....D.....`......Qb.@......iA..`>.....Qb..U<....Ky..`......Qb........cp..`......Qb........VT..`......Qb........$c..``....D..Qb........ed..`.....D..Qb.@d|....Kv..`.....D..Qb........Ib..`<....D..Qb.@GB....gg..`.....D..Qb.@.C....la..`d....D..Qb.......IT..`.....D..Qb........nf..`.....D..Qb*A......mh..`b....D..QbB._.....Sc..`<....D..QbJ.0.....pr..`.....D..QbZ..R....dk..`.....D..QbfA......mT..`*.....Qbf.8.....CS..`.....D..Qb~......bA..`.....D..Qb...O...._h..`V....D..Qb...k....Of..`.....D..Qb..tL....E_..`n.....Qb.A......

                        C:\Users\user\AppData\Local\Temp\~DFFFE5D97A2F82A9A5.TMP

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                        File Type:data
                        Category:dropped
                        Size (bytes):163840
                        Entropy (8bit):0.46115807415246324
                        Encrypted:false
                        SSDEEP:
                        MD5:F46965313BD544F0C001AB97164B158F
                        SHA1:BDDEDA1F591842CA713E7E95164B41062933ABA4
                        SHA-256:D333F69FA8F81E0567A0F8A48447E1CC3E84019FA7828750EEA919C5643D707F
                        SHA-512:DEA8E52E63EFAA4D46F9555D93EF26025350E319E411B71EB3E2E2AD0BAE0D41DB0CB9B90DD28BF7B2087DFF35DE91D0A0B4DBD4088794CDBA1D326333DBF3DC
                        Malicious:false
                        Reputation:unknown
                        Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                        C:\Users\user\AppData\Roaming\Microsoft\Office\MSO3072.acl

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                        File Type:data
                        Category:dropped
                        Size (bytes):30
                        Entropy (8bit):1.2389205950315936
                        Encrypted:false
                        SSDEEP:
                        MD5:46018C6CBFBB1AB63F61AC15FDEA4F79
                        SHA1:3F9380677F4AEBB2473B938158EF686DB1B2F797
                        SHA-256:08CF6A58EB1B1C99DDC684BCD4705E1B656B77763549A2FE2399B2C218B520FC
                        SHA-512:BB8656B2F7101D326174863D972C7C9E671E6F309DE722A27A82205A592B41B72C642486DE7FFFBBD00689101C2CB7EDCC2C37DF6482BE68522FF96221A78B0A
                        Malicious:false
                        Reputation:unknown
                        Preview:..............................

                        C:\Users\user\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                        File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                        Category:modified
                        Size (bytes):14
                        Entropy (8bit):2.699513850319966
                        Encrypted:false
                        SSDEEP:
                        MD5:C5A12EA2F9C2D2A79155C1BC161C350C
                        SHA1:75004B4B6C6C4EE37BE7C3FD7EE4AF4A531A1B1A
                        SHA-256:61EC0DAA23CBC92167446DADEFB919D86E592A31EBBD0AB56E64148EBF82152D
                        SHA-512:B3D5AF7C4A9CB09D27F0522671503654D06891740C36D3089BB5CB21E46AB235B0FA3DC2585A383B9F89F5C6DAE78F49F72B0AD58E6862DE39F440C4D6FF460B
                        Malicious:false
                        Reputation:unknown
                        Preview:..c.a.l.i.....

                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

                        Download File
                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                        File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Nov 20 15:51:17 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                        Category:dropped
                        Size (bytes):2673
                        Entropy (8bit):3.9796946661286765
                        Encrypted:false
                        SSDEEP:
                        MD5:9BF265353C072EDC9078F15CBA5792DE
                        SHA1:BFED2A81273FEDF5B4F0075172E707853631F05B
                        SHA-256:56E8BA8C3B5CAE2C2BDA0954F903755A221492969D408CD13150F1ED5FCB0722
                        SHA-512:241DE4D9D1D6F52A9FFF8762D5E9187354A4AF2FBF20F0A97756C78AB3F622B70B38317C8418CC16CDC05F1B7CFD765AAC4C3C208D55D1DFA2E54B5A9F5A2F70
                        Malicious:false
                        Reputation:unknown
                        Preview:L..................F.@.. ...$+.,.....S.jl;..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.ItYH.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VtYg.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VtYg.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VtYg............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VtYi............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............Z.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

                        Download File
                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                        File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Nov 20 15:51:16 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                        Category:dropped
                        Size (bytes):2675
                        Entropy (8bit):3.997246498431232
                        Encrypted:false
                        SSDEEP:
                        MD5:BBA56BEB3D1E73B0CD24612C42F5EDA0
                        SHA1:64752B96EEEA6AC8F9E29703472B958DF7603067
                        SHA-256:F01063E492362734476BDD3DD1F41564D901B456897FF2B92E0C9D90A1AA3008
                        SHA-512:79B9DBF32AA4BF01B77FA46FB42C6FEF8352CD2661B09478739110EBE33F6C686CBE5A1D2A5FE92FF770296C69CCA11E2D51A64C3AE6790BF0FC7F0A2B7D2377
                        Malicious:false
                        Reputation:unknown
                        Preview:L..................F.@.. ...$+.,.....4.jl;..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.ItYH.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VtYg.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VtYg.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VtYg............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VtYi............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............Z.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

                        Download File
                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                        File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                        Category:dropped
                        Size (bytes):2689
                        Entropy (8bit):4.008308127078015
                        Encrypted:false
                        SSDEEP:
                        MD5:33537A062D1F81A7F406F65F24DC3278
                        SHA1:68666DB8C473E4F4672D347BB4879DFD2088D080
                        SHA-256:3D49A0A3E1A4EE3A475C28C59618AD25EE45AC02106E82F73C85351DFC332F44
                        SHA-512:57CA66531A0C296170D287C42B191AFFB30D229845984093159EEAB1048AA6C8788E50307FA9EB48B834FE2A0C8D861CB573000D6A09541A8B5A022EA37D6113
                        Malicious:false
                        Reputation:unknown
                        Preview:L..................F.@.. ...$+.,.....Y.04...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.ItYH.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VtYg.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VtYg.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VtYg............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VFW.E...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............Z.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

                        Download File
                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                        File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Nov 20 15:51:16 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                        Category:dropped
                        Size (bytes):2677
                        Entropy (8bit):3.992901601921815
                        Encrypted:false
                        SSDEEP:
                        MD5:24C31576C006A12760DB7D9AC12B5A3C
                        SHA1:4B5A64AC160E4D3BE01C0EA0BFB10B973147C8F4
                        SHA-256:BDD5F8C67D00E8F476C485D1709C49C58EC9CC8B9B7EF1A843441B4531022931
                        SHA-512:BE0A2602447B92BD8070F3134E4BD9771134CF2C5BD645F770086C6516C2523D673A35060B66C13E65D1F3DB6C05F33F89BCC106B685C048D7CF73C2F7EBE5A5
                        Malicious:false
                        Reputation:unknown
                        Preview:L..................F.@.. ...$+.,.....V.jl;..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.ItYH.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VtYg.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VtYg.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VtYg............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VtYi............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............Z.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

                        Download File
                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                        File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Nov 20 15:51:16 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                        Category:dropped
                        Size (bytes):2677
                        Entropy (8bit):3.982939839372286
                        Encrypted:false
                        SSDEEP:
                        MD5:2EACF95FA5A4FFD6B78B0B68B416F69D
                        SHA1:00BCCFA03AF3A4C7E2DB55198CB9AF7D022D6A8F
                        SHA-256:8E4E9F990363548AF4CCFFA90A6B88635EA7CA6EFAC61924D51331D13C367BDC
                        SHA-512:8CF91E20156A703506C1A882C080AB336B0BE96DD3BD61643C07D949EB0BB01AD320DEC6F1619CA1FF3938CFDDAFDBA03941CD028F0642F9C3D2A0970092521A
                        Malicious:false
                        Reputation:unknown
                        Preview:L..................F.@.. ...$+.,....c.jl;..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.ItYH.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VtYg.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VtYg.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VtYg............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VtYi............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............Z.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

                        Download File
                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                        File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Nov 20 15:51:16 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                        Category:dropped
                        Size (bytes):2679
                        Entropy (8bit):3.99280920236154
                        Encrypted:false
                        SSDEEP:
                        MD5:AE1ED5FC47544D636E2A6E41B5AF6197
                        SHA1:B5D0813F529B7C3C235086BD4FAA7866F5B05640
                        SHA-256:750A1809CA1E4B437C439077CA2CCD83A6EDD046C66DB3ADF17F5DC7AACAF141
                        SHA-512:F8F6F1A6AA54F1751C41BC8AD391BED0D45380426593876F787CD60685FC9B2E579D3858389B110FD16D9555F2D3DA669EC738413BD2BCF4FF7152F477FB1561
                        Malicious:false
                        Reputation:unknown
                        Preview:L..................F.@.. ...$+.,.......jl;..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.ItYH.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VtYg.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VtYg.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VtYg............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VtYi............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............Z.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                        C:\Users\user\Documents\Outlook Files\Outlook Data File - NoEmail.pst

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                        File Type:Microsoft Outlook email folder (>=2003)
                        Category:dropped
                        Size (bytes):271360
                        Entropy (8bit):1.80884773660124
                        Encrypted:false
                        SSDEEP:
                        MD5:B8C3C8417681D801EBE0C361402016A6
                        SHA1:D896877A6C869C39552306721B8D588471E60262
                        SHA-256:200E0CAE6154AEA423C4D9AA8BC91F38A07CDFA582E812EC4C00B101FB7AB49D
                        SHA-512:632272845F70F5618D2060C0F8E00119FA94AAF629077DE48F3FD4E9985258051AFBE54A3BDF9E824AA696479382FE124545075381DD29485F1DEA1334AC4421
                        Malicious:true
                        Reputation:unknown
                        Preview:!BDNP..hSM......\........O......F.......W................@...........@...@...................................@...........................................................................$.......D......................B...............E...........................................................................................................................................................................................................................................................................................0..........R$@\.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                        C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                        File Type:data
                        Category:dropped
                        Size (bytes):131072
                        Entropy (8bit):2.166416571755891
                        Encrypted:false
                        SSDEEP:
                        MD5:1790DA71B676AD17D410C9A1AF7BCF09
                        SHA1:3D5C1E17A694E68AEE8842C88DD4E8708B9C8CED
                        SHA-256:A4B3EC67783BAACB94946BEBCCCD202E773104DBA2D35135CDDE0CAB357626AF
                        SHA-512:DB425211FA87874F2663CF8B23201DC66BDE5D74BAFC69E71551B248DEE76CBDCE813CF10529CCED8E95A5D840D34482D656680A2F28BB40907C9BA2B43EBEC4
                        Malicious:true
                        Reputation:unknown
                        Preview:^8.0...c.............Sl;.......D............#.............................................................................?............................................................................................................................................................................................................................................................................................................................................................................................................................................D..........0...d.............Sl;.......B............#.........................................................................................................................................................................................................................................................................................................................................................................................................

                        Chrome Cache Entry: 102

                        Download File
                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                        File Type:ASCII text, with very long lines (26548)
                        Category:downloaded
                        Size (bytes):26711
                        Entropy (8bit):4.753681219070429
                        Encrypted:false
                        SSDEEP:
                        MD5:0831CBA6A670E405168B84AA20798347
                        SHA1:05EA25BC9B3AC48993E1FEE322D3BC94B49A6E22
                        SHA-256:936FFCCDC35BC55221E669D0E76034AF76BA8C080C1B1149144DBBD3B5311829
                        SHA-512:655F4A6B01B62DE824C29DE7025C4B21516E7536AE5AE0690B5D2E11A7CC1D82F449AAEBCF903B1BBF645E1E7EE7EC28C50E47339E7D5D7D94663309DFA5A996
                        Malicious:false
                        Reputation:unknown
                        URL:https://maxcdn.bootstrapcdn.com/font-awesome/4.4.0/css/font-awesome.min.css
                        Preview:/*!. * Font Awesome 4.4.0 by @davegandy - http://fontawesome.io - @fontawesome. * License - http://fontawesome.io/license (Font: SIL OFL 1.1, CSS: MIT License). */@font-face{font-family:'FontAwesome';src:url('../fonts/fontawesome-webfont.eot?v=4.4.0');src:url('../fonts/fontawesome-webfont.eot?#iefix&v=4.4.0') format('embedded-opentype'),url('../fonts/fontawesome-webfont.woff2?v=4.4.0') format('woff2'),url('../fonts/fontawesome-webfont.woff?v=4.4.0') format('woff'),url('../fonts/fontawesome-webfont.ttf?v=4.4.0') format('truetype'),url('../fonts/fontawesome-webfont.svg?v=4.4.0#fontawesomeregular') format('svg');font-weight:normal;font-style:normal}.fa{display:inline-block;font:normal normal normal 14px/1 FontAwesome;font-size:inherit;text-rendering:auto;-webkit-font-smoothing:antialiased;-moz-osx-font-smoothing:grayscale}.fa-lg{font-size:1.33333333em;line-height:.75em;vertical-align:-15%}.fa-2x{font-size:2em}.fa-3x{font-size:3em}.fa-4x{font-size:4em}.fa-5x{font-size:5em}.fa-fw{width:1.

                        Chrome Cache Entry: 103

                        Download File
                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                        File Type:ASCII text
                        Category:downloaded
                        Size (bytes):2186
                        Entropy (8bit):4.757782388872235
                        Encrypted:false
                        SSDEEP:
                        MD5:07A6DC5AC593B15AAF16A70BE15F6D24
                        SHA1:7C3E38C817281206726470330229D1B7E2A4790B
                        SHA-256:5E56EAB72979F3A0AA28B53CD2DB8395B9BB8AC4433DDDC94B221DAA25A5B73A
                        SHA-512:44D8CA93015B9D1410515B2762808B2C52B6C4302B5D6B5804E0BC6A3435E7F93859669172D7207719EDC8A59A70FD9DADE50C10BBF6D5FF867AFA9B7776F62B
                        Malicious:false
                        Reputation:unknown
                        URL:https://clicktime.cloud.postoffice.net/css/styles.css
                        Preview:body {. background-color: #eee;. color: #444;. font-family:"Open Sans","Helvetica Neue", Helvetica, Arial, sans-serif;. font-size: 14px;.}.h1 {. font-size: 24pt;. font-weight: normal .}.table {. width: 60%;.}..analysis h3 {. display: inline;.}..content {. visibility: visible;. z-index: 1;.}.#watermark-text-black {. color:black;. opacity: 0.2;. font-size:120px;. transform:rotate(330deg);. -webkit-transform:rotate(330deg);. position:absolute;. margin: 100px auto;. padding: 2px 2px;. visibility: hidden;.}.#watermark-text-white {. color:white;. opacity: 0.2;. font-size:120px;. transform:rotate(330deg);. -webkit-transform:rotate(330deg);. position:absolute;. margin: 100px auto;. visibility: hidden;.}.button {. width: 100%;. text-align: left;. padding: 0px 15px;. font-size: 12pt;. color: #fff;. background-color: #555;. border: 5px solid #555;.}.button:hover {. background-color: #333;.}.a

                        Chrome Cache Entry: 104

                        Download File
                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                        File Type:ASCII text, with very long lines (32038)
                        Category:dropped
                        Size (bytes):95992
                        Entropy (8bit):5.391333957965341
                        Encrypted:false
                        SSDEEP:
                        MD5:F03E5A3BF534F4A738BC350631FD05BD
                        SHA1:37B1DB88B57438F1072A8EBC7559C909C9D3A682
                        SHA-256:AEC3D419D50F05781A96F223E18289AEB52598B5DB39BE82A7B71DC67D6A7947
                        SHA-512:8EEEAEFB86CF5F9D09426814F7B60E1805E644CAC3F5AB382C4D393DD0B7AB272C1909A31A57E6D38D5ACF207555F097A64A6DD62F60A97093E97BB184126D2A
                        Malicious:false
                        Reputation:unknown
                        Preview:/*! jQuery v1.11.3 | (c) 2005, 2015 jQuery Foundation, Inc. | jquery.org/license */.!function(a,b){"object"==typeof module&&"object"==typeof module.exports?module.exports=a.document?b(a,!0):function(a){if(!a.document)throw new Error("jQuery requires a window with a document");return b(a)}:b(a)}("undefined"!=typeof window?window:this,function(a,b){var c=[],d=c.slice,e=c.concat,f=c.push,g=c.indexOf,h={},i=h.toString,j=h.hasOwnProperty,k={},l="1.11.3",m=function(a,b){return new m.fn.init(a,b)},n=/^[\s\uFEFF\xA0]+|[\s\uFEFF\xA0]+$/g,o=/^-ms-/,p=/-([\da-z])/gi,q=function(a,b){return b.toUpperCase()};m.fn=m.prototype={jquery:l,constructor:m,selector:"",length:0,toArray:function(){return d.call(this)},get:function(a){return null!=a?0>a?this[a+this.length]:this[a]:d.call(this)},pushStack:function(a){var b=m.merge(this.constructor(),a);return b.prevObject=this,b.context=this.context,b},each:function(a,b){return m.each(this,a,b)},map:function(a){return this.pushStack(m.map(this,function(b,c){ret

                        Chrome Cache Entry: 107

                        Download File
                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                        File Type:JSON data
                        Category:downloaded
                        Size (bytes):121
                        Entropy (8bit):4.296888559995328
                        Encrypted:false
                        SSDEEP:
                        MD5:FF432631185D59BE11E35CC63F024573
                        SHA1:B8F12A85F14EB09570748DF8CEEA6FAEE085F31D
                        SHA-256:9DFE22BCD68B6362D5687D096DCA761218F356A37FC889E83DCD87ABC7DEEAB0
                        SHA-512:C929ACE6655CB5F6DA0FADE89F026A7EECCAFE6821CD56BA598E029B4ABC6DAF9A35CEABD236B3BCBF4BE33C74435E964FA983F8B5B1577D0BD369B9BC5DAE7C
                        Malicious:false
                        Reputation:unknown
                        URL:"https://clicktime.cloud.postoffice.net/rest/FF1001/v3/urlstatus?U=https://punchmeetdirect.info/&E=mbaker%40firstfedweb.com&X=XID170CkgR4R5051Xd2&T=FF1001&HV=U,E,X,T&H=7657709960056573da15999e9daa042b06812829&CK=CKCkTqzs76108148408c&resubmit=N&_=1732121481158"
                        Preview:{"status":"unknown","threatname":"","reprocess":true,"reason":"","polling_status":{"dynamic":1,"static":2,"in_depth":0}}.

                        Chrome Cache Entry: 108

                        Download File
                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                        File Type:ASCII text
                        Category:dropped
                        Size (bytes):22416
                        Entropy (8bit):4.386827911790251
                        Encrypted:false
                        SSDEEP:
                        MD5:74138F80B622EAC1E27CD928B8CF57DF
                        SHA1:EDB14CB1CBA354395901E6CD6F9A55DBFDDE4F93
                        SHA-256:C2717BA631484FD7F5A7848B2338A1A225EFF09914FA41D6DFB6EFC45BF0B95B
                        SHA-512:3A6D90F24D68C168861D33A5CBA6C7FB7DD6BBABE5AB5F697C8B0A7A5DBD520C02BE8346FE32122390DB2C3ADE95EF626228A5BAA533A2F27D08F6E462527D2B
                        Malicious:false
                        Reputation:unknown
                        Preview:// In case the browser doesn't have Date.now (IE8 and earlier).if (!Date.now) {. Date.now = function() {. return new Date().getTime();. }.}..// For IE9.//(function(){ window.console = window.console || { log: function(){} } }());..// Polling status code mapped with display string.POLLING_STATUS_DISPLAY_MAPPING = {. 0: { // Pending. 'icon': '',. 'text': '<h3>&lt; Pending &gt;</h3>'. }, // In Progress. 1: {. 'icon': '<img class="polling-status-icon" src="images/loading.gif">',. 'text': '<h3>&lt; In Progress &gt;</h3>'. }, // Unknown verdict. 2: {. 'icon': '<img class="polling-status-icon" src="images/tick.png">',. 'text': '<h3 style="color:#7FF337;">Nothing Found</h3>'. }, // Suspect verdict. 3: {. 'icon': '<img class="polling-status-icon" src="images/alert.svg">',. 'text': '<h3 style="color:#ffcc33;">Suspicious</h3>'. }, // Suspect in Progress. 4: {. 'icon': '<im

                        Chrome Cache Entry: 91

                        Download File
                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                        File Type:ASCII text
                        Category:dropped
                        Size (bytes):43
                        Entropy (8bit):4.376976022637824
                        Encrypted:false
                        SSDEEP:
                        MD5:752F5CBFE1380ABC745F5F8C71E09C9A
                        SHA1:21B03160831740AFAEF5EDC143FB81A77C87853B
                        SHA-256:AC791A7C366D8F879C37C893D3585660EC802C4D0534171B14E5ACCC12F368FB
                        SHA-512:C80A2A6E8BE952E702A2DD301FE9CD749CD0929B958700C9E83752474DAF0B82D62069C502B03D9BC65F30C308F24E1F2F0724B378A22A6EEF5CEC9C7D79740B
                        Malicious:false
                        Reputation:unknown
                        Preview:Array.(. [lastmodtime] => 1732121510.)..

                        Chrome Cache Entry: 93

                        Download File
                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                        File Type:ASCII text, with very long lines (9476)
                        Category:downloaded
                        Size (bytes):9477
                        Entropy (8bit):5.083820993965513
                        Encrypted:false
                        SSDEEP:
                        MD5:2EAD379C1E73686AB18ABD0E9DE02AED
                        SHA1:42073C7248BACBE4F794FFDE16CF8705999F28C9
                        SHA-256:9C5CAC9B09D5F0C3FE3D1D5A811223F1EA089177E78AAFFB9FDC04ED00E7A5A3
                        SHA-512:2484FA306CB82772995FDCFFC787052619FD869B4E0B716956324BFCFC7A61FBC73C7998AB3ED2F08C413CEFDA73C3A14F0265C371D918CCADF827312D4EC5A4
                        Malicious:false
                        Reputation:unknown
                        URL:https://cdnjs.cloudflare.com/ajax/libs/mustache.js/2.1.3/mustache.min.js
                        Preview:(function defineMustache(global,factory){if(typeof exports==="object"&&exports&&typeof exports.nodeName!=="string"){factory(exports)}else if(typeof define==="function"&&define.amd){define(["exports"],factory)}else{global.Mustache={};factory(Mustache)}})(this,function mustacheFactory(mustache){var objectToString=Object.prototype.toString;var isArray=Array.isArray||function isArrayPolyfill(object){return objectToString.call(object)==="[object Array]"};function isFunction(object){return typeof object==="function"}function typeStr(obj){return isArray(obj)?"array":typeof obj}function escapeRegExp(string){return string.replace(/[\-\[\]{}()*+?.,\\\^$|#\s]/g,"\\$&")}function hasProperty(obj,propName){return obj!=null&&typeof obj==="object"&&propName in obj}var regExpTest=RegExp.prototype.test;function testRegExp(re,string){return regExpTest.call(re,string)}var nonSpaceRe=/\S/;function isWhitespace(string){return!testRegExp(nonSpaceRe,string)}var entityMap={"&":"&amp;","<":"&lt;",">":"&gt;",'"'

                        Chrome Cache Entry: 96

                        Download File
                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                        File Type:ASCII text
                        Category:dropped
                        Size (bytes):226
                        Entropy (8bit):3.746633314569379
                        Encrypted:false
                        SSDEEP:
                        MD5:9A0074EC225494DF55A7226B2808B01B
                        SHA1:8ED0FBB6850F69AEBF05C4854166AA25504E361D
                        SHA-256:C3B833253377D17874682D092046115BE3CF3F41F3D1E29230330F094B195408
                        SHA-512:5025446F05388A4C536BEFBBF40CD8DC3096B2BA73E0C75686906765C8536748338FA14ECD07B9DDF3B380A12F401524450E473B4409842E19CD50835CE37CDE
                        Malicious:false
                        Reputation:unknown
                        Preview:Array.(. [status] => unknown. [threatname] => . [reprocess] => 1. [reason] => . [polling_status] => Array. (. [dynamic] => 1. [static] => 2. [in_depth] => 0. )..)..

                        Chrome Cache Entry: 97

                        Download File
                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                        File Type:HTML document, ASCII text
                        Category:downloaded
                        Size (bytes):209
                        Entropy (8bit):5.143049113812332
                        Encrypted:false
                        SSDEEP:
                        MD5:18FFB59B61525F781CF9251045BE575D
                        SHA1:BD7318B00B15B7A1C8A48524419FA2E5C27A5B6D
                        SHA-256:B6682CAB65D3243B5B75EFB7279DBF49491957484780F2BA0A87632CC0E25642
                        SHA-512:A032F853ABD9492232E1183D1CB1D14110B623F2E9DEC56B7B64DD576A0317DDA8D51125763E11D6642433C5364B2BD10A994EE4F1514629A4950BBAB3ABA499
                        Malicious:false
                        Reputation:unknown
                        URL:https://clicktime.cloud.postoffice.net/favicon.ico
                        Preview:<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">.<html><head>.<title>404 Not Found</title>.</head><body>.<h1>Not Found</h1>.<p>The requested URL /favicon.ico was not found on this server.</p>.</body></html>.

                        Chrome Cache Entry: 99

                        Download File
                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                        File Type:PNG image data, 250 x 92, 8-bit/color RGBA, non-interlaced
                        Category:dropped
                        Size (bytes):9335
                        Entropy (8bit):7.971742760307023
                        Encrypted:false
                        SSDEEP:
                        MD5:1C83FE8B9201CAC3D9E92DAB3E5383C4
                        SHA1:2CEDC7C3D1CAA57FC400DB2D3EE689626847CF84
                        SHA-256:0B6F376E22180D732CDF015BE9DE295BCC8E0BDB10A61536DDFD39C0026918AF
                        SHA-512:EF46559B15ED8A2FCD42275C5414D82147EF5F754CD4990103EFE174751008F2A621D9A9D70CF59A825035F5AB112B03D9C58685E3B46AF079A6C98EAA7C7987
                        Malicious:false
                        Reputation:unknown
                        Preview:.PNG........IHDR.......\.....G.......sRGB.........gAMA......a.....pHYs...#...#.x.?v..$.IDATx^..|.e..wf.K..@0...(.....)..."E.r....:XNi..I1..)......T...b....$..$3...f...%...l....<....w..}..m.H$..D".H$..D".H$..D".H$..D".H$..D".H$..D".HNi..P......W.........Wk.....77.\kU"9..PEWU...7..k..%--...e...'4}%.@...h...YYY...S....#..8.Z.HN:'\..-u..z......:.Z.H"...Z*....Z+...&MRKK..,.}[$...d.*.z...24o.2EQ...U.$b8..EJ{.....J.'##.L]7.n.J$..ITtb<..z/.Vj5....k..Z.H"....P..a8s..Z.j%.OV_<KOkU".8N..)..s.f-...Z....3.V%..$R,......k.p.....U.$"..EWNs..tk.....t5.c..*.D,...+......c.F<....p.Y.....I..Q.`......V#....GQ<..V%..&.....yaa1b..&##.".P.[..I..Q.n1$##.zk9.X.p.SU.l.J.k.D..D..3.UU%...G.;w....W..$..A$Ztr^aa...!++.,E1..V%.Z.IW.|}....Z.\...OnGk5".u......_..f-J$..IU...|}..JZ.l.....k...(Z.t..x.........g.....{[*.$b.I.<.O..s_hb.....g.p..O...5==.(**.Sv...[2&>....4...Z.'.|.....N./]..\.tI..s..9...*...!)z\\.....&MZX......`.gR...y.f...0JJJ.)...O<.L.Y..I....B'.Z5...W^y.\

                        Static File Info

                        General

                        File type:CDFV2 Microsoft Outlook Message
                        Entropy (8bit):5.592498953019931
                        TrID:
                        • Outlook Message (71009/1) 58.92%
                        • Outlook Form Template (41509/1) 34.44%
                        • Generic OLE2 / Multistream Compound File (8008/1) 6.64%
                        File name:SPECIAL PARTY INVITATION FROM DON & LINDA HUFFMAN.msg
                        File size:197'120 bytes
                        MD5:4808e757524494aa70a53c1fc51da08a
                        SHA1:f79e77711e9206e1d28036d04f60cbe85abab065
                        SHA256:81e838109a2562be17ef0c78a5ad1ccb623e7578b09f6da2f1f11f7ce0cd407b
                        SHA512:14099a91e2403360ee589a19a77e610fbd17f2609bab77cb2c31cd415f74160fc48ce01d246ecdaa9f22a578dfe19dfde1970d5bb3f40b022372d6cf3348cfcd
                        SSDEEP:3072:tmJLTxyxzc3AXFKwT8ZunK/akWaS7HlpWSErN:UZzi8ZMpWSE
                        TLSH:BC14B82435E94619F377DF724FE3809B9526FC82EE10D78F3195734E0671A81A862B2E
                        File Content Preview:........................>......................................................................................................................................................................................................................................

                        Static Mail

                        General

                        Subject:SPECIAL PARTY INVITATION FROM DON & LINDA HUFFMAN
                        From:Matt Baker <MBaker@FirstFedWeb.com>
                        To:Luis Maciel <LMaciel@firstfedweb.com>
                        Cc:
                        BCC:
                        Date:Wed, 20 Nov 2024 02:01:31 +0100
                        Communications:
                        • Luis I hate to bug you with this, but want to make sure there is no malicious links in the below. This is coming from my aunt/uncle and may be related to my Moms birthday, but youve trained me to trust no one Thank you! Matt Baker EVP, Chief Financial Officer <http://www.firstfedweb.com/> Direct (503) 435-3217 Email mbaker@firstfedweb.com <mailto:mbaker@firstfedweb.com> 118 NE Third Street, McMinnville, OR 97128 <https://www.facebook.com/firstfederal/> <https://www.instagram.com/first_federal/> <https://www.linkedin.com/company/first-federal-savings-&-loan-of-mcminnville/?viewAsMember=true> <https://www.youtube.com/channel/UCgGrkBPKOtKE-dMx-23qnwA> ---------- Forwarded message --------- From: Don or Linda Huffman <llhuffman@msn.com <mailto:llhuffman@msn.com> > Date: Thu, Nov 7, 2024 at 6:19AM Subject: SPECIAL PARTY INVITATION FROM DON & LINDA HUFFMAN To: <https://ecp.yusercontent.com/mail?url=https%3A%2F%2Fstatic.punchbowl.com%2Fassets%2Fen%2Femail%2Flogo_punchbowl_145x32-a6ea47b4ad17889d8ebd3466d36b26316f017b737b637d53d08f6247cfcf663c.png&t=1678780345&ymreqid=d41d8cd9-8f00-b204-1c80-ac000a010500&sig=W9A4aX0DIU7W7hIJq8FQ1g--~D> You're invited! Please click on the invitation to see more details and to RSVP. SPECIAL PARTY INVITATION FROM DON & LINDA HUFFMAN <https://clicktime.cloud.postoffice.net/clicktime.php?U=https://punchmeetdirect.info/&E=mbaker%40firstfedweb.com&X=XID170CkgR4R5051Xd2&T=FF1001&HV=U,E,X,T&H=7657709960056573da15999e9daa042b06812829> <https://clicktime.cloud.postoffice.net/clicktime.php?U=https://punchmeetdirect.info/&E=mbaker%40firstfedweb.com&X=XID170CkgR4R5051Xd2&T=FF1001&HV=U,E,X,T&H=7657709960056573da15999e9daa042b06812829> <https://ecp.yusercontent.com/mail?url=https%3A%2F%2Fwww.punchbowl.com%2Finvitation%2F9d959cab7e01efd6%2Ft.gif&t=1678780345&ymreqid=d41d8cd9-8f00-b204-1c80-ac000a010500&sig=6e_Ie29o7StM5w3NM99zlQ--~D> If you can't see the above invitation, click here <https://clicktime.cloud.postoffice.net/clicktime.php?U=https://punchmeetdirect.info/&E=mbaker%40firstfedweb.com&X=XID170CkgR4R5051Xd2&T=FF1001&HV=U,E,X,T&H=7657709960056573da15999e9daa042b06812829> . NB : We believe your data belongs to you, so we use it only to display your invite contents only. Punchbowl, Inc. 50 Speen Street, Suite 202 <https://clicktime.cloud.postoffice.net/clicktime.php?U=https://www.google.com/maps/search/50%2BSpeen%2BStreet,%2BSuite%2B202%2BFramingham,%2BMA%2B01701%3Fentry%3Dgmail%26source%3Dg&E=mbaker%40firstfedweb.com&X=XID170CkgR4R5051Xd2&T=FF1001&HV=U,E,X,T&H=051bd032bb79f4e7d0564eea216c41baf4b109a2> Framingham, MA 01701 <https://clicktime.cloud.postoffice.net/clicktime.php?U=https://www.google.com/maps/search/50%2BSpeen%2BStreet,%2BSuite%2B202%2BFramingham,%2BMA%2B01701%3Fentry%3Dgmail%26source%3Dg&E=mbaker%40firstfedweb.com&X=XID170CkgR4R5051Xd2&T=FF1001&HV=U,E,X,T&H=051bd032bb79f4e7d0564eea216c41baf4b109a2>
                        Attachments:
                        • image001.png
                        • image002.png
                        • image003.png
                        • image004.png
                        • image005.png
                        • image006.png
                        • image007.png
                        • image008.jpg
                        • image009.png

                        Headers

                        Key Value
                        Receivedfrom SA1PR22MB5396.namprd22.prod.outlook.com
                        0101:31 +0000
                        Authentication-Resultsdkim=none (message not signed)
                        by LV8PR22MB5028.namprd22.prod.outlook.com (260310b6:408:1c9::14) with
                        2024 0101:31 +0000
                        ([fe80:da33:cd27:23e7:48fa%6]) with mapi id 15.20.8158.017; Wed, 20 Nov 2024
                        Content-Typeapplication/ms-tnef; name="winmail.dat"
                        Content-Transfer-Encodingbinary
                        FromMatt Baker <MBaker@FirstFedWeb.com>
                        ToLuis Maciel <LMaciel@firstfedweb.com>
                        SubjectSPECIAL PARTY INVITATION FROM DON & LINDA HUFFMAN
                        Thread-TopicSPECIAL PARTY INVITATION FROM DON & LINDA HUFFMAN
                        Thread-IndexAQHbMT48zCyDiulSl0S3WZoRE/qBkrK/a7lA
                        DateWed, 20 Nov 2024 01:01:31 +0000
                        Message-ID<SA1PR22MB53965426D7E8E8AE6092D677CA212@SA1PR22MB5396.namprd22.prod.outlook.com>
                        References<SA1P220MB1432D22243073B29A907B88CBA5C2@SA1P220MB1432.NAMP220.PROD.OUTLOOK.COM>
                        In-Reply-To<CAHW=1OFg8i1PO91bzricHc9UZs6A0cnN9REiXf7_XKqjG+RdOw@mail.gmail.com>
                        Accept-Languageen-US
                        Content-Languageen-US
                        X-MS-Has-Attachyes
                        X-MS-Exchange-Organization-SCL1
                        X-MS-TNEF-Correlator<SA1PR22MB53965426D7E8E8AE6092D677CA212@SA1PR22MB5396.namprd22.prod.outlook.com>
                        MIME-Version1.0
                        X-MS-Exchange-Organization-MessageDirectionalityOriginating
                        X-MS-Exchange-Organization-AuthSourceSA1PR22MB5396.namprd22.prod.outlook.com
                        X-MS-Exchange-Organization-AuthAsInternal
                        X-MS-Exchange-Organization-AuthMechanism04
                        X-MS-Exchange-Organization-Network-Message-Idad78e3ec-5b4f-465b-2894-08dd08fedf39
                        X-MS-PublicTrafficTypeEmail
                        X-MS-TrafficTypeDiagnosticSA1PR22MB5396:EE_|LV8PR22MB5028:EE_|LV8PR22MB5166:EE_
                        Return-PathMBaker@FirstFedWeb.com
                        X-MS-Exchange-Organization-ExpirationStartTime20 Nov 2024 01:01:32.0127
                        X-MS-Exchange-Organization-ExpirationStartTimeReasonOriginalSubmit
                        X-MS-Exchange-Organization-ExpirationInterval1:00:00:00.0000000
                        X-MS-Exchange-Organization-ExpirationIntervalReasonOriginalSubmit
                        X-MS-Office365-Filtering-Correlation-Idad78e3ec-5b4f-465b-2894-08dd08fedf39
                        X-MS-Exchange-Organization-BypassClutter$true
                        X-Microsoft-AntispamBCL:0;ARA:13230040|366016|69100299015|8096899003|41050700001;
                        X-Forefront-Antispam-ReportCIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:SA1PR22MB5396.namprd22.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(366016)(69100299015)(8096899003)(41050700001);DIR:INT;
                        X-MS-Exchange-CrossTenant-OriginalArrivalTime20 Nov 2024 01:01:31.5858
                        X-MS-Exchange-CrossTenant-FromEntityHeaderHosted
                        X-MS-Exchange-CrossTenant-Id3778f0b2-789a-4d43-b25e-d4fe25a4c3c0
                        X-MS-Exchange-CrossTenant-AuthSourceSA1PR22MB5396.namprd22.prod.outlook.com
                        X-MS-Exchange-CrossTenant-AuthAsInternal
                        X-MS-Exchange-CrossTenant-Network-Message-Idad78e3ec-5b4f-465b-2894-08dd08fedf39
                        X-MS-Exchange-CrossTenant-MailboxTypeHOSTED
                        X-MS-Exchange-CrossTenant-UserPrincipalNameeVA8YzPUtpItNZ/MSqY21IhhoTFwsyIifCrRmfcvua7oS4Ub6t/lZob/hUxdAJxE5x9HOD6Ze7okxrbOUC5ftw==
                        X-MS-Exchange-Transport-CrossTenantHeadersStampedLV8PR22MB5028
                        X-MS-Exchange-Transport-EndToEndLatency00:00:02.6889427
                        X-MS-Exchange-Processed-By-BccFoldering15.20.8158.013
                        X-Microsoft-Antispam-Mailbox-Deliveryucf:0;jmr:0;auth:0;dest:I;ENG:(910001)(944506478)(944626604)(920097)(425001)(930097)(140003);
                        X-Microsoft-Antispam-Message-Infop7XmO0ekSHyxewHNy9MwMbhC9I+zFLQsodwiPlA2663THVtXW4jrx0HQHu3LYvMqmowgq3//Ob9EmYAdIfJv22LFe0/AkSJSqgLPp4/41z4awSD8ipgTzZExmMFSeoNjSqf5ohvmW7sqVqFSYztFs7OpOM0ZBMT/trY7lVq20dmb4/rheEZD9gjfI+5BZG5rX8WY9MlON+Dq2j9sqP6O8fhZgnGYZ2rfBh+wVFRAa02fqoEnLdBj1aN6NRGDrT0iFavscNyv70JkC/hnD4xi5tDNRUX5aGP8vtlx49Y+/WWZ1Mt67dbQTY2hRE28Iw0lnkf9+3il+lHGNtBhuVEzuTe5lscwRlj8R0gBepDiS9AJR5C6kDKnXijObziz+vMtvIRiUZr72wyd6JeeuHH74HGaD1ux7SCzdorZ1d0sKcqcEGUaZpL6afZPF4yFE6Jd7p12CfzBAksMJgneDqg/UHkaHaS2NCru/8V+KgDH6FNTtus96z6QLxbxskDns/NGv+t3DPtZNapE1M+2OqZDJIhRPlU3XwGV6L5uCdqDxudaaceiI4NOkDdleZBu2NPDWXDxqCMTkLKm8MnWxXZTTE6mkMgj+1WmoRF9hkC3nBymRFQAeRRB+I58QwkOVtJ4yxI15NEsfY0wm9K1pyMCMWiKJCJo3/MqA48QP14MHNtbV1c4HHryqhmyI6yFlvZt6waYF/bcTY0VXtbyOKhOilc3RBKy4PfL/0dedbSXtrrw8fns9IHMhkifA7vvxzHz8ka/p0LnWTxS4ttMQ1wjfpsv+I84pMiInzOTf7cFZ4evIZe7dBNzaC9Pr2I2twV0ziom2Lpnuh6oAhISWc2wxA==
                        dateWed, 20 Nov 2024 02:01:31 +0100

                        File Icon

                        Icon Hash:c4e1928eacb280a2