Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
Encrypt DOC2024.11.20.1983928 shared with you!.msg

Overview

General Information

Sample name:Encrypt DOC2024.11.20.1983928 shared with you!.msg
Analysis ID:1559868
MD5:81d01b71acd10bf7baf1b402cd73982e
SHA1:5edb757ab56ae2052f010feace093f6c32d67cfa
SHA256:c97b6e906d0b915446c2632b2a44f4f448c646394e7d71aa5912e54b3fe0fd82
Infos:

Detection

Score:60
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

AI detected phishing page
AI detected landing page (webpage, office document or email)
AI detected potential phishing Email
Suspicious MSG / EML detected (based on various text indicators)
Queries the volume information (name, serial number etc) of a device
Sigma detected: Office Autorun Keys Modification
Sigma detected: Suspicious Office Outbound Connections
Stores files to the Windows start menu directory
Stores large binary data to the registry
Suricata IDS alerts with low severity for network traffic

Classification

Process Tree

  • System is w10x64_ra
  • OUTLOOK.EXE (PID: 5096 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /f "C:\Users\user\Desktop\Encrypt DOC2024.11.20.1983928 shared with you!.msg" MD5: 91A5292942864110ED734005B7E005C0)
    • ai.exe (PID: 4204 cmdline: "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "1DCC07EF-E2A5-4B60-94E6-28F8550AFEBF" "C5A93F91-4E84-455E-A02B-C2BE443F6CCB" "5096" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx" MD5: EC652BEDD90E089D9406AFED89A8A8BD)
    • chrome.exe (PID: 7000 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://api.triofox.ai/docviewer/Viewer/DocViewer?s=79YNVmE8PeHyPztT MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)
      • chrome.exe (PID: 1092 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2060 --field-trial-handle=2064,i,6200511076360391076,9613365940005473051,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)
  • cleanup

Yara Signatures

⊘No yara matches

Sigma Signatures

Sigma detected: Office Autorun Keys Modification
Source: Registry Key setAuthor: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 , EventID: 13, EventType: SetValue, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE, ProcessId: 5096, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Addins\OneNote.OutlookAddin\1
Sigma detected: Suspicious Office Outbound Connections
Source: Network ConnectionAuthor: X__Junior (Nextron Systems): Data: DestinationIp: 192.168.2.17, DestinationIsIpv6: false, DestinationPort: 49693, EventID: 3, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE, Initiated: true, ProcessId: 5096, Protocol: tcp, SourceIp: 52.123.242.98, SourceIsIpv6: false, SourcePort: 443

Suricata Signatures

TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
2024-11-21T01:39:12.631770+010020283713Unknown Traffic192.168.2.174969352.123.242.98443TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Phishing

barindex
AI detected phishing page
Source: https://api.triofox.ai/docviewer/Viewer/DocViewer?s=79YNVmE8PeHyPztTJoe Sandbox AI: Score: 9 Reasons: The brand 'Apple' is classified as 'wellknown'., The URL 'api.triofox.ai' does not match the legitimate domain 'apple.com'., The domain 'triofox.ai' does not have any known association with Apple., The use of a different domain extension '.ai' and the presence of 'triofox' in the domain name are suspicious., The input fields labeled as 'u, n, k, n, o, w, n' do not provide clear context and could be a tactic to confuse users. DOM: 1.4.pages.csv
AI detected landing page (webpage, office document or email)
Source: EmailJoe Sandbox AI: Page contains button: 'VIEW DOCUMENT HERE' Source: 'Email'
Source: EmailJoe Sandbox AI: Email contains prominent button: 'view document here'
Source: https://api.triofox.ai/docviewer/Viewer/DocViewer?s=79YNVmE8PeHyPztTJoe Sandbox AI: Page contains button: 'VIEW DOCUMENT' Source: '1.5.pages.csv'
AI detected potential phishing Email
Source: EmailJoe Sandbox AI: Detected potential phishing email: Suspicious URL pattern with random parameters typical of phishing attempts. Generic document sharing subject line with random numbers to create urgency. Sender appears to be emailing themselves, which is unusual and suspicious
Suspicious MSG / EML detected (based on various text indicators)
Source: MSG / EMLOCR Text: Enclosed, please find a new scan doc shared with you. VIEW DOCUMENT HERE Pages:3 Resolution: 200x200 DPI This E-mail was sent from "RNP5838796F6B76" (1M 350).
Source: https://api.triofox.ai/docviewer/Viewer/DocViewer?s=79YNVmE8PeHyPztTHTTP Parser: No favicon
Source: https://api.triofox.ai/docviewer/Viewer/DocViewer?s=79YNVmE8PeHyPztTHTTP Parser: No favicon
Source: https://api.triofox.ai/docviewer/Viewer/DocViewer?s=79YNVmE8PeHyPztTHTTP Parser: No favicon
Source: https://api.triofox.ai/docviewer/Viewer/DocViewer?s=79YNVmE8PeHyPztTHTTP Parser: No favicon
Source: https://api.triofox.ai/docviewer/Viewer/DocViewer?s=79YNVmE8PeHyPztTHTTP Parser: No favicon
Source: https://gj.hbqcbhff.ru/wRtGG/HTTP Parser: No favicon
Source: unknownHTTPS traffic detected: 52.123.242.98:443 -> 192.168.2.17:49693 version: TLS 1.2
Source: unknownHTTPS traffic detected: 40.126.32.138:443 -> 192.168.2.17:49705 version: TLS 1.2
Source: unknownHTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.17:49708 version: TLS 1.2
Source: unknownHTTPS traffic detected: 40.126.32.138:443 -> 192.168.2.17:49712 version: TLS 1.2
Source: unknownHTTPS traffic detected: 13.107.5.88:443 -> 192.168.2.17:49742 version: TLS 1.2
Source: unknownHTTPS traffic detected: 2.18.27.82:443 -> 192.168.2.17:49746 version: TLS 1.2
Source: unknownHTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.17:49762 version: TLS 1.2
Source: Network trafficSuricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.17:49693 -> 52.123.242.98:443
Source: unknownTCP traffic detected without corresponding DNS query: 40.126.32.138
Source: unknownTCP traffic detected without corresponding DNS query: 40.126.32.138
Source: unknownTCP traffic detected without corresponding DNS query: 40.126.32.138
Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknownTCP traffic detected without corresponding DNS query: 40.126.32.138
Source: unknownTCP traffic detected without corresponding DNS query: 40.126.32.138
Source: unknownTCP traffic detected without corresponding DNS query: 40.126.32.138
Source: unknownTCP traffic detected without corresponding DNS query: 40.126.32.138
Source: unknownTCP traffic detected without corresponding DNS query: 40.126.32.138
Source: unknownTCP traffic detected without corresponding DNS query: 40.126.32.138
Source: unknownTCP traffic detected without corresponding DNS query: 40.126.32.138
Source: unknownTCP traffic detected without corresponding DNS query: 40.126.32.138
Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknownTCP traffic detected without corresponding DNS query: 40.126.32.138
Source: unknownTCP traffic detected without corresponding DNS query: 40.126.32.138
Source: unknownTCP traffic detected without corresponding DNS query: 40.126.32.138
Source: unknownTCP traffic detected without corresponding DNS query: 40.126.32.138
Source: unknownTCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknownTCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknownTCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknownTCP traffic detected without corresponding DNS query: 40.126.32.138
Source: unknownTCP traffic detected without corresponding DNS query: 40.126.32.138
Source: unknownTCP traffic detected without corresponding DNS query: 40.126.32.138
Source: unknownTCP traffic detected without corresponding DNS query: 40.126.32.138
Source: unknownTCP traffic detected without corresponding DNS query: 40.126.32.138
Source: unknownTCP traffic detected without corresponding DNS query: 40.126.32.138
Source: unknownTCP traffic detected without corresponding DNS query: 40.126.32.138
Source: unknownTCP traffic detected without corresponding DNS query: 40.126.32.138
Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknownTCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknownTCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknownTCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknownTCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknownTCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknownTCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknownTCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknownTCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknownTCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknownTCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknownTCP traffic detected without corresponding DNS query: 40.126.32.138
Source: unknownTCP traffic detected without corresponding DNS query: 40.126.32.138
Source: unknownTCP traffic detected without corresponding DNS query: 40.126.32.138
Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknownTCP traffic detected without corresponding DNS query: 40.126.32.138
Source: unknownTCP traffic detected without corresponding DNS query: 40.126.32.138
Source: unknownTCP traffic detected without corresponding DNS query: 40.126.32.138
Source: unknownTCP traffic detected without corresponding DNS query: 40.126.32.138
Source: global trafficDNS traffic detected: DNS query: api.triofox.ai
Source: global trafficDNS traffic detected: DNS query: www.google.com
Source: global trafficDNS traffic detected: DNS query: gj.hbqcbhff.ru
Source: global trafficDNS traffic detected: DNS query: code.jquery.com
Source: global trafficDNS traffic detected: DNS query: challenges.cloudflare.com
Source: global trafficDNS traffic detected: DNS query: cdnjs.cloudflare.com
Source: global trafficDNS traffic detected: DNS query: a.nel.cloudflare.com
Source: global trafficDNS traffic detected: DNS query: sejc8d32fwnu1au38ovjlaxpjg5fdpgdq5vdbmmpejexf06kxfs76xniu.ygncsqvu.ru
Source: global trafficDNS traffic detected: DNS query: google.com
Source: unknownNetwork traffic detected: HTTP traffic on port 49708 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49744
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49743
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49742
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49741
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49740
Source: unknownNetwork traffic detected: HTTP traffic on port 49789 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49766 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49743 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49746 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49781 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49769 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49720 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49739
Source: unknownNetwork traffic detected: HTTP traffic on port 49717 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49737
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49736
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49735
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49734
Source: unknownNetwork traffic detected: HTTP traffic on port 49772 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49733
Source: unknownNetwork traffic detected: HTTP traffic on port 49675 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49732
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49731
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49697
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49730
Source: unknownNetwork traffic detected: HTTP traffic on port 49732 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49693
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49690
Source: unknownNetwork traffic detected: HTTP traffic on port 49784 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49728 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49749 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49763 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49729
Source: unknownNetwork traffic detected: HTTP traffic on port 49752 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49728
Source: unknownNetwork traffic detected: HTTP traffic on port 49777 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49727
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49726
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49725
Source: unknownNetwork traffic detected: HTTP traffic on port 49735 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49724
Source: unknownNetwork traffic detected: HTTP traffic on port 49790 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49723
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49722
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49721
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49720
Source: unknownNetwork traffic detected: HTTP traffic on port 49731 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49712 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49697 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49787 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49729 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49748 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49760 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49793 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49718
Source: unknownNetwork traffic detected: HTTP traffic on port 49751 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49717
Source: unknownNetwork traffic detected: HTTP traffic on port 49680 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49713
Source: unknownNetwork traffic detected: HTTP traffic on port 49774 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49712
Source: unknownNetwork traffic detected: HTTP traffic on port 49757 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49782 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49734 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49710
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49793
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49792
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49791
Source: unknownNetwork traffic detected: HTTP traffic on port 49726 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49790
Source: unknownNetwork traffic detected: HTTP traffic on port 49740 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49765 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49768 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49723 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49708
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49705
Source: unknownNetwork traffic detected: HTTP traffic on port 49754 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49737 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49771 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49789
Source: unknownNetwork traffic detected: HTTP traffic on port 49733 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49788
Source: unknownNetwork traffic detected: HTTP traffic on port 49710 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49787
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49786
Source: unknownNetwork traffic detected: HTTP traffic on port 49779 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49785
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49784
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49782
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49781
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49780
Source: unknownNetwork traffic detected: HTTP traffic on port 49727 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49785 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49762 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49776 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49713 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49736 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49791 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49759 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49753 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49779
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49778
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49777
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49776
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49775
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49774
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49773
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49772
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49771
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49770
Source: unknownNetwork traffic detected: HTTP traffic on port 49788 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49724 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49742 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49767 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49780 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49721 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49773 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49718 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49769
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49768
Source: unknownNetwork traffic detected: HTTP traffic on port 49739 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49756 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49767
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49766
Source: unknownNetwork traffic detected: HTTP traffic on port 49758 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49765
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49764
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49763
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49762
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49761
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49760
Source: unknownNetwork traffic detected: HTTP traffic on port 49693 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49725 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49741 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49764 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49770 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49722 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49690 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49759
Source: unknownNetwork traffic detected: HTTP traffic on port 49778 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49758
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49757
Source: unknownNetwork traffic detected: HTTP traffic on port 49755 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49756
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49755
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49754
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49753
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49752
Source: unknownNetwork traffic detected: HTTP traffic on port 49705 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49730 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49751
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49750
Source: unknownNetwork traffic detected: HTTP traffic on port 49786 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49761 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49747 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49744 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49775 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49750 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49749
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49748
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49747
Source: unknownNetwork traffic detected: HTTP traffic on port 49792 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49746
Source: unknownHTTPS traffic detected: 52.123.242.98:443 -> 192.168.2.17:49693 version: TLS 1.2
Source: unknownHTTPS traffic detected: 40.126.32.138:443 -> 192.168.2.17:49705 version: TLS 1.2
Source: unknownHTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.17:49708 version: TLS 1.2
Source: unknownHTTPS traffic detected: 40.126.32.138:443 -> 192.168.2.17:49712 version: TLS 1.2
Source: unknownHTTPS traffic detected: 13.107.5.88:443 -> 192.168.2.17:49742 version: TLS 1.2
Source: unknownHTTPS traffic detected: 2.18.27.82:443 -> 192.168.2.17:49746 version: TLS 1.2
Source: unknownHTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.17:49762 version: TLS 1.2
Source: classification engineClassification label: mal60.phis.winMSG@25/21@32/231
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEFile created: C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEFile created: C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20241120T1939060156-5096.etl
Source: unknownProcess created: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /f "C:\Users\user\Desktop\Encrypt DOC2024.11.20.1983928 shared with you!.msg"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "1DCC07EF-E2A5-4B60-94E6-28F8550AFEBF" "C5A93F91-4E84-455E-A02B-C2BE443F6CCB" "5096" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://api.triofox.ai/docviewer/Viewer/DocViewer?s=79YNVmE8PeHyPztT
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2060 --field-trial-handle=2064,i,6200511076360391076,9613365940005473051,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "1DCC07EF-E2A5-4B60-94E6-28F8550AFEBF" "C5A93F91-4E84-455E-A02B-C2BE443F6CCB" "5096" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://api.triofox.ai/docviewer/Viewer/DocViewer?s=79YNVmE8PeHyPztT
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2060 --field-trial-handle=2064,i,6200511076360391076,9613365940005473051,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: apphelp.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: c2r64.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: userenv.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: msasn1.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: cryptsp.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: rsaenh.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: cryptbase.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: gpapi.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{F959DBBB-3867-41F2-8E5F-3B8BEFAA81B3}\InprocServer32
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEWindow found: window name: SysTabControl32
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Common
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEKey value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\outlook\ConfigContextData 1
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEFile Volume queried: C:\Windows\SysWOW64 FullSizeInformation
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information queried: ProcessInformation
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeQueries volume information: C:\Program Files (x86)\Microsoft Office\root\Office16\AI\WordCombinedFloatieLreOnline.onnx VolumeInformation
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management Instrumentation2
Browser Extensions		1
Process Injection		1
Masquerading		OS Credential Dumping1
Process Discovery		Remote ServicesData from Local System2
Encrypted Channel		Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/Job1
DLL Side-Loading		1
DLL Side-Loading		1
Modify Registry		LSASS Memory13
System Information Discovery		Remote Desktop ProtocolData from Removable Media1
Non-Application Layer Protocol		Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAt1
Registry Run Keys / Startup Folder		1
Registry Run Keys / Startup Folder		1
Process Injection		Security Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared Drive2
Application Layer Protocol		Automated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin Hook1
DLL Side-Loading		NTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput CaptureProtocol ImpersonationTraffic DuplicationData Destruction

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

⊘No Antivirus matches

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

SourceDetectionScannerLabelLink
svc.ms-acdc-teams.office.com0%VirustotalBrowse
api.triofox.ai0%VirustotalBrowse

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

NameIPActiveMaliciousAntivirus DetectionReputation
svc.ms-acdc-teams.office.com
52.123.242.98
truefalseunknown
sejc8d32fwnu1au38ovjlaxpjg5fdpgdq5vdbmmpejexf06kxfs76xniu.ygncsqvu.ru
172.67.168.1
truefalse
    		unknown
    bg.microsoft.map.fastly.net
    		199.232.214.172
    		truefalse
      		high
      a.nel.cloudflare.com
      		35.190.80.1
      		truefalse
        		high
        google.com
        		142.250.181.142
        		truefalse
          		high
          code.jquery.com
          		151.101.66.137
          		truefalse
            		high
            cdnjs.cloudflare.com
            		104.17.24.14
            		truefalse
              		high
              challenges.cloudflare.com
              		104.18.95.41
              		truefalse
                		high
                www.google.com
                		216.58.204.68
                		truefalse
                  		high
                  gj.hbqcbhff.ru
                  		172.67.190.113
                  		truefalse
                    		unknown
                    vertexgraph-orange-elb3-72928750.us-east-1.elb.amazonaws.com
                    		52.20.27.112
                    		truefalse
                      		unknown
                      api.triofox.ai
                      		unknown
                      		unknowntrueunknown

                      Contacted URLs

                      NameMaliciousAntivirus DetectionReputation
                      https://gj.hbqcbhff.ru/wRtGG/false
                        		unknown
                        https://api.triofox.ai/docviewer/Viewer/DocViewer?s=79YNVmE8PeHyPztTtrue
                          		unknown

                          World Map of Contacted IPs

                          • No. of IPs < 25%
                          • 25% < No. of IPs < 50%
                          • 50% < No. of IPs < 75%
                          • 75% < No. of IPs

                          Public IPs

                          IPDomainCountryFlagASNASN NameMalicious
                          52.20.27.112
                          		vertexgraph-orange-elb3-72928750.us-east-1.elb.amazonaws.comUnited States
                          		14618AMAZON-AESUSfalse
                          142.250.187.234
                          		unknownUnited States
                          		15169GOOGLEUSfalse
                          104.18.94.41
                          		unknownUnited States
                          		13335CLOUDFLARENETUSfalse
                          8.8.8.8
                          		unknownUnited States
                          		15169GOOGLEUSfalse
                          52.123.242.98
                          		svc.ms-acdc-teams.office.comUnited States
                          		8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                          172.217.169.14
                          		unknownUnited States
                          		15169GOOGLEUSfalse
                          52.109.32.97
                          		unknownUnited States
                          		8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                          199.232.214.172
                          		bg.microsoft.map.fastly.netUnited States
                          		54113FASTLYUSfalse
                          151.101.66.137
                          		code.jquery.comUnited States
                          		54113FASTLYUSfalse
                          104.21.74.88
                          		unknownUnited States
                          		13335CLOUDFLARENETUSfalse
                          151.101.194.137
                          		unknownUnited States
                          		54113FASTLYUSfalse
                          35.190.80.1
                          		a.nel.cloudflare.comUnited States
                          		15169GOOGLEUSfalse
                          104.17.24.14
                          		cdnjs.cloudflare.comUnited States
                          		13335CLOUDFLARENETUSfalse
                          1.1.1.1
                          		unknownAustralia
                          		13335CLOUDFLARENETUSfalse
                          172.67.168.1
                          		sejc8d32fwnu1au38ovjlaxpjg5fdpgdq5vdbmmpejexf06kxfs76xniu.ygncsqvu.ruUnited States
                          		13335CLOUDFLARENETUSfalse
                          51.104.15.253
                          		unknownUnited Kingdom
                          		8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                          172.217.16.227
                          		unknownUnited States
                          		15169GOOGLEUSfalse
                          2.20.12.87
                          		unknownEuropean Union
                          		20940AKAMAI-ASN1EUfalse
                          52.109.32.7
                          		unknownUnited States
                          		8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                          104.18.95.41
                          		challenges.cloudflare.comUnited States
                          		13335CLOUDFLARENETUSfalse
                          216.58.204.68
                          		www.google.comUnited States
                          		15169GOOGLEUSfalse
                          216.58.201.99
                          		unknownUnited States
                          		15169GOOGLEUSfalse
                          23.20.138.1
                          		unknownUnited States
                          		14618AMAZON-AESUSfalse
                          52.109.32.46
                          		unknownUnited States
                          		8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                          239.255.255.250
                          		unknownReserved
                          		unknownunknownfalse
                          64.233.184.84
                          		unknownUnited States
                          		15169GOOGLEUSfalse
                          172.67.190.113
                          		gj.hbqcbhff.ruUnited States
                          		13335CLOUDFLARENETUSfalse
                          23.219.197.161
                          		unknownUnited States
                          		4230CLAROSABRfalse
                          142.250.200.14
                          		unknownUnited States
                          		15169GOOGLEUSfalse

                          Private

                          IP
                          192.168.2.17

                          General Information

                          Joe Sandbox version:41.0.0 Charoite
                          Analysis ID:1559868
                          Start date and time:2024-11-21 01:38:29 +01:00
                          Joe Sandbox product:CloudBasic
                          Overall analysis duration:
                          Hypervisor based Inspection enabled:false
                          Report type:full
                          Cookbook file name:defaultwindowsinteractivecookbook.jbs
                          Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                          Number of analysed new started processes analysed:22
                          Number of new started drivers analysed:0
                          Number of existing processes analysed:0
                          Number of existing drivers analysed:0
                          Number of injected processes analysed:0
                          Technologies:
                          • EGA enabled
                          Analysis Mode:stream
                          Analysis stop reason:Timeout
                          Sample name:Encrypt DOC2024.11.20.1983928 shared with you!.msg
                          Detection:MAL
                          Classification:mal60.phis.winMSG@25/21@32/231
                          Cookbook Comments:
                          • Found application associated with file extension: .msg

                          Warnings

                          • Exclude process from analysis (whitelisted): dllhost.exe, RuntimeBroker.exe, backgroundTaskHost.exe, TextInputHost.exe, svchost.exe
                          • Excluded IPs from analysis (whitelisted): 52.109.32.97, 23.219.197.161, 52.109.32.7, 2.20.12.87, 2.20.12.72, 199.232.214.172, 52.109.32.46, 52.109.32.39, 52.109.32.38, 52.109.32.47
                          • Excluded domains from analysis (whitelisted): omex.cdn.office.net, osiprod-ukw-buff-azsc-000.ukwest.cloudapp.azure.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, eur.roaming1.live.com.akadns.net, roaming.officeapps.live.com, login.live.com, e16604.g.akamaiedge.net, officeclient.microsoft.com, ukw-azsc-config.officeapps.live.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, a1864.dscd.akamai.net, ecs.office.com, ukw-azsc-000.roaming.officeapps.live.com, fs.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, prod.configsvc1.live.com.akadns.net, ctldl.windowsupdate.com, prod.roaming1.live.com.akadns.net, prod1.naturallanguageeditorservice.osi.office.net.akadns.net, nleditor.osi.office.net, prod-eu-resolver.naturallanguageeditorservice.osi.office.net.akadns.net, config.officeapps.live.com, ecs.office.trafficmanager.net, omex.cdn.office.net.akamaized.net, europe.configsvc1.live.com.akadns.net, mira.config.skype.com
                          • Not all processes where analyzed, report is missing behavior information
                          • Report size getting too big, too many NtQueryAttributesFile calls found.
                          • Report size getting too big, too many NtQueryValueKey calls found.
                          • Report size getting too big, too many NtReadVirtualMemory calls found.

                          Created / dropped Files

                          C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

                          Download File
                          Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                          File Type:data
                          Category:modified
                          Size (bytes):338
                          Entropy (8bit):3.4598049346798283
                          Encrypted:false
                          SSDEEP:
                          MD5:44A2BC6A528A6B39186FB207B4C07CBE
                          SHA1:CADCC0C9CAC29FC605B8B27458B6409D45B0BF31
                          SHA-256:C02153E0861580BA2A91C8EC8035C3DB9A2190EE9B89281594B9A565E65BACD9
                          SHA-512:F47BE52F144D632AD95E8D1A7B00C68B193F84F1D9D7EB5483CFAA01F3B5F9EBF14CE4E968ECF46F952D2B5B56D86A3C4AD673F059C249D5A4752995502153A5
                          Malicious:false
                          Reputation:unknown
                          Preview:p...... .........y..;..(...............................................B:.VZ.. .........p.........$...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.d.i.s.a.l.l.o.w.e.d.c.e.r.t.s.t.l...c.a.b...".7.4.6.7.8.7.a.3.f.0.d.9.1.:.0."...

                          C:\Users\user\AppData\Local\Microsoft\FORMS\FRMCACHE.DAT

                          Download File
                          Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                          File Type:data
                          Category:dropped
                          Size (bytes):231348
                          Entropy (8bit):4.393159246758979
                          Encrypted:false
                          SSDEEP:
                          MD5:47309DCD749D410C11FA5FE8825D8800
                          SHA1:D3EDB17D9A4EC3829C88C1A757D7E4B05EA78122
                          SHA-256:22F4F0446D2583ABFEE03F907952C82725B9CB114214A1A4F08188F47BBFAFA1
                          SHA-512:1B2E9E014EE63F77ED51A350A8C28AA5974FD0CE0DA246C16A0E3BB39EE29A04907A2EA88664321B27EFCA5579C55AD123A7BD58A7596028A6047881FEFD8E89
                          Malicious:false
                          Reputation:unknown
                          Preview:TH02...... . .m..;......SM01X...,...@._..;..........IPM.Activity...........h...............h............H..h........S".@...h..........G.H..h\tor ...AppD...hx`F.0.........h3'.(..H........h........_`.k...h. .(@...I.+w...h....H...8..k...0....T...............d.........2h...............k.:7...........!h.............. h..............#h....8.........$h..G.....8....."h.b,..... c,...'h..............1h3'.(<.........0h....4.....k../h....h......kH..h0.H.p.........-h .......$.....+h.&.(....x........... ...... ..............F7..............FIPM.Activity....Form....Standard....Journal Entry...IPM.Microsoft.FolderDesign.FormsDescription................F.k..........1122110020000000....Microsoft...This form is used to create journal entries.........kf...... ..........&...........(.......(... ...@.....................................................................................................................fffffffff........wwwwwwww.p....pp..............p...............pw..............pw..DDDDO..

                          C:\Users\user\AppData\Local\Microsoft\FontCache\4\CatalogCacheMetaData.xml

                          Download File
                          Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                          File Type:XML 1.0 document, ASCII text, with very long lines (1869), with no line terminators
                          Category:dropped
                          Size (bytes):1869
                          Entropy (8bit):5.087773082978988
                          Encrypted:false
                          SSDEEP:
                          MD5:1E517C1B654D8854CCBD121DBA3E2E3F
                          SHA1:DBE620CC2984CBBCD721CC50664368EB82BE17C2
                          SHA-256:AD1A1FF3FD47A1800396F6017356DF36A5E5CFE04C0B9F81B88801F658187882
                          SHA-512:4801AE349C52602BE6EB45B14AD14EE6E61EEB96C3711231ED028D4229E8D81AAB10ADFE304B690F0C48FDB080AEAEDB25A0A3E740ECAFE1E7268CCC7661A747
                          Malicious:false
                          Reputation:unknown
                          Preview:<?xml version="1.0" encoding="UTF-8" standalone="yes"?><root><version>1</version><Count>12</Count><Resource><Id>Aptos_26215680</Id><LAT>2024-11-21T00:39:10Z</LAT><key>29939506207.ttf</key><folder>Aptos</folder><type>4</type></Resource><Resource><Id>Aptos_45876480</Id><LAT>2023-10-06T09:55:52Z</LAT><key>27160079615.ttf</key><folder>Aptos</folder><type>4</type></Resource><Resource><Id>Aptos Display_26215680</Id><LAT>2023-10-06T09:55:52Z</LAT><key>23001069669.ttf</key><folder>Aptos Display</folder><type>4</type></Resource><Resource><Id>Aptos Narrow_26215426</Id><LAT>2023-10-06T09:55:52Z</LAT><key>37262344671.ttf</key><folder>Aptos Narrow</folder><type>4</type></Resource><Resource><Id>Aptos Display_26215682</Id><LAT>2023-10-06T09:55:52Z</LAT><key>28367963232.ttf</key><folder>Aptos Display</folder><type>4</type></Resource><Resource><Id>Aptos Narrow_45876224</Id><LAT>2023-10-06T09:55:52Z</LAT><key>24153076628.ttf</key><folder>Aptos Narrow</folder><type>4</type></Resource><Resource><Id>Aptos_

                          C:\Users\user\AppData\Local\Microsoft\FontCache\4\Catalog\ListAll.Json

                          Download File
                          Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                          File Type:JSON data
                          Category:dropped
                          Size (bytes):521377
                          Entropy (8bit):4.9084889265453135
                          Encrypted:false
                          SSDEEP:
                          MD5:C37972CBD8748E2CA6DA205839B16444
                          SHA1:9834B46ACF560146DD7EE9086DB6019FBAC13B4E
                          SHA-256:D4CFBB0E8B9D3E36ECE921B9B51BD37EF1D3195A9CFA1C4586AEA200EB3434A7
                          SHA-512:02B4D134F84122B6EE9A304D79745A003E71803C354FB01BAF986BD15E3BA57BA5EF167CC444ED67B9BA5964FF5922C50E2E92A8A09862059852ECD9CEF1A900
                          Malicious:false
                          Reputation:unknown
                          Preview:{"MajorVersion":4,"MinorVersion":40,"Expiration":14,"Fonts":[{"a":[4294966911],"f":"Abadi","fam":[],"sf":[{"c":[1,0],"dn":"Abadi","fs":32696,"ful":[{"lcp":983041,"lsc":"Latn","ltx":"Abadi"}],"gn":"Abadi","id":"23643452060","p":[2,11,6,4,2,1,4,2,2,4],"sub":[],"t":"ttf","u":[2147483651,0,0,0],"v":197263,"w":26215680},{"c":[1,0],"dn":"Abadi Extra Light","fs":22180,"ful":[{"lcp":983042,"lsc":"Latn","ltx":"Abadi Extra Light"}],"gn":"Abadi Extra Light","id":"17656736728","p":[2,11,2,4,2,1,4,2,2,4],"sub":[],"t":"ttf","u":[2147483651,0,0,0],"v":197263,"w":13108480}]},{"a":[4294966911],"f":"ADLaM Display","fam":[],"sf":[{"c":[536870913,0],"dn":"ADLaM Display Regular","fs":140072,"ful":[{"lcp":983040,"lsc":"Latn","ltx":"ADLaM Display"}],"gn":"ADLaM Display","id":"31965479471","p":[2,1,0,0,0,0,0,0,0,0],"sub":[],"t":"ttf","u":[2147491951,1107296330,0,0],"v":131072,"w":26215680}]},{"a":[4294966911],"f":"Agency FB","fam":[],"sf":[{"c":[536870913,0],"dn":"Agency FB Bold","fs":54372,"ful":[{"lcp":9830

                          C:\Users\user\AppData\Local\Microsoft\FontCache\4\PreviewFont\flat_officeFontsPreview_4_40.ttf

                          Download File
                          Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                          File Type:TrueType Font data, 10 tables, 1st "OS/2", 7 names, Microsoft, language 0x409, \251 2018 Microsoft Corporation. All Rights Reserved.msofp_4_40RegularVersion 4.40;O365
                          Category:dropped
                          Size (bytes):773040
                          Entropy (8bit):6.55939673749297
                          Encrypted:false
                          SSDEEP:
                          MD5:4296A064B917926682E7EED650D4A745
                          SHA1:3953A6AA9100F652A6CA533C2E05895E52343718
                          SHA-256:E04E41C74D6C78213BA1588BACEE64B42C0EDECE85224C474A714F39960D8083
                          SHA-512:A25388DDCE58D9F06716C0F0BDF2AEFA7F68EBCA7171077533AF4A9BE99A08E3DCD8DFE1A278B7AA5DE65DA9F32501B4B0B0ECAB51F9AF0F12A3A8A75363FF2C
                          Malicious:false
                          Reputation:unknown
                          Preview:........... OS/29....(...`cmap.s.,.......pglyf..&....|....head2..........6hheaE.@v.......$hmtx...........@loca.U.....8...Dmaxp........... name.P+........post...<...... .........b~1_.<...........<......r......Aa...................Q....Aa....Aa.........................~...................................................3..............................MS .@.......(...Q................. ...........d...........0...J.......8.......>..........+a..#...,................................................/...K.......z...............N......*...!...-...+........z.......h..%^..3...&j..+...+%..'R..+..."....................k......$A...,.......g...&...=.......X..&........*......&....B..(B...............#.......j...............+...P...5...@...)..........#...)Q...............*...{.. ....?..'...#....N...7......<...;>.............. ]...........5......#....s.......$.......$.......^..................+...>....H.......%...7.......6.......O...V...........K......"........c...N......!...............$...&...*p..

                          C:\Users\user\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntities.bin

                          Download File
                          Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                          File Type:ASCII text, with very long lines (65536), with no line terminators
                          Category:dropped
                          Size (bytes):322260
                          Entropy (8bit):4.000299760592446
                          Encrypted:false
                          SSDEEP:
                          MD5:CC90D669144261B198DEAD45AA266572
                          SHA1:EF164048A8BC8BD3A015CF63E78BDAC720071305
                          SHA-256:89C701EEFF939A44F28921FD85365ECD87041935DCD0FE0BAF04957DA12C9899
                          SHA-512:16F8A8A6DCBAEAEFB88C7CFF910BCCC71B76A723CF808B810F500E28E543112C2FAE2491D4D209569BD810490EDFF564A2B084709B02963BCAF6FDF1AEEC59AC
                          Malicious:false
                          Reputation:unknown
                          Preview:51253fe60063c31af0d295afb42228b0:v2:2:1:1590:2:8479:76bd602437550e98c9043d06a55186ab7d95dea5a0e935a599f73e62a8c9b158e0afcb19351f6c353940c06a38172b94d18c02cf92bb8a80184eccca0392b259ab3e71dae73e491c7941997cb36ad4a198661f622dad478d840f66d530a0dde78acea3367f91fff62fbb3dc18faff0c708ad30edef5bea8b22c5fd782b770d8993386eaa784fd19a3c3e1db3b537b1a94d3d4fbd46f8df8fddf6d16611969fe0a97c50e0f3ac24750c93257cf5c161184aa7385800c87d803b339632a3d8ec7fe17a0afd83ce9e9d0e3f7b8d579637928a811f1f7e6d1887df2ddc7d4f752c4d600235e426c92c7bf8a1362f95457998cc0e5d4261f0efa4fada0f866dbcefb407dacab7a2914e91c2f08200f38c2d9d621962145b1464b0f204b326118a53ecdcab22bff005fdd5257c99a6dc51ac0600a49f2ef782396987e78c08b846dad5db55e8ccefffc64863bc2c3e90b95a09d25d0814a848c98fe01a82d4e30e6682dd546e12c45ca0d280a45295ab4bd632dafb070edfdc3c9e38313d5aeb195972986f8011b66817028fd8c78b67a0ac7e780eecc3fb6a31f5a025b8a9a3db278a98c0696aeaac739b18688b0f9c7d751bba02cc5f4e41853fb119b3c0c915059aaa92971244a1989124f12881ca88e6410df70b793a2c3a736ff4

                          C:\Users\user\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntitiesUpdated.bin

                          Download File
                          Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                          File Type:ASCII text, with no line terminators
                          Category:dropped
                          Size (bytes):10
                          Entropy (8bit):2.721928094887362
                          Encrypted:false
                          SSDEEP:
                          MD5:49220AA9F998BA7617C74C59B9B9D55D
                          SHA1:E0DBCAF2DF7CB9992580BC89AA01BB1B4FBBB7B7
                          SHA-256:328F4A36A7C1AC2B9564422F8FA1B943D42CFF36824CA101779F50E6283B0495
                          SHA-512:000AFAD4C105C3867597EB222C69850DA2B2C0FCABB41F0D2A546E6FB9B261BD98DB9C5AF0676D275B4E9222A74DEBB6D96AF7C8967F04C7EA09FF72E595B58F
                          Malicious:false
                          Reputation:unknown
                          Preview:1732149553

                          C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\8A272C30-24BC-489F-AC5C-169FD33D538A

                          Download File
                          Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                          File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                          Category:dropped
                          Size (bytes):180335
                          Entropy (8bit):5.289225625272062
                          Encrypted:false
                          SSDEEP:
                          MD5:A0BCF3468B017421BFBB20B68AD7F288
                          SHA1:B11059BD1E08EAF7A975E0BEC69F447909B27DA7
                          SHA-256:35016EF840C5808CB0E6B5D6736062CDE897A4451D3329980B4A197A78CFFD17
                          SHA-512:54422161913BC05932C8CD18E8413F5929627BBA1B1DDDBD81567252AF59A3FDA061C427316156197D1FDE20DE1FD3EF1C26E26101789BF264B9A79F948E2CBC
                          Malicious:false
                          Reputation:unknown
                          Preview:<?xml version="1.0" encoding="utf-8"?>..<o:OfficeConfig xmlns:o="urn:schemas-microsoft-com:office:office">.. <o:services o:GenerationTime="2024-11-21T00:39:09">.. Build: 16.0.18307.40125-->.. <o:default>.. <o:ticket o:headerName="Authorization" o:headerValue="{}" />.. </o:default>.. <o:service o:name="Research">.. <o:url>https://word-edit.officeapps.live.com/we/rrdiscovery.ashx</o:url>.. </o:service>.. <o:service o:name="ORedir">.. <o:url>https://o15.officeredir.microsoft.com/r</o:url>.. </o:service>.. <o:service o:name="ORedirSSL">.. <o:url>https://o15.officeredir.microsoft.com/r</o:url>.. </o:service>.. <o:service o:name="ClViewClientHelpId" o:authentication="1">.. <o:url>https://[MAX.BaseHost]/client/results</o:url>.. <o:ticket o:policy="MBI_SSL_SHORT" o:idprovider="1" o:target="[MAX.AuthHost]" o:headerValue="Passport1.4 from-PP='{}&amp;p='" />.. <o:ticket o:idprovider="3" o:headerValue="Bearer {}" o:resourceId="[

                          C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-journal

                          Download File
                          Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                          File Type:SQLite Rollback Journal
                          Category:dropped
                          Size (bytes):4616
                          Entropy (8bit):0.13700485453793962
                          Encrypted:false
                          SSDEEP:
                          MD5:42119589775C99BE48CE77E754113120
                          SHA1:336443E672A88F59D899E5776367A821813A62DE
                          SHA-256:698E31C34C401BDB19E4CE94F3AC758F04A2519FA0EDE42CC27AF48A58F8E6F0
                          SHA-512:B3E806735E072D704BA20C98C4466C549EC6EE83B1DB658F511FEFA8FD87B7E3231CA2124854CE713352600545E3B62A066B2BA8AF5798BCB4481D495607595B
                          Malicious:false
                          Reputation:unknown
                          Preview:.... .c.......:o....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................SQLite format 3......@ .......................................................................... .................................................................................................................................................................................................................................................................................................................................................................................................

                          C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres

                          Download File
                          Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                          File Type:data
                          Category:dropped
                          Size (bytes):2278
                          Entropy (8bit):3.8461904118895873
                          Encrypted:false
                          SSDEEP:
                          MD5:7F72BBA2DE91119E1737C43A26FB5018
                          SHA1:6A268E107DA4CDD8B33EF1533FEDCCBDB3E425BA
                          SHA-256:3EED96DBD21398A104A2FEE359EBD94565150BD161D6B539EF018D3CF751EE75
                          SHA-512:1FECE4C2BC9C27403DECF0B1F49717E6BD8BFD6101431EA68F0FA2D61B9EAB3C6F4871A42AE96CC8AC5E66163E7D1E186366A5EAC928673EB902F0F9D645A0C0
                          Malicious:false
                          Reputation:unknown
                          Preview:{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".C.J.1.m.u.g.S.o.z.s.S.9.x.S.Z./.Q.v.O.c.+.E.J.4.u.2.c.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.H.N.E.K.b.Y.7.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.x.k.3.L.B.S.

                          C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5475cb191e478c39370a215b2da98a37e9dc813d.tbres

                          Download File
                          Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                          File Type:data
                          Category:dropped
                          Size (bytes):2684
                          Entropy (8bit):3.9109873715330603
                          Encrypted:false
                          SSDEEP:
                          MD5:2764452AD239FC14A70A672ACF337446
                          SHA1:84073629CB51DA5438903D645C948BA7B7554B6F
                          SHA-256:71C92C4C019426B2BC2A54052C54F20B2159BFD4339D936FC704A442DB531C35
                          SHA-512:5ACBFF319AF0D9B62E7BACAD2118FD30091CFE43947B2E140A192E03BBE3F1E7F9091876AF6366AC732F760B263A1ACA515A442D6D51689C42FC399931D448D4
                          Malicious:false
                          Reputation:unknown
                          Preview:{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".V.H.X.L.G.R.5.H.j.D.k.3.C.i.F.b.L.a.m.K.N.+.n.c.g.T.0.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".9.v.K.a.Q.H.9.a.3.A.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.x.k.3.L.B.S.

                          C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\56a61aeb75d8f5be186c26607f4bb213abe7c5ec.tbres

                          Download File
                          Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                          File Type:data
                          Category:dropped
                          Size (bytes):4542
                          Entropy (8bit):3.9926348480097276
                          Encrypted:false
                          SSDEEP:
                          MD5:03E3264743518A26608F4BDE20BA3781
                          SHA1:4A318C9942359181E266CF9C256EB281532F0094
                          SHA-256:3D1CF264F6A8F21C77F7E0DE5FAFD56F572AFDC81DC1F543D320123B74A28DC9
                          SHA-512:292043BEDAEF088CA0D248B5A6E4BF682405F20C92C10D46D388F864E9AC2441855F466E1E69F8B7865648CC09E781235E7BE0A941CA5DFC81214C5FF95AC0BB
                          Malicious:false
                          Reputation:unknown
                          Preview:{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".V.q.Y.a.6.3.X.Y.9.b.4.Y.b.C.Z.g.f.0.u.y.E.6.v.n.x.e.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".L.Q.E.j.D.6.4.7.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.x.k.3.L.B.S.

                          C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\7555CD02.dat

                          Download File
                          Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                          File Type:PNG image data, 1090 x 710, 8-bit/color RGBA, non-interlaced
                          Category:dropped
                          Size (bytes):197542
                          Entropy (8bit):7.958774126629035
                          Encrypted:false
                          SSDEEP:
                          MD5:546FE17AC33985D750FC1D59777B50FA
                          SHA1:3F34A4934357ED41AAB6DD11BE159F2878D163F8
                          SHA-256:19716248F8DCE58B34CE75DBC37F12BBFF9A6644E9EFFCBFAFA28C47D647D81E
                          SHA-512:58EDFF888109DAAD85F9E964B3CE817CF72FAE60E84344C167C05E8D3ADBC53FFAEB685FDCB5C2808B7B4BEC8E4AFF85FDF3A6288143587F0A4F1C7BAAD7E71E
                          Malicious:false
                          Reputation:unknown
                          Preview:.PNG........IHDR...B.........A34....NiCCPICC Profile..H..W.XS...[R!..D@J.M...@J.-. *!..J..A....Z..,+........+.bw-....uq]...@.}.{.}s.....s....../....I.e......),R7..c..\.!_ .r....,......Q....Z....EK(...@.!N...y....o.He.....7../U.2.ud.A.k.8S.[.8]......r!~..Y..e....yV. ...a..I".K ...'/o...E..@.8']..N.J'.o..#.|~..V.2X..b.4.?..L...y...9.aU...*c.y{.3#L..!~+I...X..........IP.6.9...0!.$....B~@...gHr#.l.2.AJ..?.B...X....<0n..lF..73d\...........I..1.,.oH.s,.O...q@.81.b..#.9qaC6..Y..a.."V....2.$._...g.b..w..c.Ne.y.C.j~V|.*W.........'.p..uD.....E....q.H....q=i...j,n'.....E..J...xyA...|.8U.x.4?:^.'^....V.........(`M.3@6...6..;UO......".0...H...k.(..C$..q..."P..O.X%'..TW..1.T..O!..a ..+..$#.$.'....#>...C........_..d.....,..%1..@.!..mq.........Vg..{......AxD.A.$......2.tB..........j....7T..8.7.........]!...[...(.E......8QP.....f.H.;....e.......|sGzF...*.B......a...E..k.,.$..a.xd.=.\q......uF../OV.I.S.S..GU_.hv..e....3..Y..c.X<..q................W.f..n.

                          C:\Users\user\AppData\Roaming\Microsoft\Office\MSO3072.acl

                          Download File
                          Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                          File Type:data
                          Category:dropped
                          Size (bytes):30
                          Entropy (8bit):1.2389205950315936
                          Encrypted:false
                          SSDEEP:
                          MD5:652265AD11158017A46EA3808476208A
                          SHA1:8F1122F740FC44A5D9041403B149B0D7368578EA
                          SHA-256:194E68E1B3EB99AE02D3EB16E7B7D2A3E1486E5B01BE0D9C29C3F4895E92DFA8
                          SHA-512:CC0C6CEA922997AE595FCFEC73EC6F79C7A30AF47250BA425A32A0774F4100BD4D8130DF80A8DE93FCC0E364D39E14C04846F29917708BE93F1BAAA3E4E41623
                          Malicious:false
                          Reputation:unknown
                          Preview:..............................

                          C:\Users\user\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC

                          Download File
                          Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                          File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                          Category:dropped
                          Size (bytes):18
                          Entropy (8bit):2.725480556997868
                          Encrypted:false
                          SSDEEP:
                          MD5:A5E51FDFAF429614FB5218AB559D299A
                          SHA1:262EC76760BB9A83BCFF955C985E70820DF567AE
                          SHA-256:3E82E9F60CE38815C28B0E5323268BDA212A84C3A9C7ACCC731360F998DF0240
                          SHA-512:9B68F1C04BDE0024CECFC05A37932368CE2F09BD96C72AB0442E16C8CF5456ED9BB995901095AC1BBDF645255014A5E43AADEE475564F01CA6BE3889C96C29C9
                          Malicious:false
                          Reputation:unknown
                          Preview:..t.o.r.r.e.s.....

                          C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

                          Download File
                          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                          File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Nov 20 23:39:29 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
                          Category:dropped
                          Size (bytes):2677
                          Entropy (8bit):3.985765833640696
                          Encrypted:false
                          SSDEEP:
                          MD5:91DFC27FFEEC4AFD2781DBA06C1FB571
                          SHA1:D428C731323397493C6015080F39F2C615C6829F
                          SHA-256:E379BA5E0AFCCB0643C0EB77D0FE0F73D20643C01EF54C8AC547CE81269B2CE4
                          SHA-512:CC323339DEABC7708D721420D063874916D1FEA0361E8E599CD83C14FAF31AFF1D1C7CE3A154A457DCB00E1F723153ADF9FEFB43572E8606407EC44E69993331
                          Malicious:false
                          Reputation:unknown
                          Preview:L..................F.@.. ...$+.,......e.;......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.IuY......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VuY......L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.VuY......M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.VuY.............................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.VuY.............................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........'O.8.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                          C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

                          Download File
                          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                          File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Nov 20 23:39:29 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
                          Category:dropped
                          Size (bytes):2679
                          Entropy (8bit):4.002582720865546
                          Encrypted:false
                          SSDEEP:
                          MD5:FD5AB585611CB279D3B44FC722E85550
                          SHA1:74F0D328D6A9BF0EE597A2987DE5CB909EB38429
                          SHA-256:98A899A7ACABBFE44383FAA8708F3D68501EA61A033D0557B4EEAB2DD84FA1AA
                          SHA-512:88C566C1F249160FC60DDFF759CA089F01D63410592B8D83464B8F13356F74D5C844A32B7862EDC32275C607B0E5E621EF61C2C1ACCBA8DC6BD7537FF4AD969D
                          Malicious:false
                          Reputation:unknown
                          Preview:L..................F.@.. ...$+.,.....;W.;......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.IuY......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VuY......L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.VuY......M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.VuY.............................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.VuY.............................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........'O.8.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                          C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

                          Download File
                          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                          File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:54:41 2023, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
                          Category:dropped
                          Size (bytes):2693
                          Entropy (8bit):4.014077688150189
                          Encrypted:false
                          SSDEEP:
                          MD5:B63E34926E12DE4207255AC03240EBDE
                          SHA1:8F78D24045BF752131CC4648AA2C88ECB62973F6
                          SHA-256:5C4F0313BC7BEE742A2AE5FED31BD9007C0DAA0F853C64097DC021024499247B
                          SHA-512:67A67DCD90DC7CA8873393A86E365C0DF21BC64984EBFA104B29934B1551CCA792361B67FF79A5044023B59A23AA4D6023244F5A5AC1F79AF5F034D1C2CC0707
                          Malicious:false
                          Reputation:unknown
                          Preview:L..................F.@.. ...$+.,.....v. ;.......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.IuY......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VuY......L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.VuY......M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.VuY.............................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.VFW.N...........................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........'O.8.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                          C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

                          Download File
                          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                          File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Nov 20 23:39:29 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
                          Category:dropped
                          Size (bytes):2681
                          Entropy (8bit):4.0032997229573555
                          Encrypted:false
                          SSDEEP:
                          MD5:E2C34CE849080C4B6A91BB9F54E51C8D
                          SHA1:03EA6238388B471523750894902E96FC6D5337FD
                          SHA-256:5A54A5765B74550D4C17987165F9BB016A6E5568BF47CBFD374490B55EAAFCEE
                          SHA-512:A65AB8AEC25779293E3307623FB5F39BC2636C22D18FA4CB07178A73569EE68A5A6CF9A90A449F576512A29706A29BFEC769D440976233C217F61FDEA362364F
                          Malicious:false
                          Reputation:unknown
                          Preview:L..................F.@.. ...$+.,......O.;......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.IuY......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VuY......L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.VuY......M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.VuY.............................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.VuY.............................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........'O.8.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                          C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

                          Download File
                          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                          File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Nov 20 23:39:29 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
                          Category:dropped
                          Size (bytes):2681
                          Entropy (8bit):3.990652994645004
                          Encrypted:false
                          SSDEEP:
                          MD5:CC07E2EDC5DABD4A2068BAF0460F7863
                          SHA1:E75AEA11418B919FD10F4DA3013D171DDD0AC7F3
                          SHA-256:C346100199882E527928DF8C04F4CECDA3E4CE39180ADC078BAC53FBE22AC1CA
                          SHA-512:69FA2E460D48D6ABF3354A03AB10B26EBF9BB8274F6B3FFF9C0986AF16DC9D40B90E305BA43DDC111381A00FCCB1375091A73AF37D47396B07550E5791E1039C
                          Malicious:false
                          Reputation:unknown
                          Preview:L..................F.@.. ...$+.,....D.^.;......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.IuY......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VuY......L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.VuY......M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.VuY.............................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.VuY.............................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........'O.8.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                          C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

                          Download File
                          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                          File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Nov 20 23:39:29 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
                          Category:dropped
                          Size (bytes):2683
                          Entropy (8bit):3.9995585759712493
                          Encrypted:false
                          SSDEEP:
                          MD5:FE661B090F2CFDD302E831F8B33A4A05
                          SHA1:3484A130AAA7DDE45B3DBAD8EE7F30C7B0FC5375
                          SHA-256:704EBC8568C66D920C3F7B1E1F4C031F15D7DE05852044E90E85E77A742B6A95
                          SHA-512:65499F38D2C61CB74F31EF96F154AC52D1556D3E771402C3A8DF0F8C4584DFD236FD96E9D675E2E8A689201071CB820602C5B0380349B38529C32EE4A55B43D4
                          Malicious:false
                          Reputation:unknown
                          Preview:L..................F.@.. ...$+.,.....E.;......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.IuY......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VuY......L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.VuY......M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.VuY.............................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.VuY.............................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........'O.8.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                          Static File Info

                          General

                          File type:CDFV2 Microsoft Outlook Message
                          Entropy (8bit):7.365033801923494
                          TrID:
                          • Outlook Message (71009/1) 58.92%
                          • Outlook Form Template (41509/1) 34.44%
                          • Generic OLE2 / Multistream Compound File (8008/1) 6.64%
                          File name:Encrypt DOC2024.11.20.1983928 shared with you!.msg
                          File size:296'960 bytes
                          MD5:81d01b71acd10bf7baf1b402cd73982e
                          SHA1:5edb757ab56ae2052f010feace093f6c32d67cfa
                          SHA256:c97b6e906d0b915446c2632b2a44f4f448c646394e7d71aa5912e54b3fe0fd82
                          SHA512:689155e0e7f2f8f3b3f4737c60aca6977d7bfdaf1795f342dbaa2d83f2b9cf2500e4cd7d5de60071911dd2c8d30897c4b53bf8423e500cb6a78ac0146121c3fa
                          SSDEEP:3072:W8tpucyE0/2umG2d8uT1ivozVpY/rd8vInMXCO9dyUZDwlYrdi8hTdkxzUeO1TH2:WKucy2umrhZIkpumtoUbhTdkvO1ofJy
                          TLSH:3754BE1135E55127F2B78F361DD2C4C7972ABCA29D00CBAF3791B35E0932581ED62B2A
                          File Content Preview:........................>.......................................................o..............................................................................................................................................................................

                          Static Mail

                          General

                          Subject:Encrypt *DOC2024.11.20.1983928* shared with you!
                          From:"Ludwig, Valerie" <valerie.ludwig@dallastown.net>
                          To:"Ludwig; Valerie" <valerie.ludwig@dallastown.net>
                          Cc:"Ludwig; Valerie" <valerie.ludwig@dallastown.net>
                          BCC:"Ludwig; Valerie" <valerie.ludwig@dallastown.net>
                          Date:Wed, 20 Nov 2024 23:53:07 +0100
                          Communications:
                          • <https://api.triofox.ai/docviewer/Viewer/DocViewer?s=79YNVmE8PeHyPztT>
                          Attachments:
                          • image001.png

                          Headers

                          Key Value
                          Receivedfrom MN2PR02MB5791.namprd02.prod.outlook.com
                          2253:07 +0000
                          Authentication-Resultsdkim=none (message not signed)
                          by SA1PR02MB8559.namprd02.prod.outlook.com (260310b6:806:1fa::17) with
                          2024 2253:08 +0000
                          ([fe80:a67c:313b:6a06:586e%3]) with mapi id 15.20.8158.023; Wed, 20 Nov 2024
                          Content-Typeapplication/ms-tnef; name="winmail.dat"
                          Content-Transfer-Encodingbinary
                          From"Ludwig, Valerie" <valerie.ludwig@dallastown.net>
                          To"Ludwig, Valerie" <valerie.ludwig@dallastown.net>
                          CC"Ludwig, Valerie" <valerie.ludwig@dallastown.net>
                          SubjectEncrypt *DOC2024.11.20.1983928* shared with you!
                          Thread-TopicEncrypt *DOC2024.11.20.1983928* shared with you!
                          Thread-IndexAds7nn7JLbnNDG1QQ8SMFYEJn08xIQ==
                          DateWed, 20 Nov 2024 22:53:07 +0000
                          Message-ID<MN2PR02MB579146648C38AD12A3F393E7F4212@MN2PR02MB5791.namprd02.prod.outlook.com>
                          Accept-Languageen-US
                          Content-Languageen-US
                          X-MS-Has-Attachyes
                          X-MS-Exchange-Organization-SCL1
                          X-MS-TNEF-Correlator<MN2PR02MB579146648C38AD12A3F393E7F4212@MN2PR02MB5791.namprd02.prod.outlook.com>
                          MIME-Version1.0
                          X-MS-Exchange-Organization-MessageDirectionalityOriginating
                          X-MS-Exchange-Organization-AuthSourceMN2PR02MB5791.namprd02.prod.outlook.com
                          X-MS-Exchange-Organization-AuthAsInternal
                          X-MS-Exchange-Organization-AuthMechanism04
                          X-MS-Exchange-Organization-Network-Message-Idd8c30041-6451-406d-03d3-08dd09b619bf
                          X-MS-PublicTrafficTypeEmail
                          X-MS-TrafficTypeDiagnosticMN2PR02MB5791:EE_|SA1PR02MB8559:EE_|MN2PR02MB5791:EE_
                          Return-Pathvalerie.ludwig@dallastown.net
                          X-MS-Exchange-Organization-ExpirationStartTime20 Nov 2024 22:53:08.5907
                          X-MS-Exchange-Organization-ExpirationStartTimeReasonOriginalSubmit
                          X-MS-Exchange-Organization-ExpirationInterval1:00:00:00.0000000
                          X-MS-Exchange-Organization-ExpirationIntervalReasonOriginalSubmit
                          X-MS-Office365-Filtering-Correlation-Idd8c30041-6451-406d-03d3-08dd09b619bf
                          X-Microsoft-AntispamBCL:0;ARA:13230040|366016|4073399012|8096899003|41050700001;
                          X-Forefront-Antispam-ReportCIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:MN2PR02MB5791.namprd02.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(366016)(4073399012)(8096899003)(41050700001);DIR:INT;
                          X-MS-Exchange-CrossTenant-OriginalArrivalTime20 Nov 2024 22:53:07.6873
                          X-MS-Exchange-CrossTenant-FromEntityHeaderHosted
                          X-MS-Exchange-CrossTenant-Idd0fab761-2ee2-49ef-bfd4-791d50088f62
                          X-MS-Exchange-CrossTenant-AuthSourceMN2PR02MB5791.namprd02.prod.outlook.com
                          X-MS-Exchange-CrossTenant-AuthAsInternal
                          X-MS-Exchange-CrossTenant-Network-Message-Idd8c30041-6451-406d-03d3-08dd09b619bf
                          X-MS-Exchange-CrossTenant-MailboxTypeHOSTED
                          X-MS-Exchange-CrossTenant-UserPrincipalNameFrEZfFsuUd/rzBFmFqraqdz12KX5dqVo+tit4tJZ2jHUo5996h7DLT9nv9sk45saT3N2l2YJe20CkUDAHTWs19gwS6qkBb9n4Ju41gqtqoY=
                          X-MS-Exchange-Transport-CrossTenantHeadersStampedSA1PR02MB8559
                          X-MS-Exchange-Transport-EndToEndLatency00:00:03.2902571
                          X-MS-Exchange-Processed-By-BccFoldering15.20.8158.023
                          X-Microsoft-Antispam-Mailbox-Deliveryucf:1;jmr:0;auth:0;dest:C;OFR:CustomRules;ENG:(910001)(944506478)(944626604)(920097)(425001)(930097)(140003);
                          X-Microsoft-Antispam-Message-InfofPMShQAb4/cndJ1S8Z+1gLLE1zvdewae4IgxS9ADbscoJF+8P040i9XFSOOAiuBnjRgfpNDZx7KvqND45vb0UGyaIymuVVr+BdFFK9wIrI/dYdwT/6At5NPp9SP0xy461cpTesNWcfR0QtNQurJBCIixHT/z2bAq2przSlexQtdye1jqSQfj2orT8gS+v0CzSwsnVXNMnzynSHDc5NoiNBMwtBYftvogzgF6pIaLuV9mD9CBtOCrfB1wBbgmSOBFZ/3yKzb/JAVriWYmuHueVWGeN3sYQuo9gUVcbuE+8Dbx+CFxoieAh/Fb8aLtKRCTN4fsfnL6vMij+PIELslRaC3vW5HllHZxE0IjKYR7VXHPP9HLJWuZi1r82XqXP/9fmS9DVpXPYO9NgOGkyJNUBG801Fa7t6hS2Ir8ST7kJ1HvCnWbwvyWEP8RiAsDaYofnfvmGklqJDGfyuWCERrs+EBZ4zkLYkcbL0H52QGh7KddyJ9PspTmKTj5Cw/sGyzBj+nEgkczMpD20WcCfFAUR1mk0wWPV71PHOl8dWLsy0ATO7T3n1fbfdeNRQ6+q/0aQKNFDddA0kF6xA0pR2Hsu98k2NMKteoWD5t9CjaU1e2FrQkLbC+BPBfbWPxg2NXw+JfbzdFh/CrRskpz7jeVyA==
                          dateWed, 20 Nov 2024 23:53:07 +0100

                          File Icon

                          Icon Hash:c4e1928eacb280a2