Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
Message_2604337.eml

Overview

General Information

Sample name:Message_2604337.eml
Analysis ID:1560851
MD5:7fd30e219be63bb9ecc1fcde0c93857f
SHA1:173ac5134314de2f5ea516041507e921565e67e4
SHA256:d039995511ef353213999f3df77b19bb19991068b098dafcc22863e9111cc568
Infos:

Detection

Score:22
Range:0 - 100
Whitelisted:false
Confidence:60%

Signatures

AI detected potential phishing Email
Queries the volume information (name, serial number etc) of a device
Sigma detected: Office Autorun Keys Modification
Stores files to the Windows start menu directory
Stores large binary data to the registry

Classification

Process Tree

  • System is w10x64_ra
  • OUTLOOK.EXE (PID: 7152 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\user\Desktop\Message_2604337.eml" MD5: 91A5292942864110ED734005B7E005C0)
    • ai.exe (PID: 6252 cmdline: "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "18656E1F-CC26-40D7-B08C-AEE9664C69CE" "9D45F24E-2324-45C1-B5CE-D1FD88284483" "7152" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx" MD5: EC652BEDD90E089D9406AFED89A8A8BD)
    • chrome.exe (PID: 5504 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://accounts.benefitt.best/representaton.aspx?sets=Kzo2WUY7VCFSOUcsTjxHNCA= MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
      • chrome.exe (PID: 3660 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 --field-trial-handle=1944,i,7014618369789109582,11394782824861895470,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
    • chrome.exe (PID: 8064 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://accounts.benefitt.best/representaton.aspx?sets=Kzo2WUY7VCFSOUcsTjxHNCA= MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
      • chrome.exe (PID: 1268 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 --field-trial-handle=1948,i,15485599689338901972,10989529630386925692,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
  • cleanup

Yara Signatures

⊘No yara matches

Sigma Signatures

Sigma detected: Office Autorun Keys Modification
Source: Registry Key setAuthor: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 , EventID: 13, EventType: SetValue, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE, ProcessId: 7152, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Addins\OneNote.OutlookAddin\1

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Phishing

barindex
AI detected potential phishing Email
Source: EmailJoe Sandbox AI: Detected potential phishing email: The email contains repetitive, nonsensical text patterns that are typical of spam/phishing attempts. The sender domain 'marylandchildcares.com' doesn't match with the purported Teams-related content. The email contains a suspicious URL with an unusual domain 'benefitt.best' and encoded parameters
Source: unknownHTTPS traffic detected: 20.190.177.83:443 -> 192.168.2.16:49705 version: TLS 1.2
Source: unknownHTTPS traffic detected: 20.190.177.83:443 -> 192.168.2.16:49715 version: TLS 1.2
Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknownTCP traffic detected without corresponding DNS query: 20.190.177.83
Source: unknownTCP traffic detected without corresponding DNS query: 20.190.177.83
Source: unknownTCP traffic detected without corresponding DNS query: 20.190.177.83
Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknownTCP traffic detected without corresponding DNS query: 20.190.177.83
Source: unknownTCP traffic detected without corresponding DNS query: 20.190.177.83
Source: unknownTCP traffic detected without corresponding DNS query: 20.190.177.83
Source: unknownTCP traffic detected without corresponding DNS query: 20.190.177.83
Source: unknownTCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknownTCP traffic detected without corresponding DNS query: 20.190.177.83
Source: unknownTCP traffic detected without corresponding DNS query: 20.190.177.83
Source: unknownTCP traffic detected without corresponding DNS query: 20.190.177.83
Source: unknownTCP traffic detected without corresponding DNS query: 20.190.177.83
Source: unknownTCP traffic detected without corresponding DNS query: 20.190.177.83
Source: unknownTCP traffic detected without corresponding DNS query: 20.190.177.83
Source: unknownTCP traffic detected without corresponding DNS query: 20.190.177.83
Source: unknownTCP traffic detected without corresponding DNS query: 20.190.177.83
Source: unknownTCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknownTCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknownTCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknownTCP traffic detected without corresponding DNS query: 20.190.177.83
Source: unknownTCP traffic detected without corresponding DNS query: 20.190.177.83
Source: unknownTCP traffic detected without corresponding DNS query: 20.190.177.83
Source: unknownTCP traffic detected without corresponding DNS query: 20.190.177.83
Source: unknownTCP traffic detected without corresponding DNS query: 20.190.177.83
Source: unknownTCP traffic detected without corresponding DNS query: 20.190.177.83
Source: unknownTCP traffic detected without corresponding DNS query: 20.190.177.83
Source: unknownTCP traffic detected without corresponding DNS query: 20.190.177.83
Source: unknownTCP traffic detected without corresponding DNS query: 20.190.177.83
Source: unknownTCP traffic detected without corresponding DNS query: 20.190.177.83
Source: unknownTCP traffic detected without corresponding DNS query: 20.190.177.83
Source: unknownTCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknownTCP traffic detected without corresponding DNS query: 20.190.177.83
Source: unknownTCP traffic detected without corresponding DNS query: 20.190.177.83
Source: unknownTCP traffic detected without corresponding DNS query: 20.190.177.83
Source: unknownTCP traffic detected without corresponding DNS query: 20.190.177.83
Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknownTCP traffic detected without corresponding DNS query: 20.190.177.83
Source: unknownTCP traffic detected without corresponding DNS query: 20.190.177.83
Source: unknownTCP traffic detected without corresponding DNS query: 20.190.177.83
Source: unknownTCP traffic detected without corresponding DNS query: 20.190.177.83
Source: unknownTCP traffic detected without corresponding DNS query: 20.190.177.83
Source: unknownTCP traffic detected without corresponding DNS query: 20.190.177.83
Source: unknownTCP traffic detected without corresponding DNS query: 20.190.177.83
Source: unknownTCP traffic detected without corresponding DNS query: 20.190.177.83
Source: global trafficDNS traffic detected: DNS query: accounts.benefitt.best
Source: global trafficDNS traffic detected: DNS query: a.nel.cloudflare.com
Source: global trafficDNS traffic detected: DNS query: www.google.com
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49722
Source: unknownNetwork traffic detected: HTTP traffic on port 49733 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49710 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49721
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49720
Source: unknownNetwork traffic detected: HTTP traffic on port 49731 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49678 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49725 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49719 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49720 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49722 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49719
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49718
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49717
Source: unknownNetwork traffic detected: HTTP traffic on port 49715 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49738
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49715
Source: unknownNetwork traffic detected: HTTP traffic on port 49717 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49714
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49735
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49734
Source: unknownNetwork traffic detected: HTTP traffic on port 49738 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49711
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49733
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49710
Source: unknownNetwork traffic detected: HTTP traffic on port 49734 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49731
Source: unknownNetwork traffic detected: HTTP traffic on port 49673 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49707 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49730
Source: unknownNetwork traffic detected: HTTP traffic on port 49705 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49730 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49711 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49726 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49724 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49721 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49723 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49707
Source: unknownNetwork traffic detected: HTTP traffic on port 49714 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49705
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49726
Source: unknownNetwork traffic detected: HTTP traffic on port 49718 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49725
Source: unknownNetwork traffic detected: HTTP traffic on port 49735 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49724
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49723
Source: unknownHTTPS traffic detected: 20.190.177.83:443 -> 192.168.2.16:49705 version: TLS 1.2
Source: unknownHTTPS traffic detected: 20.190.177.83:443 -> 192.168.2.16:49715 version: TLS 1.2
Source: classification engineClassification label: sus22.winEML@33/27@12/190
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEFile created: C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEFile created: C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20241122T0624310601-7152.etl
Source: unknownProcess created: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\user\Desktop\Message_2604337.eml"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "18656E1F-CC26-40D7-B08C-AEE9664C69CE" "9D45F24E-2324-45C1-B5CE-D1FD88284483" "7152" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://accounts.benefitt.best/representaton.aspx?sets=Kzo2WUY7VCFSOUcsTjxHNCA=
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 --field-trial-handle=1944,i,7014618369789109582,11394782824861895470,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "18656E1F-CC26-40D7-B08C-AEE9664C69CE" "9D45F24E-2324-45C1-B5CE-D1FD88284483" "7152" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://accounts.benefitt.best/representaton.aspx?sets=Kzo2WUY7VCFSOUcsTjxHNCA=
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 --field-trial-handle=1948,i,15485599689338901972,10989529630386925692,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://accounts.benefitt.best/representaton.aspx?sets=Kzo2WUY7VCFSOUcsTjxHNCA=
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 --field-trial-handle=1944,i,7014618369789109582,11394782824861895470,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://accounts.benefitt.best/representaton.aspx?sets=Kzo2WUY7VCFSOUcsTjxHNCA=
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 --field-trial-handle=1948,i,15485599689338901972,10989529630386925692,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: apphelp.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: c2r64.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: userenv.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: msasn1.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: cryptsp.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: rsaenh.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: cryptbase.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: gpapi.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{F959DBBB-3867-41F2-8E5F-3B8BEFAA81B3}\InprocServer32
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEWindow found: window name: SysTabControl32
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Common
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEKey value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\outlook\ConfigContextData 1
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEFile Volume queried: C:\Windows\SysWOW64 FullSizeInformation
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information queried: ProcessInformation
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeQueries volume information: C:\Program Files (x86)\Microsoft Office\root\Office16\AI\WordCombinedFloatieLreOnline.onnx VolumeInformation
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management Instrumentation1
Browser Extensions		1
Process Injection		1
Masquerading		OS Credential Dumping1
Process Discovery		Remote ServicesData from Local System2
Encrypted Channel		Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/Job1
DLL Side-Loading		1
DLL Side-Loading		1
Modify Registry		LSASS Memory13
System Information Discovery		Remote Desktop ProtocolData from Removable Media1
Non-Application Layer Protocol		Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAt1
Registry Run Keys / Startup Folder		1
Registry Run Keys / Startup Folder		1
Process Injection		Security Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared Drive2
Application Layer Protocol		Automated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin Hook1
DLL Side-Loading		NTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput CaptureProtocol ImpersonationTraffic DuplicationData Destruction

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

⊘No Antivirus matches

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

NameIPActiveMaliciousAntivirus DetectionReputation
a.nel.cloudflare.com
35.190.80.1
truefalse
    		high
    accounts.benefitt.best
    		104.21.95.6
    		truefalse
      		high
      www.google.com
      		172.217.21.36
      		truefalse
        		high

        World Map of Contacted IPs

        • No. of IPs < 25%
        • 25% < No. of IPs < 50%
        • 50% < No. of IPs < 75%
        • 75% < No. of IPs

        Public IPs

        IPDomainCountryFlagASNASN NameMalicious
        52.113.194.132
        		unknownUnited States
        		8068MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
        172.217.19.238
        		unknownUnited States
        		15169GOOGLEUSfalse
        172.217.19.227
        		unknownUnited States
        		15169GOOGLEUSfalse
        1.1.1.1
        		unknownAustralia
        		13335CLOUDFLARENETUSfalse
        172.217.17.67
        		unknownUnited States
        		15169GOOGLEUSfalse
        172.217.17.78
        		unknownUnited States
        		15169GOOGLEUSfalse
        23.218.208.109
        		unknownUnited States
        		6453AS6453USfalse
        142.250.181.100
        		unknownUnited States
        		15169GOOGLEUSfalse
        64.233.165.84
        		unknownUnited States
        		15169GOOGLEUSfalse
        239.255.255.250
        		unknownReserved
        		unknownunknownfalse
        52.109.89.19
        		unknownUnited States
        		8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
        2.19.198.58
        		unknownEuropean Union
        		16625AKAMAI-ASUSfalse
        172.217.21.35
        		unknownUnited States
        		15169GOOGLEUSfalse
        104.21.95.6
        		accounts.benefitt.bestUnited States
        		13335CLOUDFLARENETUSfalse
        35.190.80.1
        		a.nel.cloudflare.comUnited States
        		15169GOOGLEUSfalse
        172.217.21.36
        		www.google.comUnited States
        		15169GOOGLEUSfalse
        104.208.16.89
        		unknownUnited States
        		8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
        52.109.76.240
        		unknownUnited States
        		8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse

        Private

        IP
        192.168.2.16

        General Information

        Joe Sandbox version:41.0.0 Charoite
        Analysis ID:1560851
        Start date and time:2024-11-22 12:24:02 +01:00
        Joe Sandbox product:CloudBasic
        Overall analysis duration:
        Hypervisor based Inspection enabled:false
        Report type:full
        Cookbook file name:defaultwindowsinteractivecookbook.jbs
        Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
        Number of analysed new started processes analysed:21
        Number of new started drivers analysed:0
        Number of existing processes analysed:0
        Number of existing drivers analysed:0
        Number of injected processes analysed:0
        Technologies:
        • EGA enabled
        Analysis Mode:stream
        Analysis stop reason:Timeout
        Sample name:Message_2604337.eml
        Detection:SUS
        Classification:sus22.winEML@33/27@12/190
        Cookbook Comments:
        • Found application associated with file extension: .eml

        Warnings

        • Exclude process from analysis (whitelisted): dllhost.exe
        • Excluded IPs from analysis (whitelisted): 52.109.76.240
        • Excluded domains from analysis (whitelisted): neu-azsc-config.officeapps.live.com, config.officeapps.live.com, prod.configsvc1.live.com.akadns.net, ctldl.windowsupdate.com, officeclient.microsoft.com, europe.configsvc1.live.com.akadns.net
        • Not all processes where analyzed, report is missing behavior information
        • Report size getting too big, too many NtQueryAttributesFile calls found.
        • Report size getting too big, too many NtQueryValueKey calls found.
        • VT rate limit hit for: Message_2604337.eml

        Created / dropped Files

        C:\Users\user\AppData\Local\Microsoft\FORMS\FRMCACHE.DAT

        Download File
        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
        File Type:data
        Category:dropped
        Size (bytes):231348
        Entropy (8bit):4.377970097783006
        Encrypted:false
        SSDEEP:
        MD5:6A9B9F98BE437B2A68F95F3FF42560B1
        SHA1:377F62A914E91A0F84D82A838CD63E17CCD10CD8
        SHA-256:D1027AF7E419845F7961F01E9B954FF231493913D91CF1DD4DEB6976CCA9181B
        SHA-512:F5E5A4F0C7786267B392BCC9EB2C8B6E8B449638B60FB9C27CFA7A0A490D17A55D42761DB031DBA56A350418881051995B19455FD609724492E78E71B25AE279
        Malicious:false
        Reputation:unknown
        Preview:TH02...... .p/<..<......SM01X...,.....-..<..........IPM.Activity...........h...............h............H..h.........L....h.......... .H..h\cal ...pDat...hHZ..0...0......hz./... ........h........_`Pk...h6./.@...I.lw...h....H...8.Uk...0....T...............d.........2h...............k..............!h.............. h`.......H.....#h....8.........$h.. .....8....."h.G.......I....'h..............1hz./.<.........0h....4....Uk../h....h.....UkH..h.. .p........-h .......t.....+h./....................... ..............F7..............FIPM.Activity....Form....Standard....Journal Entry...IPM.Microsoft.FolderDesign.FormsDescription................F.k..........1122110020000000....Microsoft...This form is used to create journal entries.........kf...... ..........&...........(.......(... ...@.....................................................................................................................fffffffff........wwwwwwww.p....pp..............p...............pw..............pw..DDDDO..

        C:\Users\user\AppData\Local\Microsoft\FontCache\4\Catalog\ListAll.Json

        Download File
        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
        File Type:JSON data
        Category:modified
        Size (bytes):521377
        Entropy (8bit):4.9084889265453135
        Encrypted:false
        SSDEEP:
        MD5:C37972CBD8748E2CA6DA205839B16444
        SHA1:9834B46ACF560146DD7EE9086DB6019FBAC13B4E
        SHA-256:D4CFBB0E8B9D3E36ECE921B9B51BD37EF1D3195A9CFA1C4586AEA200EB3434A7
        SHA-512:02B4D134F84122B6EE9A304D79745A003E71803C354FB01BAF986BD15E3BA57BA5EF167CC444ED67B9BA5964FF5922C50E2E92A8A09862059852ECD9CEF1A900
        Malicious:false
        Reputation:unknown
        Preview:{"MajorVersion":4,"MinorVersion":40,"Expiration":14,"Fonts":[{"a":[4294966911],"f":"Abadi","fam":[],"sf":[{"c":[1,0],"dn":"Abadi","fs":32696,"ful":[{"lcp":983041,"lsc":"Latn","ltx":"Abadi"}],"gn":"Abadi","id":"23643452060","p":[2,11,6,4,2,1,4,2,2,4],"sub":[],"t":"ttf","u":[2147483651,0,0,0],"v":197263,"w":26215680},{"c":[1,0],"dn":"Abadi Extra Light","fs":22180,"ful":[{"lcp":983042,"lsc":"Latn","ltx":"Abadi Extra Light"}],"gn":"Abadi Extra Light","id":"17656736728","p":[2,11,2,4,2,1,4,2,2,4],"sub":[],"t":"ttf","u":[2147483651,0,0,0],"v":197263,"w":13108480}]},{"a":[4294966911],"f":"ADLaM Display","fam":[],"sf":[{"c":[536870913,0],"dn":"ADLaM Display Regular","fs":140072,"ful":[{"lcp":983040,"lsc":"Latn","ltx":"ADLaM Display"}],"gn":"ADLaM Display","id":"31965479471","p":[2,1,0,0,0,0,0,0,0,0],"sub":[],"t":"ttf","u":[2147491951,1107296330,0,0],"v":131072,"w":26215680}]},{"a":[4294966911],"f":"Agency FB","fam":[],"sf":[{"c":[536870913,0],"dn":"Agency FB Bold","fs":54372,"ful":[{"lcp":9830

        C:\Users\user\AppData\Local\Microsoft\FontCache\4\PreviewFont\flat_officeFontsPreview_4_40.ttf

        Download File
        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
        File Type:TrueType Font data, 10 tables, 1st "OS/2", 7 names, Microsoft, language 0x409, \251 2018 Microsoft Corporation. All Rights Reserved.msofp_4_40RegularVersion 4.40;O365
        Category:dropped
        Size (bytes):773040
        Entropy (8bit):6.55939673749297
        Encrypted:false
        SSDEEP:
        MD5:4296A064B917926682E7EED650D4A745
        SHA1:3953A6AA9100F652A6CA533C2E05895E52343718
        SHA-256:E04E41C74D6C78213BA1588BACEE64B42C0EDECE85224C474A714F39960D8083
        SHA-512:A25388DDCE58D9F06716C0F0BDF2AEFA7F68EBCA7171077533AF4A9BE99A08E3DCD8DFE1A278B7AA5DE65DA9F32501B4B0B0ECAB51F9AF0F12A3A8A75363FF2C
        Malicious:false
        Reputation:unknown
        Preview:........... OS/29....(...`cmap.s.,.......pglyf..&....|....head2..........6hheaE.@v.......$hmtx...........@loca.U.....8...Dmaxp........... name.P+........post...<...... .........b~1_.<...........<......r......Aa...................Q....Aa....Aa.........................~...................................................3..............................MS .@.......(...Q................. ...........d...........0...J.......8.......>..........+a..#...,................................................/...K.......z...............N......*...!...-...+........z.......h..%^..3...&j..+...+%..'R..+..."....................k......$A...,.......g...&...=.......X..&........*......&....B..(B...............#.......j...............+...P...5...@...)..........#...)Q...............*...{.. ....?..'...#....N...7......<...;>.............. ]...........5......#....s.......$.......$.......^..................+...>....H.......%...7.......6.......O...V...........K......"........c...N......!...............$...&...*p..

        C:\Users\user\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntities.bin

        Download File
        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
        File Type:ASCII text, with very long lines (65536), with no line terminators
        Category:dropped
        Size (bytes):322260
        Entropy (8bit):4.000299760592446
        Encrypted:false
        SSDEEP:
        MD5:CC90D669144261B198DEAD45AA266572
        SHA1:EF164048A8BC8BD3A015CF63E78BDAC720071305
        SHA-256:89C701EEFF939A44F28921FD85365ECD87041935DCD0FE0BAF04957DA12C9899
        SHA-512:16F8A8A6DCBAEAEFB88C7CFF910BCCC71B76A723CF808B810F500E28E543112C2FAE2491D4D209569BD810490EDFF564A2B084709B02963BCAF6FDF1AEEC59AC
        Malicious:false
        Reputation:unknown
        Preview:51253fe60063c31af0d295afb42228b0:v2:2:1:1590:2:8479:76bd602437550e98c9043d06a55186ab7d95dea5a0e935a599f73e62a8c9b158e0afcb19351f6c353940c06a38172b94d18c02cf92bb8a80184eccca0392b259ab3e71dae73e491c7941997cb36ad4a198661f622dad478d840f66d530a0dde78acea3367f91fff62fbb3dc18faff0c708ad30edef5bea8b22c5fd782b770d8993386eaa784fd19a3c3e1db3b537b1a94d3d4fbd46f8df8fddf6d16611969fe0a97c50e0f3ac24750c93257cf5c161184aa7385800c87d803b339632a3d8ec7fe17a0afd83ce9e9d0e3f7b8d579637928a811f1f7e6d1887df2ddc7d4f752c4d600235e426c92c7bf8a1362f95457998cc0e5d4261f0efa4fada0f866dbcefb407dacab7a2914e91c2f08200f38c2d9d621962145b1464b0f204b326118a53ecdcab22bff005fdd5257c99a6dc51ac0600a49f2ef782396987e78c08b846dad5db55e8ccefffc64863bc2c3e90b95a09d25d0814a848c98fe01a82d4e30e6682dd546e12c45ca0d280a45295ab4bd632dafb070edfdc3c9e38313d5aeb195972986f8011b66817028fd8c78b67a0ac7e780eecc3fb6a31f5a025b8a9a3db278a98c0696aeaac739b18688b0f9c7d751bba02cc5f4e41853fb119b3c0c915059aaa92971244a1989124f12881ca88e6410df70b793a2c3a736ff4

        C:\Users\user\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntitiesUpdated.bin

        Download File
        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
        File Type:ASCII text, with no line terminators
        Category:dropped
        Size (bytes):10
        Entropy (8bit):2.6464393446710157
        Encrypted:false
        SSDEEP:
        MD5:A70406AE625BB40935DD9A594440A0BF
        SHA1:5C03A316A62FA25CBAD60271C53B89870F5103AC
        SHA-256:0291CC3B8D9ED417540629F20B9A55B662A65D4E3199D5F885435A4733C74A97
        SHA-512:FEA86A16082197E9D76F4AA09CED4EB2B72DDB08628110C24A3784E6B2DAFCBE7FBE5E69980DCB5E1E5A2FC90B11476DBC04392C15CB6CB465855D5EB282961A
        Malicious:false
        Reputation:unknown
        Preview:1732274678

        C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\6B746EF4-EC93-4440-9878-0C4D8D59AAAC

        Download File
        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
        File Type:XML 1.0 document, ASCII text, with CRLF line terminators
        Category:dropped
        Size (bytes):181859
        Entropy (8bit):5.295295323051718
        Encrypted:false
        SSDEEP:
        MD5:B1799A8C2027C3C53FEE2EE7734716FB
        SHA1:BD5B86907063DE6B10C0478A3C6B805E941AD4E7
        SHA-256:167F10313D592EDC389D4A435903AE0A819C71302A404ADF655A2A573C7335AA
        SHA-512:8AE1916D3621D3E96F79C9CDD995E97FB1BEF082CC9E004587090BEE4DE1885C5DA684F60580B0C0DD01D5594EA28837DD3BD4770B7AAD4AEFBD7EBAADF04602
        Malicious:false
        Reputation:unknown
        Preview:<?xml version="1.0" encoding="utf-8"?>..<o:OfficeConfig xmlns:o="urn:schemas-microsoft-com:office:office">.. <o:services o:GenerationTime="2024-11-22T11:24:35">.. Build: 16.0.18312.40138-->.. <o:default>.. <o:ticket o:headerName="Authorization" o:headerValue="{}" />.. </o:default>.. <o:service o:name="Research">.. <o:url>https://word-edit.officeapps.live.com/we/rrdiscovery.ashx</o:url>.. </o:service>.. <o:service o:name="ORedir">.. <o:url>https://o15.officeredir.microsoft.com/r</o:url>.. </o:service>.. <o:service o:name="ORedirSSL">.. <o:url>https://o15.officeredir.microsoft.com/r</o:url>.. </o:service>.. <o:service o:name="ClViewClientHelpId" o:authentication="1">.. <o:url>https://[MAX.BaseHost]/client/results</o:url>.. <o:ticket o:policy="MBI_SSL_SHORT" o:idprovider="1" o:target="[MAX.AuthHost]" o:headerValue="Passport1.4 from-PP='{}&amp;p='" />.. <o:ticket o:idprovider="3" o:headerValue="Bearer {}" o:resourceId="[

        C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db

        Download File
        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
        File Type:SQLite 3.x database, last written using SQLite version 3023002, writer version 2, read version 2, file counter 2, database pages 1, cookie 0, schema 0, largest root page 1, unknown 0 encoding, version-valid-for 2
        Category:dropped
        Size (bytes):4096
        Entropy (8bit):0.09216609452072291
        Encrypted:false
        SSDEEP:
        MD5:F138A66469C10D5761C6CBB36F2163C3
        SHA1:EEA136206474280549586923B7A4A3C6D5DB1E25
        SHA-256:C712D6C7A60F170A0C6C5EC768D962C58B1F59A2D417E98C7C528A037C427AB6
        SHA-512:9D25F943B6137DD2981EE75D57BAF3A9E0EE27EEA2DF19591D580F02EC8520D837B8E419A8B1EB7197614A3C6D8793C56EBC848C38295ADA23C31273DAA302D9
        Malicious:false
        Reputation:unknown
        Preview:SQLite format 3......@ .......................................................................... .....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

        C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-journal

        Download File
        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
        File Type:SQLite Rollback Journal
        Category:dropped
        Size (bytes):4616
        Entropy (8bit):0.13700485453793962
        Encrypted:false
        SSDEEP:
        MD5:EFC8E4DD70945AC30ED12C1682607264
        SHA1:BD65308449DD8663AB80DE202023DCD459326141
        SHA-256:7E24E8367DE1D958FD9C5A2749C7B216971F7AF4319E6F0F909997D7B302BF91
        SHA-512:BF0EE11B4DC3A6C342AD064662DB6A1BE84FFF47122ED041A15B613D25DB4F2EADA04BEFCCC108D33CA723773EE1CD27FB72CEE0B17360E5F2F2C7AAC4009342
        Malicious:false
        Reputation:unknown
        Preview:.... .c.......B.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................SQLite format 3......@ .......................................................................... .................................................................................................................................................................................................................................................................................................................................................................................................

        C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-shm

        Download File
        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
        File Type:data
        Category:dropped
        Size (bytes):32768
        Entropy (8bit):0.04446227416749482
        Encrypted:false
        SSDEEP:
        MD5:ACC0FCA2A896F5611B9A8F20DBE070F1
        SHA1:4BEFAD692B3DE971D050D3ADFE53185AC95A3A48
        SHA-256:EB38722E60DD559AE504ACF7ABE8FABCA7B9CACD3008ABF86359A3200AE7523C
        SHA-512:E7670FDF3FCE0B00C8680181606287205EF1DB4FEB29A069CFC1B1B887FD54122CFE26B9984E63D87CE8F0B3B2764DF62846A237F3CC69F8ADC82F63934E92F7
        Malicious:false
        Reputation:unknown
        Preview:..-.......................%..UI..._...*...+.....-.......................%..UI..._...*...+...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

        C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-wal

        Download File
        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
        File Type:SQLite Write-Ahead Log, version 3007000
        Category:dropped
        Size (bytes):45352
        Entropy (8bit):0.39444483671128894
        Encrypted:false
        SSDEEP:
        MD5:94416E84784B09CD03D697C9B2E05CC6
        SHA1:983F7D8A7425D9DDB2345176B3F789112B06B988
        SHA-256:2B5AA2CACD8B03C2CC5393B9F1D1E9AD83A1E6FF103CF2D270A333CE3A0928E4
        SHA-512:A369ED883559230D7E36D0D20462847E3362EFB503D649357F90C99F78427A1F276ACD15ED371FB9D5B13A47344BACB53BF011CF2C2DD4D2A49E60A8CFB9BF2E
        Malicious:false
        Reputation:unknown
        Preview:7....-............_...*.F..j.xp.........._...*Y:.)..XFSQLite format 3......@ .......................................................................... .............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

        C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres

        Download File
        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
        File Type:data
        Category:dropped
        Size (bytes):2278
        Entropy (8bit):3.857647540386479
        Encrypted:false
        SSDEEP:
        MD5:CB1EFC1BF28FC19F9699480535F745F6
        SHA1:CF8F9CB40ADE352AD7F45BBC89AC74BAD33F9035
        SHA-256:40C10F0BECE508BECEFD9B2574907B0F185EA24EA9EFD88B5A47C97DE616F3A0
        SHA-512:81F9151C7EF429EBCB803374F6AD37DFBCCFF2234D3435243C52EF85A490A1AFD723A9E7F66320E884026AEB761985DB9A7712F382BF1B1BA2C54371564023EF
        Malicious:false
        Reputation:unknown
        Preview:{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".C.J.1.m.u.g.S.o.z.s.S.9.x.S.Z./.Q.v.O.c.+.E.J.4.u.2.c.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".g.E.O.U.f.d.k.8.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.z.2.p.g.E.+.

        C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5475cb191e478c39370a215b2da98a37e9dc813d.tbres

        Download File
        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
        File Type:data
        Category:dropped
        Size (bytes):2684
        Entropy (8bit):3.8906812065345076
        Encrypted:false
        SSDEEP:
        MD5:FD4751C27BA5F5E5B8B45E46B2B5D5F6
        SHA1:7AA88F974A6E2DA5C7ECC00A33B533F2400DDCF9
        SHA-256:B33BF31B131C7880C5C448D4F3B12CACABF7233A307C94BF59D9770A594BC42E
        SHA-512:58599C5C3D5327D60A35CC021262A763B73C6F9974290BC3583973A61E592F5AF54495F9581DF040FD0EE25C8BB9B4A06CE494053D47B3F3C92884C1F261BBE1
        Malicious:false
        Reputation:unknown
        Preview:{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".V.H.X.L.G.R.5.H.j.D.k.3.C.i.F.b.L.a.m.K.N.+.n.c.g.T.0.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".x.o.j.8.l.K.J.b.3.A.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.z.2.p.g.E.+.

        C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\56a61aeb75d8f5be186c26607f4bb213abe7c5ec.tbres

        Download File
        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
        File Type:data
        Category:dropped
        Size (bytes):4542
        Entropy (8bit):3.9974709603062437
        Encrypted:false
        SSDEEP:
        MD5:38E889B76089B07340BE258865DCF1C0
        SHA1:0A9AD35CC4119E40006C7C87A5D9B840C03EAE4F
        SHA-256:75D63E144FF40ADEE2D7F4E1A83D543C131FCE03368A149B553A7C40EF91731F
        SHA-512:189FD33FEB1D3B71CE2AE24FE6C620D173EFF87A4DB5B190EE243CE5D12AD06FB5B3D979CB961E9E003A36051FF812F437FB6B86AB7963D90183D5652621E6F3
        Malicious:false
        Reputation:unknown
        Preview:{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".V.q.Y.a.6.3.X.Y.9.b.4.Y.b.C.Z.g.f.0.u.y.E.6.v.n.x.e.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".d.d.+.N.Y.9.E.8.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.z.2.p.g.E.+.

        C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{AB245521-90A5-4013-8FF3-6558BCE95D39}.tmp

        Download File
        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
        File Type:data
        Category:modified
        Size (bytes):3028
        Entropy (8bit):3.3412270990713306
        Encrypted:false
        SSDEEP:
        MD5:9F5CDFC0D0635C68FA8CD3216550FC74
        SHA1:06C554CD8E2F469700930A1AD4392D56C8C69A91
        SHA-256:A34DD2463E471765EB543FD4AEB641B633FA33805C733CC9FB06B3EB2C38C22C
        SHA-512:52E0DC7CF1333F6BA4498FD3A5CE1314AB901777BF767540AEDF1EDDDD223C834BB160B55CCE5DF885AA87D2E388F42560022A206B391DD5DC13390B2D758907
        Malicious:false
        Reputation:unknown
        Preview:........u.s.e.r.-.i.n.f.o.r.m.a.t.i.o.n.-.d.e.l.e.t.e.d...C.o.l.l.a.b.o.r.a.t.i.v.e. .T.e.a.m.s.....B.o.a.r.d. .P.r.o.j.e.c.t. .t.e.a.m.!.........i.n.f.o.@.d.o.m.a.i.n.-.i.n.f.o.r.m.a.t.i.o.n.-.d.e.l.e.t.e.d.............u.s.e.r.-.i.n.f.o.r.m.a.t.i.o.n.-.d.e.l.e.t.e.d. .M.a.n.a.g.e.m.e.n.t. .T.e.a.m.s.............w.e. .n.e.e.d. .y.o.u. .t.o. .f.o.l.l.o.w. .u.p. .o.n. .t.h.i.s. .t.e.a.m. .u.r.g.e.n.t.l.y.............1.7. .M.e.m.b.e.r.s...........................................................................................b...d...............................0...4...6...:.............................................................................................................................................................................................................................................$.-D..9D..M.......c....a$.....$..$.If....:V.......t.....6......4........4........a.........$.........[$.\$.a$.*...$..$.If........!v..h.#v....:V.......t.....6......5.......4........4.....

        C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1732274671796696000_3D18023A-F793-400B-9E80-E3BB0AC685A6.log

        Download File
        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
        File Type:ASCII text, with very long lines (859), with CRLF line terminators
        Category:dropped
        Size (bytes):20971520
        Entropy (8bit):0.011709173094206134
        Encrypted:false
        SSDEEP:
        MD5:B4A0FA5B647F4472250A1EEAB05B41F7
        SHA1:BFDBC9E810624E91875C03D0A9456EF6C57F77B1
        SHA-256:59750DFD328398E636E5E36147D7D52052CABE8D001C12D9CC74BDB1E7D20B2B
        SHA-512:336D7913734DBBD0D5EF997EAAFD04FB30A55E5D5E881331091EE364E4816C681443F5E4CD2AE1C88FB8494D4D8E4DEE60D236C2F2B7994627DBA234F2AC9205
        Malicious:false
        Reputation:unknown
        Preview:Timestamp.Process.TID.Area.Category.EventID.Level.Message.Correlation..11/22/2024 11:24:31.839.OUTLOOK (0x1BF0).0x1BF4.Microsoft Outlook.Telemetry Event.b7vzq.Medium.SendEvent {"EventName":"Office.System.GracefulExit.GracefulAppExitDesktop","Flags":33777014402039809,"InternalSequenceNumber":17,"Time":"2024-11-22T11:24:31.839Z","Data.PreviousAppMajor":16,"Data.PreviousAppMinor":0,"Data.PreviousAppBuild":16827,"Data.PreviousAppRevision":20130,"Data.PreviousSessionId":"4EA4CDDC-F0FA-4A57-B277-A56D84942401","Data.PreviousSessionInitTime":"2024-11-22T11:24:16.239Z","Data.PreviousSessionUninitTime":"2024-11-22T11:24:19.286Z","Data.SessionFlags":2147483652,"Data.InstallMethod":0,"Data.OfficeUILang":1033,"Data.PreviousBuild":"Unknown","Data.EcsETag":"\"\"","Data.ProcessorArchitecture":"x64"}...11/22/2024 11:24:31.855.OUTLOOK (0x1BF0).0x191C.Microsoft Outlook.Telemetry Event.b7vzq.Medium.SendEvent {"EventName":"Office.Telemetry.LoadXmlRules","Flags":33777014401990913,"InternalSequenceNumber":22

        C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1732274671797495600_3D18023A-F793-400B-9E80-E3BB0AC685A6.log

        Download File
        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
        File Type:data
        Category:dropped
        Size (bytes):20971520
        Entropy (8bit):0.0
        Encrypted:false
        SSDEEP:
        MD5:8F4E33F3DC3E414FF94E5FB6905CBA8C
        SHA1:9674344C90C2F0646F0B78026E127C9B86E3AD77
        SHA-256:CD52D81E25F372E6FA4DB2C0DFCEB59862C1969CAB17096DA352B34950C973CC
        SHA-512:7FB91E868F3923BBD043725818EF3A5D8D08EBF1059A18AC0FE07040D32EEBA517DA11515E6A4AFAEB29BCC5E0F1543BA2C595B0FE8E6167DDC5E6793EDEF5BB
        Malicious:false
        Reputation:unknown
        Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

        C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20241122T0624310601-7152.etl

        Download File
        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
        File Type:data
        Category:modified
        Size (bytes):200704
        Entropy (8bit):4.871524271370355
        Encrypted:false
        SSDEEP:
        MD5:592E641EFDB3FB54711D97FEAF227438
        SHA1:7E5B255DD3178C66A4677893749DAC52A2207904
        SHA-256:18C22AB84455BDEBE122F449FB45405DA9B0A224A5C4A2B7EE5DA664C1DA1458
        SHA-512:211C9E61CB1F265B97F27471E5F981FA36389EC1AD55C3BD27BAC285FC3B7C0A8320C167E147D19C4AD60F92E6042F45389BCB4A31A60E2410CFF8DE5EF2FFE7
        Malicious:false
        Reputation:unknown
        Preview:............................................................................`............\...<..................eJ..............Zb..2...................................,...@.t.z.r.e.s...d.l.l.,.-.1.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.1.1.1............................................................5...Y...........\...<..........v.2._.O.U.T.L.O.O.K.:.1.b.f.0.:.e.0.3.e.7.5.0.3.b.a.d.f.4.7.a.3.8.8.4.a.5.1.e.6.0.1.f.5.6.5.6.f...C.:.\.U.s.e.r.s.\.c.a.l.i.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.O.u.t.l.o.o.k. .L.o.g.g.i.n.g.\.O.U.T.L.O.O.K._.1.6._.0._.1.6.8.2.7._.2.0.1.3.0.-.2.0.2.4.1.1.2.2.T.0.6.2.4.3.1.0.6.0.1.-.7.1.5.2...e.t.l.......P.P..........\...<..........................................................................................................................................................................................................................................................................................................

        C:\Users\user\AppData\Roaming\Microsoft\Office\MSO3072.acl

        Download File
        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
        File Type:data
        Category:dropped
        Size (bytes):30
        Entropy (8bit):1.2389205950315936
        Encrypted:false
        SSDEEP:
        MD5:C2A572BE6087F520CAE42F250A0D8617
        SHA1:DD51F1FC76389B7D4843EC23CF9DD20351B848E6
        SHA-256:D2D024AB0231879A5B5AA3CD65486941AACCDD6E48900590D8CA63F58B54F0EC
        SHA-512:DED21CB4891C874EEB4FEB8EBC383BC92A71B54F0F4A7CAE414E13F2058C65AC903D97975E77490B8B724CC3B2B8FB1A021C93E3212866CB57B18E65291333AD
        Malicious:false
        Reputation:unknown
        Preview:..............................

        C:\Users\user\AppData\Roaming\Microsoft\Outlook\NoEmail.srs

        Download File
        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
        File Type:Composite Document File V2 Document, Cannot read section info
        Category:dropped
        Size (bytes):16384
        Entropy (8bit):0.6702195821129567
        Encrypted:false
        SSDEEP:
        MD5:BBBD967774E6C94854B15CC8389F520D
        SHA1:1821DE79D32485A5BB2E14CA536855379F68585D
        SHA-256:2B60C1E97DBB1CF07B0DE1E394D3BAD8655BF4C15C2A4FE4AE60036F0D6D106E
        SHA-512:44C5929E440329F2AFB6AB4F43D6E51B019DF93A4F9E425EB1DC48354AC99C62F8C2B29874615A8828A3DEA2E0DD1B4D47A1A5871C24DF99D60CE5A19CD1E817
        Malicious:true
        Reputation:unknown
        Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

        Download File
        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
        File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Nov 22 10:24:41 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
        Category:dropped
        Size (bytes):2673
        Entropy (8bit):3.9946459397462024
        Encrypted:false
        SSDEEP:
        MD5:E796EB214E0D758DCCC39F7A81233B42
        SHA1:0C9F9D795238E6312B7FB310C62DA13656B05813
        SHA-256:BFABE3A6E2411841D70B61437F14F31D2BFD992F45147C38FC9C35B1572EB5DA
        SHA-512:BF17F9BECCB6C7C8D2B2146A0600021E9E7C3611CF24D31D61EB444E1987E00DB9D613EDC1F7DB81E857C853C693F5181F30C4CD8A7E9D6F8C00BEC6F9368E1D
        Malicious:false
        Reputation:unknown
        Preview:L..................F.@.. ...$+.,.....#...<..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IvY.[....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VvY.[....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VvY.[....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VvY.[..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VvY.[...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

        Download File
        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
        File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Nov 22 10:24:41 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
        Category:dropped
        Size (bytes):2675
        Entropy (8bit):4.007983809028723
        Encrypted:false
        SSDEEP:
        MD5:D0763812136C3A4F310F1A575B75B316
        SHA1:95BF021D3B156BE1420EBF02D1BB699BA69E448B
        SHA-256:9E1630DC60AFDB08ADBFDDA11BA2D7D69509D59D831852C7F1448F80655E4896
        SHA-512:541922E5C63838D432DD0D6CAF1D2FC9968BEA71F814B98447ADA2B32C390551FDF1EF70369A4DCB4E041767CE0E7B66A9F0BB5276D98635DB3669758E33A6D3
        Malicious:false
        Reputation:unknown
        Preview:L..................F.@.. ...$+.,........<..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IvY.[....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VvY.[....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VvY.[....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VvY.[..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VvY.[...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

        Download File
        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
        File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
        Category:dropped
        Size (bytes):2689
        Entropy (8bit):4.012289304772313
        Encrypted:false
        SSDEEP:
        MD5:08515F95CC3AB1333C266E0D9684EF9E
        SHA1:AEB4A8A4E462D230B34C91803990F9471273AC32
        SHA-256:01F5BF13DAFAEC47409EEECFA31D04107E0F941C873329048105E33E3D41FF02
        SHA-512:8EB551AC953280D41FFA4E4E50A1607BFBABBF7161751091D22B8F173879AF9D31A5E7E95AF3473E5FD9C8FD3E01B5FE7D961E77E7EC5624C1F6056FCD3713C2
        Malicious:false
        Reputation:unknown
        Preview:L..................F.@.. ...$+.,.....Y.04...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IvY.[....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VvY.[....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VvY.[....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VvY.[..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VFW.E...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

        Download File
        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
        File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Nov 22 10:24:41 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
        Category:dropped
        Size (bytes):2677
        Entropy (8bit):4.0063186247919065
        Encrypted:false
        SSDEEP:
        MD5:2ADC866B68B994047F46D50494632E7D
        SHA1:600F70286BF5C0492118A654ACAF185AF21621FD
        SHA-256:F22253BC644920C98B26AD415D326C804225AC6F2287DEBD70599A9720DA91D8
        SHA-512:A3E0B5C4AE4A0FD5F30187037EA8ADF37902228625E1608117209D74FBFBED3F862AA08C6484F514AC593CB6278315CFD62F0987AA74C6F4C997B177B5DC33E0
        Malicious:false
        Reputation:unknown
        Preview:L..................F.@.. ...$+.,.........<..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IvY.[....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VvY.[....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VvY.[....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VvY.[..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VvY.[...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

        Download File
        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
        File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Nov 22 10:24:41 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
        Category:dropped
        Size (bytes):2677
        Entropy (8bit):3.9955220593079743
        Encrypted:false
        SSDEEP:
        MD5:5C3817BA08402C24A5BF404167D8D72B
        SHA1:8556832655082BBD5581C65E1174E0E6873584E9
        SHA-256:11FFB6613C8E4B3126732E2A75B6CEF97F327F0F5FFDD3F1CFB7C52E0AC42CE4
        SHA-512:66D702E6DC477B52C7EEA7FF0DB361EDA16BE85D495F93D46341E02352CC649AB42952081B37982BE3A3DAD49BC9871DBE0FB10C2109AAE74F87EB7BE94A75F1
        Malicious:false
        Reputation:unknown
        Preview:L..................F.@.. ...$+.,....,0...<..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IvY.[....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VvY.[....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VvY.[....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VvY.[..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VvY.[...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

        Download File
        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
        File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Nov 22 10:24:41 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
        Category:dropped
        Size (bytes):2679
        Entropy (8bit):4.004737561283107
        Encrypted:false
        SSDEEP:
        MD5:6BC6C406C48E1C1E02A500DA6E47860D
        SHA1:529A4AB3FB6FC301E201889FE565FD3C27D61AD3
        SHA-256:E34C89989E74E16B47B56BCF4709CFA30B86628BD97FCFA9F190AF27975D0B27
        SHA-512:76AFC953B3724EA850A392609F4C56FD92A73141F845653886BADB2939CCC07DA74FEF8F33B6ADB49E1936D661BCB4B82378990FC06D364FB77DB68BB8E69039
        Malicious:false
        Reputation:unknown
        Preview:L..................F.@.. ...$+.,....[....<..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IvY.[....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VvY.[....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VvY.[....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VvY.[..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VvY.[...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

        C:\Users\user\Documents\Outlook Files\Outlook Data File - NoEmail.pst

        Download File
        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
        File Type:Microsoft Outlook email folder (>=2003)
        Category:dropped
        Size (bytes):271360
        Entropy (8bit):2.094553986971774
        Encrypted:false
        SSDEEP:
        MD5:833AC0B49354D198A330519D1C667E9C
        SHA1:E2B6152C254DEB8F76971EA917E977C332742535
        SHA-256:F33CA48A552E9950DCC72F4F84628610E0E352F6CAFCBF6737622DFE8E4A182F
        SHA-512:4C698540D2E90C6D3264821DC95FC0611A08AA745BA868856092019C5A2D050147399CE3D6056BDD10D617FED0E9CDA1266209ECC27C166A74D97C43D9648F8F
        Malicious:true
        Reputation:unknown
        Preview:!BDNMw..SM......\...)...........E.......`................@...........@...@...................................@...........................................................................$.......D......@...............D........T......A...................................................................................................................................................................................................................................................................................................._..Xwv.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

        C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp

        Download File
        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
        File Type:data
        Category:dropped
        Size (bytes):131072
        Entropy (8bit):3.0312448576548796
        Encrypted:false
        SSDEEP:
        MD5:640B0E2BC108F5238B544F35AB81C8EA
        SHA1:C15EA8AA9425BDEBA980B53F17EAF3CADB0F5C76
        SHA-256:FFE956BEFF028FC6D06FBFDE61629EB3A70BC7F2C68A5AB8A4FC85B6DA9E0347
        SHA-512:8B6E2AC34C8344BC42A55D8470B7057D17C77081F09EFACC1ACA017B45BAFE68F6EDA1D99B105AB581D2A934553AF35677DE38943DBFB85330062163891DC7D2
        Malicious:true
        Reputation:unknown
        Preview:....C...E...........c'...<....................#.!BDNMw..SM......\...)...........E.......`................@...........@...@...................................@...........................................................................$.......D......@...............D........T......A...................................................................................................................................................................................................................................................................................................._..Xwv.c'...<.......B............#.........................................................................................................................................................................................................................................................................................................................................................................................................

        Static File Info

        General

        File type:RFC 822 mail, ASCII text, with CRLF line terminators
        Entropy (8bit):5.488044509617481
        TrID:
        • E-Mail message (Var. 5) (54515/1) 100.00%
        File name:Message_2604337.eml
        File size:10'968 bytes
        MD5:7fd30e219be63bb9ecc1fcde0c93857f
        SHA1:173ac5134314de2f5ea516041507e921565e67e4
        SHA256:d039995511ef353213999f3df77b19bb19991068b098dafcc22863e9111cc568
        SHA512:5c319320864a333d7a4e7744aa2caf7810cd5596f3b22db9a8853f71d8e8a2b223505ed3348ee56889ed05297be0884b890154e30759cc2c4c07e23e9d44f354
        SSDEEP:192:2hFWWFG9RrClxsHCXN0872odQE64PpZR9tIRzeqTU//GbCitfultQTWiB6Zj10vT:+FWWYH2lCHWNp5QE64PpRSRzeqTU/Obt
        TLSH:52321B66E61490C613F683F4B082BFDF4BA44E5D83018ABDBE516AD4BD4E42705D6FC8
        File Content Preview:Received: from noj.nojokemarketinghosting.com (noj.nojokemarketinghosting.com [162.241.157.65])...(using TLSv1.2 with cipher DHE-RSA-AES256-GCM-SHA384 (256/256 bits))...(No client certificate requested)...by mail1.domain-information-deleted (Postfix) with

        Static Mail

        General

        Subject:Join Meeting
        From:user-information-deleted Teams <email@marylandchildcares.com>
        To:info@domain-information-deleted
        Cc:
        BCC:
        Date:Thu, 21 Nov 2024 16:43:02 -0800
        Communications:
        • user-information-deletedCollaborative Teams Board Project team! info@domain-information-deleted user-information-deleted Management Teams we need you to follow up on this team urgently 17 Members Open user-information-deleted Teams user-information-deletedCollaborative Teams Board Project team! info@domain-information-deleted user-information-deleted Management Teams we need you to follow up on this team urgently 17 Members Open user-information-deleted Teams user-information-deletedCollaborative Teams Board Project team! info@domain-information-deleted user-information-deleted Management Teams we need you to follow up on this team urgently 17 Members Open user-information-deleted Teams user-information-deletedCollaborative Teams Board Project team! info@domain-information-deleted user-information-deleted Management Teams we need you to follow up on this team urgently 17 Members Open user-information-deleted Teams user-information-deletedCollaborative Teams Board Project team! info@domain-information-deleted user-information-deleted Management Teams we need you to follow up on this team urgently 17 Members Open user-information-deleted Teams user-information-deletedCollaborative Teams Board Project team! info@domain-information-deleted user-information-deleted Management Teams we need you to follow up on this team urgently 17 Members Open user-information-deleted Teams user-information-deletedCollaborative Teams Board Project team! info@domain-information-deleted user-information-deleted Management Teams we need you to follow up on this team urgently 17 Members user-information-deletedCollaborative Teams Board Project team! info@domain-information-deleted user-information-deleted Management Teams we need you to follow up on this team urgently 17 Members user-information-deletedCollaborative Teams user-information-deletedCollaborative Teams Board Project team! Board Project team! Board Project team! info@domain-information-deleted user-information-deleted Management Teams we need you to follow up on this team urgently 17 Members info@domain-information-deleted user-information-deleted Management Teams we need you to follow up on this team urgently 17 Members info@domain-information-deleted user-information-deleted Management Teams we need you to follow up on this team urgently 17 Members info@domain-information-deleted user-information-deleted Management Teams we need you to follow up on this team urgently 17 Members info@domain-information-deleted info@domain-information-deleted info@domain-information-deleted user-information-deleted Management Teams user-information-deleted Management Teams user-information-deleted Management Teams we need you to follow up on this team urgently we need you to follow up on this team urgently 17 Members 17 Members Open user-information-deleted Teams Open user-information-deleted Teams Open user-information-deleted Teams Open user-information-deleted Teams Open user-information-deleted Teams Open user-information-deleted Teams Open user-information-deleted Teams Open user-information-deleted Teams Open user-information-deleted Teams https://accounts.benefitt.best/representaton.aspx?sets=Kzo2WUY7VCFSOUcsTjxHNCA= Open user-information-deleted Teams
        Attachments:

          Headers

          Key Value
          Receivedfrom [185.198.188.85] (port=58446) by noj.nojokemarketinghosting.com with esmtpsa (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.96.2) (envelope-from <email@marylandchildcares.com>) id 1tEHlI-0003Jh-1T for info@domain-information-deleted; Thu, 21 Nov 2024 19:43:05 -0500
          DKIM-Signaturev=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=marylandchildcares.com; s=default; h=Content-Transfer-Encoding:Content-Type :MIME-Version:Message-ID:Date:Subject:To:From:Sender:Reply-To:Cc:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:In-Reply-To:References:List-Id:List-Help:List-Unsubscribe: List-Subscribe:List-Post:List-Owner:List-Archive; bh=luW5omKQZO7oNECrQ9WVjh4SRh1r0HBiFZSaFWwzDqg=; b=tWBwXdpf545hFFh9J1q/GyGLO+ KMYn0+MIly7ycj/x824iSpxSrEbe9I/XlipHNN4JO/8Jxyd8CzjADWqZa99RoSf8c6mSNkrpmU78X qvtqntMXMJATCD3WtmJ1kZmjlAxn2VuLWZ+BKc47rfL1hbQsrGwiJK62AQvN7dDGgs9/c/9UDC1UF nlyUDWS552OhEj+F5ZYlWz8zo2tVL8DQD7OPZ7bI2VW3WPgNHTLze7Snc7aipaJUB3fJTXmESvuHJ oyjh/+XULmxxZDZmwvRxFPSQYgi+uJhZZS3hOc3lrshsp9u3NhuG7LWbHa2DfCN4rNenCUZk5B+/K 77ekghIg==;
          Fromuser-information-deleted Teams <email@marylandchildcares.com>
          Toinfo@domain-information-deleted
          SubjectJoin Meeting
          DateThu, 21 Nov 2024 16:43:02 -0800
          Message-ID<20241121164302.0140C1D983E7AC9D@marylandchildcares.com>
          MIME-Version1.0
          Content-Typetext/html
          Content-Transfer-Encodingquoted-printable
          X-AntiAbuseSender Address Domain - marylandchildcares.com
          X-Get-Message-Sender-Vianoj.nojokemarketinghosting.com: authenticated_id: email@marylandchildcares.com
          X-Authenticated-Sendernoj.nojokemarketinghosting.com: email@marylandchildcares.com
          X-Source
          X-Source-Args
          X-Source-Dir

          File Icon

          Icon Hash:46070c0a8e0c67d6