Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
Document Review for Recent Transaction - Signature requested by Xiomara Baldwin Support Team.eml

Overview

General Information

Sample name:Document Review for Recent Transaction - Signature requested by Xiomara Baldwin Support Team.eml
Analysis ID:1563802
MD5:ecbb4c7eca5eff914ee2c4f3e19421a0
SHA1:4f7f364466aff4fd2c206758c6d494c21bd02477
SHA256:175217057a7c8acd334b2cef98a7b11027b8544fa942d52e549ea2ca1e4922fd
Infos:

Detection

Lure-BasedAttack
Score:48
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

AI detected landing page (webpage, office document or email)
AI detected potential phishing Email
Queries the volume information (name, serial number etc) of a device
Sigma detected: Office Autorun Keys Modification
Sigma detected: Suspicious Office Outbound Connections
Stores large binary data to the registry
Suricata IDS alerts with low severity for network traffic

Classification

Process Tree

  • System is w10x64_ra
  • OUTLOOK.EXE (PID: 7052 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\user\Desktop\Document Review for Recent Transaction - Signature requested by Xiomara Baldwin Support Team.eml" MD5: 91A5292942864110ED734005B7E005C0)
    • ai.exe (PID: 2828 cmdline: "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "F0E833CD-D411-45B2-B8DA-BADEF3AFEBB5" "A5B385C4-C5FC-44BD-B5AD-DBA638C57298" "7052" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx" MD5: EC652BEDD90E089D9406AFED89A8A8BD)
  • cleanup

Yara Signatures

⊘No yara matches

Sigma Signatures

Sigma detected: Office Autorun Keys Modification
Source: Registry Key setAuthor: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 , EventID: 13, EventType: SetValue, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE, ProcessId: 7052, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Addins\OneNote.OutlookAddin\1
Sigma detected: Suspicious Office Outbound Connections
Source: Network ConnectionAuthor: X__Junior (Nextron Systems): Data: DestinationIp: 192.168.2.16, DestinationIsIpv6: false, DestinationPort: 49719, EventID: 3, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE, Initiated: true, ProcessId: 7052, Protocol: tcp, SourceIp: 23.218.208.109, SourceIsIpv6: false, SourcePort: 443

Suricata Signatures

TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
2024-11-27T14:24:06.903262+010020283713Unknown Traffic192.168.2.164971923.218.208.109443TCP
2024-11-27T14:24:06.903262+010020283713Unknown Traffic192.168.2.164971923.218.208.109443TCP
2024-11-27T14:24:06.903262+010020283713Unknown Traffic192.168.2.164971923.218.208.109443TCP
2024-11-27T14:24:06.903262+010020283713Unknown Traffic192.168.2.164971923.218.208.109443TCP
2024-11-27T14:24:06.903262+010020283713Unknown Traffic192.168.2.164971923.218.208.109443TCP
2024-11-27T14:24:06.903262+010020283713Unknown Traffic192.168.2.164971923.218.208.109443TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Phishing

barindex
AI detected landing page (webpage, office document or email)
Source: EmailJoe Sandbox AI: Page contains button: 'Review & sign' Source: 'Email'
Source: EmailJoe Sandbox AI: Email contains prominent button: 'review & sign'
AI detected potential phishing Email
Source: EmailJoe Sandbox AI: Detected potential phishing email: The email uses a suspicious mix of services (PayPal, Dropbox Sign, Bitdefender) and claims an unauthorized charge requiring immediate action. The sender email domain (@pacifico.edu.co) is suspicious and doesn't match legitimate PayPal or Dropbox communications. The email creates urgency with a large charge ($499.99) and requests clicking links/signing documents, which are common phishing tactics
Source: EmailClassification: Lure-Based Attack
Source: unknownHTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.16:49715 version: TLS 1.2
Source: unknownHTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.16:49718 version: TLS 1.2
Source: unknownHTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.16:49719 version: TLS 1.2
Source: Network trafficSuricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.16:49719 -> 23.218.208.109:443
Source: unknownTCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknownTCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknownTCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknownTCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknownTCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknownTCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknownTCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknownTCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknownTCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknownTCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknownTCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknownTCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknownTCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknownTCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknownTCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknownTCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknownTCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknownTCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknownTCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknownTCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknownTCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknownTCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknownTCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknownTCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknownTCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknownTCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknownTCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknownTCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknownTCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknownTCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknownTCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknownTCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknownTCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknownTCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknownTCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknownTCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknownTCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknownTCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknownTCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknownTCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknownTCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknownTCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknownTCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknownTCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknownTCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknownTCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknownTCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknownTCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknownTCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknownTCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknownNetwork traffic detected: HTTP traffic on port 49719 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49719
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49718
Source: unknownNetwork traffic detected: HTTP traffic on port 49715 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49715
Source: unknownNetwork traffic detected: HTTP traffic on port 49718 -> 443
Source: unknownHTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.16:49715 version: TLS 1.2
Source: unknownHTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.16:49718 version: TLS 1.2
Source: unknownHTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.16:49719 version: TLS 1.2
Source: classification engineClassification label: mal48.winEML@3/19@0/68
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEFile created: C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEFile created: C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20241127T0824010227-7052.etl
Source: unknownProcess created: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\user\Desktop\Document Review for Recent Transaction - Signature requested by Xiomara Baldwin Support Team.eml"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "F0E833CD-D411-45B2-B8DA-BADEF3AFEBB5" "A5B385C4-C5FC-44BD-B5AD-DBA638C57298" "7052" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "F0E833CD-D411-45B2-B8DA-BADEF3AFEBB5" "A5B385C4-C5FC-44BD-B5AD-DBA638C57298" "7052" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: apphelp.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: c2r64.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: userenv.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: msasn1.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: cryptsp.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: rsaenh.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: cryptbase.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: gpapi.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7b8a2d94-0ac9-11d1-896c-00c04Fb6bfc4}\InprocServer32
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEWindow found: window name: SysTabControl32
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Common
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEKey value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\outlook\ConfigContextData 1
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information queried: ProcessInformation
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeQueries volume information: C:\Program Files (x86)\Microsoft Office\root\Office16\AI\WordCombinedFloatieLreOnline.onnx VolumeInformation
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management Instrumentation21
Browser Extensions		1
Process Injection		1
Masquerading		OS Credential Dumping1
Process Discovery		Remote ServicesData from Local System2
Encrypted Channel		Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/Job1
DLL Side-Loading		1
DLL Side-Loading		1
Modify Registry		LSASS Memory12
System Information Discovery		Remote Desktop ProtocolData from Removable Media1
Application Layer Protocol		Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)1
Process Injection		Security Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared DriveSteganographyAutomated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin Hook1
DLL Side-Loading		NTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput CaptureProtocol ImpersonationTraffic DuplicationData Destruction

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

⊘No Antivirus matches

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

World Map of Contacted IPs

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Public IPs

IPDomainCountryFlagASNASN NameMalicious
52.113.194.132
unknownUnited States
8068MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
52.109.28.47
unknownUnited States
8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
52.109.32.97
unknownUnited States
8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
20.189.173.4
unknownUnited States
8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
23.218.208.109
unknownUnited States
6453AS6453USfalse
23.50.131.23
unknownUnited States
16625AKAMAI-ASUSfalse

General Information

Joe Sandbox version:41.0.0 Charoite
Analysis ID:1563802
Start date and time:2024-11-27 14:23:21 +01:00
Joe Sandbox product:CloudBasic
Overall analysis duration:
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultwindowsinteractivecookbook.jbs
Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:15
Number of new started drivers analysed:0
Number of existing processes analysed:0
Number of existing drivers analysed:0
Number of injected processes analysed:0
Technologies:
  • EGA enabled
Analysis Mode:stream
Analysis stop reason:Timeout
Sample name:Document Review for Recent Transaction - Signature requested by Xiomara Baldwin Support Team.eml
Detection:MAL
Classification:mal48.winEML@3/19@0/68
Cookbook Comments:
  • Found application associated with file extension: .eml

Warnings

  • Exclude process from analysis (whitelisted): dllhost.exe, SIHClient.exe
  • Excluded IPs from analysis (whitelisted): 52.109.32.97, 52.109.28.47, 52.113.194.132, 23.50.131.23, 23.50.131.25, 20.189.173.4
  • Excluded domains from analysis (whitelisted): fs.microsoft.com, ctldl.windowsupdate.com
  • Not all processes where analyzed, report is missing behavior information
  • Report size getting too big, too many NtQueryValueKey calls found.
  • VT rate limit hit for: Document Review for Recent Transaction - Signature requested by Xiomara Baldwin Support Team.eml

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\FORMS\FRMCACHE.DAT

Download File
Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:data
Category:modified
Size (bytes):231348
Entropy (8bit):4.390108841979596
Encrypted:false
SSDEEP:
MD5:CF486FF125FD053E6DEE94B337BE076F
SHA1:05D5B88ACF82DE6E7D0B4B8D5EB25E7785D997A6
SHA-256:5D0891965B9797F2A1BA5941D3D37EED10BA113D933021A40EAC37785F26EBC3
SHA-512:82B84574E482DFBCFD41EC3E05A8994F751FA3CDFEA38F193A4E15868B661EAB85BF9732B5CDFC8CF5F64C52F98C7F53ED6DDD351157827BAB25E2CF93563EF4
Malicious:false
Reputation:unknown
Preview:TH02...... .PH...@......SM01X...,...pa..@..........IPM.Activity...........h...............h............H..h4.;........!...h........0y..H..h\cal ...pDat...h....0.....;....h..UH...........h........_`Qk...hk.UH@...I.lw...h....H...8.Vk...0....T...............d.........2h...............k8.......8.....!h.............. h3>.c......;...#h....8.........$h0y......8....."h .......p.....'h..c...........1h..UH<.........0h....4....Vk../h....h.....VkH..h..p...4.;...-h ........;...+h/.UH....(.;................. ..............F7..............FIPM.Activity....Form....Standard....Journal Entry...IPM.Microsoft.FolderDesign.FormsDescription................F.k..........1122110020000000....Microsoft...This form is used to create journal entries.........kf...... ..........&...........(.......(... ...@.....................................................................................................................fffffffff........wwwwwwww.p....pp..............p...............pw..............pw..DDDDO..

C:\Users\user\AppData\Local\Microsoft\FontCache\4\Catalog\ListAll.Json

Download File
Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:JSON data
Category:dropped
Size (bytes):521377
Entropy (8bit):4.9084889265453135
Encrypted:false
SSDEEP:
MD5:C37972CBD8748E2CA6DA205839B16444
SHA1:9834B46ACF560146DD7EE9086DB6019FBAC13B4E
SHA-256:D4CFBB0E8B9D3E36ECE921B9B51BD37EF1D3195A9CFA1C4586AEA200EB3434A7
SHA-512:02B4D134F84122B6EE9A304D79745A003E71803C354FB01BAF986BD15E3BA57BA5EF167CC444ED67B9BA5964FF5922C50E2E92A8A09862059852ECD9CEF1A900
Malicious:false
Reputation:unknown
Preview:{"MajorVersion":4,"MinorVersion":40,"Expiration":14,"Fonts":[{"a":[4294966911],"f":"Abadi","fam":[],"sf":[{"c":[1,0],"dn":"Abadi","fs":32696,"ful":[{"lcp":983041,"lsc":"Latn","ltx":"Abadi"}],"gn":"Abadi","id":"23643452060","p":[2,11,6,4,2,1,4,2,2,4],"sub":[],"t":"ttf","u":[2147483651,0,0,0],"v":197263,"w":26215680},{"c":[1,0],"dn":"Abadi Extra Light","fs":22180,"ful":[{"lcp":983042,"lsc":"Latn","ltx":"Abadi Extra Light"}],"gn":"Abadi Extra Light","id":"17656736728","p":[2,11,2,4,2,1,4,2,2,4],"sub":[],"t":"ttf","u":[2147483651,0,0,0],"v":197263,"w":13108480}]},{"a":[4294966911],"f":"ADLaM Display","fam":[],"sf":[{"c":[536870913,0],"dn":"ADLaM Display Regular","fs":140072,"ful":[{"lcp":983040,"lsc":"Latn","ltx":"ADLaM Display"}],"gn":"ADLaM Display","id":"31965479471","p":[2,1,0,0,0,0,0,0,0,0],"sub":[],"t":"ttf","u":[2147491951,1107296330,0,0],"v":131072,"w":26215680}]},{"a":[4294966911],"f":"Agency FB","fam":[],"sf":[{"c":[536870913,0],"dn":"Agency FB Bold","fs":54372,"ful":[{"lcp":9830

C:\Users\user\AppData\Local\Microsoft\FontCache\4\PreviewFont\flat_officeFontsPreview_4_40.ttf

Download File
Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:TrueType Font data, 10 tables, 1st "OS/2", 7 names, Microsoft, language 0x409, \251 2018 Microsoft Corporation. All Rights Reserved.msofp_4_40RegularVersion 4.40;O365
Category:dropped
Size (bytes):773040
Entropy (8bit):6.55939673749297
Encrypted:false
SSDEEP:
MD5:4296A064B917926682E7EED650D4A745
SHA1:3953A6AA9100F652A6CA533C2E05895E52343718
SHA-256:E04E41C74D6C78213BA1588BACEE64B42C0EDECE85224C474A714F39960D8083
SHA-512:A25388DDCE58D9F06716C0F0BDF2AEFA7F68EBCA7171077533AF4A9BE99A08E3DCD8DFE1A278B7AA5DE65DA9F32501B4B0B0ECAB51F9AF0F12A3A8A75363FF2C
Malicious:false
Reputation:unknown
Preview:........... OS/29....(...`cmap.s.,.......pglyf..&....|....head2..........6hheaE.@v.......$hmtx...........@loca.U.....8...Dmaxp........... name.P+........post...<...... .........b~1_.<...........<......r......Aa...................Q....Aa....Aa.........................~...................................................3..............................MS .@.......(...Q................. ...........d...........0...J.......8.......>..........+a..#...,................................................/...K.......z...............N......*...!...-...+........z.......h..%^..3...&j..+...+%..'R..+..."....................k......$A...,.......g...&...=.......X..&........*......&....B..(B...............#.......j...............+...P...5...@...)..........#...)Q...............*...{.. ....?..'...#....N...7......<...;>.............. ]...........5......#....s.......$.......$.......^..................+...>....H.......%...7.......6.......O...V...........K......"........c...N......!...............$...&...*p..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntities.bin

Download File
Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:ASCII text, with very long lines (65536), with no line terminators
Category:dropped
Size (bytes):322260
Entropy (8bit):4.000299760592446
Encrypted:false
SSDEEP:
MD5:CC90D669144261B198DEAD45AA266572
SHA1:EF164048A8BC8BD3A015CF63E78BDAC720071305
SHA-256:89C701EEFF939A44F28921FD85365ECD87041935DCD0FE0BAF04957DA12C9899
SHA-512:16F8A8A6DCBAEAEFB88C7CFF910BCCC71B76A723CF808B810F500E28E543112C2FAE2491D4D209569BD810490EDFF564A2B084709B02963BCAF6FDF1AEEC59AC
Malicious:false
Reputation:unknown
Preview:51253fe60063c31af0d295afb42228b0:v2:2:1:1590:2:8479:76bd602437550e98c9043d06a55186ab7d95dea5a0e935a599f73e62a8c9b158e0afcb19351f6c353940c06a38172b94d18c02cf92bb8a80184eccca0392b259ab3e71dae73e491c7941997cb36ad4a198661f622dad478d840f66d530a0dde78acea3367f91fff62fbb3dc18faff0c708ad30edef5bea8b22c5fd782b770d8993386eaa784fd19a3c3e1db3b537b1a94d3d4fbd46f8df8fddf6d16611969fe0a97c50e0f3ac24750c93257cf5c161184aa7385800c87d803b339632a3d8ec7fe17a0afd83ce9e9d0e3f7b8d579637928a811f1f7e6d1887df2ddc7d4f752c4d600235e426c92c7bf8a1362f95457998cc0e5d4261f0efa4fada0f866dbcefb407dacab7a2914e91c2f08200f38c2d9d621962145b1464b0f204b326118a53ecdcab22bff005fdd5257c99a6dc51ac0600a49f2ef782396987e78c08b846dad5db55e8ccefffc64863bc2c3e90b95a09d25d0814a848c98fe01a82d4e30e6682dd546e12c45ca0d280a45295ab4bd632dafb070edfdc3c9e38313d5aeb195972986f8011b66817028fd8c78b67a0ac7e780eecc3fb6a31f5a025b8a9a3db278a98c0696aeaac739b18688b0f9c7d751bba02cc5f4e41853fb119b3c0c915059aaa92971244a1989124f12881ca88e6410df70b793a2c3a736ff4

C:\Users\user\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntitiesUpdated.bin

Download File
Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:ASCII text, with no line terminators
Category:modified
Size (bytes):10
Entropy (8bit):2.4464393446710155
Encrypted:false
SSDEEP:
MD5:474AEA9678238A216950594DD37CB178
SHA1:F67DE9E0799F70D199208466C4316063C2420CB0
SHA-256:1BBE79C230BADC873EA4A9F0EC6707924A1D615F95A6F24434B2702F8ABB36CF
SHA-512:F25BB16FF7EBAB945DF6A2E4864E34B8C7E8AD2D36DDD24C02A88A0F9F3FA03A7778F35F8537EB4718023C8CC88CFADC9042406A51F02230F7AD5218890AEE47
Malicious:false
Reputation:unknown
Preview:1732713847

C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\CCCD40BA-C679-448E-8394-30DD4CAA6AD3

Download File
Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:XML 1.0 document, ASCII text, with CRLF line terminators
Category:dropped
Size (bytes):181859
Entropy (8bit):5.2953064756650985
Encrypted:false
SSDEEP:
MD5:A23738EAFD106D4B89D97D2238A3DD05
SHA1:6122A57DB7B458AC2A798101B666A1BA4C6D4667
SHA-256:40BAAEA66BFEFD3186CA80F39F4C8B7806F3D274A9B2E41FB6B116DE3331CCF8
SHA-512:0D75B54364A95814D4AB8D3AB76BDCA374BFCEFBD201EB299C10B5CE5DFEED78691839353E59C92C6CAA1935A35583783C663FD30BCD9F036B3FCF66E727E190
Malicious:false
Reputation:unknown
Preview:<?xml version="1.0" encoding="utf-8"?>..<o:OfficeConfig xmlns:o="urn:schemas-microsoft-com:office:office">.. <o:services o:GenerationTime="2024-11-27T13:24:04">.. Build: 16.0.18312.40138-->.. <o:default>.. <o:ticket o:headerName="Authorization" o:headerValue="{}" />.. </o:default>.. <o:service o:name="Research">.. <o:url>https://word-edit.officeapps.live.com/we/rrdiscovery.ashx</o:url>.. </o:service>.. <o:service o:name="ORedir">.. <o:url>https://o15.officeredir.microsoft.com/r</o:url>.. </o:service>.. <o:service o:name="ORedirSSL">.. <o:url>https://o15.officeredir.microsoft.com/r</o:url>.. </o:service>.. <o:service o:name="ClViewClientHelpId" o:authentication="1">.. <o:url>https://[MAX.BaseHost]/client/results</o:url>.. <o:ticket o:policy="MBI_SSL_SHORT" o:idprovider="1" o:target="[MAX.AuthHost]" o:headerValue="Passport1.4 from-PP='{}&amp;p='" />.. <o:ticket o:idprovider="3" o:headerValue="Bearer {}" o:resourceId="[

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db

Download File
Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:SQLite 3.x database, last written using SQLite version 3023002, writer version 2, read version 2, file counter 2, database pages 1, cookie 0, schema 0, largest root page 1, unknown 0 encoding, version-valid-for 2
Category:dropped
Size (bytes):4096
Entropy (8bit):0.09216609452072291
Encrypted:false
SSDEEP:
MD5:F138A66469C10D5761C6CBB36F2163C3
SHA1:EEA136206474280549586923B7A4A3C6D5DB1E25
SHA-256:C712D6C7A60F170A0C6C5EC768D962C58B1F59A2D417E98C7C528A037C427AB6
SHA-512:9D25F943B6137DD2981EE75D57BAF3A9E0EE27EEA2DF19591D580F02EC8520D837B8E419A8B1EB7197614A3C6D8793C56EBC848C38295ADA23C31273DAA302D9
Malicious:false
Reputation:unknown
Preview:SQLite format 3......@ .......................................................................... .....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-journal

Download File
Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:SQLite Rollback Journal
Category:dropped
Size (bytes):4616
Entropy (8bit):0.13760166725504608
Encrypted:false
SSDEEP:
MD5:431C79A04A340E4E2689CE99B1715CED
SHA1:EBE8D80A5430537FA420F4834D88294F2191A955
SHA-256:0C5726F3F0EF356DB4F88A5B7D801CC1039866AEE2DE70B9E1EA3A42B7C5D969
SHA-512:A97B288E336CB68689F857D4286292F50474FC9AF7FD9FC9A04654A61536C54D3D535BE5009AFEB400FEC1A3ECD9A6DFA1B8CB3D6798BF52C662A9AC492CF37B
Malicious:false
Reputation:unknown
Preview:.... .c......12.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................SQLite format 3......@ .......................................................................... .................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-shm

Download File
Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:data
Category:dropped
Size (bytes):32768
Entropy (8bit):0.04462234229792196
Encrypted:false
SSDEEP:
MD5:626F72FC904804441419E87D1C3FCDCD
SHA1:2ACD40AC8B785F76B91F08BAA70FBB6D12689D93
SHA-256:AB9FA9B462B7F28C03570FD2FE8479701DF841FDD603C738F003157AFC945D2C
SHA-512:68CC88667AAED0588BD86B3EC53CB9A2A12EA842D8F076DAC44769068DE6EF6F72A6FFFE21D6C2BF68156CC1F71D87F2DF47BA675D8B6BFD876FBC9ED11C09E5
Malicious:false
Reputation:unknown
Preview:..-.....................w..~..."5.U>....n..E....-.....................w..~..."5.U>....n..E..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-wal

Download File
Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:SQLite Write-Ahead Log, version 3007000
Category:dropped
Size (bytes):45352
Entropy (8bit):0.3943046025721052
Encrypted:false
SSDEEP:
MD5:4468076A5AD3720296BBB6997279BA02
SHA1:DA64BD13A54765EDF1A537C04D7E700EBB9D5AE0
SHA-256:93C0DB373ED3C713F150E8430D3CE90BC2A6D73F5AF35CBB4062FDD72E8E38FC
SHA-512:6891E9AFC84DD5D034E8EFFC7A94210C8DF73503A4F055DD789F00B4C80B46EF7F2EA06582A533539472BF423B806926A7A0B2FAC0B56805B4BA26E125BE7A59
Malicious:false
Reputation:unknown
Preview:7....-..........5.U>....<.H..C.........5.U>...{.....SQLite format 3......@ .......................................................................... .............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres

Download File
Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:data
Category:dropped
Size (bytes):2278
Entropy (8bit):3.8566210877895264
Encrypted:false
SSDEEP:
MD5:FF6CCEA53740E84A47D7D38F1A38F80D
SHA1:274B41E9A53B71C486AFF9770FB7FF599D58D461
SHA-256:73D499595A1FA42837C1159F1842D14171A6C0DFADBD6331F711D49F174F55D4
SHA-512:C868A2A62B1F2817B04BA378CCA021C410D1A27B80F99AC8FFA5E7BA68DECFE510922B896F82B98600D306FCE30A967F605495219EF6540950274E76DCE2BAB7
Malicious:false
Reputation:unknown
Preview:{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".C.J.1.m.u.g.S.o.z.s.S.9.x.S.Z./.Q.v.O.c.+.E.J.4.u.2.c.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.J.q.z.A.t.h.A.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.t.C.f.+.K.O.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5475cb191e478c39370a215b2da98a37e9dc813d.tbres

Download File
Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:data
Category:dropped
Size (bytes):2684
Entropy (8bit):3.9140597460898627
Encrypted:false
SSDEEP:
MD5:EBAD7D9671E4874737DFC0AFC59761B7
SHA1:BE8A8A41F5E7E13CB83DE247D3824FD84306FC26
SHA-256:4E0827969156EC163FB66D5A1807A9F2BCA8738D5342E0204403793B8169CF6E
SHA-512:B4F969876CE61B1F54CDDA977E20C30576108B95AA8367A625D20BF2926BF084DAFBF77E9E7BE5191293EADED869A6B942918621DB75799805CF606F8A2205B4
Malicious:false
Reputation:unknown
Preview:{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".V.H.X.L.G.R.5.H.j.D.k.3.C.i.F.b.L.a.m.K.N.+.n.c.g.T.0.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".D.5.N.Z.G.q.F.f.3.A.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.t.C.f.+.K.O.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{67C52E17-00D1-46C8-81B4-4F55DEEAB2CE}.tmp

Download File
Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:data
Category:dropped
Size (bytes):35936
Entropy (8bit):4.055965578999801
Encrypted:false
SSDEEP:
MD5:15D56DDE0CED7EC56E9B67B2C4631266
SHA1:D7DCF323D2270626C648C9C14418E7630666631E
SHA-256:8D06253A94C9E2BD6C241939123768C5280EB8DDCB7EC26F96532D3A1A4A850E
SHA-512:2283175E4B474283658930D77813F99819EFE060DB52C714F39A0E4961674A980AD04977AD21BB9A01C8D4ED79CDC5F61B0451B02DF7CA96103F407065EAF5EE
Malicious:false
Reputation:unknown
Preview:.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................d.........$..dh...a$......d<...*...$..$.If........!v..h.#v....:V.......t.....6......5.......4........4.

C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1732713841455197900_BC3DE223-19D1-4BBD-894A-CE66A04B827E.log

Download File
Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:ASCII text, with very long lines (859), with CRLF line terminators
Category:dropped
Size (bytes):20971520
Entropy (8bit):0.010923808506785258
Encrypted:false
SSDEEP:
MD5:B84B8433D15BED286B73ED40905179DF
SHA1:F78D8F822ECE9845B41E1137A95E885AAE2D6659
SHA-256:3CEF652603D5B826CCB4F15B6E03A4EF15000710062BE6411618779CBC2451A1
SHA-512:5480802DE6E8AA6110E3ED254D34A4C60C998AF6A8A1A3044407F1BFB65E2777FE11F07D8E9E22298E7572AB5A74B8585A5129D3161B526A6EF8229546F9D1DE
Malicious:false
Reputation:unknown
Preview:Timestamp.Process.TID.Area.Category.EventID.Level.Message.Correlation..11/27/2024 13:24:01.483.OUTLOOK (0x1B8C).0x1B90.Microsoft Outlook.Telemetry Event.b7vzq.Medium.SendEvent {"EventName":"Office.System.GracefulExit.GracefulAppExitDesktop","Flags":33777014402039809,"InternalSequenceNumber":17,"Time":"2024-11-27T13:24:01.483Z","Data.PreviousAppMajor":16,"Data.PreviousAppMinor":0,"Data.PreviousAppBuild":16827,"Data.PreviousAppRevision":20130,"Data.PreviousSessionId":"405232A3-4E1A-4EB0-A7A2-3B0FC08F0D54","Data.PreviousSessionInitTime":"2024-11-27T13:23:34.460Z","Data.PreviousSessionUninitTime":"2024-11-27T13:23:37.928Z","Data.SessionFlags":2147483652,"Data.InstallMethod":0,"Data.OfficeUILang":1033,"Data.PreviousBuild":"Unknown","Data.EcsETag":"\"\"","Data.ProcessorArchitecture":"x64"}...11/27/2024 13:24:01.530.OUTLOOK (0x1B8C).0xD84.Microsoft Outlook.Telemetry Event.b7vzq.Medium.SendEvent {"EventName":"Office.Telemetry.LoadXmlRules","Flags":33777014401990913,"InternalSequenceNumber":22,

C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1732713841455999900_BC3DE223-19D1-4BBD-894A-CE66A04B827E.log

Download File
Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:data
Category:dropped
Size (bytes):20971520
Entropy (8bit):0.0
Encrypted:false
SSDEEP:
MD5:8F4E33F3DC3E414FF94E5FB6905CBA8C
SHA1:9674344C90C2F0646F0B78026E127C9B86E3AD77
SHA-256:CD52D81E25F372E6FA4DB2C0DFCEB59862C1969CAB17096DA352B34950C973CC
SHA-512:7FB91E868F3923BBD043725818EF3A5D8D08EBF1059A18AC0FE07040D32EEBA517DA11515E6A4AFAEB29BCC5E0F1543BA2C595B0FE8E6167DDC5E6793EDEF5BB
Malicious:false
Reputation:unknown
Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20241127T0824010227-7052.etl

Download File
Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:data
Category:modified
Size (bytes):143360
Entropy (8bit):4.7975339993524955
Encrypted:false
SSDEEP:
MD5:DE5AC1456761A123A7EE6B34EF59E5FC
SHA1:F2436D9D4AA1A4779E12DC3058291742D26A25CA
SHA-256:7820DFA96AA605BA9FDD949FCD7B97B01FB4431F7CB60ACDFA97FD52CC651D65
SHA-512:194401B471A806E59A9B141AE90D67C9E7212FED3E85F7FF615CB0124128C0C4688338C4543F611D6E13D0B0602960B980DCB37FA9506065CDE45BFEE65CAF93
Malicious:false
Reputation:unknown
Preview:............................................................................`.............H..@..................eJ..............Zb..2...................................,...@.t.z.r.e.s...d.l.l.,.-.1.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.1.1.1............................................................''..Y............H..@..........v.2._.O.U.T.L.O.O.K.:.1.b.8.c.:.a.f.5.3.6.0.2.0.c.a.3.4.4.5.7.3.b.2.b.5.4.e.4.c.2.b.e.6.3.9.2.c...C.:.\.U.s.e.r.s.\.c.a.l.i.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.O.u.t.l.o.o.k. .L.o.g.g.i.n.g.\.O.U.T.L.O.O.K._.1.6._.0._.1.6.8.2.7._.2.0.1.3.0.-.2.0.2.4.1.1.2.7.T.0.8.2.4.0.1.0.2.2.7.-.7.0.5.2...e.t.l.......P.P...........H..@..........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Outlook\NoEmail.srs

Download File
Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:Composite Document File V2 Document, Cannot read section info
Category:dropped
Size (bytes):16384
Entropy (8bit):0.6701075702133217
Encrypted:false
SSDEEP:
MD5:43887C54883F6DF82451E4A08DA5E239
SHA1:5525EF748657DD2EE7D2CC70F531CD6FBE9D27E9
SHA-256:2AE0EBED6DF938310A4344BAAAF4724C06D87A0604CEF468F77777782051223E
SHA-512:C681857E8B8B58AFD39F764BAC7197E264D5DED55B5AB0C47CD6B02515015CC18473E2BE65723DE4BF0FD64CBA077BAC673CDEC9B5C860A0F922C1191DA49322
Malicious:true
Reputation:unknown
Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Documents\Outlook Files\Outlook Data File - NoEmail.pst

Download File
Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:Microsoft Outlook email folder (>=2003)
Category:dropped
Size (bytes):271360
Entropy (8bit):3.1577093367143427
Encrypted:false
SSDEEP:
MD5:9D86DECD830B0F746134C9493F830AF5
SHA1:B171E4844CA6E0AE089A792C20C995DB19DBF835
SHA-256:43FBD5560CB9971740C14EEFE7B8D3A59A1B61709186BF42A16C66E6066E7C7D
SHA-512:E8AEB8E58805F1A0EEF7C5255EBED1662C6CFBE8E5F93BC2C9971BBDEBF4D6C5FFEBE6F657D54DD9A85CCAE65D7E1CD411E57547FD969F5DBF02C8FF4F9342B5
Malicious:true
Reputation:unknown
Preview:!BDN....SM......\...............>.......`................@...........@...@...................................@...........................................................................$.......D.......g..............=...............:.....................................................................................................................................................................................................................................................................................................hi......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp

Download File
Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:data
Category:dropped
Size (bytes):131072
Entropy (8bit):3.611185147720047
Encrypted:false
SSDEEP:
MD5:AA7FD369E43310E190DF151B96297CE2
SHA1:6D676465592D8A23B6D68CC81B8DC938D60297DF
SHA-256:8FFAEF285F25A9E021ED1800EDD97727EED01CE2C592EA04E21187F033E8F0C3
SHA-512:A3C3E82A08AC8E4D2611B92A1C55533BF1DD6A421D0CD7040C06BC6CC611757BAAA996E06ABA31F2334DA6F7F409221A18218114F4F5392F83E17B5119A340FD
Malicious:true
Reputation:unknown
Preview:...C...b...........WP...@....................#.!BDN....SM......\...............>.......`................@...........@...@...................................@...........................................................................$.......D.......g..............=...............:.....................................................................................................................................................................................................................................................................................................hi..WP...@.......B............#.........................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:MIME entity, ASCII text, with CRLF line terminators
Entropy (8bit):5.7997983262255275
TrID:
    File name:Document Review for Recent Transaction - Signature requested by Xiomara Baldwin Support Team.eml
    File size:44'286 bytes
    MD5:ecbb4c7eca5eff914ee2c4f3e19421a0
    SHA1:4f7f364466aff4fd2c206758c6d494c21bd02477
    SHA256:175217057a7c8acd334b2cef98a7b11027b8544fa942d52e549ea2ca1e4922fd
    SHA512:61b7076d5fbe0c9496d8789a20fc17849f3ab948df7dfea3e1a052a1927e3ddcabb6d36e56ba66bbe35ea2cb485cf8c6f5d2a1c450eb9244eceecb9cfec94f19
    SSDEEP:384:T2v0MEEH+rybJ+WJUiU7/BfPQ2BT4aabzv+tTcop0kHiHDiE63OwKXR1LhOj4G8z:Q0MEEHBMr1fMGtAopdEDR6+bX3qjK1
    TLSH:99132BD916E62D79EDB07F01B67CA96B360C884F06B4D06F563C9B856138BAD0DF18C4
    File Content Preview:MIME-Version: 1.0..Date: Wed, 27 Nov 2024 06:53:59 -0600..From: Xiomara Baldwin Support Team <noreply@mail.hellosign.com>..Subject: Document Review for Recent Transaction - Signature requested by.. Xiomara Baldwin Support Team..Thread-Topic: Document Revi

    Static Mail

    General

    Subject:Document Review for Recent Transaction - Signature requested by Xiomara Baldwin Support Team
    From:Xiomara Baldwin Support Team <noreply@mail.hellosign.com>
    To:"iblish@changlopez.onmicrosoft.com" <iblish@changlopez.onmicrosoft.com>
    Cc:
    BCC:
    Date:Wed, 27 Nov 2024 06:53:59 -0600
    Communications:
    • ACTION REQUESTEDXiomara Baldwin Support Team (angela.nelson@pacifico.edu.co) has requested a signature Review & sign Document Document Review for Recent Transaction Message from Xiomara Baldwin Support Team (angela.nelson@pacifico.edu.co) Dear Customer,This is to inform you that a payment of $499.99 for Bitdefender Total Security has been initiated through PayPal. To confirm this transaction, please review and sign the attached document using Dropbox Sign.Transaction Details:Amount: $499.99Service Provider: BitdefenderPayment Method: PayPalTo ensure accuracy and security, please click the link below to access the document and complete the required action.This transaction will reflect on your account within 24 hours. If you have any questions or wish to cancel this transaction, please contact us immediately for assistance:Support Line: 1-833-425-2732Thank you for your prompt attention to this matter.Sincerely,Team PayPal Reply to sender Thanks, The Dropbox Sign team Warning: To prevent others from accessing your document, please do not forward this email. Report abuse <!-- @font-face {font-family:'Atlas Grotesk'; font-weight:400} @font-face {font-family:'Atlas Grotesk'; font-weight:500} b, strong {font-weight:500} @media only screen { html {min-height:100%; background:#ececec} a {color:#0061FE!important} } @media only screen and (max-width: 736px) { .small-float-center {margin:0 auto!important; float:none!important; text-align:center!important} } @media only screen and (max-width: 736px) { table.body img {width:auto; height:auto} table.body center {min-width:0!important} table.body .container {width:95%!important} table.body .columns {height:auto!important; box-sizing:border-box; padding-left:16px!important; padding-right:16px!important} table.body .columns .columns {padding-left:0!important; padding-right:0!important} table.body .collapse .columns {padding-left:0!important; padding-right:0!important} th.small-2 {display:inline-block!important; width:16.66667%!important} th.small-6 {display:inline-block!important; width:50%!important} th.small-10 {display:inline-block!important; width:83.33333%!important} th.small-12 {display:inline-block!important; width:100%!important} .columns th.small-12 {display:block!important; width:100%!important} table.menu {width:100%!important} table.menu td, table.menu th {width:auto!important; display:inline-block!important} table.menu.vertical td, table.menu.vertical th {display:block!important} table.button.small-expanded.rebrand-button {width:45%!important} table.button.small-expanded {width:100%!important} table.button.small-expanded table {width:100%} table.button.small-expanded table a {text-align:center!important; width:100%!important; padding-left:0!important; padding-right:0!important} } @media only screen and (min-width: 736px) { .padder {width:60px!important} } @media only screen and (min-width: 736px) { .header__top-spacer {height:80px!important} } @media only screen and (min-width: 736px) { .header__bottom-spacer {height:45px!important} } @media only screen and (min-width: 736px) { .action-item .icon {height:50px!important} } @media only screen and (min-width: 736px) { .action-item .action-item--action {font-size:20px} } @media only screen and (min-width: 736px) { .notification .notification__spacer-top {height:40px!important} } @media only screen and (min-width: 736px) { .custom-tagline-spacer {height:20px!important} } @media only screen and (min-width: 736px) { .custom-tagline-copy {font-size:15px!important} } --> ACTION REQUESTEDXiomara Baldwin Support Team (angela.nelson@pacifico.edu.co) has requested a signature Review & sign Document Document Review for Recent Transaction Message from Xiomara Baldwin Support Team (angela.nelson@pacifico.edu.co) Dear Customer,This is to inform you that a payment of $499.99 for Bitdefender Total Security has been initiated through PayPal. To confirm this transaction, please review and sign the attached document using Dropbox Sign.Transaction Details:Amount: $499.99Service Provider: BitdefenderPayment Method: PayPalTo ensure accuracy and security, please click the link below to access the document and complete the required action.This transaction will reflect on your account within 24 hours. If you have any questions or wish to cancel this transaction, please contact us immediately for assistance:Support Line: 1-833-425-2732Thank you for your prompt attention to this matter.Sincerely,Team PayPal Reply to sender Thanks, The Dropbox Sign team Warning: To prevent others from accessing your document, please do not forward this email. Report abuse ACTION REQUESTEDXiomara Baldwin Support Team (angela.nelson@pacifico.edu.co) has requested a signature Review & sign Document Document Review for Recent Transaction Message from Xiomara Baldwin Support Team (angela.nelson@pacifico.edu.co) Dear Customer,This is to inform you that a payment of $499.99 for Bitdefender Total Security has been initiated through PayPal. To confirm this transaction, please review and sign the attached document using Dropbox Sign.Transaction Details:Amount: $499.99Service Provider: BitdefenderPayment Method: PayPalTo ensure accuracy and security, please click the link below to access the document and complete the required action.This transaction will reflect on your account within 24 hours. If you have any questions or wish to cancel this transaction, please contact us immediately for assistance:Support Line: 1-833-425-2732Thank you for your prompt attention to this matter.Sincerely,Team PayPal Reply to sender Thanks, The Dropbox Sign team Warning: To prevent others from accessing your document, please do not forward this email. Report abuse ACTION REQUESTEDXiomara Baldwin Support Team (angela.nelson@pacifico.edu.co) has requested a signature Review & sign Document Document Review for Recent Transaction Message from Xiomara Baldwin Support Team (angela.nelson@pacifico.edu.co) Dear Customer,This is to inform you that a payment of $499.99 for Bitdefender Total Security has been initiated through PayPal. To confirm this transaction, please review and sign the attached document using Dropbox Sign.Transaction Details:Amount: $499.99Service Provider: BitdefenderPayment Method: PayPalTo ensure accuracy and security, please click the link below to access the document and complete the required action.This transaction will reflect on your account within 24 hours. If you have any questions or wish to cancel this transaction, please contact us immediately for assistance:Support Line: 1-833-425-2732Thank you for your prompt attention to this matter.Sincerely,Team PayPal Reply to sender Thanks, The Dropbox Sign team Warning: To prevent others from accessing your document, please do not forward this email. Report abuse ACTION REQUESTEDXiomara Baldwin Support Team (angela.nelson@pacifico.edu.co) has requested a signature Review & sign Document Document Review for Recent Transaction Message from Xiomara Baldwin Support Team (angela.nelson@pacifico.edu.co) Dear Customer,This is to inform you that a payment of $499.99 for Bitdefender Total Security has been initiated through PayPal. To confirm this transaction, please review and sign the attached document using Dropbox Sign.Transaction Details:Amount: $499.99Service Provider: BitdefenderPayment Method: PayPalTo ensure accuracy and security, please click the link below to access the document and complete the required action.This transaction will reflect on your account within 24 hours. If you have any questions or wish to cancel this transaction, please contact us immediately for assistance:Support Line: 1-833-425-2732Thank you for your prompt attention to this matter.Sincerely,Team PayPal Reply to sender Thanks, The Dropbox Sign team Warning: To prevent others from accessing your document, please do not forward this email. Report abuse ACTION REQUESTEDXiomara Baldwin Support Team (angela.nelson@pacifico.edu.co) has requested a signature Review & sign Document Document Review for Recent Transaction Message from Xiomara Baldwin Support Team (angela.nelson@pacifico.edu.co) Dear Customer,This is to inform you that a payment of $499.99 for Bitdefender Total Security has been initiated through PayPal. To confirm this transaction, please review and sign the attached document using Dropbox Sign.Transaction Details:Amount: $499.99Service Provider: BitdefenderPayment Method: PayPalTo ensure accuracy and security, please click the link below to access the document and complete the required action.This transaction will reflect on your account within 24 hours. If you have any questions or wish to cancel this transaction, please contact us immediately for assistance:Support Line: 1-833-425-2732Thank you for your prompt attention to this matter.Sincerely,Team PayPal Reply to sender Thanks, The Dropbox Sign team Warning: To prevent others from accessing your document, please do not forward this email. Report abuse ACTION REQUESTEDXiomara Baldwin Support Team (angela.nelson@pacifico.edu.co) has requested a signature Review & sign Document Document Review for Recent Transaction Message from Xiomara Baldwin Support Team (angela.nelson@pacifico.edu.co) Dear Customer,This is to inform you that a payment of $499.99 for Bitdefender Total Security has been initiated through PayPal. To confirm this transaction, please review and sign the attached document using Dropbox Sign.Transaction Details:Amount: $499.99Service Provider: BitdefenderPayment Method: PayPalTo ensure accuracy and security, please click the link below to access the document and complete the required action.This transaction will reflect on your account within 24 hours. If you have any questions or wish to cancel this transaction, please contact us immediately for assistance:Support Line: 1-833-425-2732Thank you for your prompt attention to this matter.Sincerely,Team PayPal Reply to sender Thanks, The Dropbox Sign team Warning: To prevent others from accessing your document, please do not forward this email. Report abuse https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Fapp.hellosign.com%2F%3Futm_campaign%3Dunspecified%26utm_source%3Ddefault%26utm_channel%3Dproduct_promo%26utm_medium%3Demail&data=05%7C02%7Claura.luce%40gbaships.org%7C0efabe258c8b47b7736108dd0ee288fb%7C1917185a187d415b87e6295e95df8a01%7C0%7C0%7C638683088383478085%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=w12a4fSOHwj15thVpFARQl0tlrb59LIlfBwDpBwbT%2BY%3D&reserved=0 ACTION REQUESTEDXiomara Baldwin Support Team (angela.nelson@pacifico.edu.co) has requested a signature Review & sign Document Document Review for Recent Transaction Message from Xiomara Baldwin Support Team (angela.nelson@pacifico.edu.co) Dear Customer,This is to inform you that a payment of $499.99 for Bitdefender Total Security has been initiated through PayPal. To confirm this transaction, please review and sign the attached document using Dropbox Sign.Transaction Details:Amount: $499.99Service Provider: BitdefenderPayment Method: PayPalTo ensure accuracy and security, please click the link below to access the document and complete the required action.This transaction will reflect on your account within 24 hours. If you have any questions or wish to cancel this transaction, please contact us immediately for assistance:Support Line: 1-833-425-2732Thank you for your prompt attention to this matter.Sincerely,Team PayPal Reply to sender Thanks, The Dropbox Sign team ACTION REQUESTEDXiomara Baldwin Support Team (angela.nelson@pacifico.edu.co) has requested a signature Review & sign Document Document Review for Recent Transaction Message from Xiomara Baldwin Support Team (angela.nelson@pacifico.edu.co) Dear Customer,This is to inform you that a payment of $499.99 for Bitdefender Total Security has been initiated through PayPal. To confirm this transaction, please review and sign the attached document using Dropbox Sign.Transaction Details:Amount: $499.99Service Provider: BitdefenderPayment Method: PayPalTo ensure accuracy and security, please click the link below to access the document and complete the required action.This transaction will reflect on your account within 24 hours. If you have any questions or wish to cancel this transaction, please contact us immediately for assistance:Support Line: 1-833-425-2732Thank you for your prompt attention to this matter.Sincerely,Team PayPal Reply to sender Thanks, The Dropbox Sign team ACTION REQUESTEDXiomara Baldwin Support Team (angela.nelson@pacifico.edu.co) has requested a signature Review & sign Document Document Review for Recent Transaction Message from Xiomara Baldwin Support Team (angela.nelson@pacifico.edu.co) Dear Customer,This is to inform you that a payment of $499.99 for Bitdefender Total Security has been initiated through PayPal. To confirm this transaction, please review and sign the attached document using Dropbox Sign.Transaction Details:Amount: $499.99Service Provider: BitdefenderPayment Method: PayPalTo ensure accuracy and security, please click the link below to access the document and complete the required action.This transaction will reflect on your account within 24 hours. If you have any questions or wish to cancel this transaction, please contact us immediately for assistance:Support Line: 1-833-425-2732Thank you for your prompt attention to this matter.Sincerely,Team PayPal Reply to sender Thanks, The Dropbox Sign team ACTION REQUESTEDXiomara Baldwin Support Team (angela.nelson@pacifico.edu.co) has requested a signature Review & sign Document Document Review for Recent Transaction Message from Xiomara Baldwin Support Team (angela.nelson@pacifico.edu.co) Dear Customer,This is to inform you that a payment of $499.99 for Bitdefender Total Security has been initiated through PayPal. To confirm this transaction, please review and sign the attached document using Dropbox Sign.Transaction Details:Amount: $499.99Service Provider: BitdefenderPayment Method: PayPalTo ensure accuracy and security, please click the link below to access the document and complete the required action.This transaction will reflect on your account within 24 hours. If you have any questions or wish to cancel this transaction, please contact us immediately for assistance:Support Line: 1-833-425-2732Thank you for your prompt attention to this matter.Sincerely,Team PayPal Reply to sender Thanks, The Dropbox Sign team ACTION REQUESTEDXiomara Baldwin Support Team (angela.nelson@pacifico.edu.co) has requested a signature Review & sign Document Document Review for Recent Transaction Message from Xiomara Baldwin Support Team (angela.nelson@pacifico.edu.co) Dear Customer,This is to inform you that a payment of $499.99 for Bitdefender Total Security has been initiated through PayPal. To confirm this transaction, please review and sign the attached document using Dropbox Sign.Transaction Details:Amount: $499.99Service Provider: BitdefenderPayment Method: PayPalTo ensure accuracy and security, please click the link below to access the document and complete the required action.This transaction will reflect on your account within 24 hours. If you have any questions or wish to cancel this transaction, please contact us immediately for assistance:Support Line: 1-833-425-2732Thank you for your prompt attention to this matter.Sincerely,Team PayPal Reply to sender Thanks, The Dropbox Sign team ACTION REQUESTEDXiomara Baldwin Support Team (angela.nelson@pacifico.edu.co) has requested a signature Review & sign Document Document Review for Recent Transaction Message from Xiomara Baldwin Support Team (angela.nelson@pacifico.edu.co) Dear Customer,This is to inform you that a payment of $499.99 for Bitdefender Total Security has been initiated through PayPal. To confirm this transaction, please review and sign the attached document using Dropbox Sign.Transaction Details:Amount: $499.99Service Provider: BitdefenderPayment Method: PayPalTo ensure accuracy and security, please click the link below to access the document and complete the required action.This transaction will reflect on your account within 24 hours. If you have any questions or wish to cancel this transaction, please contact us immediately for assistance:Support Line: 1-833-425-2732Thank you for your prompt attention to this matter.Sincerely,Team PayPal Reply to sender Thanks, The Dropbox Sign team ACTION REQUESTEDXiomara Baldwin Support Team (angela.nelson@pacifico.edu.co) has requested a signature Review & sign Document Document Review for Recent Transaction Message from Xiomara Baldwin Support Team (angela.nelson@pacifico.edu.co) Dear Customer,This is to inform you that a payment of $499.99 for Bitdefender Total Security has been initiated through PayPal. To confirm this transaction, please review and sign the attached document using Dropbox Sign.Transaction Details:Amount: $499.99Service Provider: BitdefenderPayment Method: PayPalTo ensure accuracy and security, please click the link below to access the document and complete the required action.This transaction will reflect on your account within 24 hours. If you have any questions or wish to cancel this transaction, please contact us immediately for assistance:Support Line: 1-833-425-2732Thank you for your prompt attention to this matter.Sincerely,Team PayPal Reply to sender Thanks, The Dropbox Sign team ACTION REQUESTEDXiomara Baldwin Support Team (angela.nelson@pacifico.edu.co) has requested a signature Review & sign Document Document Review for Recent Transaction Message from Xiomara Baldwin Support Team (angela.nelson@pacifico.edu.co) Dear Customer,This is to inform you that a payment of $499.99 for Bitdefender Total Security has been initiated through PayPal. To confirm this transaction, please review and sign the attached document using Dropbox Sign.Transaction Details:Amount: $499.99Service Provider: BitdefenderPayment Method: PayPalTo ensure accuracy and security, please click the link below to access the document and complete the required action.This transaction will reflect on your account within 24 hours. If you have any questions or wish to cancel this transaction, please contact us immediately for assistance:Support Line: 1-833-425-2732Thank you for your prompt attention to this matter.Sincerely,Team PayPal Reply to sender Thanks, The Dropbox Sign team ACTION REQUESTEDXiomara Baldwin Support Team (angela.nelson@pacifico.edu.co) has requested a signature Review & sign Document Document Review for Recent Transaction Message from Xiomara Baldwin Support Team (angela.nelson@pacifico.edu.co) Dear Customer,This is to inform you that a payment of $499.99 for Bitdefender Total Security has been initiated through PayPal. To confirm this transaction, please review and sign the attached document using Dropbox Sign.Transaction Details:Amount: $499.99Service Provider: BitdefenderPayment Method: PayPalTo ensure accuracy and security, please click the link below to access the document and complete the required action.This transaction will reflect on your account within 24 hours. If you have any questions or wish to cancel this transaction, please contact us immediately for assistance:Support Line: 1-833-425-2732Thank you for your prompt attention to this matter.Sincerely,Team PayPal Reply to sender Thanks, The Dropbox Sign team ACTION REQUESTEDXiomara Baldwin Support Team (angela.nelson@pacifico.edu.co) has requested a signature Review & sign Document Document Review for Recent Transaction Message from Xiomara Baldwin Support Team (angela.nelson@pacifico.edu.co) Dear Customer,This is to inform you that a payment of $499.99 for Bitdefender Total Security has been initiated through PayPal. To confirm this transaction, please review and sign the attached document using Dropbox Sign.Transaction Details:Amount: $499.99Service Provider: BitdefenderPayment Method: PayPalTo ensure accuracy and security, please click the link below to access the document and complete the required action.This transaction will reflect on your account within 24 hours. If you have any questions or wish to cancel this transaction, please contact us immediately for assistance:Support Line: 1-833-425-2732Thank you for your prompt attention to this matter.Sincerely,Team PayPal Reply to sender Thanks, The Dropbox Sign team ACTION REQUESTEDXiomara Baldwin Support Team (angela.nelson@pacifico.edu.co) has requested a signature Review & sign Document Document Review for Recent Transaction Message from Xiomara Baldwin Support Team (angela.nelson@pacifico.edu.co) Dear Customer,This is to inform you that a payment of $499.99 for Bitdefender Total Security has been initiated through PayPal. To confirm this transaction, please review and sign the attached document using Dropbox Sign.Transaction Details:Amount: $499.99Service Provider: BitdefenderPayment Method: PayPalTo ensure accuracy and security, please click the link below to access the document and complete the required action.This transaction will reflect on your account within 24 hours. If you have any questions or wish to cancel this transaction, please contact us immediately for assistance:Support Line: 1-833-425-2732Thank you for your prompt attention to this matter.Sincerely,Team PayPal Reply to sender Thanks, The Dropbox Sign team ACTION REQUESTEDXiomara Baldwin Support Team (angela.nelson@pacifico.edu.co) has requested a signature Review & sign Document Document Review for Recent Transaction Message from Xiomara Baldwin Support Team (angela.nelson@pacifico.edu.co) Dear Customer,This is to inform you that a payment of $499.99 for Bitdefender Total Security has been initiated through PayPal. To confirm this transaction, please review and sign the attached document using Dropbox Sign.Transaction Details:Amount: $499.99Service Provider: BitdefenderPayment Method: PayPalTo ensure accuracy and security, please click the link below to access the document and complete the required action.This transaction will reflect on your account within 24 hours. If you have any questions or wish to cancel this transaction, please contact us immediately for assistance:Support Line: 1-833-425-2732Thank you for your prompt attention to this matter.Sincerely,Team PayPal Reply to sender Thanks, The Dropbox Sign team ACTION REQUESTEDXiomara Baldwin Support Team (angela.nelson@pacifico.edu.co) has requested a signature Review & sign ACTION REQUESTEDXiomara Baldwin Support Team (angela.nelson@pacifico.edu.co) has requested a signature Review & sign ACTION REQUESTEDXiomara Baldwin Support Team (angela.nelson@pacifico.edu.co) has requested a signature Review & sign ACTION REQUESTEDXiomara Baldwin Support Team (angela.nelson@pacifico.edu.co) has requested a signature Review & sign ACTION REQUESTEDXiomara Baldwin Support Team (angela.nelson@pacifico.edu.co) has requested a signature ACTION REQUESTEDXiomara Baldwin Support Team (angela.nelson@pacifico.edu.co) has requested a signature ACTION REQUESTEDXiomara Baldwin Support Team (angela.nelson@pacifico.edu.co) has requested a signature ACTION REQUESTEDXiomara Baldwin Support Team (angela.nelson@pacifico.edu.co) has requested a signature ACTION REQUESTEDXiomara Baldwin Support Team (angela.nelson@pacifico.edu.co) has requested a signature ACTION REQUESTEDXiomara Baldwin Support Team (angela.nelson@pacifico.edu.co) has requested a signature ACTION REQUESTEDXiomara Baldwin Support Team (angela.nelson@pacifico.edu.co) has requested a signature ACTION REQUESTEDXiomara Baldwin Support Team (angela.nelson@pacifico.edu.co) has requested a signature ACTION REQUESTED ACTION REQUESTED ACTION REQUESTED ACTION REQUESTED ACTION REQUESTED Xiomara Baldwin Support Team (angela.nelson@pacifico.edu.co) has requested a signature Xiomara Baldwin Support Team (angela.nelson@pacifico.edu.co) has requested a signature Xiomara Baldwin Support Team (angela.nelson@pacifico.edu.co) has requested a signature Xiomara Baldwin Support Team (angela.nelson@pacifico.edu.co) has requested a signature Review & sign Review & sign Review & sign Review & sign Review & sign Review & sign Review & sign Review & sign Review & sign Review & sign Review & sign Review & sign Review & sign Review & sign Review & sign Review & sign Review & sign Review & sign Review & sign Review & sign Review & sign https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Fapp.hellosign.com%2Ft%2F6738230dd44b5e99c093e050b0e12e6577ee2bfd%3Futm_campaign%3Dmultisigner_complete%26utm_source%3Ddefault%26utm_channel%3Dproduct_promo%26utm_medium%3Demail%26utm_content%3Doriginal&data=05%7C02%7Claura.luce%40gbaships.org%7C0efabe258c8b47b7736108dd0ee288fb%7C1917185a187d415b87e6295e95df8a01%7C0%7C0%7C638683088383497963%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=DpP9KAP2yWqvr1WFvlT7Y7itFr4aTDETQbTOrJ8u4Cs%3D&reserved=0 Document Document Review for Recent Transaction Message from Xiomara Baldwin Support Team (angela.nelson@pacifico.edu.co) Dear Customer,This is to inform you that a payment of $499.99 for Bitdefender Total Security has been initiated through PayPal. To confirm this transaction, please review and sign the attached document using Dropbox Sign.Transaction Details:Amount: $499.99Service Provider: BitdefenderPayment Method: PayPalTo ensure accuracy and security, please click the link below to access the document and complete the required action.This transaction will reflect on your account within 24 hours. If you have any questions or wish to cancel this transaction, please contact us immediately for assistance:Support Line: 1-833-425-2732Thank you for your prompt attention to this matter.Sincerely,Team PayPal Reply to sender Document Document Review for Recent Transaction Message from Xiomara Baldwin Support Team (angela.nelson@pacifico.edu.co) Dear Customer,This is to inform you that a payment of $499.99 for Bitdefender Total Security has been initiated through PayPal. To confirm this transaction, please review and sign the attached document using Dropbox Sign.Transaction Details:Amount: $499.99Service Provider: BitdefenderPayment Method: PayPalTo ensure accuracy and security, please click the link below to access the document and complete the required action.This transaction will reflect on your account within 24 hours. If you have any questions or wish to cancel this transaction, please contact us immediately for assistance:Support Line: 1-833-425-2732Thank you for your prompt attention to this matter.Sincerely,Team PayPal Reply to sender Document Document Review for Recent Transaction Message from Xiomara Baldwin Support Team (angela.nelson@pacifico.edu.co) Dear Customer,This is to inform you that a payment of $499.99 for Bitdefender Total Security has been initiated through PayPal. To confirm this transaction, please review and sign the attached document using Dropbox Sign.Transaction Details:Amount: $499.99Service Provider: BitdefenderPayment Method: PayPalTo ensure accuracy and security, please click the link below to access the document and complete the required action.This transaction will reflect on your account within 24 hours. If you have any questions or wish to cancel this transaction, please contact us immediately for assistance:Support Line: 1-833-425-2732Thank you for your prompt attention to this matter.Sincerely,Team PayPal Reply to sender Document Document Review for Recent Transaction Message from Xiomara Baldwin Support Team (angela.nelson@pacifico.edu.co) Dear Customer,This is to inform you that a payment of $499.99 for Bitdefender Total Security has been initiated through PayPal. To confirm this transaction, please review and sign the attached document using Dropbox Sign.Transaction Details:Amount: $499.99Service Provider: BitdefenderPayment Method: PayPalTo ensure accuracy and security, please click the link below to access the document and complete the required action.This transaction will reflect on your account within 24 hours. If you have any questions or wish to cancel this transaction, please contact us immediately for assistance:Support Line: 1-833-425-2732Thank you for your prompt attention to this matter.Sincerely,Team PayPal Reply to sender Document Document Review for Recent Transaction Message from Xiomara Baldwin Support Team (angela.nelson@pacifico.edu.co) angela.nelson@pacifico.edu.co Dear Customer,This is to inform you that a payment of $499.99 for Bitdefender Total Security has been initiated through PayPal. To confirm this transaction, please review and sign the attached document using Dropbox Sign.Transaction Details:Amount: $499.99Service Provider: BitdefenderPayment Method: PayPalTo ensure accuracy and security, please click the link below to access the document and complete the required action.This transaction will reflect on your account within 24 hours. If you have any questions or wish to cancel this transaction, please contact us immediately for assistance:Support Line: 1-833-425-2732Thank you for your prompt attention to this matter.Sincerely,Team PayPal Reply to sender mailto:angela.nelson@pacifico.edu.co?subject=RE%3A%20Document Review for Recent Transaction Thanks, The Dropbox Sign team Thanks, The Dropbox Sign team Thanks, The Dropbox Sign team Thanks, The Dropbox Sign team Warning: To prevent others from accessing your document, please do not forward this email. Warning: To prevent others from accessing your document, please do not forward this email. Warning: To prevent others from accessing your document, please do not forward this email. Warning: To prevent others from accessing your document, please do not forward this email. Warning: To prevent others from accessing your document, please do not forward this email. Warning: To prevent others from accessing your document, please do not forward this email. Warning: To prevent others from accessing your document, please do not forward this email. Warning: To prevent others from accessing your document, please do not forward this email. Report abuse Report abuse Report abuse Report abuse Report abuse Report abuse Report abuse Report abuse Report abuse https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.dropbox.com%2Freport_abuse%3Futm_campaign%3Dunspecified%26utm_source%3Ddefault%26utm_channel%3Dproduct_promo%26utm_medium%3Demail%26utm_content%3DS&data=05%7C02%7Claura.luce%40gbaships.org%7C0efabe258c8b47b7736108dd0ee288fb%7C1917185a187d415b87e6295e95df8a01%7C0%7C0%7C638683088383513804%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=JfTubf8Uf0pv0FvzRh2ZNwa2t1T0v3QPxDLB8zfmiXc%3D&reserved=0
    Attachments:

      Headers

      Key Value
      MIME-Version1.0
      DateWed, 27 Nov 2024 06:53:59 -0600
      FromXiomara Baldwin Support Team <noreply@mail.hellosign.com>
      SubjectDocument Review for Recent Transaction - Signature requested by Xiomara Baldwin Support Team
      Thread-TopicDocument Review for Recent Transaction - Signature requested by Xiomara Baldwin Support Team
      Message-ID<20241127125158.edd881ccdd7f9158@mail.hellosign.com>
      To"iblish@changlopez.onmicrosoft.com" <iblish@changlopez.onmicrosoft.com>
      Content-Transfer-Encodingbase64
      Content-Typetext/html; charset="utf-8"

      File Icon

      Icon Hash:46070c0a8e0c67d6

      Static OLE Info

      General

      Document Type:Text
      Number of OLE Files:1

      OLE File "Document Review for Recent Transaction - Signature requested by Xiomara Baldwin Support Team.eml"

      Indicators
      Has Summary Info:
      Application Name:
      Encrypted Document:False
      Contains Word Document Stream:False
      Contains Workbook/Book Stream:False
      Contains PowerPoint Document Stream:False
      Contains Visio Document Stream:False
      Contains ObjectPool Stream:False
      Flash Objects Count:0
      Contains VBA Macros:True