Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
FW_ Complete with Docusign_ Louisiana Association of Business and Industry_pdf.msg

Overview

General Information

Sample name:FW_ Complete with Docusign_ Louisiana Association of Business and Industry_pdf.msg
Analysis ID:1566951
MD5:f6cad3d73474d02a058b025d8f5cd7ce
SHA1:95c04bc4fcd60e0389cdd6bfd5dd65f2e93bafde
SHA256:23a83d94b2563eba5b03eb623010d954930176aca965a3b0c755cbfa35bb5672
Infos:

Detection

Score:48
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

AI detected landing page (webpage, office document or email)
Suspicious MSG / EML detected (based on various text indicators)
Queries the volume information (name, serial number etc) of a device
Sigma detected: Office Autorun Keys Modification
Stores files to the Windows start menu directory

Classification

Process Tree

  • System is w10x64_ra
  • OUTLOOK.EXE (PID: 3900 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /f "C:\Users\user\Desktop\FW_ Complete with Docusign_ Louisiana Association of Business and Industry_pdf.msg" MD5: 91A5292942864110ED734005B7E005C0)
    • ai.exe (PID: 6268 cmdline: "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "166EF99A-93DA-47DF-8CB9-D93AF00E45AD" "5DCE5BA0-5423-4820-9BD2-DFE0CE0C58CF" "3900" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx" MD5: EC652BEDD90E089D9406AFED89A8A8BD)
    • chrome.exe (PID: 2712 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://urldefense.proofpoint.com/v2/url?u=https-3A__na3.docusign.net_Signing_EmailStart.aspx-3Fa-3D601beb6c-2D990f-2D4b61-2D873f-2D03e1c0fa31a4-26etti-3D24-26acct-3Dc807c6cc-2D9db9-2D4dad-2D9dd9-2D3bdafd75ef87-26er-3Dee32b569-2Ddc9c-2D4902-2D8203-2D6d9eb3fe325b&d=DwMFaQ&c=euGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM&r=_s-Im0evCJZzZ6DANeC7JdcMDtVmt7y_MjRsI4BSh6Q&m=ELN3G4IJB9ezIYN0Qb5jidwZVRw2WjDo0arwmkkotIYh_RAUScXASOWxa5vU2nxv&s=NVSdFxrZLAueY3vV1c1daJzFJZPHXaoyCW5ix3v0yCA&e= MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
      • chrome.exe (PID: 3984 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 --field-trial-handle=2008,i,5604532453264000219,4462698733504479268,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
  • cleanup

Yara Signatures

⊘No yara matches

Sigma Signatures

Sigma detected: Office Autorun Keys Modification
Source: Registry Key setAuthor: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 , EventID: 13, EventType: SetValue, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE, ProcessId: 3900, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Addins\OneNote.OutlookAddin\1

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Phishing

barindex
AI detected landing page (webpage, office document or email)
Source: EmailJoe Sandbox AI: Page contains button: 'REVIEW DOCUMENT' Source: 'Email'
Source: EmailJoe Sandbox AI: Email contains prominent button: 'review document'
Suspicious MSG / EML detected (based on various text indicators)
Source: MSG / EMLOCR Text: Is this legit? From: DocuSign NA3 System <dse NA3@docusign.net> Sent: Monday, December 2, 2024 1:09 PM To: Sam Canatella <scanatella@steamsolutions.com> Subject: Complete with Docusign: Louisiana Association of Business and Industry.pdf This email originated from outside of the organization. Do not click links or open attachments unless you recognize the sender and CAUTION: know the content is safe. docusign Louisiana Association of Business and Industry sent you a document to Pictur e of review and sign. REVIEW DOCUMENT Louisiana Association of Business and Industry Jcotto@rwtowne.com Louisiana Association of Business and Industry 500 Main Street Baton Rouge, LA 70801 Do Not Share This Email This email contains a secure link to Docusign. Please do not share this email, link, or access code with others. Alternate Signing Method Visit Docusign.com, click 'Access Documents', and enter the security code: 601 BEB6C990F4B61873F03EICOFA31A43 About Docusign Sign documents electronically in just minutes. It's safe, secure, and legally binding. Whether you're in an office, at home, on-the-go -- or even across the globe -- Docusign provides a professional trusted solution for Digital Transaction ManagementTM. Questions about the Document? If you need to modify the document or have questions about the details in the document, please reach out to the sender by emailing them directly. Stop receiving this email Report this email or read more about Declining to sign and Managing notifications.
Source: unknownHTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.16:49737 version: TLS 1.2
Source: unknownTCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknownTCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownTCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownTCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknownTCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknownTCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknownTCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknownTCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknownTCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknownTCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknownTCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknownTCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknownTCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknownTCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknownTCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknownTCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknownTCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknownTCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknownTCP traffic detected without corresponding DNS query: 84.201.211.37
Source: unknownTCP traffic detected without corresponding DNS query: 84.201.211.37
Source: unknownTCP traffic detected without corresponding DNS query: 84.201.211.37
Source: unknownTCP traffic detected without corresponding DNS query: 84.201.211.37
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownTCP traffic detected without corresponding DNS query: 192.229.221.95
Source: unknownTCP traffic detected without corresponding DNS query: 20.190.177.82
Source: unknownTCP traffic detected without corresponding DNS query: 20.190.177.82
Source: unknownTCP traffic detected without corresponding DNS query: 192.229.221.95
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownTCP traffic detected without corresponding DNS query: 20.190.177.82
Source: unknownTCP traffic detected without corresponding DNS query: 20.190.177.82
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global trafficDNS traffic detected: DNS query: na3.docusign.net
Source: global trafficDNS traffic detected: DNS query: docucdn-a.akamaihd.net
Source: global trafficDNS traffic detected: DNS query: urldefense.proofpoint.com
Source: global trafficDNS traffic detected: DNS query: www.google.com
Source: unknownNetwork traffic detected: HTTP traffic on port 49733 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49731 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49678 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49727 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49729 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49701 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49739
Source: unknownNetwork traffic detected: HTTP traffic on port 49736 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49737
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49736
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49735
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49734
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49733
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49732
Source: unknownNetwork traffic detected: HTTP traffic on port 49734 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49731
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49730
Source: unknownNetwork traffic detected: HTTP traffic on port 49673 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49732 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49730 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49705 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49728 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49729
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49728
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49727
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49705
Source: unknownNetwork traffic detected: HTTP traffic on port 49735 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49737 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49739 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49701
Source: unknownHTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.16:49737 version: TLS 1.2
Source: classification engineClassification label: mal48.phis.winMSG@17/28@13/166
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEFile created: C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEFile created: C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20241202T1513400066-3900.etl
Source: unknownProcess created: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /f "C:\Users\user\Desktop\FW_ Complete with Docusign_ Louisiana Association of Business and Industry_pdf.msg"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "166EF99A-93DA-47DF-8CB9-D93AF00E45AD" "5DCE5BA0-5423-4820-9BD2-DFE0CE0C58CF" "3900" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "166EF99A-93DA-47DF-8CB9-D93AF00E45AD" "5DCE5BA0-5423-4820-9BD2-DFE0CE0C58CF" "3900" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://urldefense.proofpoint.com/v2/url?u=https-3A__na3.docusign.net_Signing_EmailStart.aspx-3Fa-3D601beb6c-2D990f-2D4b61-2D873f-2D03e1c0fa31a4-26etti-3D24-26acct-3Dc807c6cc-2D9db9-2D4dad-2D9dd9-2D3bdafd75ef87-26er-3Dee32b569-2Ddc9c-2D4902-2D8203-2D6d9eb3fe325b&d=DwMFaQ&c=euGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM&r=_s-Im0evCJZzZ6DANeC7JdcMDtVmt7y_MjRsI4BSh6Q&m=ELN3G4IJB9ezIYN0Qb5jidwZVRw2WjDo0arwmkkotIYh_RAUScXASOWxa5vU2nxv&s=NVSdFxrZLAueY3vV1c1daJzFJZPHXaoyCW5ix3v0yCA&e=
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 --field-trial-handle=2008,i,5604532453264000219,4462698733504479268,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://urldefense.proofpoint.com/v2/url?u=https-3A__na3.docusign.net_Signing_EmailStart.aspx-3Fa-3D601beb6c-2D990f-2D4b61-2D873f-2D03e1c0fa31a4-26etti-3D24-26acct-3Dc807c6cc-2D9db9-2D4dad-2D9dd9-2D3bdafd75ef87-26er-3Dee32b569-2Ddc9c-2D4902-2D8203-2D6d9eb3fe325b&d=DwMFaQ&c=euGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM&r=_s-Im0evCJZzZ6DANeC7JdcMDtVmt7y_MjRsI4BSh6Q&m=ELN3G4IJB9ezIYN0Qb5jidwZVRw2WjDo0arwmkkotIYh_RAUScXASOWxa5vU2nxv&s=NVSdFxrZLAueY3vV1c1daJzFJZPHXaoyCW5ix3v0yCA&e=
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 --field-trial-handle=2008,i,5604532453264000219,4462698733504479268,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: apphelp.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: c2r64.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: userenv.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: msasn1.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: cryptsp.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: rsaenh.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: cryptbase.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: gpapi.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{F959DBBB-3867-41F2-8E5F-3B8BEFAA81B3}\InprocServer32
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEWindow found: window name: SysTabControl32
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Common
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEFile Volume queried: C:\Windows\SysWOW64 FullSizeInformation
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information queried: ProcessInformation
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeQueries volume information: C:\Program Files (x86)\Microsoft Office\root\Office16\AI\WordCombinedFloatieLreOnline.onnx VolumeInformation
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management Instrumentation1
Browser Extensions		1
Process Injection		1
Masquerading		OS Credential Dumping1
Process Discovery		Remote ServicesData from Local System2
Encrypted Channel		Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/Job1
DLL Side-Loading		1
DLL Side-Loading		1
Process Injection		LSASS Memory13
System Information Discovery		Remote Desktop ProtocolData from Removable Media1
Non-Application Layer Protocol		Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAt1
Registry Run Keys / Startup Folder		1
Registry Run Keys / Startup Folder		1
DLL Side-Loading		Security Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared Drive2
Application Layer Protocol		Automated ExfiltrationData Encrypted for Impact

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

⊘No Antivirus matches

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

NameIPActiveMaliciousAntivirus DetectionReputation
urldefense.com
52.71.28.102
truefalse
    		high
    www.google.com
    		172.217.21.36
    		truefalse
      		high
      na3.docusign.net
      		unknown
      		unknownfalse
        		high
        docucdn-a.akamaihd.net
        		unknown
        		unknownfalse
          		high
          urldefense.proofpoint.com
          		unknown
          		unknownfalse
            		unknown

            Contacted URLs

            NameMaliciousAntivirus DetectionReputation
            https://urldefense.proofpoint.com/jblocked?u=https-3A__na3.docusign.net_Signing_EmailStart.aspx-3Fa-3D601beb6c-2D990f-2D4b61-2D873f-2D03e1c0fa31a4-26etti-3D24-26acct-3Dc807c6cc-2D9db9-2D4dad-2D9dd9-2D3bdafd75ef87-26er-3Dee32b569-2Ddc9c-2D4902-2D8203-2D6d9eb3fe325b&c=ppessentials_us_hosted&sig=lGtG461s3_b0uh-6MmbDjG7SpjtTSYo8RauU37cj-zA%3Dtrue
              		unknown

              World Map of Contacted IPs

              • No. of IPs < 25%
              • 25% < No. of IPs < 50%
              • 50% < No. of IPs < 75%
              • 75% < No. of IPs

              Public IPs

              IPDomainCountryFlagASNASN NameMalicious
              52.113.194.132
              		unknownUnited States
              		8068MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
              172.217.19.206
              		unknownUnited States
              		15169GOOGLEUSfalse
              172.217.19.238
              		unknownUnited States
              		15169GOOGLEUSfalse
              1.1.1.1
              		unknownAustralia
              		13335CLOUDFLARENETUSfalse
              52.71.28.102
              		urldefense.comUnited States
              		14618AMAZON-AESUSfalse
              172.217.17.35
              		unknownUnited States
              		15169GOOGLEUSfalse
              216.58.208.227
              		unknownUnited States
              		15169GOOGLEUSfalse
              52.111.252.17
              		unknownUnited States
              		8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
              2.16.149.13
              		unknownEuropean Union
              		1273CWVodafoneGroupPLCEUfalse
              64.207.218.235
              		unknownUnited States
              		62856DOCUS-6-PRODUSfalse
              74.125.205.84
              		unknownUnited States
              		15169GOOGLEUSfalse
              239.255.255.250
              		unknownReserved
              		unknownunknownfalse
              52.109.28.46
              		unknownUnited States
              		8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
              52.6.56.188
              		unknownUnited States
              		14618AMAZON-AESUSfalse
              104.208.16.89
              		unknownUnited States
              		8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
              172.217.21.36
              		www.google.comUnited States
              		15169GOOGLEUSfalse
              52.109.76.243
              		unknownUnited States
              		8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse

              Private

              IP
              192.168.2.16

              General Information

              Joe Sandbox version:41.0.0 Charoite
              Analysis ID:1566951
              Start date and time:2024-12-02 21:13:06 +01:00
              Joe Sandbox product:CloudBasic
              Overall analysis duration:
              Hypervisor based Inspection enabled:false
              Report type:full
              Cookbook file name:defaultwindowsinteractivecookbook.jbs
              Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
              Number of analysed new started processes analysed:16
              Number of new started drivers analysed:0
              Number of existing processes analysed:0
              Number of existing drivers analysed:0
              Number of injected processes analysed:0
              Technologies:
              • EGA enabled
              Analysis Mode:stream
              Analysis stop reason:Timeout
              Sample name:FW_ Complete with Docusign_ Louisiana Association of Business and Industry_pdf.msg
              Detection:MAL
              Classification:mal48.phis.winMSG@17/28@13/166
              Cookbook Comments:
              • Found application associated with file extension: .msg

              Warnings

              • Exclude process from analysis (whitelisted): dllhost.exe, svchost.exe
              • Excluded IPs from analysis (whitelisted): 52.109.28.46
              • Excluded domains from analysis (whitelisted): config.officeapps.live.com, prod.configsvc1.live.com.akadns.net, officeclient.microsoft.com, europe.configsvc1.live.com.akadns.net, uks-azsc-config.officeapps.live.com
              • Not all processes where analyzed, report is missing behavior information
              • Report size getting too big, too many NtQueryAttributesFile calls found.
              • Report size getting too big, too many NtQueryValueKey calls found.
              • Report size getting too big, too many NtReadVirtualMemory calls found.
              • VT rate limit hit for: FW_ Complete with Docusign_ Louisiana Association of Business and Industry_pdf.msg

              Created / dropped Files

              C:\Users\user\AppData\Local\Microsoft\FORMS\FRMCACHE.DAT

              Download File
              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
              File Type:data
              Category:dropped
              Size (bytes):231348
              Entropy (8bit):4.384125485033823
              Encrypted:false
              SSDEEP:
              MD5:00479EDC70A558E136C68700765D7209
              SHA1:4F8F24B30F6AC08DED555D19DD7A7679ADBE5145
              SHA-256:059F3A7E15125C477B0EE3A9AAA7797DDC2D3C61152E269CA912AC0C79EA8082
              SHA-512:A98AD29B3A8151997EE3B20D2CD98C2E56E2E4464295E710F5FFAFA49022592C8D6B87BE4F2D7E1CE8B51CCDB62B97B13780D82496013E4255A8F6A5D9D3C480
              Malicious:false
              Reputation:unknown
              Preview:TH02...... ..g...D......SM01X...,...0....D..........IPM.Activity...........h...............h............H..h..S.......vw...h............H..h\cal ...pDat...hhj..0.....S....hN..............h........_`Pk...h....@...I.lw...h....H...8.Uk...0....T...............d.........2h...............k..D...........!h.............. h+Z......(.S...#h....8.........$h........8....."hx.......h.....'h..............1hN...<.........0h....4....Uk../h....h.....UkH..h @..p.....S...-h .......T.S...+h.........S......... ...... ..............F7..............FIPM.Activity....Form....Standard....Journal Entry...IPM.Microsoft.FolderDesign.FormsDescription................F.k..........1122110020000000....Microsoft...This form is used to create journal entries.........kf...... ..........&...........(.......(... ...@.....................................................................................................................fffffffff........wwwwwwww.p....pp..............p...............pw..............pw..DDDDO..

              C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\494B6871-F6BF-41E1-9E31-8D19799929EF

              Download File
              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
              File Type:XML 1.0 document, ASCII text, with CRLF line terminators
              Category:dropped
              Size (bytes):181859
              Entropy (8bit):5.295295378103498
              Encrypted:false
              SSDEEP:
              MD5:83FA57BBAD01EE2EBCAE3FEFDBA3DDEB
              SHA1:1C908C82A041EC7A088FF7FF043B6D165C4A423C
              SHA-256:7636EDCDB83D66E67E282319DCC516B09AF1D826515A4C0A068DD771AB93D3B8
              SHA-512:58BBC2196136D6B7671CD01588CD97B01CF30DF88BDE219AE524E672A09A0EBBE2816B19B5E01EFF05DF65461A2015072F31258904EC7E47E272AD96C283A770
              Malicious:false
              Reputation:unknown
              Preview:<?xml version="1.0" encoding="utf-8"?>..<o:OfficeConfig xmlns:o="urn:schemas-microsoft-com:office:office">.. <o:services o:GenerationTime="2024-12-02T20:13:43">.. Build: 16.0.18312.40138-->.. <o:default>.. <o:ticket o:headerName="Authorization" o:headerValue="{}" />.. </o:default>.. <o:service o:name="Research">.. <o:url>https://word-edit.officeapps.live.com/we/rrdiscovery.ashx</o:url>.. </o:service>.. <o:service o:name="ORedir">.. <o:url>https://o15.officeredir.microsoft.com/r</o:url>.. </o:service>.. <o:service o:name="ORedirSSL">.. <o:url>https://o15.officeredir.microsoft.com/r</o:url>.. </o:service>.. <o:service o:name="ClViewClientHelpId" o:authentication="1">.. <o:url>https://[MAX.BaseHost]/client/results</o:url>.. <o:ticket o:policy="MBI_SSL_SHORT" o:idprovider="1" o:target="[MAX.AuthHost]" o:headerValue="Passport1.4 from-PP='{}&amp;p='" />.. <o:ticket o:idprovider="3" o:headerValue="Bearer {}" o:resourceId="[

              C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-shm

              Download File
              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
              File Type:data
              Category:dropped
              Size (bytes):32768
              Entropy (8bit):0.04604146709717531
              Encrypted:false
              SSDEEP:
              MD5:AD8518BBBABDAC8647A1166AD0A4B08E
              SHA1:52A376B594BF61BC35E13F873E48C693EC4522CE
              SHA-256:FCF6E0EF7C17B1F327BBA92110AD7C4A6E5781E1E10D38C7CFC04EB4AAD0F4CC
              SHA-512:ADD3E483A619FCD14DAACE9405C91C6D47FEEEBD311F10CBB20945F274FF3A0E22EF67814CDD37B74CE3422A690371FCE14598C5CDD0107758ACA7FF9D1A04FF
              Malicious:false
              Reputation:unknown
              Preview:..-.....................'.<.|'...9.cHb.D.gY.sf;..-.....................'.<.|'...9.cHb.D.gY.sf;........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

              C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-wal

              Download File
              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
              File Type:SQLite Write-Ahead Log, version 3007000
              Category:dropped
              Size (bytes):49472
              Entropy (8bit):0.4838616425629464
              Encrypted:false
              SSDEEP:
              MD5:32106432552AAC4D1A35B9DF3499EFF8
              SHA1:22075466E0F26A6F42CE40B6ED0DDFB43C0254BE
              SHA-256:E8BC8C0B9884314EC865F6BA1925B13EDBD08A2607D46D1A5DBBACDAAAFB3236
              SHA-512:BB49ED813200176D68B73013FD969E2D38CB31FB1039FB4C919A6840A928D184C61864D81E8E9BB1A1B4B1EA05047209BC80842C2FE28F06E7D65C9EBF7B98AE
              Malicious:false
              Reputation:unknown
              Preview:7....-...........9.cHb.. ..,j...........9.cHb.S.[h.x.HSQLite format 3......@ .......................................................................... .............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

              C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{779E0772-9CCE-498F-98CB-45D4F7CD0F7E}.tmp

              Download File
              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
              File Type:data
              Category:modified
              Size (bytes):42368
              Entropy (8bit):4.186109814562627
              Encrypted:false
              SSDEEP:
              MD5:6D05F74EE4FF652E5C04A4BC159A4D6B
              SHA1:C0FE5458D01EF7A0608BAFBBD8F47E627E25F8A4
              SHA-256:4E2338CD5739F173EC2F7E865C255FA594A706F369EF8D21093B282B006B2B2C
              SHA-512:A7BF438AB8F5E98FBA17DF23399367C73D461AB01D6048FE0CC53B1B130D4D173FC6F6972B0EFA954EF5EC4857CE097A5F9D7B1A16CC27AA5CEB2BE8D1A71B68
              Malicious:false
              Reputation:unknown
              Preview:....I.s. .t.h.i.s. .l.e.g.i.t.?.....F.r.o.m.:. .D.o.c.u.S.i.g.n. .N.A.3. .S.y.s.t.e.m. .<.d.s.e._.N.A.3.@.d.o.c.u.s.i.g.n...n.e.t.>. ...S.e.n.t.:. .M.o.n.d.a.y.,. .D.e.c.e.m.b.e.r. .2.,. .2.0.2.4. .1.:.0.9. .P.M...T.o.:. .S.a.m. .C.a.n.a.t.e.l.l.a. .<.s.c.a.n.a.t.e.l.l.a.@.s.t.e.a.m.s.o.l.u.t.i.o.n.s...c.o.m.>...S.u.b.j.e.c.t.:. ................................................................................................................................................................................................."...$...............................2...............D...F...H...J...L...N...P..................................................................................................................................................................................................................................................................................................................$.a$.*...$..$.If........!v..h.#v....:V.......t.....6......5.......4........4........a........

              C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\33CUD2J1\docInvite-white[1].png

              Download File
              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
              File Type:PNG image data, 150 x 150, 8-bit/color RGBA, non-interlaced
              Category:dropped
              Size (bytes):2555
              Entropy (8bit):7.88910627682238
              Encrypted:false
              SSDEEP:
              MD5:6A78B0944A1DA4F3892D0F4A0163DA25
              SHA1:EDBEE8BAECF4D272F1B52BFA4C823DDC50E5486D
              SHA-256:C9903CB4027BD617227A5F968C1B48883F9FFC3C140A629C418A413A3C14991C
              SHA-512:1ECB84B1B369B7CF3BFA9184B527B9AB5885B1A8BE20A4AA408619D769379DC96ED56616400149381F14204C193FF359C86D7A7113089C6510A109705BF0C089
              Malicious:false
              Reputation:unknown
              Preview:.PNG........IHDR.............<.q.....tEXtSoftware.Adobe ImageReadyq.e<....IDATx..q.:..mO......Ax...K..s..U.u`_.N*.]...p.y.N...$..j....1...."...B...#./.$u...,.......r.."...z..-Q...A$`y...&..@.&..%..f...&..Wy..UQ..Z._.Z.v.X.a.$L...":.]~......~..kW9H..\ [3.j....,..-.....g..N..........R..h...^&;zv.*.R..I%.....wLZ...9.%..C...e..D.9.......S...l~.J........MZ....B..)&..BG....b.@...X.^.*/.(n.@..L|......c$Nf....Y..B.0..]..j.qB!9....2@.c.e.....-.8.....L.+..zUl.^.a.e4!.r.{...[CKK....k4.3Tp}~]#...9a.L./Li.Sp...*.S..].........7......(.@.P..W..T..".WE..C..1U.1.J.R@...l.J..*.....8...<0...aH%..;.ENb.eXOU.*/.%.uR.m:.J+...s7e.B..N..A...."..M...J..K....h.>..f.........xk....C.* .R.u6.....YL...*.6D.....Y`...P..m.Zg.K,..A....i...Z.......R..k..bx.Xp..`........}H..`...S[..7..V.{.&.Z!Y.1.i.t....X....Z...\...{..G.......|...Z.X.).(..z....>..T....X+.3...B...Y.a.'.....X.._u.....0.P..I.P.......r....&.`.\;/.2..9TA..'.V.9.7...9T.G@.s..+...57xZ.T..]Z..R..CwH..RzG.`.p....1A.

              C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\90SNK17T\email-logo[1].png

              Download File
              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
              File Type:PNG image data, 228 x 50, 8-bit/color RGBA, non-interlaced
              Category:dropped
              Size (bytes):2684
              Entropy (8bit):7.901894652512653
              Encrypted:false
              SSDEEP:
              MD5:B4F8F0DCDA279711CB9224C2239323D4
              SHA1:3C1B1B68CD9D2D25FF5D7FB2C7A61271DFFBF41B
              SHA-256:53D92718DD6001A4EBF49D631AB9DF5B8194E6AF220790B1D8CF57164E38C6B0
              SHA-512:E97F783AF2EECCAFD684BDDE181C1509414997D2970405CC2AD7B9182439EF471EE6BF58253E6661A7B4491DD80523CC23C4544B0F9CF5AA0E9BFF4F20E7CA92
              Malicious:false
              Reputation:unknown
              Preview:.PNG........IHDR.......2.....L0w.....pHYs.................sRGB.........gAMA......a.....IDATx...n....#...C.y..R .!.So..s.J.%7..@..h..v.@.[....}....^.^.*r3Z.(.C.h3?s...q.....J.......3$.$..# ..D"..*.k...(..#..$Q........o."...{.).d.n.R.e...?.t5...._....2.+..... .....B..l...yQ*.....*..2.....e.X.}.{PG.SH....J.|..#....3D.FZ.Eh...d..............3..0......?."...x......4J.-....g..a8..9B$..e8....s.q...4JF[2....a.>.~3...6B.....D4d3*......o.....r#.....=.jK...1.?...o..YW..Hdgyx.7.[.....?x.......P.........K.fT..5Y&.%CbyS\.a.a.....6..y....._`.....r..!...G<...0......B.E...=:......#.p...6........!+..!MQ....t.....m.6RhO.:..odmu@P#....m.......]...|.ndS.PU\.]..`.f.Z...?.Ds]9....F).w....... ..W.........fW.R..J..4\.d4!.d.l..h..T.Rh/.+.z..R..5.h......-.{.n..@......V.k]..RR.H....(.+...C.MIl.\.LDG....C...k*...)..H0qM.{.._..A+.'.c.....-..WY......pG....A.. .......Y)EG.#t.....(...._..H....".....>.Zl.:..g...W_[I............@=Zh.75t.9.y\...N.e|..$....6...,9..h......3..fs.'9.

              C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\AN5UOLP8\icon-download-app[1].png

              Download File
              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
              File Type:PNG image data, 36 x 36, 8-bit/color RGBA, non-interlaced
              Category:dropped
              Size (bytes):445
              Entropy (8bit):7.318768335834397
              Encrypted:false
              SSDEEP:
              MD5:E03518ED70845F60E54D995516FC7814
              SHA1:F70C7019C0989B62CC691B6CD34859D8FC506C01
              SHA-256:6F1AE1C2D727A21E023D4C687EDBD6FB7AA97BE003E3B17E4E6A2505F2B2B82C
              SHA-512:D8E73BE08FDC026BF5733C276E165AB9E93F562F99A4AFAAC46C9097CB6CE80FC45BA0FF9733391EC1A51727B1A1715394D03F6F167CFA22D8B4720D053B7E22
              Malicious:false
              Reputation:unknown
              Preview:.PNG........IHDR...$...$.............IDATx..?N.A......4.+..7....[.h(....9.z......... z...5..Zl....&..;..3._23..m...Y.&..|..'0..{..i8....].F.............<n=~....[B........8.d.g.*9./..#[-O.."TF.-...*..8.we.V.rm.......Qj|......g?sQ..Z.!".]]'.....X...N..G.z...(g...0..d....T.Im 5.|..J.Hle....^`.....[B.b...Q@..pI...7..|...u.@..MNl..N.3.;..{BR.q.9].Q.u.?@...&...*1.<...".j?$.1.....C.X..#vB........A...p...~.'.r...NM....IEND.B`.

              C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\AN5UOLP8\image[1].gif

              Download File
              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
              File Type:GIF image data, version 89a, 150 x 150
              Category:dropped
              Size (bytes):4064
              Entropy (8bit):7.594809840814567
              Encrypted:false
              SSDEEP:
              MD5:348BC69E07AE793619B66946B4839F0F
              SHA1:270A017648CF9D54C35B4F1094C36BD1A2150929
              SHA-256:E80822965FF8E899DFD0FA5D8C43D4A2207B3A8FA0195C9A0A2881A7406C1A51
              SHA-512:6594EBB5001552850AB372DDAC4572BA1FDABE77C90799382945EFDE62575CC359C850D56E463BBD9A87B5270AA34DDF5E272003900191E577290D793B87F6D3
              Malicious:false
              Reputation:unknown
              Preview:GIF89a............3..f..........+..+3.+f.+..+..+..U..U3.Uf.U..U..U......3..f..............3..f..............3..f.............3..f.........3..3.33.f3..3..3..3+.3+33+f3+.3+.3+.3U.3U33Uf3U.3U.3U.3..3.33.f3..3..3..3..3.33.f3..3..3..3..3.33.f3.3..3..3..3.33.f3..3..3..f..f.3f.ff..f..f..f+.f+3f+ff+.f+.f+.fU.fU3fUffU.fU.fU.f..f.3f.ff..f..f..f..f.3f.ff..f..f..f..f.3f.ff.f..f..f..f.3f.ff..f..f.......3..f.........+..+3.+f.+..+.+..U..U3.Uf.U..U.U......3..f.............3..f.............3..f............3..f.............3..f..........+..+3.+f.+..+..+..U..U3.Uf.U..U..U....3.f.........3.f...........3..f.............3..f..............3..f..........+..+3.+f.+..+..+..U..U3.Uf.U..U..U......3..f..............3..f..............3..f.............3..f.....................!.......,...............H......*L..G&b."...bEz....$&.. C..I..A1i.A.....&.0I.....*{..Oe.q..Jt`.1.v.\.'P1E.J.....X..T.f.W.b.i.K.".._..T!feY....}.... .L..V_E....h......<x....d..'.z.)b.H.1........<... S..Y

              C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1733170420284223300_81A44BA4-A495-43ED-AD75-AA224BDE2768.log

              Download File
              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
              File Type:ASCII text, with very long lines (28760), with CRLF line terminators
              Category:dropped
              Size (bytes):20971520
              Entropy (8bit):0.1766908601762102
              Encrypted:false
              SSDEEP:
              MD5:2CF841102E1CCCF5EEE6F8F396B2A222
              SHA1:C4EB80087B808496BC5BBC24240760F40356F09D
              SHA-256:3549C95FDC4C99E241C7B1C861A2B006B631D4BE49F29D64A4878D3BC26709D6
              SHA-512:92D314643352FEACBF3857C8E018A43445EE8FD950FFE1C59C99A9858BFF1D2C2B814CED565E71EB575A1CADF2BD775845BECAB89BAB819272A2C89DCC1B3F68
              Malicious:false
              Reputation:unknown
              Preview:Timestamp.Process.TID.Area.Category.EventID.Level.Message.Correlation..12/02/2024 20:13:40.316.OUTLOOK (0xF3C).0xF14.Microsoft Outlook.Telemetry Event.b7vzq.Medium.SendEvent {"EventName":"Office.Text.GDIAssistant.HandleCallback","Flags":30962256044949761,"InternalSequenceNumber":22,"Time":"2024-12-02T20:13:40.316Z","Contract":"Office.System.Activity","Activity.CV":"pEukgZWk7UOtdaoiS94naA.4.9","Activity.Duration":14,"Activity.Count":1,"Activity.AggMode":0,"Activity.Success":true,"Data.GdiFamilyName":"","Data.CloudFontStatus":6,"Data.CloudFontTypes":256}...12/02/2024 20:13:40.348.OUTLOOK (0xF3C).0xF14.Microsoft Outlook.Telemetry Event.b7vzq.Medium.SendEvent {"EventName":"Office.Text.ResourceClient.Deserialize","Flags":30962256044949761,"InternalSequenceNumber":24,"Time":"2024-12-02T20:13:40.348Z","Contract":"Office.System.Activity","Activity.CV":"pEukgZWk7UOtdaoiS94naA.4.10","Activity.Duration":15890,"Activity.Count":1,"Activity.AggMode":0,"Activity.Success":true,"Data.JsonFileMajorVersi

              C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1733170420285402300_81A44BA4-A495-43ED-AD75-AA224BDE2768.log

              Download File
              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
              File Type:data
              Category:dropped
              Size (bytes):20971520
              Entropy (8bit):0.0
              Encrypted:false
              SSDEEP:
              MD5:8F4E33F3DC3E414FF94E5FB6905CBA8C
              SHA1:9674344C90C2F0646F0B78026E127C9B86E3AD77
              SHA-256:CD52D81E25F372E6FA4DB2C0DFCEB59862C1969CAB17096DA352B34950C973CC
              SHA-512:7FB91E868F3923BBD043725818EF3A5D8D08EBF1059A18AC0FE07040D32EEBA517DA11515E6A4AFAEB29BCC5E0F1543BA2C595B0FE8E6167DDC5E6793EDEF5BB
              Malicious:false
              Reputation:unknown
              Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

              C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20241202T1513400066-3900.etl

              Download File
              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
              File Type:data
              Category:modified
              Size (bytes):90112
              Entropy (8bit):4.445378178672601
              Encrypted:false
              SSDEEP:
              MD5:8FC302DB9FD4B820D5557E6ACA171F67
              SHA1:0B273FE275F8E56E475E9A292B7FC781A675D44A
              SHA-256:825CD3AC287DA5E517586767D03C9B5CA05DF8925549142FC5900A701AB30842
              SHA-512:D07BA817ADE8ED9582BD183AA5A26BBFFA4567A66DCC80DE1C6027677DD93ECA76E065987D7A6EA2367461B760F07A5BADB22B9A4F6A50C4E9D0DB607F6FB5EB
              Malicious:false
              Reputation:unknown
              Preview:............................................................................^.......<....%z..D..................eJ..............Zb..2...................................,...@.t.z.r.e.s...d.l.l.,.-.1.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.1.1.1...........................................................@!...Y...........%z..D..........v.2._.O.U.T.L.O.O.K.:.f.3.c.:.a.e.2.8.0.0.d.4.3.8.4.b.4.9.7.a.8.d.d.6.a.5.8.b.5.3.1.1.f.c.5.2...C.:.\.U.s.e.r.s.\.c.a.l.i.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.O.u.t.l.o.o.k. .L.o.g.g.i.n.g.\.O.U.T.L.O.O.K._.1.6._.0._.1.6.8.2.7._.2.0.1.3.0.-.2.0.2.4.1.2.0.2.T.1.5.1.3.4.0.0.0.6.6.-.3.9.0.0...e.t.l.........P.P.....<....%z..D..........................................................................................................................................................................................................................................................................................................

              C:\Users\user\AppData\Local\Temp\~DF512601F9DC7EF485.TMP

              Download File
              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
              File Type:data
              Category:dropped
              Size (bytes):180224
              Entropy (8bit):0.5353127231846789
              Encrypted:false
              SSDEEP:
              MD5:1CA2DB9D820E39E29E8F31E7848EA6C2
              SHA1:A283F5BF9B8C60F24649E971E6EC556ECCF2B862
              SHA-256:7BC8A5BEC8CC4E359547E4EC65FA199A94DC37CEC5769341DE2AC9728082487E
              SHA-512:1CFB38DF17E2CDCD751B76B3249136234E6CB60AC9C24864A36D07A811ACCE04165F4E5FBE0B0E3AEE71BA622FC2721FFCA54417587174D9A1AE1FC79C9F5FD9
              Malicious:false
              Reputation:unknown
              Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

              C:\Users\user\AppData\Roaming\Microsoft\Office\MSO3072.acl

              Download File
              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
              File Type:data
              Category:dropped
              Size (bytes):30
              Entropy (8bit):1.2389205950315936
              Encrypted:false
              SSDEEP:
              MD5:BE3EED99C7516888EBA86E3374AEEBD7
              SHA1:EEFD362C85FE1BEEB490AEBAC4EF8ED85FEDB8E4
              SHA-256:C1DEA879777347F3A68A0606BBD1EBD14C81383454F689B1E9D4582BB0300C64
              SHA-512:9F809093DE96BC5C87E9196895E0E1D24400BE50B76F40426F7698799538CA8C41AF941C0A1050D4186E414A652AC85646EA049F4535387530C4550FDDF210B3
              Malicious:false
              Reputation:unknown
              Preview:....i.........................

              C:\Users\user\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC

              Download File
              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
              File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
              Category:dropped
              Size (bytes):14
              Entropy (8bit):2.699513850319966
              Encrypted:false
              SSDEEP:
              MD5:C5A12EA2F9C2D2A79155C1BC161C350C
              SHA1:75004B4B6C6C4EE37BE7C3FD7EE4AF4A531A1B1A
              SHA-256:61EC0DAA23CBC92167446DADEFB919D86E592A31EBBD0AB56E64148EBF82152D
              SHA-512:B3D5AF7C4A9CB09D27F0522671503654D06891740C36D3089BB5CB21E46AB235B0FA3DC2585A383B9F89F5C6DAE78F49F72B0AD58E6862DE39F440C4D6FF460B
              Malicious:false
              Reputation:unknown
              Preview:..c.a.l.i.....

              C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

              Download File
              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
              File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Dec 2 19:14:00 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
              Category:dropped
              Size (bytes):2673
              Entropy (8bit):3.992647999982947
              Encrypted:false
              SSDEEP:
              MD5:6F6E86B4B0C1C814D816F3B2A4BEFCF0
              SHA1:FBD1B8E8CE3D6134D37ED1F5A0A4458A5DA4A4A6
              SHA-256:8A2BEA53EB76680DE345FC787B76D6BB404990607BBA953D10014063605FB172
              SHA-512:121AFF3EA1D9D3C05DD9C13CAB50854054F987D24DC236C7A396B364622621FA987F6804B1241628372B33BF8D914593950223EBA0549856BA88CE2D5262D16D
              Malicious:false
              Reputation:unknown
              Preview:L..................F.@.. ...$+.,....'...D..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.Y......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............C......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

              C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

              Download File
              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
              File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Dec 2 19:14:00 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
              Category:dropped
              Size (bytes):2675
              Entropy (8bit):4.009698845618603
              Encrypted:false
              SSDEEP:
              MD5:0A17ECF9C36839C8FA1BDCC75EE59B72
              SHA1:EE00274FBD748C1F9331BCC5828DB89F7D8E62EB
              SHA-256:E560F4F337A7D28C578B3F3082A623B2AE55514F3E31B275D671E6F10AB31C46
              SHA-512:1D85CA94D2D60BEB649C7583AB0159A0C79DAB6333C4A28204B9DA1E901AF06EA3CF1343699DC2D9081B30DD93678590C7D1C563DAC69BD1F739D9CF840C4FD2
              Malicious:false
              Reputation:unknown
              Preview:L..................F.@.. ...$+.,....$...D..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.Y......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............C......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

              C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

              Download File
              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
              File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
              Category:dropped
              Size (bytes):2689
              Entropy (8bit):4.0152268769498285
              Encrypted:false
              SSDEEP:
              MD5:3A61536DD5756C0149A41376CB5A10B0
              SHA1:BC88C3265C896F14A0139959C06A4E9A97186A3F
              SHA-256:12329E6B36581A103DEB988497266BC55471BF87979ED9EF7960B1E4D56BE731
              SHA-512:AEFB4C245B49CF2D816211DF2B9A52CC3F4E797557F4DF5B8524D3B3436133B586A1DD19FBA91ABAB333FCC88145D126CBDB9C267F6428F34540DCE50175DF59
              Malicious:false
              Reputation:unknown
              Preview:L..................F.@.. ...$+.,.....Y.04...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.Y......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VFW.E...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............C......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

              C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

              Download File
              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
              File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Dec 2 19:14:00 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
              Category:dropped
              Size (bytes):2677
              Entropy (8bit):4.0061163417441685
              Encrypted:false
              SSDEEP:
              MD5:8BA99FE9BE92209776A92660EC75DEF7
              SHA1:3E4ADA88C0572316BF886DF1436E4F5E29086427
              SHA-256:F12CA3CD2DCAA9BF4768B622F925F8AC6BFC83695B6A131DC3B258096274F413
              SHA-512:B0CCDCE639CA62F6F19A03CF5AD2CE14566F23921E19857524364804952179C0690B97B1AFCD12281841CA576C123CF10770404DCEFFBF1BD36CD11DFD3DCBA7
              Malicious:false
              Reputation:unknown
              Preview:L..................F.@.. ...$+.,.....9...D..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.Y......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............C......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

              C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

              Download File
              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
              File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Dec 2 19:14:00 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
              Category:dropped
              Size (bytes):2677
              Entropy (8bit):3.996228331921622
              Encrypted:false
              SSDEEP:
              MD5:A3B25E47D66C2FA146D8ADDD8D8AC668
              SHA1:6DEB7D34D0558AE88D1002151B400039EB23217E
              SHA-256:F0FBB142E274631591ED409CE6B39FDAF515B30C85DF6EFB89EE90148B19EB6C
              SHA-512:768148D3C34A707A8A22C2DA29E3A557F8B729233AAD435E7E57DFB15552E1D45B2C267B477AA6FEC8D08EF3B2705ECFE3C543B8AAC6997C2811D726EEB2EA2D
              Malicious:false
              Reputation:unknown
              Preview:L..................F.@.. ...$+.,........D..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.Y......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............C......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

              C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

              Download File
              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
              File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Dec 2 19:14:00 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
              Category:dropped
              Size (bytes):2679
              Entropy (8bit):4.00432480628661
              Encrypted:false
              SSDEEP:
              MD5:8B55DBA161EE68F58857662B3152CB73
              SHA1:05A83AEE73A2EC64F48E088FC82D923052FD74A0
              SHA-256:FFF8C40E4F2458FFC88EC489ED5CDE11B3CFDAD29F01A7DBEF636E01718C7495
              SHA-512:9483DBD61FC65FAFF27CF2D99A3DF952791366CF72D0EE0712CEBB31B6695B8702D3FA8409A0C7060B59B324B8A2A3BD60F655122720D166BBCE538BB8C65DA3
              Malicious:false
              Reputation:unknown
              Preview:L..................F.@.. ...$+.,.......D..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.Y......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............C......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

              C:\Users\user\Documents\Outlook Files\Outlook Data File - NoEmail.pst

              Download File
              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
              File Type:Microsoft Outlook email folder (>=2003)
              Category:dropped
              Size (bytes):271360
              Entropy (8bit):1.2842488384090451
              Encrypted:false
              SSDEEP:
              MD5:F377CD29F7CFB54FB394A96250258C2B
              SHA1:0C090A3C4D28B417D4E614F66765F2866C0B3AE5
              SHA-256:AE45E588D30E0706D779548A5B223F98DFF2B789B7B6BC6E72FEFB4DD754003E
              SHA-512:5BB050CA0F6D26EA37C0D2990741334916DA822D52B5B382661E503DB2AF0FECC3CE17CC0997899E6F2D8916B8D7C9CC0DF227199841AFD60B4A7D29CD2405C3
              Malicious:true
              Reputation:unknown
              Preview:!BDN7].%SM......\.......@+......8.......T................@...........@...@...................................@...........................................................................$.......D......@*..............4...............7...........................................................................................................................................................................................................................................................................................x...........rc......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

              C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp

              Download File
              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
              File Type:data
              Category:dropped
              Size (bytes):131072
              Entropy (8bit):1.1556944952977493
              Encrypted:false
              SSDEEP:
              MD5:5482E6D10E2303BE4544169E8F8D2634
              SHA1:FE65C6B103D5A7AFCFEF0BFD7961F520CEEE09CD
              SHA-256:A8DD99D4B5B54EECB477962C319CD145B2ED04C9288C5491BDBB5112C8BA3C7B
              SHA-512:E3A1CE4C4AAB81A95F687AEDFF303A27A40FC1A58B9B64D3D318B0753384D573B1D110B3F07EF9AEC5F369D44E6D97F66EB0190415564B1747EBEF5B8F88C78F
              Malicious:true
              Reputation:unknown
              Preview:|$i.0...W.......<.....S..D.......D............#...........?........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................./..].D.......E.0...X.......<.....S..D.......B............#.........................................................................................................................................................................................................................................................................................................................................................................................................

              Chrome Cache Entry: 67

              Download File
              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
              File Type:HTML document, ASCII text, with very long lines (318)
              Category:downloaded
              Size (bytes):2042
              Entropy (8bit):4.52657188515219
              Encrypted:false
              SSDEEP:
              MD5:E386D4C2A6EA5B9F21569333D8816E14
              SHA1:7210EF10CE7987B4578AC2F917022EB41408E862
              SHA-256:0CC01659526FFE05371AFDA792C691600DD94CB35E12F9646307F9201B481AB1
              SHA-512:D701817924606E8DE85ABCE49BB5453F0043617DE8072AB018FEDB91AFD103FC5E9F442EC617BE30D2874C5A3109135EAADD7D403BC67D29ABDEE5EB38C4A597
              Malicious:false
              Reputation:unknown
              URL:https://urldefense.proofpoint.com/jblocked?u=https-3A__na3.docusign.net_Signing_EmailStart.aspx-3Fa-3D601beb6c-2D990f-2D4b61-2D873f-2D03e1c0fa31a4-26etti-3D24-26acct-3Dc807c6cc-2D9db9-2D4dad-2D9dd9-2D3bdafd75ef87-26er-3Dee32b569-2Ddc9c-2D4902-2D8203-2D6d9eb3fe325b&c=ppessentials_us_hosted&sig=lGtG461s3_b0uh-6MmbDjG7SpjtTSYo8RauU37cj-zA%3D
              Preview:<!DOCTYPE html>.<html>. <head>. <meta charset="UTF-8">. <meta name="viewport" content="width=694, user-scalable=no">. <title>Proofpoint Essentials Targeted Attack Protection</title>. <link href="/jasset/stylesheets/common.css" media="all" rel="stylesheet" type="text/css" />. <link href='/jasset/images/favicon.ico' rel='shortcut icon'>. </head>. <body>. <div class='warningbox shadow'>. <div class='en title' style="background-image:url('/jasset/images/warning.png')">Web Site Has Been Blocked!</div>. <div class='description'>. <p style="direction:ltr">The web page you are attempting to access has been classified as malicious. This classification is determined by direct analysis of the web page. Although an entire web site may be blocked as malicious, it is very common for a single page on a valid web site to be blocked.</p>. <p style="direction:ltr">Your organization has enabled this tec

              Chrome Cache Entry: 68

              Download File
              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
              File Type:ASCII text
              Category:downloaded
              Size (bytes):2864
              Entropy (8bit):5.139585964425596
              Encrypted:false
              SSDEEP:
              MD5:2FEC9CA2BE9C015E692928EB54429CA1
              SHA1:EAD795B071563A70FB00600551DDF1C7B2E2D07D
              SHA-256:080218E94B8FBE62AB1CBA4465CD549A03737E69C25F4FC375DA5AD9DC58DC35
              SHA-512:FA7DDE474AE3E0CBFA42E93C7D6836F66610D288FF02E9739BD7C749EDC9811CC9D34AE3D770E4F044C8BDE9C7F3D76C16CE68D3417F384BABEB2B82A85B2C29
              Malicious:false
              Reputation:unknown
              URL:https://urldefense.proofpoint.com/jasset/stylesheets/common.css
              Preview:html{..min-height:100%;..background:#0094bc;..background:-moz-linear-gradient(#0094bc, #3dd6ff);..background:-ms-linear-gradient(#0094bc, #3dd6ff 100%);..background:-webkit-gradient(linear, left top, left bottom, from(#0094bc), to(#3dd6ff));..background:-webkit-linear-gradient(#0094bc, #3dd6ff 100%);..background:-o-linear-gradient(#0094bc, #3dd6ff 100%);..filter:progid:DXImageTransform.Microsoft.gradient(startColorstr='$background-gradient-start', endColorstr='$background-gradient-end');..-ms-filter:"progid:DXImageTransform.Microsoft.gradient(startColorstr='$background-gradient-start', endColorstr='$background-gradient-end')";..background:linear-gradient(#0094bc, #3dd6ff 100%).}.body{..font-family:arial, verdana, helvetica;font-size:12px.}...warningbox{..-moz-box-shadow:3px 3px 10px 3px #006c89;..-webkit-box-shadow:3px 3px 10px 3px #006c89;..box-shadow:3px 3px 10px 3px #006c89;..-webkit-border-top-left-radius:16px;..-moz-border-top-left-radius:16px;..border-top-left-radius:16px;..-webk

              Chrome Cache Entry: 71

              Download File
              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
              File Type:PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
              Category:downloaded
              Size (bytes):4803
              Entropy (8bit):7.945415885603797
              Encrypted:false
              SSDEEP:
              MD5:B69B8937C432C824243F1FF03FE4A169
              SHA1:CFF98ABE81FE41B5A2FAF269CB0F6859B616ED51
              SHA-256:8A552613C9B52A23149A7CEFE7C15C321E62162AED70E9A736E6C96BBB07BC5F
              SHA-512:75943C9F3728E8A7BB98D5C108C5F5B7982C3C18C559353B818A4BCE1EED8CD408B868964B853BAC42A8F3BC662AE242C91D344D1D53EC4F1048C4FA59AB2DAC
              Malicious:false
              Reputation:unknown
              URL:https://urldefense.proofpoint.com/jasset/images/warning.png
              Preview:.PNG........IHDR...@...@......iq.....sRGB........}IDATx..y..U..?..~U..Z.'.t..:..$$!....DV.....[D...t.:.2...#g.....D..A.....9s...,.$!!Io.[u-..{w..u7.tc....v..._u.z.{......5...rX.._.....Z..._.".........._...n....&v.......(a.Rj......[.|./.....nR6wk..@:SQA<Q.~:.H...Z./...Jw"1.N.o.........37N....3R).g.R.:)q..P....K....e.....X....|.P..;._.p..]{>3..7....{U.....a4.%F...K&...Q...R..-_<o....].....Cj..'6.....:_....!.....1N.."..D.H..Q...L.\....t...o|[z.7./..=.WO..Z5..t..!.X..2.B.......q5..5....../...2|..s.y...o?..emF;R...MW.O.W....+.&...d.}.......x.A..a.a.>Z..g..t...{..m.......I..2.k<...Q.0..,\@../A....z.6\L.I.(..C..Q..j.d.(..1..o+..:...;:.WUVi,]N,o..(.B..khy.{q^.Q......}..;.BJ%<[.S%.KRQ[..:.N......-....kj.w.tu.*.iSD5@.E4.'..}.z....Y.8...5M.^...."!...).YS%.%...y.=..t.[........LoCbq,J..p...yT.x<.X.QT.V...u.O^.@G.%..z.j..>.m-.;.....4..6~&...)."U.A...|.R@o*I..!Q............JjW.!.La.%......i.2.'..}...6...`..?.V....[TJ%T.J..18...NX. ......."..0...E...I)....<

              Chrome Cache Entry: 72

              Download File
              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
              File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 300x300, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CC 2015 (Macintosh), datetime=2015:10:01 15:42:26], baseline, precision 8, 187x64, components 1
              Category:dropped
              Size (bytes):20820
              Entropy (8bit):6.115298643155388
              Encrypted:false
              SSDEEP:
              MD5:2354AE0C3B30ED5A5A6CE13853946CDE
              SHA1:62A4EDF895F221D051B6B7509490F64721A15CCD
              SHA-256:C3161B65DA3DA019547FBC4072E5E7DA13C1FABCE048107019FEFC72DE02E21A
              SHA-512:D1E3E4D245B63E6FC771213229A4533E62817F845BCBAF2249FC1377F226447D003D1469F7BB584927CD8C833ACAD8A032D4B936971BEAF4A7FC6E03EB846986
              Malicious:false
              Reputation:unknown
              Preview:......JFIF.....,.,.....nPhotoshop 3.0.8BIM.......6..Z...%G.........>..20150924..?..150838-0700.....Print8BIM.%...........~..Q.,.........Exif..MM.*.............................b...........j.(...........1.....$...r.2...........i.................,.......,....Adobe Photoshop CC 2015 (Macintosh).2015:10:01 15:42:26.................................................`....2015:09:24 15:08:38...=.http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="XMP Core 5.4.0"> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmlns:xmpTPg="http://ns.adobe.com/xap/1.0/t/pg/" xmlns:xmpG="http://ns.adobe.com/xap/1.0/g/" xmlns:stDim="http://ns.adobe.com/xap/1.0/sType/Dimensions#" xmlns:dc="http://purl.org/dc/elements/1.1/" xm

              Chrome Cache Entry: 74

              Download File
              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
              File Type:MS Windows icon resource - 1 icon, 16x16, 24 bits/pixel
              Category:downloaded
              Size (bytes):894
              Entropy (8bit):4.344683701204062
              Encrypted:false
              SSDEEP:
              MD5:F5C7F1AA9AEB0DFA465C2FC4B66D8837
              SHA1:F219EFD04FCA7AEC4395D2910861329C164C9E22
              SHA-256:111F2D2E3DE93DE285F0AAD6B78FCFB36BDB6D0EEF4CE75491FE586E631E0C4C
              SHA-512:C95B7CD68BA2712279A0F471C721F277B053175AAE5341D06EA354EA959B4A0371B2C962ED7B7A5CF0194823A93FD74A9C3B443F1EA718917F7A4B78E9D0213F
              Malicious:false
              Reputation:unknown
              URL:https://urldefense.proofpoint.com/jasset/images/favicon.ico
              Preview:..............h.......(....... ...........@......................9.3.3.3.3.3.3.3.3.3.3.3.3.9...N.............................Z.K.............................Z.K..........`...@...............Z.K........p............ ...........Z.K........`..........................Z.K..........`....................`.....Z.K...............................p...Z.K...............................p...Z.K..........`....................`.....Z.K........`..........................Z.K........p............ ...........Z.K..........`...@...............Z.K.............................Z.N.............................].....f..f..f..f..f..f..f..f..f..f..f..f..f..f.....ME..AR..\\..ta..10..\h..e$..li...L..S_..CA..DI..C:..ro..am..il

              Static File Info

              General

              File type:CDFV2 Microsoft Outlook Message
              Entropy (8bit):4.1915738383175105
              TrID:
              • Outlook Message (71009/1) 58.92%
              • Outlook Form Template (41509/1) 34.44%
              • Generic OLE2 / Multistream Compound File (8008/1) 6.64%
              File name:FW_ Complete with Docusign_ Louisiana Association of Business and Industry_pdf.msg
              File size:120'832 bytes
              MD5:f6cad3d73474d02a058b025d8f5cd7ce
              SHA1:95c04bc4fcd60e0389cdd6bfd5dd65f2e93bafde
              SHA256:23a83d94b2563eba5b03eb623010d954930176aca965a3b0c755cbfa35bb5672
              SHA512:de2ea4d63f705dd523e1bb04baff0fc755b60aa5dd936ca71c8b7b4884f8d0944e23928c241b119ed6736f68d32c4179ce1ba33067778806dc13e4c6efe9d0dc
              SSDEEP:1536:p1jIW2W4WIJM5JfieXYW1j8sgXgi0XaQpP9w+SDWPWgfXDmC15xQx+TjLRjyE:p1j7VrBKtkvhT
              TLSH:18C3002436FA4119F3B7DF315EE6949BD926BD92AC14994F2185330F0932A40ED62B3F
              File Content Preview:........................>......................................................................................................................................................................................................................................

              Static Mail

              General

              Subject:FW: Complete with Docusign: Louisiana Association of Business and Industry.pdf
              From:Sam Canatella <scanatella@steamsolutions.com>
              To:Cameron Gambrell <cgambrell@steamsolutions.com>
              Cc:
              BCC:
              Date:Mon, 02 Dec 2024 21:07:38 +0100
              Communications:
              • Is this legit?
              • From: DocuSign NA3 System <dse_NA3@docusign.net> Sent: Monday, December 2, 2024 1:09 PM To: Sam Canatella <scanatella@steamsolutions.com> Subject: Complete with Docusign: Louisiana Association of Business and Industry.pdf CAUTION: This email originated from outside of the organization. Do not click links or open attachments unless you recognize the sender and know the content is safe. <https://docucdn-a.akamaihd.net/olive/images/2.62.0/global-assets/email-templates/email-logo.png> <https://NA3.docusign.net/member/Images/email/docInvite-white.png> Louisiana Association of Business and Industry sent you a document to review and sign. REVIEW DOCUMENT <https://urldefense.proofpoint.com/v2/url?u=https-3A__na3.docusign.net_Signing_EmailStart.aspx-3Fa-3D601beb6c-2D990f-2D4b61-2D873f-2D03e1c0fa31a4-26etti-3D24-26acct-3Dc807c6cc-2D9db9-2D4dad-2D9dd9-2D3bdafd75ef87-26er-3Dee32b569-2Ddc9c-2D4902-2D8203-2D6d9eb3fe325b&d=DwMFaQ&c=euGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM&r=_s-Im0evCJZzZ6DANeC7JdcMDtVmt7y_MjRsI4BSh6Q&m=ELN3G4IJB9ezIYN0Qb5jidwZVRw2WjDo0arwmkkotIYh_RAUScXASOWxa5vU2nxv&s=NVSdFxrZLAueY3vV1c1daJzFJZPHXaoyCW5ix3v0yCA&e=> <https://NA3.docusign.net/Member/image.aspx?i=logo&l=5c635e39-adbe-4f88-a6a9-1c0fc40379a5> Louisiana Association of Business and Industry Jcotto@rwtowne.com <mailto:Jcotto@rwtowne.com> Louisiana Association of Business and Industry 500 Main Street Baton Rouge, LA 70801 Do Not Share This Email This email contains a secure link to Docusign. Please do not share this email, link, or access code with others. Alternate Signing Method Visit Docusign.com, click 'Access Documents', and enter the security code: 601BEB6C990F4B61873F03E1C0FA31A43 About Docusign Sign documents electronically in just minutes. It's safe, secure, and legally binding. Whether you're in an office, at home, on-the-go -- or even across the globe -- Docusign provides a professional trusted solution for Digital Transaction Management. Questions about the Document? If you need to modify the document or have questions about the details in the document, please reach out to the sender by emailing them directly. Stop receiving this email Report this email <https://urldefense.proofpoint.com/v2/url?u=https-3A__protect.docusign.net_report-2Dabuse-3Fe-3DAUtomjpFak9GlbPL0zFFi10aJHhQCAYY4fACN-5F3KO-2Dj9wj-5FrOkQCbSeOhAlEPZ3LE47RSrH1JKc0yrXx1SxdD1LO-5FJDX-2DvdQQEo-2DC444yFyfoI5v1-5F90FuiTEtSuCUFXRgIEY3JtDPlR74lKZ4jI8L-5F6nSLico6d9VhOr7DGi-5FgFg9wsZ3jeZEZtTdZpUF15HAAndo7aIlnpfp-2Djc0jM17X8Kr-2DPwzEEWzcPtTUEpeccTRgHNsaX12JGGqc3t-5FL52Zvt-5F58eVIWurS8bnuqk2JRfL-2DlzfqEUQGIIkVAEeCNgo6d1eFmSA4SEbGprhKLko52PI6PNOlhL6JYyZh4USq1I0S3rwpqvq1MjzqQtuNCAbnZLP8LhzKonLSpP9cqGHJfdkMK9JXS7MZJa0xw5MjSrTs5knd2y2WCSB3oedUzkIy2nbl3ll4LOcDavGx7nNpB1n7u3N0pNly2t1tlc2Tc-26lang-3Den&d=DwMFaQ&c=euGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM&r=_s-Im0evCJZzZ6DANeC7JdcMDtVmt7y_MjRsI4BSh6Q&m=ELN3G4IJB9ezIYN0Qb5jidwZVRw2WjDo0arwmkkotIYh_RAUScXASOWxa5vU2nxv&s=GNLsKCBR1ZYzyLliSm48oheBTqgIhkY2v3MEjh74Du8&e=> or read more about Declining to sign <https://urldefense.proofpoint.com/v2/url?u=https-3A__support.docusign.com_en_guides_Declining-2Dto-2Dsign-2DDocuSign-2DSigner-2DGuide&d=DwMFaQ&c=euGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM&r=_s-Im0evCJZzZ6DANeC7JdcMDtVmt7y_MjRsI4BSh6Q&m=ELN3G4IJB9ezIYN0Qb5jidwZVRw2WjDo0arwmkkotIYh_RAUScXASOWxa5vU2nxv&s=x539rfi9s8_lgd5MerQEZ649dIUPbU9Ibmk3pr8jyfk&e=> and Managing notifications <https://urldefense.proofpoint.com/v2/url?u=https-3A__support.docusign.com_en_articles_How-2Ddo-2DI-2Dmanage-2Dmy-2Demail-2Dnotifications&d=DwMFaQ&c=euGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM&r=_s-Im0evCJZzZ6DANeC7JdcMDtVmt7y_MjRsI4BSh6Q&m=ELN3G4IJB9ezIYN0Qb5jidwZVRw2WjDo0arwmkkotIYh_RAUScXASOWxa5vU2nxv&s=f85FT_5cr8CnsDiXE895wO-A6IsXrNkWPzmi93xYg38&e=> . If you have trouble signing, visit "How to Sign a Document <https://urldefense.proofpoint.com/v2/url?u=https-3A__support.docusign.com_s_articles_How-2Ddo-2DI-2Dsign-2Da-2DDocuSign-2Ddocument-2DBasic-2DSigning-3Flanguage-3Den-5FUS-26utm-5Fcampaign-3DGBL-5FXX-5FDBU-5FUPS-5F2211-5FSignNotificationEmailFooter-26utm-5Fmedium-3Dproduct-26utm-5Fsource-3Dpostsend&d=DwMFaQ&c=euGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM&r=_s-Im0evCJZzZ6DANeC7JdcMDtVmt7y_MjRsI4BSh6Q&m=ELN3G4IJB9ezIYN0Qb5jidwZVRw2WjDo0arwmkkotIYh_RAUScXASOWxa5vU2nxv&s=F-hxCpqn5HTCAj25ZmYM4_nbNFTxc8dC7PnON-3btdA&e=> " on our Docusign Support Center <https://urldefense.proofpoint.com/v2/url?u=https-3A__support.docusign.com_&d=DwMFaQ&c=euGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM&r=_s-Im0evCJZzZ6DANeC7JdcMDtVmt7y_MjRsI4BSh6Q&m=ELN3G4IJB9ezIYN0Qb5jidwZVRw2WjDo0arwmkkotIYh_RAUScXASOWxa5vU2nxv&s=oHiMJ6xO12kXB4OJaer0dYmQGB4DaB63o-XiuulpzDg&e=> , or browse our Docusign Community <https://urldefense.proofpoint.com/v2/url?u=https-3A__community.docusign.com_esignature-2D111-3Futm-5Fcampaign-3DGBL-5FUS-5FPRD-5FAWA-5F2405-5FCommunityCTA-26utm-5Fmedium-3Demail-26utm-5Fsource-3Dpostsend&d=DwMFaQ&c=euGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM&r=_s-Im0evCJZzZ6DANeC7JdcMDtVmt7y_MjRsI4BSh6Q&m=ELN3G4IJB9ezIYN0Qb5jidwZVRw2WjDo0arwmkkotIYh_RAUScXASOWxa5vU2nxv&s=q1NE1OHWnIN_JEKjPbE39W4dWqgsZ3MjSs3U1hxnaTI&e=> for more information. Download the Docusign App <https://urldefense.proofpoint.com/v2/url?u=https-3A__www.docusign.com_features-2Dand-2Dbenefits_mobile-3Futm-5Fcampaign-3DGBL-5FXX-5FDBU-5FUPS-5F2211-5FSignNotificationEmailFooter-26utm-5Fmedium-3Dproduct-26utm-5Fsource-3Dpostsend&d=DwMFaQ&c=euGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM&r=_s-Im0evCJZzZ6DANeC7JdcMDtVmt7y_MjRsI4BSh6Q&m=ELN3G4IJB9ezIYN0Qb5jidwZVRw2WjDo0arwmkkotIYh_RAUScXASOWxa5vU2nxv&s=-pX5hDLOsChC-Wf0gzbGNlq82PWiVUKBHDQeJBndR4U&e=> This message was sent to you by Louisiana Association of Business and Industry who is using the Docusign Electronic Signature Service. If you would rather not receive email from this sender you may contact the sender with your request.
              Attachments:

                Headers

                Key Value
                Receivedfrom SA1PR15MB4465.namprd15.prod.outlook.com
                2007:38 +0000
                Authentication-Resultsdkim=none (message not signed)
                by SA1PR15MB4821.namprd15.prod.outlook.com (260310b6:806:1e0::7) with
                2024 2007:38 +0000
                ([fe80:54d9:5126:ad31:2986%7]) with mapi id 15.20.8207.017; Mon, 2 Dec 2024
                Content-Typeapplication/ms-tnef; name="winmail.dat"
                Content-Transfer-Encodingbinary
                FromSam Canatella <scanatella@steamsolutions.com>
                ToCameron Gambrell <cgambrell@steamsolutions.com>
                SubjectFW: Complete with Docusign: Louisiana Association of Business and
                Thread-TopicComplete with Docusign: Louisiana Association of Business and
                Thread-IndexAQHbRO2jSpGkwen/8kmZJNtqSDzww7LTYb2A
                DateMon, 2 Dec 2024 20:07:38 +0000
                Message-ID<SA1PR15MB44658D4D8F2A9B80248021BDBF352@SA1PR15MB4465.namprd15.prod.outlook.com>
                References<64ed1bad4245432a9f13e815f98c8d3e@docusign.net>
                In-Reply-To<64ed1bad4245432a9f13e815f98c8d3e@docusign.net>
                Accept-Languageen-US
                Content-Languageen-US
                X-MS-Has-AttachX-MS-Exchange-Organization-SCL: 1
                X-MS-TNEF-Correlator<SA1PR15MB44658D4D8F2A9B80248021BDBF352@SA1PR15MB4465.namprd15.prod.outlook.com>
                MIME-Version1.0
                X-MS-Exchange-Organization-MessageDirectionalityOriginating
                X-MS-Exchange-Organization-AuthSourceSA1PR15MB4465.namprd15.prod.outlook.com
                X-MS-Exchange-Organization-AuthAsInternal
                X-MS-Exchange-Organization-AuthMechanism04
                X-MS-Exchange-Organization-Network-Message-Idd1587449-a589-43da-f0a1-08dd130cf886
                X-MS-PublicTrafficTypeEmail
                X-MS-TrafficTypeDiagnosticSA1PR15MB4465:EE_|SA1PR15MB4821:EE_|SA1PR15MB4675:EE_
                Return-Pathscanatella@steamsolutions.com
                X-MS-Exchange-Organization-ExpirationStartTime02 Dec 2024 20:07:38.9143
                X-MS-Exchange-Organization-ExpirationStartTimeReasonOriginalSubmit
                X-MS-Exchange-Organization-ExpirationInterval1:00:00:00.0000000
                X-MS-Exchange-Organization-ExpirationIntervalReasonOriginalSubmit
                X-MS-Office365-Filtering-Correlation-Idd1587449-a589-43da-f0a1-08dd130cf886
                X-Microsoft-AntispamBCL:0;ARA:13230040|366016|69100299015|8096899003|41050700001;
                X-Forefront-Antispam-ReportCIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:SA1PR15MB4465.namprd15.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(366016)(69100299015)(8096899003)(41050700001);DIR:INT;
                X-MS-Exchange-CrossTenant-OriginalArrivalTime02 Dec 2024 20:07:38.6062
                X-MS-Exchange-CrossTenant-FromEntityHeaderHosted
                X-MS-Exchange-CrossTenant-Idae77d94d-d50f-4ea7-877a-9ae2f36050b2
                X-MS-Exchange-CrossTenant-AuthSourceSA1PR15MB4465.namprd15.prod.outlook.com
                X-MS-Exchange-CrossTenant-AuthAsInternal
                X-MS-Exchange-CrossTenant-Network-Message-Idd1587449-a589-43da-f0a1-08dd130cf886
                X-MS-Exchange-CrossTenant-MailboxTypeHOSTED
                X-MS-Exchange-CrossTenant-UserPrincipalNameg/Q2GeTIAWIb2oO39xs6WfV0BRgCg6ZoR/bBBgoPPeLFLdEKKfpsw7vyd8Mu6cUYqmPdvC7L6mAIUQEcvHUA8r2SV18yOnNGWKguTQsxZH8=
                X-MS-Exchange-Transport-CrossTenantHeadersStampedSA1PR15MB4821
                X-MS-Exchange-Transport-EndToEndLatency00:00:02.1774039
                X-MS-Exchange-Processed-By-BccFoldering15.20.8207.017
                X-Microsoft-Antispam-Mailbox-Deliveryucf:0;jmr:0;auth:0;dest:I;ENG:(910001)(944506478)(944626604)(920097)(425001)(930097)(140003)(1310096);
                X-Microsoft-Antispam-Message-InfoluGMR/4pvUSUkwYIXHYEXAZe97tPXFAH43TaT4ZjOacM4XHhJYSyrekhfK2jhmFzN342BFdOBj3JCzWJ6+lobfk3fY8GKY8wxsFiYH40VuhmqppS1lO6iY9zw8Yd+rjhaD8o2YwJY28TC6Sc6lIxaCcgPCs3iyoGtsjUmU0rtlxGsvm6RoJJplE1crrwAaAIU0xBX9oMa22G8n/oSH+l5nhUt//FEDjhmusxkQhvWsl827p9bhpf7JY9g2R6TBiThtD8sVpMH6BxqeMrnMEnVqVOTFGH0L0WHMnknoiUT/EmkWNryfZ09SJ55aC84xXU/f8XYI7citiA3SNkJ06+55uLjaoRgJTAzQQOzzcpL3buGjqwro2umY/r4uDLbNWPetRP/704cdWRR6W3/Od4pUHpHXJkT517dhcvjzgOllCmQVybK2v3ac8I7mgULKqGaJkOeyJ/MFpN0xjB9JHHeG7Aumz/IAG2w6o0Uq0Tvvya+8FNozQz6T6eugbw8nv3Xa/Ti9LRZvYc4A1Ha8BR4sBXo8a2Riq08dmTrRhW2roEqEwpTezi30IJN3+FN3CODmNDV6dbx8fk0FKL3Zjp+QozFGl0ZigU16tJZ17D+tNo6EEvl1zwc7t9EmQGkmGUqt1HKaNFY3GAEckyki3MEKs3UeEPk3ckQEbR2lwxUpYBSIvtxHn/AjEe36Aej0H3/8E+FZl1Tk+PElwuzXgB/n59Hfxse+9Hv1LUXllTerPHFi6tuh8oehKbCrS48As4tNnxd6uysg7tsi7xpFD17GXQPqi41Z2MzvLGmfKIWLDVShgL8ztv8HtvxYvXrRghrJ21k0dBEqg56XQAjPbN7w==
                dateMon, 02 Dec 2024 21:07:38 +0100

                File Icon

                Icon Hash:c4e1928eacb280a2