Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
phish_alert_sp2_2.0.0.0.eml

Overview

General Information

Sample name:phish_alert_sp2_2.0.0.0.eml
Analysis ID:1573319
MD5:b8d46b9b9ba48926f24ee059fc37c0ca
SHA1:f0de81b44e638c1b697fff10353e5e7c65857310
SHA256:34bbbedbbd2c23b75edd03e24e6348eff5f15900a7a6e6f07fe13daecdf01033
Infos:

Detection

Score:48
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

AI detected landing page (webpage, office document or email)
AI detected potential phishing Email
HTML page contains hidden javascript code
Queries the volume information (name, serial number etc) of a device
Sigma detected: Office Autorun Keys Modification
Stores files to the Windows start menu directory
Stores large binary data to the registry

Classification

Process Tree

  • System is w10x64_ra
  • OUTLOOK.EXE (PID: 6716 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\user\Desktop\phish_alert_sp2_2.0.0.0.eml" MD5: 91A5292942864110ED734005B7E005C0)
    • ai.exe (PID: 6552 cmdline: "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "AEF58244-9B1B-44E7-A27D-93942C52EB64" "9384E14E-77CB-40E0-A9F2-410FB33F3705" "6716" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx" MD5: EC652BEDD90E089D9406AFED89A8A8BD)
    • chrome.exe (PID: 1764 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.dropbox.com%2Fl%2Fscl%2FAAB4V53nKLWUXmbro1xPTjAMcY4OqqHkQkg&data=05%7C02%7Cjhalterman%40olgoonik.com%7C4b46bbf1c60f4a90a8fc08dd19fe2dfc%7C341c5aad39be47a3901e146d297ecd80%7C0%7C0%7C638695303646952310%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C20000%7C%7C%7C&sdata=6jOFuqVpgTRy7%2BMrTHyHGLyMLTx9AL2hyejyw5FDTLA%3D&reserved=0 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
      • chrome.exe (PID: 6228 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2100 --field-trial-handle=2012,i,215042447886840451,14132836227163473062,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
  • cleanup

Yara Signatures

⊘No yara matches

Sigma Signatures

Sigma detected: Office Autorun Keys Modification
Source: Registry Key setAuthor: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 , EventID: 13, EventType: SetValue, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE, ProcessId: 6716, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Addins\OneNote.OutlookAddin\1

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Phishing

barindex
AI detected landing page (webpage, office document or email)
Source: EmailJoe Sandbox AI: Page contains button: 'Open file' Source: 'Email'
Source: EmailJoe Sandbox AI: Email contains prominent button: 'open file'
AI detected potential phishing Email
Source: EmailJoe Sandbox AI: Detected potential phishing email: The sender's email address (gladys.hydroturfinc@dr.com) does not match the displayed sender name (Gladys Ayala <no-reply@dropbox.com>), which is a common tactic in phishing to impersonate legitimate services.. The email contains multiple warnings about invoices and funds transfers, which are often used in phishing attempts to create urgency and prompt the recipient to act without caution.. The email includes a suspicious link with a long and complex URL, which is often used in phishing to disguise the true destination and trick users into clicking.
Source: https://www.dropbox.com/scl/fi/i5a0xhg1aq4whd5p6vhpl/HYDRO-TURF-INC-FUNDS-DSIBURSEMENT-CONTRACT.paper?dl=0&oref=e&r=ACSIKTjwrAdgtEB37FkD2IXb6HFVTrGff4C_yGA0IYcMf5D00TsEvFk-9CTWHwh4ugR7vU7gL6H2d6RnaQohW7trmLmqod_DPHgalltvwCTNab8fBXTatsTfgY6TiDypg0GSuN-106s2kIUJLTj4QORj-CZWhGTTkpDwHknyTfFb_UdfOHIoN6Z_VzxHA5rRuiqH85AI-N6T9aIjMVEVPQ_n&sm=1HTTP Parser: Base64 decoded: age_file(49058dd0203c89ee1cbdd90a453927d288810e5eprod
Source: EmailClassification: Invoice Scam
Source: unknownHTTPS traffic detected: 20.190.147.6:443 -> 192.168.2.16:49710 version: TLS 1.2
Source: unknownHTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.16:49711 version: TLS 1.2
Source: unknownHTTPS traffic detected: 20.190.147.6:443 -> 192.168.2.16:49714 version: TLS 1.2
Source: unknownHTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.16:49783 version: TLS 1.2
Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknownTCP traffic detected without corresponding DNS query: 20.190.147.6
Source: unknownTCP traffic detected without corresponding DNS query: 20.190.147.6
Source: unknownTCP traffic detected without corresponding DNS query: 20.190.147.6
Source: unknownTCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknownTCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknownTCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknownTCP traffic detected without corresponding DNS query: 20.190.147.6
Source: unknownTCP traffic detected without corresponding DNS query: 20.190.147.6
Source: unknownTCP traffic detected without corresponding DNS query: 20.190.147.6
Source: unknownTCP traffic detected without corresponding DNS query: 20.190.147.6
Source: unknownTCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknownTCP traffic detected without corresponding DNS query: 20.190.147.6
Source: unknownTCP traffic detected without corresponding DNS query: 20.190.147.6
Source: unknownTCP traffic detected without corresponding DNS query: 20.190.147.6
Source: unknownTCP traffic detected without corresponding DNS query: 20.190.147.6
Source: unknownTCP traffic detected without corresponding DNS query: 20.190.147.6
Source: unknownTCP traffic detected without corresponding DNS query: 20.190.147.6
Source: unknownTCP traffic detected without corresponding DNS query: 20.190.147.6
Source: unknownTCP traffic detected without corresponding DNS query: 20.190.147.6
Source: unknownTCP traffic detected without corresponding DNS query: 20.190.147.6
Source: unknownTCP traffic detected without corresponding DNS query: 20.190.147.6
Source: unknownTCP traffic detected without corresponding DNS query: 20.190.147.6
Source: unknownTCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknownTCP traffic detected without corresponding DNS query: 20.190.147.6
Source: unknownTCP traffic detected without corresponding DNS query: 20.190.147.6
Source: unknownTCP traffic detected without corresponding DNS query: 20.190.147.6
Source: unknownTCP traffic detected without corresponding DNS query: 20.190.147.6
Source: unknownTCP traffic detected without corresponding DNS query: 20.190.147.6
Source: unknownTCP traffic detected without corresponding DNS query: 20.190.147.6
Source: unknownTCP traffic detected without corresponding DNS query: 20.190.147.6
Source: unknownTCP traffic detected without corresponding DNS query: 20.190.147.6
Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknownTCP traffic detected without corresponding DNS query: 20.190.147.6
Source: unknownTCP traffic detected without corresponding DNS query: 20.190.147.6
Source: unknownTCP traffic detected without corresponding DNS query: 20.190.147.6
Source: unknownTCP traffic detected without corresponding DNS query: 20.190.147.6
Source: unknownTCP traffic detected without corresponding DNS query: 20.190.147.6
Source: unknownTCP traffic detected without corresponding DNS query: 20.190.147.6
Source: unknownTCP traffic detected without corresponding DNS query: 20.190.147.6
Source: unknownTCP traffic detected without corresponding DNS query: 20.190.147.6
Source: unknownTCP traffic detected without corresponding DNS query: 20.190.147.6
Source: unknownTCP traffic detected without corresponding DNS query: 20.190.147.6
Source: unknownTCP traffic detected without corresponding DNS query: 20.190.147.6
Source: global trafficDNS traffic detected: DNS query: nam04.safelinks.protection.outlook.com
Source: global trafficDNS traffic detected: DNS query: www.dropbox.com
Source: global trafficDNS traffic detected: DNS query: www.google.com
Source: global trafficDNS traffic detected: DNS query: cfl.dropboxstatic.com
Source: global trafficDNS traffic detected: DNS query: www.dropboxstatic.com
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49722
Source: unknownNetwork traffic detected: HTTP traffic on port 49710 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49721
Source: unknownNetwork traffic detected: HTTP traffic on port 49783 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49720
Source: unknownNetwork traffic detected: HTTP traffic on port 49712 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49783
Source: unknownNetwork traffic detected: HTTP traffic on port 49678 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49781
Source: unknownNetwork traffic detected: HTTP traffic on port 49725 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49746 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49781 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49720 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49722 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49714
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49712
Source: unknownNetwork traffic detected: HTTP traffic on port 49755 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49711
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49755
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49710
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49775
Source: unknownNetwork traffic detected: HTTP traffic on port 49673 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49711 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49724 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49721 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49723 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49775 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49714 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49725
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49724
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49746
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49723
Source: unknownHTTPS traffic detected: 20.190.147.6:443 -> 192.168.2.16:49710 version: TLS 1.2
Source: unknownHTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.16:49711 version: TLS 1.2
Source: unknownHTTPS traffic detected: 20.190.147.6:443 -> 192.168.2.16:49714 version: TLS 1.2
Source: unknownHTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.16:49783 version: TLS 1.2
Source: classification engineClassification label: mal48.winEML@18/17@14/166
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEFile created: C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEFile created: C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20241211T1418020180-6716.etl
Source: unknownProcess created: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\user\Desktop\phish_alert_sp2_2.0.0.0.eml"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "AEF58244-9B1B-44E7-A27D-93942C52EB64" "9384E14E-77CB-40E0-A9F2-410FB33F3705" "6716" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "AEF58244-9B1B-44E7-A27D-93942C52EB64" "9384E14E-77CB-40E0-A9F2-410FB33F3705" "6716" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.dropbox.com%2Fl%2Fscl%2FAAB4V53nKLWUXmbro1xPTjAMcY4OqqHkQkg&data=05%7C02%7Cjhalterman%40olgoonik.com%7C4b46bbf1c60f4a90a8fc08dd19fe2dfc%7C341c5aad39be47a3901e146d297ecd80%7C0%7C0%7C638695303646952310%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C20000%7C%7C%7C&sdata=6jOFuqVpgTRy7%2BMrTHyHGLyMLTx9AL2hyejyw5FDTLA%3D&reserved=0
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2100 --field-trial-handle=2012,i,215042447886840451,14132836227163473062,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.dropbox.com%2Fl%2Fscl%2FAAB4V53nKLWUXmbro1xPTjAMcY4OqqHkQkg&data=05%7C02%7Cjhalterman%40olgoonik.com%7C4b46bbf1c60f4a90a8fc08dd19fe2dfc%7C341c5aad39be47a3901e146d297ecd80%7C0%7C0%7C638695303646952310%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C20000%7C%7C%7C&sdata=6jOFuqVpgTRy7%2BMrTHyHGLyMLTx9AL2hyejyw5FDTLA%3D&reserved=0
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2100 --field-trial-handle=2012,i,215042447886840451,14132836227163473062,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: apphelp.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: c2r64.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: userenv.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: msasn1.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: cryptsp.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: rsaenh.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: cryptbase.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: gpapi.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{93E5752E-B889-47C5-8545-654EE2533C64}\InprocServer32
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEWindow found: window name: SysTabControl32
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Common
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEKey value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\outlook\ConfigContextData 1
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEFile Volume queried: C:\Windows\SysWOW64 FullSizeInformation
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information queried: ProcessInformation
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeQueries volume information: C:\Program Files (x86)\Microsoft Office\root\Office16\AI\WordCombinedFloatieLreOnline.onnx VolumeInformation
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management Instrumentation21
Browser Extensions		1
Process Injection		1
Masquerading		OS Credential Dumping1
Process Discovery		Remote ServicesData from Local System2
Encrypted Channel		Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/Job1
DLL Side-Loading		1
DLL Side-Loading		1
Modify Registry		LSASS Memory13
System Information Discovery		Remote Desktop ProtocolData from Removable Media1
Non-Application Layer Protocol		Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAt1
Registry Run Keys / Startup Folder		1
Registry Run Keys / Startup Folder		1
Process Injection		Security Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared Drive2
Application Layer Protocol		Automated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin Hook1
DLL Side-Loading		NTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput CaptureProtocol ImpersonationTraffic DuplicationData Destruction

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

⊘No Antivirus matches

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

NameIPActiveMaliciousAntivirus DetectionReputation
bg.microsoft.map.fastly.net
199.232.210.172
truefalse
    		high
    nam04.safelinks.eop-tm2.outlook.com
    		104.47.73.28
    		truefalse
      		high
      static-pdx.v.dropbox.com
      		162.125.40.3
      		truefalse
        		high
        www-env.dropbox-dns.com
        		162.125.65.18
        		truefalse
          		high
          www.google.com
          		142.250.181.68
          		truefalse
            		high
            www.dropboxstatic.com
            		unknown
            		unknownfalse
              		high
              nam04.safelinks.protection.outlook.com
              		unknown
              		unknownfalse
                		high
                www.dropbox.com
                		unknown
                		unknownfalse
                  		high
                  cfl.dropboxstatic.com
                  		unknown
                  		unknownfalse
                    		high

                    Contacted URLs

                    NameMaliciousAntivirus DetectionReputation
                    https://www.dropbox.com/scl/fi/i5a0xhg1aq4whd5p6vhpl/HYDRO-TURF-INC-FUNDS-DSIBURSEMENT-CONTRACT.paper?dl=0&oref=e&r=ACSIKTjwrAdgtEB37FkD2IXb6HFVTrGff4C_yGA0IYcMf5D00TsEvFk-9CTWHwh4ugR7vU7gL6H2d6RnaQohW7trmLmqod_DPHgalltvwCTNab8fBXTatsTfgY6TiDypg0GSuN-106s2kIUJLTj4QORj-CZWhGTTkpDwHknyTfFb_UdfOHIoN6Z_VzxHA5rRuiqH85AI-N6T9aIjMVEVPQ_n&sm=1false
                      		unknown

                      World Map of Contacted IPs

                      • No. of IPs < 25%
                      • 25% < No. of IPs < 50%
                      • 50% < No. of IPs < 75%
                      • 75% < No. of IPs

                      Public IPs

                      IPDomainCountryFlagASNASN NameMalicious
                      52.113.194.132
                      		unknownUnited States
                      		8068MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                      162.125.65.18
                      		www-env.dropbox-dns.comUnited States
                      		19679DROPBOXUSfalse
                      172.217.19.238
                      		unknownUnited States
                      		15169GOOGLEUSfalse
                      1.1.1.1
                      		unknownAustralia
                      		13335CLOUDFLARENETUSfalse
                      20.189.173.6
                      		unknownUnited States
                      		8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                      104.47.73.28
                      		nam04.safelinks.eop-tm2.outlook.comUnited States
                      		8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                      104.16.100.29
                      		unknownUnited States
                      		13335CLOUDFLARENETUSfalse
                      23.218.208.109
                      		unknownUnited States
                      		6453AS6453USfalse
                      239.255.255.250
                      		unknownReserved
                      		unknownunknownfalse
                      52.109.28.46
                      		unknownUnited States
                      		8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                      52.109.89.19
                      		unknownUnited States
                      		8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                      162.125.40.3
                      		static-pdx.v.dropbox.comUnited States
                      		19679DROPBOXUSfalse
                      142.250.181.68
                      		www.google.comUnited States
                      		15169GOOGLEUSfalse
                      2.16.238.137
                      		unknownEuropean Union
                      		20940AKAMAI-ASN1EUfalse
                      172.217.21.35
                      		unknownUnited States
                      		15169GOOGLEUSfalse
                      104.16.99.29
                      		unknownUnited States
                      		13335CLOUDFLARENETUSfalse
                      173.194.222.84
                      		unknownUnited States
                      		15169GOOGLEUSfalse

                      Private

                      IP
                      192.168.2.16

                      General Information

                      Joe Sandbox version:41.0.0 Charoite
                      Analysis ID:1573319
                      Start date and time:2024-12-11 20:17:24 +01:00
                      Joe Sandbox product:CloudBasic
                      Overall analysis duration:
                      Hypervisor based Inspection enabled:false
                      Report type:full
                      Cookbook file name:defaultwindowsinteractivecookbook.jbs
                      Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                      Number of analysed new started processes analysed:19
                      Number of new started drivers analysed:0
                      Number of existing processes analysed:0
                      Number of existing drivers analysed:0
                      Number of injected processes analysed:0
                      Technologies:
                      • EGA enabled
                      Analysis Mode:stream
                      Analysis stop reason:Timeout
                      Sample name:phish_alert_sp2_2.0.0.0.eml
                      Detection:MAL
                      Classification:mal48.winEML@18/17@14/166
                      Cookbook Comments:
                      • Found application associated with file extension: .eml

                      Warnings

                      • Exclude process from analysis (whitelisted): dllhost.exe, SgrmBroker.exe, svchost.exe
                      • Excluded IPs from analysis (whitelisted): 23.218.208.109
                      • Excluded domains from analysis (whitelisted): fs.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, e16604.g.akamaiedge.net, ctldl.windowsupdate.com, prod.fs.microsoft.com.akadns.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, wu-b-net.trafficmanager.net
                      • Not all processes where analyzed, report is missing behavior information
                      • Report size getting too big, too many NtQueryValueKey calls found.
                      • Report size getting too big, too many NtReadVirtualMemory calls found.
                      • VT rate limit hit for: phish_alert_sp2_2.0.0.0.eml

                      Created / dropped Files

                      C:\Users\user\AppData\Local\Microsoft\FORMS\FRMCACHE.DAT

                      Download File
                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                      File Type:data
                      Category:dropped
                      Size (bytes):231348
                      Entropy (8bit):4.390205259688575
                      Encrypted:false
                      SSDEEP:
                      MD5:90DC34B093DAD9E33DE3DDFD15F82B4F
                      SHA1:DFE2F7D7D9581C1D8C9746E07518782CA2CD09BF
                      SHA-256:A80245D8BBF8EFF159700EAA4DF660E9FF62B409F05DAC7761DB2A1F3982215C
                      SHA-512:A06833DB159422C0B0CE6BC7E5D6C793512ADC8550961446B7ADD37709465265C8DF3BF2830F21CCF598D8B1D664D8B841546894986C81B7C9C68E3E1CB155D8
                      Malicious:false
                      Reputation:unknown
                      Preview:TH02...... ....Y.L......SM01X...,.....Y.L..........IPM.Activity...........h...............h............H..h..o.......*...h.........O..H..h\cal ...pDat...h...0...P.o....h$.!C...........h........_`Pk...hh.!C@...I.lw...h....H...8.Uk...0....T...............d.........2h...............k..............!h.............. h...I....h.o...#h....8.........$h.O......8....."h..............'h..............1h$.!C<.........0h....4....Uk../h....h.....UkH..hx_..p.....o...-h .........o...+h..!C.....o.....3.0.2.;.2.4. ..............F7..............FIPM.Activity..5.Form..;.Standard..;.Journal Entry.5.IPM.Microsoft.FolderDesign.FormsDescription................F.k..........1122110020000000..;.Microsoft.;.This form is used to create journal entries.......5.kf...... ..........&...........(.......(... ...@.....................................................................................................................fffffffff........wwwwwwww.p....pp..............p...............pw..............pw..DDDDO..

                      C:\Users\user\AppData\Local\Microsoft\FontCache\4\Catalog\ListAll.Json

                      Download File
                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):521377
                      Entropy (8bit):4.9084889265453135
                      Encrypted:false
                      SSDEEP:
                      MD5:C37972CBD8748E2CA6DA205839B16444
                      SHA1:9834B46ACF560146DD7EE9086DB6019FBAC13B4E
                      SHA-256:D4CFBB0E8B9D3E36ECE921B9B51BD37EF1D3195A9CFA1C4586AEA200EB3434A7
                      SHA-512:02B4D134F84122B6EE9A304D79745A003E71803C354FB01BAF986BD15E3BA57BA5EF167CC444ED67B9BA5964FF5922C50E2E92A8A09862059852ECD9CEF1A900
                      Malicious:false
                      Reputation:unknown
                      Preview:{"MajorVersion":4,"MinorVersion":40,"Expiration":14,"Fonts":[{"a":[4294966911],"f":"Abadi","fam":[],"sf":[{"c":[1,0],"dn":"Abadi","fs":32696,"ful":[{"lcp":983041,"lsc":"Latn","ltx":"Abadi"}],"gn":"Abadi","id":"23643452060","p":[2,11,6,4,2,1,4,2,2,4],"sub":[],"t":"ttf","u":[2147483651,0,0,0],"v":197263,"w":26215680},{"c":[1,0],"dn":"Abadi Extra Light","fs":22180,"ful":[{"lcp":983042,"lsc":"Latn","ltx":"Abadi Extra Light"}],"gn":"Abadi Extra Light","id":"17656736728","p":[2,11,2,4,2,1,4,2,2,4],"sub":[],"t":"ttf","u":[2147483651,0,0,0],"v":197263,"w":13108480}]},{"a":[4294966911],"f":"ADLaM Display","fam":[],"sf":[{"c":[536870913,0],"dn":"ADLaM Display Regular","fs":140072,"ful":[{"lcp":983040,"lsc":"Latn","ltx":"ADLaM Display"}],"gn":"ADLaM Display","id":"31965479471","p":[2,1,0,0,0,0,0,0,0,0],"sub":[],"t":"ttf","u":[2147491951,1107296330,0,0],"v":131072,"w":26215680}]},{"a":[4294966911],"f":"Agency FB","fam":[],"sf":[{"c":[536870913,0],"dn":"Agency FB Bold","fs":54372,"ful":[{"lcp":9830

                      C:\Users\user\AppData\Local\Microsoft\FontCache\4\PreviewFont\flat_officeFontsPreview_4_40.ttf

                      Download File
                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                      File Type:TrueType Font data, 10 tables, 1st "OS/2", 7 names, Microsoft, language 0x409, \251 2018 Microsoft Corporation. All Rights Reserved.msofp_4_40RegularVersion 4.40;O365
                      Category:dropped
                      Size (bytes):773040
                      Entropy (8bit):6.55939673749297
                      Encrypted:false
                      SSDEEP:
                      MD5:4296A064B917926682E7EED650D4A745
                      SHA1:3953A6AA9100F652A6CA533C2E05895E52343718
                      SHA-256:E04E41C74D6C78213BA1588BACEE64B42C0EDECE85224C474A714F39960D8083
                      SHA-512:A25388DDCE58D9F06716C0F0BDF2AEFA7F68EBCA7171077533AF4A9BE99A08E3DCD8DFE1A278B7AA5DE65DA9F32501B4B0B0ECAB51F9AF0F12A3A8A75363FF2C
                      Malicious:false
                      Reputation:unknown
                      Preview:........... OS/29....(...`cmap.s.,.......pglyf..&....|....head2..........6hheaE.@v.......$hmtx...........@loca.U.....8...Dmaxp........... name.P+........post...<...... .........b~1_.<...........<......r......Aa...................Q....Aa....Aa.........................~...................................................3..............................MS .@.......(...Q................. ...........d...........0...J.......8.......>..........+a..#...,................................................/...K.......z...............N......*...!...-...+........z.......h..%^..3...&j..+...+%..'R..+..."....................k......$A...,.......g...&...=.......X..&........*......&....B..(B...............#.......j...............+...P...5...@...)..........#...)Q...............*...{.. ....?..'...#....N...7......<...;>.............. ]...........5......#....s.......$.......$.......^..................+...>....H.......%...7.......6.......O...V...........K......"........c...N......!...............$...&...*p..

                      C:\Users\user\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntities.bin

                      Download File
                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                      File Type:ASCII text, with very long lines (65536), with no line terminators
                      Category:dropped
                      Size (bytes):322260
                      Entropy (8bit):4.000299760592446
                      Encrypted:false
                      SSDEEP:
                      MD5:CC90D669144261B198DEAD45AA266572
                      SHA1:EF164048A8BC8BD3A015CF63E78BDAC720071305
                      SHA-256:89C701EEFF939A44F28921FD85365ECD87041935DCD0FE0BAF04957DA12C9899
                      SHA-512:16F8A8A6DCBAEAEFB88C7CFF910BCCC71B76A723CF808B810F500E28E543112C2FAE2491D4D209569BD810490EDFF564A2B084709B02963BCAF6FDF1AEEC59AC
                      Malicious:false
                      Reputation:unknown
                      Preview:51253fe60063c31af0d295afb42228b0:v2:2:1:1590:2:8479:76bd602437550e98c9043d06a55186ab7d95dea5a0e935a599f73e62a8c9b158e0afcb19351f6c353940c06a38172b94d18c02cf92bb8a80184eccca0392b259ab3e71dae73e491c7941997cb36ad4a198661f622dad478d840f66d530a0dde78acea3367f91fff62fbb3dc18faff0c708ad30edef5bea8b22c5fd782b770d8993386eaa784fd19a3c3e1db3b537b1a94d3d4fbd46f8df8fddf6d16611969fe0a97c50e0f3ac24750c93257cf5c161184aa7385800c87d803b339632a3d8ec7fe17a0afd83ce9e9d0e3f7b8d579637928a811f1f7e6d1887df2ddc7d4f752c4d600235e426c92c7bf8a1362f95457998cc0e5d4261f0efa4fada0f866dbcefb407dacab7a2914e91c2f08200f38c2d9d621962145b1464b0f204b326118a53ecdcab22bff005fdd5257c99a6dc51ac0600a49f2ef782396987e78c08b846dad5db55e8ccefffc64863bc2c3e90b95a09d25d0814a848c98fe01a82d4e30e6682dd546e12c45ca0d280a45295ab4bd632dafb070edfdc3c9e38313d5aeb195972986f8011b66817028fd8c78b67a0ac7e780eecc3fb6a31f5a025b8a9a3db278a98c0696aeaac739b18688b0f9c7d751bba02cc5f4e41853fb119b3c0c915059aaa92971244a1989124f12881ca88e6410df70b793a2c3a736ff4

                      C:\Users\user\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntitiesUpdated.bin

                      Download File
                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                      File Type:ASCII text, with no line terminators
                      Category:modified
                      Size (bytes):10
                      Entropy (8bit):2.7219280948873625
                      Encrypted:false
                      SSDEEP:
                      MD5:F803693D78B0D6F5846A00DAB426B85F
                      SHA1:D19220805FA9DC65E8D3A4FD552A34635DDE8241
                      SHA-256:AC36BD56206F31AB02A276539309B9EA853E0F3C9C5DF2DB24BC79279E205ADE
                      SHA-512:157F9F0A709E7DBB55E6B4EE226AE7215E87F87DA726B4CF02673AA72BE5E1731648AC2AB2D62F06EC7DD24A98F11734E582D2BA0D9C03038E69227C52175EE4
                      Malicious:false
                      Reputation:unknown
                      Preview:1733944689

                      C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\6E56B99A-ABDE-4649-8352-C0E616D5858B

                      Download File
                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                      File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                      Category:dropped
                      Size (bytes):181859
                      Entropy (8bit):5.295306253411843
                      Encrypted:false
                      SSDEEP:
                      MD5:B416CD4535A02D8874E524E1695C6CCE
                      SHA1:CC8EF84D6CFBED70DD038EA394EB3B1DEF87D36F
                      SHA-256:7D89DED92CF0E56E90A88571BB4AB03C8943C9BCD76D5D16E8DB06FAA809E8EF
                      SHA-512:37AF1665338E1323930293811458D5DACF66E1E23CC1AFC480E1E1970D22D7FE785BBF53296C94C45F7178DDAE881A500ECCF8D109F029377FFF4F657EE88E21
                      Malicious:false
                      Reputation:unknown
                      Preview:<?xml version="1.0" encoding="utf-8"?>..<o:OfficeConfig xmlns:o="urn:schemas-microsoft-com:office:office">.. <o:services o:GenerationTime="2024-12-11T19:18:05">.. Build: 16.0.18312.40138-->.. <o:default>.. <o:ticket o:headerName="Authorization" o:headerValue="{}" />.. </o:default>.. <o:service o:name="Research">.. <o:url>https://word-edit.officeapps.live.com/we/rrdiscovery.ashx</o:url>.. </o:service>.. <o:service o:name="ORedir">.. <o:url>https://o15.officeredir.microsoft.com/r</o:url>.. </o:service>.. <o:service o:name="ORedirSSL">.. <o:url>https://o15.officeredir.microsoft.com/r</o:url>.. </o:service>.. <o:service o:name="ClViewClientHelpId" o:authentication="1">.. <o:url>https://[MAX.BaseHost]/client/results</o:url>.. <o:ticket o:policy="MBI_SSL_SHORT" o:idprovider="1" o:target="[MAX.AuthHost]" o:headerValue="Passport1.4 from-PP='{}&amp;p='" />.. <o:ticket o:idprovider="3" o:headerValue="Bearer {}" o:resourceId="[

                      C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-journal

                      Download File
                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                      File Type:SQLite Rollback Journal
                      Category:dropped
                      Size (bytes):4616
                      Entropy (8bit):0.13760166725504608
                      Encrypted:false
                      SSDEEP:
                      MD5:F24D7AF19A2144B937D6BE54FEFFD97B
                      SHA1:70FC0F80EE2A27F1D1FBDEE7075BBBE2C36AAB95
                      SHA-256:58459CDF150ADB29AFD2D149F7F4C67F0FB19BDAA5D6A5C8C2A5C79B4DF2F68B
                      SHA-512:666BD8C432127D39C6BEF778D58268BEE367AFD6DF23DBE0DBCF7A0F6796F9465A24E1230ADB741BF4BD6FE8EF548F71D73CBA4681F2116D4332139600940A55
                      Malicious:false
                      Reputation:unknown
                      Preview:.... .c........=....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................SQLite format 3......@ .......................................................................... .................................................................................................................................................................................................................................................................................................................................................................................................

                      C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres

                      Download File
                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                      File Type:data
                      Category:dropped
                      Size (bytes):2278
                      Entropy (8bit):3.8303471012491546
                      Encrypted:false
                      SSDEEP:
                      MD5:75F18548126D025D6838BF13DF358676
                      SHA1:535223A0181D3C5553D35384293D0DFD19DC5DE9
                      SHA-256:3133AECFDA86E2741B83D75A6D1F44CEEF1EACA7DFAF26F585C55B6FEC834FAB
                      SHA-512:37D93827AC1F0E7C5C36B9D0B45E1A60829E30C553B3E15C1EBC33601FD506CE6C95D47882DD435482511582A7DEA583C2891E0820A06BD2D196D13ACF55C235
                      Malicious:false
                      Reputation:unknown
                      Preview:{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".C.J.1.m.u.g.S.o.z.s.S.9.x.S.Z./.Q.v.O.c.+.E.J.4.u.2.c.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.B.O.0.y.Q.l.M.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.4.z.O.x.Z.x.

                      C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5475cb191e478c39370a215b2da98a37e9dc813d.tbres

                      Download File
                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                      File Type:data
                      Category:dropped
                      Size (bytes):2684
                      Entropy (8bit):3.9063665238783853
                      Encrypted:false
                      SSDEEP:
                      MD5:9905216190073FF13FB13A493B6787DD
                      SHA1:6C402EA7D357CB61B47D5E08157AA5FCF4210231
                      SHA-256:B2F4769A8F2E1E77B5CBB91EA77C88AF46EFFC2CAE17F9BD990F1E9064E25513
                      SHA-512:9283C0F1C4CAF1004F8F6F773E89CC6CBE35572B0FA2E0A8A1D372453494D0F4B4F3011AA1A14B5EE07D8B5C6E5AB9E2F6B650AD24964D74ED580881439CFD17
                      Malicious:false
                      Reputation:unknown
                      Preview:{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".V.H.X.L.G.R.5.H.j.D.k.3.C.i.F.b.L.a.m.K.N.+.n.c.g.T.0.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".u.S.A.r.4.d.J.q.3.A.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.4.z.O.x.Z.x.

                      C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\56a61aeb75d8f5be186c26607f4bb213abe7c5ec.tbres

                      Download File
                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                      File Type:data
                      Category:dropped
                      Size (bytes):4542
                      Entropy (8bit):4.002078617993039
                      Encrypted:false
                      SSDEEP:
                      MD5:D7714CE9339253E78FD8C6A470FE4D74
                      SHA1:F8C7ED59E24F24358BA1A2696AD33A6C528D56C3
                      SHA-256:519BC44803F5CCF1E3F1630665F40FBD90C83772E07F98B4974F3F8C01DD7FB4
                      SHA-512:6FA59974F6CD0516DC66E8E5E0C392CBDE1A6AC1A3AD5EBF27A02F8AF9B6096A5C0826EBB23B42C98C5411D05577287A1B5EC79361DC44478A271F59D45C0A17
                      Malicious:false
                      Reputation:unknown
                      Preview:{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".V.q.Y.a.6.3.X.Y.9.b.4.Y.b.C.Z.g.f.0.u.y.E.6.v.n.x.e.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".q.S.O.w.r.w.F.M.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.4.z.O.x.Z.x.

                      C:\Users\user\AppData\Roaming\Microsoft\Office\MSO3072.acl

                      Download File
                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                      File Type:data
                      Category:dropped
                      Size (bytes):30
                      Entropy (8bit):1.2389205950315936
                      Encrypted:false
                      SSDEEP:
                      MD5:EC0F916CE59AA4219091C5FDFDBC2841
                      SHA1:97C6CD916FD8C19FFFED02AF5D819FDFDDA71494
                      SHA-256:1AC106D9B8C6AE840EB421FD839A3CDDB91E5628EA8FFD669E64E81FD6513D1C
                      SHA-512:8D9013B4256A40239C22B5F65C3D0570B487D66929AA62CD855D1824E7B2539F011F9AAD22452728BE173F97916E5DA662405B16335260DC771CEC82E5CD6DF3
                      Malicious:false
                      Reputation:unknown
                      Preview:..............................

                      C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

                      Download File
                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                      File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Dec 11 18:18:17 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                      Category:dropped
                      Size (bytes):2673
                      Entropy (8bit):3.985843694107027
                      Encrypted:false
                      SSDEEP:
                      MD5:24637A7EB113A77F3D134D098D047A0A
                      SHA1:B8B43C629570FDD3C6291CD6D7DEC48BA2383B3A
                      SHA-256:9E6B6C3F1A117E2552882BCA9D50A78DD9A80BF038C6FE09BC6EE01EF868EEC5
                      SHA-512:1873FDD2466E3971F2846D9E02EEE24FF1A99095F53D22A7C0B861221E6C6E4CA7553BC6DCC844A071E179F445BDF86EF93FC8080CA72CFD8A5F4CB345F96598
                      Malicious:false
                      Reputation:unknown
                      Preview:L..................F.@.. ...$+.,....ZJ.n.L..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.Y4.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.YH.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.YH.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.YH............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.YI............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........@........C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                      C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

                      Download File
                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                      File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Dec 11 18:18:17 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                      Category:dropped
                      Size (bytes):2675
                      Entropy (8bit):4.000646254370492
                      Encrypted:false
                      SSDEEP:
                      MD5:3BE710A92C9E547CBAFF26ED7578A5FE
                      SHA1:4680986BBF7FC3A1256EE49A489411896AF19E76
                      SHA-256:EF00812EDE5B5A800218B2F3ADEAC418141ECBC3B59F11BA441C5EB4D04A9760
                      SHA-512:5A61BF1A4A48DB05C337FD7A2ABD1F64071056027FB65518DCE6188E85000EA8D764E52FC97F59FF621EB8DA5AC15A36513860763BF8C147B1BE406D8069936A
                      Malicious:false
                      Reputation:unknown
                      Preview:L..................F.@.. ...$+.,....+..n.L..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.Y4.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.YH.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.YH.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.YH............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.YI............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........@........C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                      C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

                      Download File
                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                      File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                      Category:dropped
                      Size (bytes):2689
                      Entropy (8bit):4.011512619228379
                      Encrypted:false
                      SSDEEP:
                      MD5:FB4187D9B79C089F0EAA99E932620FF2
                      SHA1:999B70B02ECCB0839747CF4BE2ACEEF7CD92D8CF
                      SHA-256:B80D44E88C6F0FC03EB749FA257E83FF69363E2C85202A20392F7AA3BE4AC57F
                      SHA-512:D1A5E153F20557325A04D674489E1AD19E677B8B228E021F8A2F8AF6C21F9CC2F8236C7B17DDF8F01CCD3EFA639537C8B2C3B6DA3E6989F9895F172FCB73E44D
                      Malicious:false
                      Reputation:unknown
                      Preview:L..................F.@.. ...$+.,.....Y.04...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.Y4.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.YH.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.YH.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.YH............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VFW.E...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........@........C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                      C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

                      Download File
                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                      File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Dec 11 18:18:17 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                      Category:dropped
                      Size (bytes):2677
                      Entropy (8bit):3.9998819930487137
                      Encrypted:false
                      SSDEEP:
                      MD5:34D3E21731732566536AFA4E45C3496A
                      SHA1:BB6015C5014E85A627E501930850BB2ADA5C7C37
                      SHA-256:92CE4E611A3B02E930D3016163AF12A1FDC6BECA65E25350B2C8DB8D11297F20
                      SHA-512:0B10FE3DC25FDF6B586AE7B9AE688B98AF017593733A7076B5910708033EFC03287680F50EB50DA2111D7C2291AB828949695D0893F935A59F1FF5793BC200AF
                      Malicious:false
                      Reputation:unknown
                      Preview:L..................F.@.. ...$+.,......n.L..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.Y4.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.YH.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.YH.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.YH............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.YI............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........@........C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                      C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

                      Download File
                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                      File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Dec 11 18:18:17 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                      Category:dropped
                      Size (bytes):2677
                      Entropy (8bit):3.987300816375717
                      Encrypted:false
                      SSDEEP:
                      MD5:BCF7D9DDEBB493DDFF13F3E0E8C55B96
                      SHA1:6E1E94DCB4DB87E5BF6BC4D6C52A1E087FBF38BE
                      SHA-256:CD411D877F434F04E6C6ECDECB8949784008CBB1897228B6BA697200FF60304A
                      SHA-512:85A14619F48F539596F7DB2CB365653512959AC1B7D56124E6EFE2BC46E35351C78A1EFF8D47D984FF142E4AA668A8D49DF6E40726FC34220EBD73FB82BB1D23
                      Malicious:false
                      Reputation:unknown
                      Preview:L..................F.@.. ...$+.,....w".n.L..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.Y4.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.YH.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.YH.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.YH............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.YI............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........@........C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                      C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

                      Download File
                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                      File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Dec 11 18:18:17 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                      Category:dropped
                      Size (bytes):2679
                      Entropy (8bit):3.996364479814644
                      Encrypted:false
                      SSDEEP:
                      MD5:F0308865802F89481DF25D422E416113
                      SHA1:7CE772322380FD90EF09AF6AE08092FAE204169F
                      SHA-256:F039DAD4CA7C9265F715385CD5B74523E7DC216BF29E43F8E53A7DE9C027F163
                      SHA-512:4FC83E42BD904AAAC0A03096CD02938B548562466BF0C8BA2E4B39AFA7DB6DEA736704F864F82153D28FA00C233968A4E961FDF0B46D14831E16ABE595C834DE
                      Malicious:false
                      Reputation:unknown
                      Preview:L..................F.@.. ...$+.,......n.L..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.Y4.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.YH.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.YH.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.YH............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.YI............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........@........C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                      Static File Info

                      General

                      File type:RFC 822 mail, ASCII text, with very long lines (2393), with CRLF line terminators
                      Entropy (8bit):5.996350491528287
                      TrID:
                      • E-Mail message (Var. 5) (54515/1) 100.00%
                      File name:phish_alert_sp2_2.0.0.0.eml
                      File size:19'314 bytes
                      MD5:b8d46b9b9ba48926f24ee059fc37c0ca
                      SHA1:f0de81b44e638c1b697fff10353e5e7c65857310
                      SHA256:34bbbedbbd2c23b75edd03e24e6348eff5f15900a7a6e6f07fe13daecdf01033
                      SHA512:827d9cbeb39c96b7e9cdfb708dc09d04721afaedf67ca88c5a7d388e8fee0e87cd8003098afbfdde7b135572116dbe132817af9a12ee6ccc9628d1951d65765c
                      SSDEEP:384:G0EMB9pienMxZWJcyjb5aJIw+Jc15FGu+1:G0EMTpienqZzy5LJc15FGu8
                      TLSH:B6825C41A32900C925BA27CDB2127746B2E20D4DCBD795F17DBE9A644FCF8640B2670E
                      File Content Preview:Received: from PH7PR08MB8256.namprd08.prod.outlook.com.. (2603:10b6:510:157::20) by BYAPR08MB5862.namprd08.prod.outlook.com with.. HTTPS; Wed, 11 Dec 2024 16:12:44 +0000..Received: from BN9PR03CA0742.namprd03.prod.outlook.com.. (2603:10b6:408:110::27) by

                      Static Mail

                      General

                      Subject:[EXTERNAL] Gladys Ayala shared "HYDRO TURF INC FUNDS DSIBURSEMENT CONTRACT.paper" with you
                      From:Gladys Ayala <no-reply@dropbox.com>
                      To:JoAnn Halterman <jhalterman@olgoonik.com>
                      Cc:
                      BCC:
                      Date:Wed, 11 Dec 2024 16:09:23 +0000
                      Communications:
                      • CAUTION: This email contains references to an invoice, statement, or funds transfer. Please use caution before opening any attachments, clicking any links, or following instructions below. Do not sign-in with your corporate account. Please report email as phishing if in doubt.Warning Code: [INV1] Gladys Ayala (gladys.hydroturfinc@dr.com) invited you to view the file "HYDRO TURF INC FUNDS DSIBURSEMENT CONTRACT.paper" on Dropbox.Open fileDo more with your filesget the desktop and mobile apps. Dropbox for MobileDropbox for Desktop Is there an issue? Report to Dropbox @font-face { font-family: "proxima_nova"; src: url("https://www.dropbox.com/static/fonts/proximanova/proxima-nova-regular.otf") format("opentype"); font-weight: normal; font-style: normal; } @font-face { font-family: "atlas_grotesk"; src: url("https://www.dropbox.com/static/fonts/atlasgrotesk/AtlasGrotesk-Regular.otf") format("opentype"); font-weight: normal; font-style: normal; } @font-face { font-family: "sharp_grotesk_db"; src: url("https://www.dropbox.com/static/fonts/sharpgrotesk/SharpGroteskDBMedium22.woff") format("woff"); font-weight: normal; font-style: normal; } a { color: #007ee6; text-decoration: none; } CAUTION: This email contains references to an invoice, statement, or funds transfer. Please use caution before opening any attachments, clicking any links, or following instructions below. Do not sign-in with your corporate account. Please report email as phishing if in doubt.Warning Code: [INV1] Gladys Ayala (gladys.hydroturfinc@dr.com) invited you to view the file "HYDRO TURF INC FUNDS DSIBURSEMENT CONTRACT.paper" on Dropbox.Open fileDo more with your filesget the desktop and mobile apps. Dropbox for MobileDropbox for Desktop Is there an issue? Report to Dropbox CAUTION: This email contains references to an invoice, statement, or funds transfer. Please use caution before opening any attachments, clicking any links, or following instructions below. Do not sign-in with your corporate account. Please report email as phishing if in doubt.Warning Code: [INV1] CAUTION: Gladys Ayala (gladys.hydroturfinc@dr.com) invited you to view the file "HYDRO TURF INC FUNDS DSIBURSEMENT CONTRACT.paper" on Dropbox.Open fileDo more with your filesget the desktop and mobile apps. Dropbox for MobileDropbox for Desktop Is there an issue? Report to Dropbox Gladys Ayala (gladys.hydroturfinc@dr.com) invited you to view the file "HYDRO TURF INC FUNDS DSIBURSEMENT CONTRACT.paper" on Dropbox.Open fileDo more with your filesget the desktop and mobile apps. Dropbox for MobileDropbox for Desktop Is there an issue? Report to Dropbox Gladys Ayala (gladys.hydroturfinc@dr.com) invited you to view the file "HYDRO TURF INC FUNDS DSIBURSEMENT CONTRACT.paper" on Dropbox.Open fileDo more with your filesget the desktop and mobile apps. Dropbox for MobileDropbox for Desktop Is there an issue? Report to Dropbox Gladys Ayala (gladys.hydroturfinc@dr.com) invited you to view the file "HYDRO TURF INC FUNDS DSIBURSEMENT CONTRACT.paper" on Dropbox.Open fileDo more with your filesget the desktop and mobile apps. Dropbox for MobileDropbox for Desktop Is there an issue? Report to Dropbox Gladys Ayala (gladys.hydroturfinc@dr.com) invited you to view the file "HYDRO TURF INC FUNDS DSIBURSEMENT CONTRACT.paper" on Dropbox.Open fileDo more with your filesget the desktop and mobile apps. Dropbox for MobileDropbox for Desktop Is there an issue? Report to Dropbox Gladys Ayala (gladys.hydroturfinc@dr.com) invited you to view the file "HYDRO TURF INC FUNDS DSIBURSEMENT CONTRACT.paper" on Dropbox.Open fileDo more with your filesget the desktop and mobile apps. Dropbox for MobileDropbox for Desktop Is there an issue? Report to Dropbox Gladys Ayala (gladys.hydroturfinc@dr.com) invited you to view the file "HYDRO TURF INC FUNDS DSIBURSEMENT CONTRACT.paper" on Dropbox.Open fileDo more with your filesget the desktop and mobile apps. Dropbox for MobileDropbox for Desktop Gladys Ayala (gladys.hydroturfinc@dr.com) invited you to view the file "HYDRO TURF INC FUNDS DSIBURSEMENT CONTRACT.paper" on Dropbox.Open fileDo more with your filesget the desktop and mobile apps. Dropbox for MobileDropbox for Desktop Gladys Ayala (gladys.hydroturfinc@dr.com) invited you to view the file "HYDRO TURF INC FUNDS DSIBURSEMENT CONTRACT.paper" on Dropbox.Open fileDo more with your filesget the desktop and mobile apps. Dropbox for MobileDropbox for Desktop Gladys Ayala (gladys.hydroturfinc@dr.com) invited you to view the file "HYDRO TURF INC FUNDS DSIBURSEMENT CONTRACT.paper" on Dropbox.Open fileDo more with your filesget the desktop and mobile apps. Dropbox for MobileDropbox for Desktop Gladys Ayala (gladys.hydroturfinc@dr.com) invited you to view the file "HYDRO TURF INC FUNDS DSIBURSEMENT CONTRACT.paper" on Dropbox.Open fileDo more with your filesget the desktop and mobile apps. Dropbox for MobileDropbox for Desktop Gladys Ayala (gladys.hydroturfinc@dr.com) invited you to view the file "HYDRO TURF INC FUNDS DSIBURSEMENT CONTRACT.paper" on Dropbox.Open fileDo more with your filesget the desktop and mobile apps. Dropbox for MobileDropbox for Desktop Gladys Ayala (gladys.hydroturfinc@dr.com) invited you to view the file "HYDRO TURF INC FUNDS DSIBURSEMENT CONTRACT.paper" on Dropbox.Open fileDo more with your filesget the desktop and mobile apps. Dropbox for MobileDropbox for Desktop Gladys Ayala (gladys.hydroturfinc@dr.com) invited you to view the file "HYDRO TURF INC FUNDS DSIBURSEMENT CONTRACT.paper" on Dropbox.Open fileDo more with your filesget the desktop and mobile apps. Dropbox for MobileDropbox for Desktop Gladys Ayala (gladys.hydroturfinc@dr.com) invited you to view the file "HYDRO TURF INC FUNDS DSIBURSEMENT CONTRACT.paper" on Dropbox.Open fileDo more with your filesget the desktop and mobile apps. Dropbox for MobileDropbox for Desktop Gladys Ayala (gladys.hydroturfinc@dr.com) invited you to view the file "HYDRO TURF INC FUNDS DSIBURSEMENT CONTRACT.paper" on Dropbox.Open file Gladys Ayala (gladys.hydroturfinc@dr.com) invited you to view the file "HYDRO TURF INC FUNDS DSIBURSEMENT CONTRACT.paper" on Dropbox. Gladys Ayala (gladys.hydroturfinc@dr.com) invited you to view the file "HYDRO TURF INC FUNDS DSIBURSEMENT CONTRACT.paper" on Dropbox. HYDRO TURF INC FUNDS DSIBURSEMENT CONTRACT.paper Open file Open file https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.dropbox.com%2Fl%2Fscl%2FAAB4V53nKLWUXmbro1xPTjAMcY4OqqHkQkg&data=05%7C02%7Cjhalterman%40olgoonik.com%7C4b46bbf1c60f4a90a8fc08dd19fe2dfc%7C341c5aad39be47a3901e146d297ecd80%7C0%7C0%7C638695303646952310%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C20000%7C%7C%7C&sdata=6jOFuqVpgTRy7%2BMrTHyHGLyMLTx9AL2hyejyw5FDTLA%3D&reserved=0 Open file {"@context": "http://schema.org", "@type": "EmailMessage", "description": null, "action": {"name": "Open file", "url": "https&#58;&#47;&#47;www.dropbox.com&#47;scl&#47;fi&#47;i5a0xhg1aq4whd5p6vhpl&#47;HYDRO-TURF-INC-FUNDS-DSIBURSEMENT-CONTRACT.paper&#63;r&#61;ACSIKTjwrAdgtEB37FkD2IXb6HFVTrGff4C_yGA0IYcMf5D00TsEvFk-9CTWHwh4ugR7vU7gL6H2d6RnaQohW7trmLmqod_DPHgalltvwCTNab8fBXTatsTfgY6TiDypg0GSuN-106s2kIUJLTj4QORj-CZWhGTTkpDwHknyTfFb_UdfOHIoN6Z_VzxHA5rRuiqH85AI-N6T9aIjMVEVPQ_n&#38;sm&#61;1&#38;dl&#61;0", "@type": "ViewAction"}} Do more with your filesget the desktop and mobile apps. Dropbox for MobileDropbox for Desktop Dropbox for Mobile https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.dropbox.com%2Fl%2FAABC5iDizuUreJnxgCO78ysq2cktSdlWPZ0%2Fmobile&data=05%7C02%7Cjhalterman%40olgoonik.com%7C4b46bbf1c60f4a90a8fc08dd19fe2dfc%7C341c5aad39be47a3901e146d297ecd80%7C0%7C0%7C638695303646974916%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C20000%7C%7C%7C&sdata=B%2ByUHfy%2BI78X2uBw0K705gngackp%2B32%2BjE%2FK2KHFq4k%3D&reserved=0 Dropbox for Mobile Dropbox for Desktop https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.dropbox.com%2Fl%2FAAAL8_2PXm_2nN5YG4BtoGPIT8BQis7JlXM%2Finstall&data=05%7C02%7Cjhalterman%40olgoonik.com%7C4b46bbf1c60f4a90a8fc08dd19fe2dfc%7C341c5aad39be47a3901e146d297ecd80%7C0%7C0%7C638695303646995864%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C20000%7C%7C%7C&sdata=9yV%2FoYAtzW2k4pQcVmBsxu0tTZ2RfyTRn7eBHrD2Owc%3D&reserved=0 Dropbox for Desktop Is there an issue? Report to Dropbox Is there an issue? Report to Dropbox Is there an issue? Report to Dropbox Is there an issue? Report to Dropbox Is there an issue? Report to Dropbox Is there an issue? Report to Dropbox Is there an issue? Report to Dropbox Is there an issue? Report to Dropbox Is there an issue? Report to Dropbox https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.dropbox.com%2Fl%2FAAAFRLiv0j14RrNH08fqIs_6DCda7y0bMxI%2Freport_abuse&data=05%7C02%7Cjhalterman%40olgoonik.com%7C4b46bbf1c60f4a90a8fc08dd19fe2dfc%7C341c5aad39be47a3901e146d297ecd80%7C0%7C0%7C638695303647019998%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C20000%7C%7C%7C&sdata=q6M4FYU2C90iDANB6wSRzmljbwIFqS%2FVF%2Bs9yY%2FhM5U%3D&reserved=0
                      Attachments:

                        Headers

                        Key Value
                        Receivedfrom a39-213.smtp-out.amazonses.com (54.240.39.213) by BL6PEPF0001AB75.mail.protection.outlook.com (10.167.242.168) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.20.8251.15 via Frontend Transport; Wed, 11 Dec 2024 16:09:23 +0000
                        Authentication-Resultsspf=pass (sender IP is 54.240.39.213) smtp.mailfrom=email.dropbox.com; dkim=pass (signature was verified) header.d=dropbox.com;dkim=pass (signature was verified) header.d=amazonses.com;dmarc=pass action=none header.from=dropbox.com;compauth=pass reason=100
                        Received-SpfPass (protection.outlook.com: domain of email.dropbox.com designates 54.240.39.213 as permitted sender) receiver=protection.outlook.com; client-ip=54.240.39.213; helo=a39-213.smtp-out.amazonses.com; pr=C
                        Dkim-Signaturev=1; a=rsa-sha256; q=dns/txt; c=relaxed/simple; s=ug7nbtf4gccmlpwj322ax3p6ow6yfsug; d=amazonses.com; t=1733933363; h=Content-Type:MIME-Version:From:To:CC:Subject:Date:Message-ID:Reply-To:Feedback-ID; bh=fNePO5A6qhdef2ItBQmU4lhu3+it0ofcn+6uocrtWjs=; b=ikxwsImwAoRIMi37Ik/WIZhprVRbPkwXlLmK34PZtpuPUITpJq3HokF1Jmppm4Zq y77Q5+BhxKTA2A4haqDtu+idAO6YLX350+3weHVnN+GyfA++X09oG0Wq7D8/pWRC7d7 qpxyM4rLIHxDP9xbxQwnMXT+SurDlOBUp2yXfpak=
                        Content-Typemultipart/mixed; boundary="----sinikael-?=_1-17339433529770.40642531881553195"
                        MIME-Version1.0
                        FromGladys Ayala <no-reply@dropbox.com>
                        ToJoAnn Halterman <jhalterman@olgoonik.com>
                        Subject[EXTERNAL] Gladys Ayala shared "HYDRO TURF INC FUNDS DSIBURSEMENT CONTRACT.paper" with you
                        DateWed, 11 Dec 2024 16:09:23 +0000
                        Message-Id <01000193b67b70f0-27275f76-6e34-4045-afff-80bcd2764da4-000000@email.amazonses.com>
                        X-Dropbox-Message-Id739335148427663718
                        Reply-Togladys.hydroturfinc@dr.com
                        X-Cid20004268
                        Feedback-Id 20004268::1.us-east-1.syWQ1+fF8Wo1tY8y/+s85ptiAKu7bILK6PHyxwpB+xo=:AmazonSES
                        X-Ses-Outgoing2024.12.11-54.240.39.213
                        Return-Path 01000193b67b70f0-27275f76-6e34-4045-afff-80bcd2764da4-000000@email.dropbox.com
                        X-Ms-Exchange-Organization-Expirationstarttime11 Dec 2024 16:09:24.0399 (UTC)
                        X-Ms-Exchange-Organization-ExpirationstarttimereasonOriginalSubmit
                        X-Ms-Exchange-Organization-Expirationinterval1:00:00:00.0000000
                        X-Ms-Exchange-Organization-ExpirationintervalreasonOriginalSubmit
                        X-Ms-Exchange-Organization-Network-Message-Id 4b46bbf1-c60f-4a90-a8fc-08dd19fe2dfc
                        X-Eopattributedmessage0
                        X-Eoptenantattributedmessage341c5aad-39be-47a3-901e-146d297ecd80:0
                        X-Ms-Exchange-Organization-MessagedirectionalityIncoming
                        X-Ms-PublictraffictypeEmail
                        X-Ms-Traffictypediagnostic BL6PEPF0001AB75:EE_|PH7PR08MB8256:EE_|BYAPR08MB5862:EE_
                        X-Ms-Exchange-Organization-Authsource BL6PEPF0001AB75.namprd02.prod.outlook.com
                        X-Ms-Exchange-Organization-AuthasAnonymous
                        X-Ms-Office365-Filtering-Correlation-Id 4b46bbf1-c60f-4a90-a8fc-08dd19fe2dfc
                        X-Ms-Exchange-AtpmessagepropertiesSA|SL
                        X-Ms-Exchange-Organization-Scl-1
                        X-Microsoft-Antispam BCL:4;ARA:13230040|1032899013|5073199012|5082899009|13102899012|13012899012|5062899012|2092899012|32142699015|4092899012|3092899012|3072899012|6062899009|12012899012|4123199012|69100299015|5063199012|2066899003|8096899003|43540500003;
                        X-Forefront-Antispam-Report CIP:54.240.39.213;CTRY:US;LANG:en;SCL:-1;SRV:;IPV:NLI;SFV:SKA;H:a39-213.smtp-out.amazonses.com;PTR:a39-213.smtp-out.amazonses.com;CAT:NONE;SFS:(13230040)(1032899013)(5073199012)(5082899009)(13102899012)(13012899012)(5062899012)(2092899012)(32142699015)(4092899012)(3092899012)(3072899012)(6062899009)(12012899012)(4123199012)(69100299015)(5063199012)(2066899003)(8096899003)(43540500003);DIR:INB;
                        X-Ms-Exchange-Crosstenant-Originalarrivaltime11 Dec 2024 16:09:23.8992 (UTC)
                        X-Ms-Exchange-Crosstenant-Network-Message-Id 4b46bbf1-c60f-4a90-a8fc-08dd19fe2dfc
                        X-Ms-Exchange-Crosstenant-Id341c5aad-39be-47a3-901e-146d297ecd80
                        X-Ms-Exchange-Crosstenant-Authsource BL6PEPF0001AB75.namprd02.prod.outlook.com
                        X-Ms-Exchange-Crosstenant-AuthasAnonymous
                        X-Ms-Exchange-Crosstenant-FromentityheaderInternet
                        X-Ms-Exchange-Transport-CrosstenantheadersstampedPH7PR08MB8256
                        X-Ms-Exchange-Transport-Endtoendlatency00:03:20.6551549
                        X-Ms-Exchange-Processed-By-Bccfoldering15.20.8182.018
                        X-Microsoft-Antispam-Mailbox-Delivery ucf:0;jmr:0;auth:0;dest:I;ENG:(910001)(944506478)(944626604)(920097)(930097)(140003)(1420198);
                        X-Microsoft-Antispam-Message-Info A69/TY9YkesAxfE497TJf/8S0O7uO5Y9p5ONbVah940ygTN7UnQj1OeAh5AEBdc+q3PbkqWvKxdvnCXmzNxA7q8gzsay7IgI8O+cqEtp4Tlhfc/ra7PFBdLyziW7Y+wFm3RBdnGGoCT+kvRjKBvJ2yrbuhcRYBd+K4XUyRXQVd/sfsG191M3+2fHJCYpKytk3dKomUIHkuQ/JYkXfAjfCmEzlH049OHLxbWkccyjJH9IwHZYLvuKu2F20ybnpJL61Gp4y0qvb7NFGwQmlLLTD7W0wdxRlFEH3JeoJaIkZDhwm/Y783Mob1uE1vkKZB8eoY70oCe+PgsxFYt+2Pf3hU4/XbqSIG03ELzZcpHyddyHxTyLH/LEkaf9Xzucud1bgRKLz9ricB2tjJAro8oNz6SvAYC3rzsbcAaywGL5VE6XU2YHfr8OoUbp8tuqISIjUazEcSoSlahciZtwjnqxZ6zTVW7ykxSnspZUM1vPnRvTY+an1hBwBmRmfTWSpdEvLi/D32FgZFpPQF97OD12EFvlHx627cPTBCln/kb5tduxPlQwrAfSKYXHqd0bASJS5A2aNsfaZOFseFI8Xis5UCEObcVA5a5QeB2lceEmpHlMXVNvaDoAaYbEQnjAGFTgY1agEb99NwuliAav3/pr9IaGO6Gc6aP79K79VPGUJAJpDoye1SBo9NuAINm9cODMZ47f7TRcaG8PAGhv4C6yr9eU+4jj8tKjgTUrOx0gkXihMnTD8mYa8/QIFuW3wuo8SiOcm8iyx4HEsNe8ljLgmDNz96hVfILXrCwh0bc0RErgnCJ4y9kYGBBPauDLw1EsKoBjKIwSoAp7XMADDH3/znr5Dax+HWdhZXul77+HgHRMTBFSdLcM3Uw+vsUeHiO1i3Umn5G8Th+jk1Y6Gwuc8P9KJ3s9DEDwZ16XxpC8XLBAm7UdK4W9CJ7eeuehBEb0t1eEKttCt8M66YlZIfk3JSjPPptlpiEL19EMLp5swrmElH1Ptf4upAzHdP25E4GwOY58d2wODxudrBpYkn61VGfvvgQs0bj7P+PtpuJnhB4aRnv65qTlnnnYMMKWxbvOGCBVGW+3HzAEJqwPaeLXSRDriDUz0n+JYyT4O7iH+QQDU680krADbcDANMtjUydBr0zH/3MiGgyqR56NYFP02iq6sEZtiM/3xxLCVncNOpcMTxxyRQlrC4o6kztkfGblFgtcAKESrzedKg/CQHzRy6OvqN6wEAFPZMJySm4TYm6Gcj/lD5b76y6Gb3TuwKL6VNj3BKl528mm6SE/F1tGehFy0wXKSIysb3Fnlpof+cm6sS8mkSU9/FiC/LohVd7W+wf3WoLQWUDQ6IysTtt2X3TKfoKQ/cAlvYiojODO6XxKVlqZ67WjP9+PfOLUiw5DEvb/RVEcBJMrLjlupyvCTXV4SYn8kXjbFSfPHE0CjS1jutLgJEsN6CsrI3ivdYXIffPYsbbdiWiYBxVk55LXF8KumKiM6STOLZ/oU2K8NaR8sRgQY/TloXRRjhnupeexBbBQ6YIrCB/hxuipjgmLZWSFfDGcOaoXOMjPVsVQovCTwiaR0GERNLk728DKFAglDcEoLnBf2lhuLoQ+hgDuN66OIH0pRRGPXY5OYMCnhJq+SmA/DQgrQmSPijiHqRXDYGjD5PUdN5WHaqkKOijySne4CVdmSH8u24ebVYsTDXXuPZGeW/3R8pribkkHsqbz5cmjcpEEiXeerK4fX8BrGolxE0gm25kSHm54GTaG6bjXRHg4ywkB6Ido0vo74HHNdpim4vrF7luImZiwVHaGdv/Gh6KtVXOlzCk+ApfqZ+aEGlzUajuQgY1FFm74BS6YEaQZBlxQzM4r8LksZxKggzmWEo9hB4eMHUEw8RLskWpJK/iXBXdUEpLKSqoFs9Ji+ObkGBdJPsUw5rzvN9vUsdY30GualJ15DtE4u6KfDAZkHgrSRyrCEvuo1kNftZ3y800+CkTQ4Je/fL4cLudAuAc8pFgu3Ev+mUr0iLjpr8726S+Cu5xEvJw90yGAf03i7G/2uKlZMjHR+5sotHW9arZ/ax9c61kJU493GUJKjvBcK+ogHTSBLPgOq3Ry+DJ25SCh0nWDRgI4XZOu8R+xVYommv+w4j7hakT4tHVffQHzDjpr2kKGh3T3QGsGdhMu+RHyRpiJa59GM2gVF0/z2x8d8BEbZkbsBMWHXw0vXURP+Ga4AtFvMSGM5BcL5sRvduWIboQM95nwLLxrjtz11L6nfiR0wVdBW9azK63njv8J7SIwJoepimc2utx89YQFBi7kSAuqs6sJDZwhLqtnBG5p2UB/ypQsXj8DnsphJcI0sAXJsMAQKeOQ6rwu6uc2J+hzmlG+bY3EI3KUG2l+fQ==
                        Content-Transfer-Encoding7bit

                        File Icon

                        Icon Hash:46070c0a8e0c67d6