Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
_EXTERNAL_ Action Required_ Access & Approve Closing Document.msg

Overview

General Information

Sample name:_EXTERNAL_ Action Required_ Access & Approve Closing Document.msg
Analysis ID:1574936
MD5:f01c30934ca2b8c7a09e1363faa99c0c
SHA1:ffdfc1a4f9769bb8bbde22351de0dfc4b38e50dd
SHA256:57ae29c0a518d14f4e0ae8f79447c1216fabf70b187f4fd24bf2ee4290865bcf
Infos:

Detection

Score:52
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

AI detected landing page (webpage, office document or email)
AI detected potential phishing Email
Suspicious MSG / EML detected (based on various text indicators)
Queries the volume information (name, serial number etc) of a device
Sigma detected: Office Autorun Keys Modification
Stores files to the Windows start menu directory
Very long command line found

Classification

Process Tree

  • System is w10x64_ra
  • OUTLOOK.EXE (PID: 6864 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /f "C:\Users\user\Desktop\_EXTERNAL_ Action Required_ Access & Approve Closing Document.msg" MD5: 91A5292942864110ED734005B7E005C0)
    • ai.exe (PID: 6532 cmdline: "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "ECFC75BA-AF68-4243-988A-F74F05647F3E" "FC09AF84-F47A-44CE-8A41-45245F034280" "6864" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx" MD5: EC652BEDD90E089D9406AFED89A8A8BD)
    • chrome.exe (PID: 5492 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.google.com%2Furl%3Fq%3Dhttps%3A%2F%2Fwww.google.com%2Furl%3Fq%253Dhttps%3A%2F%2Fwww.google.com%2Furl%3Fq%25253Ddata%3Aimage%2Fpng%3Bbase64%2CiVBORw0KGgoAAAANSUhEUgAAAXMAAACICAMAAAAiRvvOAAAAnFBMVEX%2F%2F%2F9zc3N%2FugD%2FuQHyUCIBpO9qampvb29paWltbW18fHwAou%2Ft7e309PT8%2FPzAwMCtra3%2FtACNwSnx9%2Bl1tQDc68KLi4vk5OTD3aD%2F4qv%2FvADzZD71fmHySxn1eFzyRgn4sqar2fhSuvP%2F9%2Bn%2F68MAqPC2traZmZmkpKTJycnS0tKBgYGMjIzZ2dnm5ubExMT2i3H6w7i74vpUvfMEYak7AAAH%2B0lEQVR4nO2b6ZacNhBGwY61EKBJ7EAWO4udsNM4yfu%2FW5BKK5vHccO4%2B9Q982PQAuKTVFWS6CBAEARBEARBEARBEARBEARBEARBEARBEARBEARBEARBEARBEARBEARBnp2Pv%2BzwMQhev%2Fh%2Bmxc%2FPHfz75K373b4ddL8zYtt3qDm%2F4e3777ZBDU%2FBtT8fFDz80HNzwc1Px%2FU%2FHxQ8%2FNBzV3SOI6PfwpqboizkAmqox%2F07JpfhxNG1lPIGA8l3dFPurXm6UWTrD6v8bOT7oyB9RR6Eiryox91a80TxgFWrj3OZsPojuj0kuQrEL3i4f1qTnXTo7XHXfSrEan5wOQFW58TJ6IaQlnI2d3ZFqs5G1YeF4We5i1MaHY9%2BjU%2FRS%2BbTeqp8%2BMLJBXZ6ky9AcdpTlcshhpORvOrGucHvdyTSWQ7aK2v07aeYpjsoKcdp3nIlxajor7mQc3oNKHHg17uycBYICaCqqZmhfweNb%2FMM2MTG5j3G%2FOoXzNC59JAw8y1HBv3qPnSi5Z8ofnXwcj99t6l5nTVi9os1Pzmmney0XMvKqMUnlHU%2FBDNwSnNvGgu8qKCOJqnEv8WaTGWWV2Og6qd2kLXZmxip2AzFcwu7Ur%2FTfeos7K5zu6dDCNUsS0Tt74ozfWjYMhkwUrrbsAxmkdBt%2FSiMjDkZezGCL20Nm6xoQoZ4ZROS1XaFyIFJsYUxxX5lMO0pytUQcoJiS6eMkkWTutdkcPC2klvKwrpnPC8UYlduM%2Fq2u6LOErzkSzaK7Vj8dXVXA59YjWPe%2BY4YSIFy8Qg5HXQMmrvmVRuwZCEjX1QS7mTZZKvuVeFReBuOjfxrjVPFl40lfO1D4qF5nY6NMQTABYpsq9orQNNqcFA50rZFUzD3HQj2cgWVeS64HHGeVDPvaiMgVm7p%2FlFq0WFBfA1z%2FR6SmgwuAVnoqu1LSWEiDwt2bhWpXkszYu5F4V3S3c010qSsMrKrKeEW81DUZ2zyYJHdhHAoros605Vm%2FpTAH1D%2BmZoL5PJD%2F17s05UidScERs9ESN6dhFNaLqNsDC4Nb%2F%2BtoPUfI8dzedeVEotwq9NzVP1puEIDjG5OONcZpRFPGSd3UJolZ6Ruhb1UuhrNejTMYKbweYa7QpIb9Qyop8ekySpilvSBEhV3ALXN9f87993%2BHtq9I97vN7RfOZFa%2FCgO5pLXxnSyL5kIh2j0px2kJGaMWsKpuAHibDPkMlMHAP%2FQGOo3RqP4abK4Zwbn98aq3nqedGUqGG1qXlKZ0pqtOZ2BwruXNgiMQQqYucbtofnO5Xd4t5QTm0lPormyouq%2BFi%2BFRHGYEtz2GcizeKWoDk3u9kpzAdvkVubxa3aIvRvA36VexvinbVHJ2v%2Bzx87%2FDO94E97fFjcz9H86nrRyLzgluYV9d%2FbAJrbsySlqreZo9JavRUecm9%2FGOw199aroDOcEZ6r%2Bftvd3gfBB%2B%2B2%2BPPxf0czdWCR778wMxLbGkeO MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
      • chrome.exe (PID: 2660 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 --field-trial-handle=1952,i,9213023485868535245,9443633490030863859,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
  • cleanup

Yara Signatures

⊘No yara matches

Sigma Signatures

Sigma detected: Office Autorun Keys Modification
Source: Registry Key setAuthor: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 , EventID: 13, EventType: SetValue, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE, ProcessId: 6864, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Addins\OneNote.OutlookAddin\1

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Phishing

barindex
AI detected landing page (webpage, office document or email)
Source: EmailJoe Sandbox AI: Page contains button: 'VIEW COMPLETED DOCUMENT' Source: 'Email'
Source: EmailJoe Sandbox AI: Email contains prominent button: 'view completed document'
AI detected potential phishing Email
Source: EmailJoe Sandbox AI: Detected potential phishing email: The email claims to be from DocuSign but uses a suspicious sender address (mvmservico.awsapps.com). Contains urgent action request and generic 'View Document' button typical of phishing attempts. The actual email thread content about lift trucks appears to be unrelated and likely appended to make the phishing attempt look legitimate
Suspicious MSG / EML detected (based on various text indicators)
Source: MSG / EMLOCR Text: This email originated from outside of the organization and has a high sense of urgency. Please use caution before opening any CAUTION: attachments, clicking any links, or following instructions below. Do not sign-in with your corporate account. Please report email as phishing if in doubt. Warning Code: [URGI] DocuSign A document is available for you. Please click the button below to see the details. VIEW COMPLETED DOCUMENT This email is intended only for the use of the individual(s) to whom it is addressed and may be privileged and confidential. Unauthorised use or disclosure is prohibited. If you receive this e-mail in error, please advise immediately and delete the original message. This message may have been altered without your or our knowledge and the sender does not accept any liability for any errors or omissions in the message. Ce courriel est confidentiel et protOgO. L'expOditeur ne renonce pas aux droits et obligations qui s'y rapportent. Toute diffusion, utilisation ou copie de ce message ou des renseignements qu'il contient par une personne autre que le (les) destinataire(s) dAOsignO(s) est interdite. Si vous recevez ce courriel par erreur, veuillez m'en aviser immOdiatement, par retour de courriel ou par un autre moyen. Please see link for RBCCM disclosures. https://www.rbccm.com/rbccm/policies-disclaimers.page. This email is intended only for the use of the individual(s) to whom it is addressed and may be privileged and confidential. Unauthorised use or disclosure is prohibited. If you receive this e-mail in error, please advise immediately and delete the original message. This message may have been altered without your or our knowledge and the sender does not accept any liability for any errors or omissions in the message. Ce couniel est confidentiel et protAOgO. L'expOditeur ne renonce pas aux droits et obligations qui s'y rapportent. Toute diffusion, utilisation ou copie de ce message ou des renseignements qu'il contient par une personne autre que le (les) destinataire(s) dOsignAO(s) est interdite. Si vous recevez ce couniel par erreur, veuillez m'en aviser immAOdiatement, par retour de courriel ou par un autre moyen. Please see link for RBCCM disclosures. https://www.rbccm.com/rbccm/policies-disclaimers.page.
Source: EmailClassification: Credential Stealer
Source: unknownHTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.16:49719 version: TLS 1.2
Source: chrome.exeMemory has grown: Private usage: 1MB later: 30MB
Source: unknownTCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknownTCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknownTCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownTCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknownTCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknownTCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknownTCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknownTCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknownTCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknownTCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknownTCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknownTCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknownTCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknownTCP traffic detected without corresponding DNS query: 2.20.68.210
Source: unknownTCP traffic detected without corresponding DNS query: 2.20.68.210
Source: unknownTCP traffic detected without corresponding DNS query: 2.20.68.210
Source: unknownTCP traffic detected without corresponding DNS query: 2.20.68.210
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownTCP traffic detected without corresponding DNS query: 40.126.53.10
Source: unknownTCP traffic detected without corresponding DNS query: 192.229.221.95
Source: unknownTCP traffic detected without corresponding DNS query: 40.126.53.10
Source: unknownTCP traffic detected without corresponding DNS query: 192.229.221.95
Source: unknownTCP traffic detected without corresponding DNS query: 40.126.53.10
Source: unknownTCP traffic detected without corresponding DNS query: 40.126.53.10
Source: global trafficDNS traffic detected: DNS query: nam04.safelinks.protection.outlook.com
Source: global trafficDNS traffic detected: DNS query: www.google.com
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49722
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49720
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49697
Source: unknownNetwork traffic detected: HTTP traffic on port 49697 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49702 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49719 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49720 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49722 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49719
Source: unknownNetwork traffic detected: HTTP traffic on port 49716 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49715 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49716
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49715
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49702
Source: unknownHTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.16:49719 version: TLS 1.2
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: Commandline size = 2178
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: Commandline size = 2178
Source: classification engineClassification label: mal52.phis.winMSG@17/18@4/98
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEFile created: C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEFile created: C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20241213T1407490059-6864.etl
Source: unknownProcess created: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /f "C:\Users\user\Desktop\_EXTERNAL_ Action Required_ Access & Approve Closing Document.msg"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "ECFC75BA-AF68-4243-988A-F74F05647F3E" "FC09AF84-F47A-44CE-8A41-45245F034280" "6864" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "ECFC75BA-AF68-4243-988A-F74F05647F3E" "FC09AF84-F47A-44CE-8A41-45245F034280" "6864" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.google.com%2Furl%3Fq%3Dhttps%3A%2F%2Fwww.google.com%2Furl%3Fq%253Dhttps%3A%2F%2Fwww.google.com%2Furl%3Fq%25253Ddata%3Aimage%2Fpng%3Bbase64%2CiVBORw0KGgoAAAANSUhEUgAAAXMAAACICAMAAAAiRvvOAAAAnFBMVEX%2F%2F%2F9zc3N%2FugD%2FuQHyUCIBpO9qampvb29paWltbW18fHwAou%2Ft7e309PT8%2FPzAwMCtra3%2FtACNwSnx9%2Bl1tQDc68KLi4vk5OTD3aD%2F4qv%2FvADzZD71fmHySxn1eFzyRgn4sqar2fhSuvP%2F9%2Bn%2F68MAqPC2traZmZmkpKTJycnS0tKBgYGMjIzZ2dnm5ubExMT2i3H6w7i74vpUvfMEYak7AAAH%2B0lEQVR4nO2b6ZacNhBGwY61EKBJ7EAWO4udsNM4yfu%2FW5BKK5vHccO4%2B9Q982PQAuKTVFWS6CBAEARBEARBEARBEARBEARBEARBEARBEARBEARBEARBEARBEARBEARBnp2Pv%2BzwMQhev%2Fh%2Bmxc%2FPHfz75K373b4ddL8zYtt3qDm%2F4e3777ZBDU%2FBtT8fFDz80HNzwc1Px%2FU%2FHxQ8%2FNBzV3SOI6PfwpqboizkAmqox%2F07JpfhxNG1lPIGA8l3dFPurXm6UWTrD6v8bOT7oyB9RR6Eiryox91a80TxgFWrj3OZsPojuj0kuQrEL3i4f1qTnXTo7XHXfSrEan5wOQFW58TJ6IaQlnI2d3ZFqs5G1YeF4We5i1MaHY9%2BjU%2FRS%2BbTeqp8%2BMLJBXZ6ky9AcdpTlcshhpORvOrGucHvdyTSWQ7aK2v07aeYpjsoKcdp3nIlxajor7mQc3oNKHHg17uycBYICaCqqZmhfweNb%2FMM2MTG5j3G%2FOoXzNC59JAw8y1HBv3qPnSi5Z8ofnXwcj99t6l5nTVi9os1Pzmmney0XMvKqMUnlHU%2FBDNwSnNvGgu8qKCOJqnEv8WaTGWWV2Og6qd2kLXZmxip2AzFcwu7Ur%2FTfeos7K5zu6dDCNUsS0Tt74ozfWjYMhkwUrrbsAxmkdBt%2FSiMjDkZezGCL20Nm6xoQoZ4ZROS1XaFyIFJsYUxxX5lMO0pytUQcoJiS6eMkkWTutdkcPC2klvKwrpnPC8UYlduM%2Fq2u6LOErzkSzaK7Vj8dXVXA59YjWPe%2BY4YSIFy8Qg5HXQMmrvmVRuwZCEjX1QS7mTZZKvuVeFReBuOjfxrjVPFl40lfO1D4qF5nY6NMQTABYpsq9orQNNqcFA50rZFUzD3HQj2cgWVeS64HHGeVDPvaiMgVm7p%2FlFq0WFBfA1z%2FR6SmgwuAVnoqu1LSWEiDwt2bhWpXkszYu5F4V3S3c010qSsMrKrKeEW81DUZ2zyYJHdhHAoros605Vm%2FpTAH1D%2BmZoL5PJD%2F17s05UidScERs9ESN6dhFNaLqNsDC4Nb%2F%2BtoPUfI8dzedeVEotwq9NzVP1puEIDjG5OONcZpRFPGSd3UJolZ6Ruhb1UuhrNejTMYKbweYa7QpIb9Qyop8ekySpilvSBEhV3ALXN9f87993%2BHtq9I97vN7RfOZFa%2FCgO5pLXxnSyL5kIh2j0px2kJGaMWsKpuAHibDPkMlMHAP%2FQGOo3RqP4abK4Zwbn98aq3nqedGUqGG1qXlKZ0pqtOZ2BwruXNgiMQQqYucbtofnO5Xd4t5QTm0lPormyouq%2BFi%2BFRHGYEtz2GcizeKWoDk3u9kpzAdvkVubxa3aIvRvA36VexvinbVHJ2v%2Bzx87%2FDO94E97fFjcz9H86nrRyLzgluYV9d%2FbAJrbsySlqreZo9JavRUecm9%2FGOw199aroDOcEZ6r%2Bftvd3gfBB%2B%2B2%2BPPxf0czdWCR778wMxLbGkeO
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 --field-trial-handle=1952,i,9213023485868535245,9443633490030863859,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.google.com%2Furl%3Fq%3Dhttps%3A%2F%2Fwww.google.com%2Furl%3Fq%253Dhttps%3A%2F%2Fwww.google.com%2Furl%3Fq%25253Ddata%3Aimage%2Fpng%3Bbase64%2CiVBORw0KGgoAAAANSUhEUgAAAXMAAACICAMAAAAiRvvOAAAAnFBMVEX%2F%2F%2F9zc3N%2FugD%2FuQHyUCIBpO9qampvb29paWltbW18fHwAou%2Ft7e309PT8%2FPzAwMCtra3%2FtACNwSnx9%2Bl1tQDc68KLi4vk5OTD3aD%2F4qv%2FvADzZD71fmHySxn1eFzyRgn4sqar2fhSuvP%2F9%2Bn%2F68MAqPC2traZmZmkpKTJycnS0tKBgYGMjIzZ2dnm5ubExMT2i3H6w7i74vpUvfMEYak7AAAH%2B0lEQVR4nO2b6ZacNhBGwY61EKBJ7EAWO4udsNM4yfu%2FW5BKK5vHccO4%2B9Q982PQAuKTVFWS6CBAEARBEARBEARBEARBEARBEARBEARBEARBEARBEARBEARBEARBEARBnp2Pv%2BzwMQhev%2Fh%2Bmxc%2FPHfz75K373b4ddL8zYtt3qDm%2F4e3777ZBDU%2FBtT8fFDz80HNzwc1Px%2FU%2FHxQ8%2FNBzV3SOI6PfwpqboizkAmqox%2F07JpfhxNG1lPIGA8l3dFPurXm6UWTrD6v8bOT7oyB9RR6Eiryox91a80TxgFWrj3OZsPojuj0kuQrEL3i4f1qTnXTo7XHXfSrEan5wOQFW58TJ6IaQlnI2d3ZFqs5G1YeF4We5i1MaHY9%2BjU%2FRS%2BbTeqp8%2BMLJBXZ6ky9AcdpTlcshhpORvOrGucHvdyTSWQ7aK2v07aeYpjsoKcdp3nIlxajor7mQc3oNKHHg17uycBYICaCqqZmhfweNb%2FMM2MTG5j3G%2FOoXzNC59JAw8y1HBv3qPnSi5Z8ofnXwcj99t6l5nTVi9os1Pzmmney0XMvKqMUnlHU%2FBDNwSnNvGgu8qKCOJqnEv8WaTGWWV2Og6qd2kLXZmxip2AzFcwu7Ur%2FTfeos7K5zu6dDCNUsS0Tt74ozfWjYMhkwUrrbsAxmkdBt%2FSiMjDkZezGCL20Nm6xoQoZ4ZROS1XaFyIFJsYUxxX5lMO0pytUQcoJiS6eMkkWTutdkcPC2klvKwrpnPC8UYlduM%2Fq2u6LOErzkSzaK7Vj8dXVXA59YjWPe%2BY4YSIFy8Qg5HXQMmrvmVRuwZCEjX1QS7mTZZKvuVeFReBuOjfxrjVPFl40lfO1D4qF5nY6NMQTABYpsq9orQNNqcFA50rZFUzD3HQj2cgWVeS64HHGeVDPvaiMgVm7p%2FlFq0WFBfA1z%2FR6SmgwuAVnoqu1LSWEiDwt2bhWpXkszYu5F4V3S3c010qSsMrKrKeEW81DUZ2zyYJHdhHAoros605Vm%2FpTAH1D%2BmZoL5PJD%2F17s05UidScERs9ESN6dhFNaLqNsDC4Nb%2F%2BtoPUfI8dzedeVEotwq9NzVP1puEIDjG5OONcZpRFPGSd3UJolZ6Ruhb1UuhrNejTMYKbweYa7QpIb9Qyop8ekySpilvSBEhV3ALXN9f87993%2BHtq9I97vN7RfOZFa%2FCgO5pLXxnSyL5kIh2j0px2kJGaMWsKpuAHibDPkMlMHAP%2FQGOo3RqP4abK4Zwbn98aq3nqedGUqGG1qXlKZ0pqtOZ2BwruXNgiMQQqYucbtofnO5Xd4t5QTm0lPormyouq%2BFi%2BFRHGYEtz2GcizeKWoDk3u9kpzAdvkVubxa3aIvRvA36VexvinbVHJ2v%2Bzx87%2FDO94E97fFjcz9H86nrRyLzgluYV9d%2FbAJrbsySlqreZo9JavRUecm9%2FGOw199aroDOcEZ6r%2Bftvd3gfBB%2B%2B2%2BPPxf0czdWCR778wMxLbGkeO
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 --field-trial-handle=1952,i,9213023485868535245,9443633490030863859,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: apphelp.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: c2r64.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: userenv.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: msasn1.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: cryptsp.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: rsaenh.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: cryptbase.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: gpapi.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{275C23E2-3747-11D0-9FEA-00AA003F8646}\InProcServer32
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEWindow found: window name: SysTabControl32
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Common
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEFile Volume queried: C:\Windows\SysWOW64 FullSizeInformation
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information queried: ProcessInformation
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeQueries volume information: C:\Program Files (x86)\Microsoft Office\root\Office16\AI\WordCombinedFloatieLreOnline.onnx VolumeInformation
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid Accounts1
Command and Scripting Interpreter		21
Browser Extensions		1
Process Injection		1
Masquerading		OS Credential Dumping1
Process Discovery		Remote ServicesData from Local System2
Encrypted Channel		Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/Job1
DLL Side-Loading		1
DLL Side-Loading		1
Process Injection		LSASS Memory13
System Information Discovery		Remote Desktop ProtocolData from Removable Media1
Non-Application Layer Protocol		Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAt1
Registry Run Keys / Startup Folder		1
Registry Run Keys / Startup Folder		1
DLL Side-Loading		Security Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared Drive2
Application Layer Protocol		Automated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCronLogin Hook1
Extra Window Memory Injection		1
Extra Window Memory Injection		NTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput CaptureProtocol ImpersonationTraffic DuplicationData Destruction

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

⊘No Antivirus matches

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

NameIPActiveMaliciousAntivirus DetectionReputation
nam04.safelinks.eop-tm2.outlook.com
104.47.74.28
truefalse
    		high
    www.google.com
    		142.250.181.132
    		truefalse
      		high
      nam04.safelinks.protection.outlook.com
      		unknown
      		unknownfalse
        		high

        Contacted URLs

        NameMaliciousAntivirus DetectionReputation
        https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.google.com%2Furl%3Fq%3Dhttps%3A%2F%2Fwww.google.com%2Furl%3Fq%253Dhttps%3A%2F%2Fwww.google.com%2Furl%3Fq%25253Ddata%3Aimage%2Fpng%3Bbase64%2CiVBORw0KGgoAAAANSUhEUgAAAXMAAACICAMAAAAiRvvOAAAAnFBMVEX%2F%2F%2F9zc3N%2FugD%2FuQHyUCIBpO9qampvb29paWltbW18fHwAou%2Ft7e309PT8%2FPzAwMCtra3%2FtACNwSnx9%2Bl1tQDc68KLi4vk5OTD3aD%2F4qv%2FvADzZD71fmHySxn1eFzyRgn4sqar2fhSuvP%2F9%2Bn%2F68MAqPC2traZmZmkpKTJycnS0tKBgYGMjIzZ2dnm5ubExMT2i3H6w7i74vpUvfMEYak7AAAH%2B0lEQVR4nO2b6ZacNhBGwY61EKBJ7EAWO4udsNM4yfu%2FW5BKK5vHccO4%2B9Q982PQAuKTVFWS6CBAEARBEARBEARBEARBEARBEARBEARBEARBEARBEARBEARBEARBEARBnp2Pv%2BzwMQhev%2Fh%2Bmxc%2FPHfz75K373b4ddL8zYtt3qDm%2F4e3777ZBDU%2FBtT8fFDz80HNzwc1Px%2FU%2FHxQ8%2FNBzV3SOI6PfwpqboizkAmqox%2F07JpfhxNG1lPIGA8l3dFPurXm6UWTrD6v8bOT7oyB9RR6Eiryox91a80TxgFWrj3OZsPojuj0kuQrEL3i4f1qTnXTo7XHXfSrEan5wOQFW58TJ6IaQlnI2d3ZFqs5G1YeF4We5i1MaHY9%2BjU%2FRS%2BbTeqp8%2BMLJBXZ6ky9AcdpTlcshhpORvOrGucHvdyTSWQ7aK2v07aeYpjsoKcdp3nIlxajor7mQc3oNKHHg17uycBYICaCqqZmhfweNb%2FMM2MTG5j3G%2FOoXzNC59JAw8y1HBv3qPnSi5Z8ofnXwcj99t6l5nTVi9os1Pzmmney0XMvKqMUnlHU%2FBDNwSnNvGgu8qKCOJqnEv8WaTGWWV2Og6qd2kLXZmxip2AzFcwu7Ur%2FTfeos7K5zu6dDCNUsS0Tt74ozfWjYMhkwUrrbsAxmkdBt%2FSiMjDkZezGCL20Nm6xoQoZ4ZROS1XaFyIFJsYUxxX5lMO0pytUQcoJiS6eMkkWTutdkcPC2klvKwrpnPC8UYlduM%2Fq2u6LOErzkSzaK7Vj8dXVXA59YjWPe%2BY4YSIFy8Qg5HXQMmrvmVRuwZCEjX1QS7mTZZKvuVeFReBuOjfxrjVPFl40lfO1D4qF5nY6NMQTABYpsq9orQNNqcFA50rZFUzD3HQj2cgWVeS64HHGeVDPvaiMgVm7p%2FlFq0WFBfA1z%2FR6SmgwuAVnoqu1LSWEiDwt2bhWpXkszYu5F4V3S3c010qSsMrKrKeEW81DUZ2zyYJHdhHAoros605Vm%2FpTAH1D%2BmZoL5PJD%2F17s05UidScERs9ESN6dhFNaLqNsDC4Nb%2F%2BtoPUfI8dzedeVEotwq9NzVP1puEIDjG5OONcZpRFPGSd3UJolZ6Ruhb1UuhrNejTMYKbweYa7QpIb9Qyop8ekySpilvSBEhV3ALXN9f87993%2BHtq9I97vN7RfOZFa%2FCgO5pLXxnSyL5kIh2j0px2kJGaMWsKpuAHibDPkMlMHAP%2FQGOo3RqP4abK4Zwbn98aq3nqedGUqGG1qXlKZ0pqtOZ2BwruXNgiMQQqYucbtofnO5Xd4t5QTm0lPormyouq%2BFi%2BFRHGYEtz2GcizeKWoDk3u9kpzAdvkVubxa3aIvRvA36VexvinbVHJ2v%2Bzx87%2FDO94E97fFjcz9H86nrRyLzgluYV9d%2FbAJrbsySlqreZo9JavRUecm9%2FGOw199aroDOcEZ6r%2Bftvd3gfBB%2B%2B2%2BPPxf0czdWCR778wMxLbGkeOfalse
          		unknown

          World Map of Contacted IPs

          • No. of IPs < 25%
          • 25% < No. of IPs < 50%
          • 50% < No. of IPs < 75%
          • 75% < No. of IPs

          Public IPs

          IPDomainCountryFlagASNASN NameMalicious
          52.113.194.132
          		unknownUnited States
          		8068MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
          172.217.19.206
          		unknownUnited States
          		15169GOOGLEUSfalse
          1.1.1.1
          		unknownAustralia
          		13335CLOUDFLARENETUSfalse
          64.233.164.84
          		unknownUnited States
          		15169GOOGLEUSfalse
          239.255.255.250
          		unknownReserved
          		unknownunknownfalse
          172.217.17.35
          		unknownUnited States
          		15169GOOGLEUSfalse
          52.109.89.19
          		unknownUnited States
          		8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
          13.89.178.27
          		unknownUnited States
          		8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
          142.250.181.99
          		unknownUnited States
          		15169GOOGLEUSfalse
          104.47.74.28
          		nam04.safelinks.eop-tm2.outlook.comUnited States
          		8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
          142.250.181.132
          		www.google.comUnited States
          		15169GOOGLEUSfalse

          Private

          IP
          192.168.2.16

          General Information

          Joe Sandbox version:41.0.0 Charoite
          Analysis ID:1574936
          Start date and time:2024-12-13 20:07:15 +01:00
          Joe Sandbox product:CloudBasic
          Overall analysis duration:
          Hypervisor based Inspection enabled:false
          Report type:full
          Cookbook file name:defaultwindowsinteractivecookbook.jbs
          Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
          Number of analysed new started processes analysed:15
          Number of new started drivers analysed:0
          Number of existing processes analysed:0
          Number of existing drivers analysed:0
          Number of injected processes analysed:0
          Technologies:
          • EGA enabled
          Analysis Mode:stream
          Analysis stop reason:Timeout
          Sample name:_EXTERNAL_ Action Required_ Access & Approve Closing Document.msg
          Detection:MAL
          Classification:mal52.phis.winMSG@17/18@4/98
          Cookbook Comments:
          • Found application associated with file extension: .msg

          Warnings

          • Exclude process from analysis (whitelisted): dllhost.exe, SgrmBroker.exe, svchost.exe
          • Excluded IPs from analysis (whitelisted): 52.113.194.132, 52.109.89.19, 13.89.178.27
          • Excluded domains from analysis (whitelisted): fs.microsoft.com
          • Not all processes where analyzed, report is missing behavior information
          • Report size getting too big, too many NtQueryValueKey calls found.
          • VT rate limit hit for: _EXTERNAL_ Action Required_ Access & Approve Closing Document.msg

          Created / dropped Files

          C:\Users\user\AppData\Local\Microsoft\FORMS\FRMCACHE.DAT

          Download File
          Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
          File Type:data
          Category:modified
          Size (bytes):231348
          Entropy (8bit):4.392921805413447
          Encrypted:false
          SSDEEP:
          MD5:4FB5D0F5516C0016D7109E751BCAC855
          SHA1:E7AD5E926418DB2626D3F144EABB39E788E80B0B
          SHA-256:84A762CB1DD81D6520E005271F3B309B02EFE23153B62C92DCCF1D90BDFD6DAB
          SHA-512:2D2061687493B21AC4ED7E816CA7A69028968A0C72387175B9CC0EF2E1FC5C7E3CE8D03FB004C43AFEF0F5915D879C57E5AF1B668A1B4EFA427EC009B34C274A
          Malicious:false
          Reputation:unknown
          Preview:TH02...... ..`,B.M......SM01X...,...@..B.M..........IPM.Activity...........h...............h............H..h..o............h............H..h\cal ...pDat...h0...0....o....h...............h........_`Pk...h....@...I.lw...h....H...8.Uk...0....T...............d.........2h...............k..A.......D...!h.............. h.37.......o...#h....8.........$h........8....."h.:......h7....'h..=...........1h....<.........0h....4....Uk../h....h.....UkH..hX...p.....o...-h .......4.o...+h..........o................. ..............F7..............FIPM.Activity....Form....Standard....Journal Entry...IPM.Microsoft.FolderDesign.FormsDescription................F.k..........1122110020000000.GwwMicrosoft...This form is used to create journal entries.........kf...... ..........&...........(.......(... ...@.....................................................................................................................fffffffff........wwwwwwww.p....pp..............p...............pw..............pw..DDDDO..

          C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-shm

          Download File
          Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
          File Type:data
          Category:dropped
          Size (bytes):32768
          Entropy (8bit):0.045620532224602085
          Encrypted:false
          SSDEEP:
          MD5:12673EDEA51B1DC768F0FDE126E718DD
          SHA1:F711C41CF298B9A0A593A608DE301E07A4088CAB
          SHA-256:B9AA4F0F4CA63749DA34193CD2D440F8FC079EE9CC077008DD14E818AF477CD5
          SHA-512:10C77396BD0C9C0F22E7C40F6604E55B64FF236DC79248B59AF4B6EB97B73B381BF21D77E2FC2AADFF045404CDA63936EB68D7072E46D4A11CFBC7DA04CDBBA2
          Malicious:false
          Reputation:unknown
          Preview:..-.....................<.5..$...l........[w.>i..-.....................<.5..$...l........[w.>i........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

          C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-wal

          Download File
          Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
          File Type:SQLite Write-Ahead Log, version 3007000
          Category:modified
          Size (bytes):49472
          Entropy (8bit):0.4845463044863727
          Encrypted:false
          SSDEEP:
          MD5:D75ED93E80B77F47B68FFD3E90061C51
          SHA1:18EC5F409DAF5C8DC5CB08510FD70B85E330D6F2
          SHA-256:B05F06B4F7257F7982B03371536D3732AEF65AD3E2A3E0A753FFAF11C3E3E654
          SHA-512:42769B7E3CD49C98C23D03E169DD88554C9B14BFAEB881DC1643BAC352878C6314E46E7803B0927A6D74077383E0D791556F6B4E09F23DB2D812BC227A594955
          Malicious:false
          Reputation:unknown
          Preview:7....-...........l.......o.\PJ..........l.....`.....8.SQLite format 3......@ .......................................................................... .............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

          C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{DA08805E-DDB2-4323-B304-F4207036B8B7}.tmp

          Download File
          Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
          File Type:data
          Category:dropped
          Size (bytes):29092
          Entropy (8bit):3.8380913400726113
          Encrypted:false
          SSDEEP:
          MD5:CE9D898AC923E0922C9777ED7C92C145
          SHA1:2B05B53BDE67134D58ADC6E7843E788770D074D0
          SHA-256:915BFAEA25F6ACD3675C75545DC16AB1B9AB90F1FDAF298D88375061D6F44AB7
          SHA-512:E0D2F49C97B43667085423733B48620F184EAB7BA7252E045D7E35C31EEF8D4EA253474BA256C7537CBF194F6FE96C854A1236911DB71CF0649DE609B3BDBA7E
          Malicious:false
          Reputation:unknown
          Preview:....C.A.U.T.I.O.N.:. .......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................\...`...r... ...$....(...(..`0..b0..f0..j0...;...;...;......................................................................................................................................................................................................................................*...$..$.If........!v..h.#v....:V.......t.....6......5.......4........4........a........$.........-D .M.......L....]...^...a$.....$.........-D .M.......L....]...^...a$.............]...^.......

          C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1734116869294390300_979B9421-7574-44E0-94C8-1CFF5C97A157.log

          Download File
          Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
          File Type:ASCII text, with very long lines (28770), with CRLF line terminators
          Category:dropped
          Size (bytes):20971520
          Entropy (8bit):0.161005969294589
          Encrypted:false
          SSDEEP:
          MD5:6C67F347465741D908477B25BA8FFE22
          SHA1:313F6A6FAC2F43721FF53062CC446A34BC203BED
          SHA-256:94825D561BBDEA43D3AEB6266C291183B8EB0B047FB519A736B4DBBBBE0E2AC9
          SHA-512:C8D8EAD0A7DB760803042B22AFA600FC37731E36F47EEEB60E6BA6DA6A90F4D28CB4F0FD5FBD00EEC709D70806767FB100A1C6F72CF5D610CC2C003E5C333304
          Malicious:false
          Reputation:unknown
          Preview:Timestamp.Process.TID.Area.Category.EventID.Level.Message.Correlation..12/13/2024 19:07:49.330.OUTLOOK (0x1AD0).0x1ACC.Microsoft Outlook.Telemetry Event.b7vzq.Medium.SendEvent {"EventName":"Office.Text.GDIAssistant.HandleCallback","Flags":30962256044949761,"InternalSequenceNumber":26,"Time":"2024-12-13T19:07:49.330Z","Contract":"Office.System.Activity","Activity.CV":"IZSbl3R14ESUyBz/XJehVw.4.11","Activity.Duration":18,"Activity.Count":1,"Activity.AggMode":0,"Activity.Success":true,"Data.GdiFamilyName":"","Data.CloudFontStatus":6,"Data.CloudFontTypes":256}...12/13/2024 19:07:49.361.OUTLOOK (0x1AD0).0x1ACC.Microsoft Outlook.Telemetry Event.b7vzq.Medium.SendEvent {"EventName":"Office.Text.ResourceClient.Deserialize","Flags":30962256044949761,"InternalSequenceNumber":28,"Time":"2024-12-13T19:07:49.361Z","Contract":"Office.System.Activity","Activity.CV":"IZSbl3R14ESUyBz/XJehVw.4.12","Activity.Duration":13361,"Activity.Count":1,"Activity.AggMode":0,"Activity.Success":true,"Data.JsonFileMajor

          C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1734116869295347700_979B9421-7574-44E0-94C8-1CFF5C97A157.log

          Download File
          Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
          File Type:data
          Category:dropped
          Size (bytes):20971520
          Entropy (8bit):0.0
          Encrypted:false
          SSDEEP:
          MD5:8F4E33F3DC3E414FF94E5FB6905CBA8C
          SHA1:9674344C90C2F0646F0B78026E127C9B86E3AD77
          SHA-256:CD52D81E25F372E6FA4DB2C0DFCEB59862C1969CAB17096DA352B34950C973CC
          SHA-512:7FB91E868F3923BBD043725818EF3A5D8D08EBF1059A18AC0FE07040D32EEBA517DA11515E6A4AFAEB29BCC5E0F1543BA2C595B0FE8E6167DDC5E6793EDEF5BB
          Malicious:false
          Reputation:unknown
          Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

          C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20241213T1407490059-6864.etl

          Download File
          Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
          File Type:data
          Category:modified
          Size (bytes):94208
          Entropy (8bit):4.473288093861348
          Encrypted:false
          SSDEEP:
          MD5:A3D59B9307B33489F76764D74BCCED93
          SHA1:3FFBE48EEC671659AD4468903981F810697AB609
          SHA-256:6F54561F816C2724170C3704189AD1FFDE7716046CFDDDE47694336BF99DDCDF
          SHA-512:7E0945B8FAE954C7A6092B4410A0BBF0F2B471E7A942F53878D4FD7EAF8EBADC06E91647AC28E9EFE545803247D3F1D3CBC7B9BF49399B324F2C3FB9D529A656
          Malicious:false
          Reputation:unknown
          Preview:............................................................................`...........U..M.M..................eJ..............Zb..2...................................,...@.t.z.r.e.s...d.l.l.,.-.1.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.1.1.1...........................................................@_...Y..........U..M.M..........v.2._.O.U.T.L.O.O.K.:.1.a.d.0.:.b.b.9.1.5.c.0.4.6.7.4.0.4.8.4.3.9.5.1.e.8.4.8.d.a.a.4.3.6.8.d.6...C.:.\.U.s.e.r.s.\.c.a.l.i.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.O.u.t.l.o.o.k. .L.o.g.g.i.n.g.\.O.U.T.L.O.O.K._.1.6._.0._.1.6.8.2.7._.2.0.1.3.0.-.2.0.2.4.1.2.1.3.T.1.4.0.7.4.9.0.0.5.9.-.6.8.6.4...e.t.l.......P.P.........U..M.M..........................................................................................................................................................................................................................................................................................................

          C:\Users\user\AppData\Local\Temp\~DFAB835F85B2010C80.TMP

          Download File
          Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
          File Type:data
          Category:dropped
          Size (bytes):163840
          Entropy (8bit):0.47564912957766486
          Encrypted:false
          SSDEEP:
          MD5:3B768B897EE46F36DACC2969E421896E
          SHA1:A1444517A308A32B262F0C63C5BEF207D1427B70
          SHA-256:805A22640561CDC6B85389F44F2C4E9A501AB48AE37186E50271373AB5E9573E
          SHA-512:18C4DC79DE1C414C974ED0AF843EF81556C66409FE230EBCD08C4618F24C1F8977EDC1ED3F1A34813EF42C287888B1188AB2797684B7FA6FD1BA8C1F041C4D78
          Malicious:false
          Reputation:unknown
          Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

          C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

          Download File
          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
          File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Dec 13 18:08:36 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
          Category:dropped
          Size (bytes):2673
          Entropy (8bit):3.981286280183027
          Encrypted:false
          SSDEEP:
          MD5:ECD7F8EDBA57C73E6A9BAF81A983C858
          SHA1:5243DC12FA48F528AE289859C0638418D38E5E86
          SHA-256:8EDC982B4481BCC3029E20474BB093FCA9690168ACB16E5BFF9C07B4C4B61C5A
          SHA-512:C0411A4916B28C39BA14E3E0B30311CEC3A12295F8A246597B37DF663C8C8510904CC62CB6025D1F823AECAF1F4CBC2BE8EE5725EEB89516F211E8AD002248C6
          Malicious:false
          Reputation:unknown
          Preview:L..................F.@.. ...$+.,......bi.M..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.Y.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............k.m.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

          C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

          Download File
          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
          File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Dec 13 18:08:36 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
          Category:dropped
          Size (bytes):2675
          Entropy (8bit):3.99548631936469
          Encrypted:false
          SSDEEP:
          MD5:8827E9F6B43501F0299A48AF68BE623A
          SHA1:BC8D13255C248153C3D9789D116A076BB33129C0
          SHA-256:3EC7B00354B4B62595D765D1418CA3541C5767FCC0DFB9AB6083AE9BB84F1C08
          SHA-512:4DF6A7009AAED62B061CFF6D1429AC016C13E86299C472F128590026C980299CA441CC2ED21168914284DD7BC229B6683D924945B3AB5E3F4B63C51D06E8759E
          Malicious:false
          Reputation:unknown
          Preview:L..................F.@.. ...$+.,....b.Si.M..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.Y.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............k.m.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

          C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

          Download File
          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
          File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
          Category:dropped
          Size (bytes):2689
          Entropy (8bit):4.007356461829184
          Encrypted:false
          SSDEEP:
          MD5:EAB950AC14526A0B709BB801F56BDCE5
          SHA1:43B82504DBC27A315878A310EFA2DE14BAAC033F
          SHA-256:020F024E494B541D0368EF7F8A3E8B05B45BF6282D3886AB6ACB415B633449D7
          SHA-512:004553F0376B47DCAA394EE636DB3BCB763ED2CEE157D46D4E61293988EA39CABB23DD4355C9A7A8690B4214EC76FA065B7E5E9A489EEA3580B3B5C453A355CC
          Malicious:false
          Reputation:unknown
          Preview:L..................F.@.. ...$+.,.....Y.04...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.Y.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VFW.E...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............k.m.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

          C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

          Download File
          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
          File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Dec 13 18:08:36 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
          Category:dropped
          Size (bytes):2677
          Entropy (8bit):3.992253332271261
          Encrypted:false
          SSDEEP:
          MD5:57E22CB599F137FF60D3F349522D397A
          SHA1:118806C58AE386889A685D67449C5A3442C89CB8
          SHA-256:C1982753B9C9307F27CE140961A599ABC1568DF752426426D881951E35F2425D
          SHA-512:C22DB2427F9EE6D16D7C12739361598C6E7415EC548C112B75BD473298CC5A90830F869981328E22E49F653B935692372AB9980CEFDDE2B7D1E2281995770410
          Malicious:false
          Reputation:unknown
          Preview:L..................F.@.. ...$+.,....P-Li.M..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.Y.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............k.m.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

          C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

          Download File
          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
          File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Dec 13 18:08:36 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
          Category:dropped
          Size (bytes):2677
          Entropy (8bit):3.982254612656627
          Encrypted:false
          SSDEEP:
          MD5:5B58F4B56D8AC4F75406A2E8B2F8601B
          SHA1:96294CB13A465B10B1DEA05D8386AA3EE0FC7B96
          SHA-256:BEB55CD88DDC9E7B1A5FE0B2F06B94AD71259DDD2F9FBEE6D95401D1348E8857
          SHA-512:5CB0317DBB8888780FD3F8952E6E431FCF265266C761EB7F8139D7362FA8E4D20E0423DD93CFC76C98F8EA91F5E82AD7AD55FBDA1F4CA919DCA4ADDFDDF2D723
          Malicious:false
          Reputation:unknown
          Preview:L..................F.@.. ...$+.,......\i.M..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.Y.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............k.m.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

          C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

          Download File
          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
          File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Dec 13 18:08:36 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
          Category:dropped
          Size (bytes):2679
          Entropy (8bit):3.992897644178618
          Encrypted:false
          SSDEEP:
          MD5:588B2CFF12C10282818B3D51344F52DC
          SHA1:07CCF6B22F555AEC90B37FAA22CC066E6027CEDB
          SHA-256:C60062DC0A6582EFFF60A7AC808241E230D27AB4FF7843DA2054B3C541F3F70C
          SHA-512:054EAB7C5E8F6C929BAAE91BAC616D60F6EC28CBDBB19A079270D24C183B43FA2E51BBA285D14E822DC5F611A005827D7088DEF4DDA63DA9A7D3544B2D0E396B
          Malicious:false
          Reputation:unknown
          Preview:L..................F.@.. ...$+.,....s.?i.M..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.Y.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............k.m.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

          C:\Users\user\Documents\Outlook Files\Outlook Data File - NoEmail.pst

          Download File
          Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
          File Type:Microsoft Outlook email folder (>=2003)
          Category:dropped
          Size (bytes):271360
          Entropy (8bit):1.3620527029991691
          Encrypted:false
          SSDEEP:
          MD5:CAF5B8A914A02C4AC7577351A826F0DC
          SHA1:C802B010F7C9BA076605F707688A1598EDFF5DCF
          SHA-256:4A6D53558479272149C7A432A1A61820B2A15FA20F6B6D8551B7432D8A7BEC1C
          SHA-512:0F23E4B6FF740719245159ECC211E63EA49C7439C40BC4799234F7B6A84EF2BD36A4AAF5255184F54A6F145E964A05C36ABC46D7262B2CC2ABE4B5BF4F0874DA
          Malicious:true
          Reputation:unknown
          Preview:!BDNp.(.SM......\...F...........2.......T................@...........@...@...................................@...........................................................................$.......D.......L..............................1...................................................................................................................................................................................................................................................................................................+.K...=.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

          C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp

          Download File
          Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
          File Type:data
          Category:dropped
          Size (bytes):131072
          Entropy (8bit):1.1282153440148517
          Encrypted:false
          SSDEEP:
          MD5:85DEA0CC8FD60B491A6B3730228E7CBC
          SHA1:5487E65828C878B04908CE587194800CAC7B857E
          SHA-256:D99BB58CA4A2B4BC716DF632A9E88D8366ED9C1756393D4DD9A90EEF5F961411
          SHA-512:188C40CF642EEAD20604C3B2EDB587A63523A2B48C421D02766407CF70F95D718ACE8328653170CC389BA81E1B0D131908F9A6855782540BCAED3133014C618E
          Malicious:true
          Reputation:unknown
          Preview:t.~sC...S..........."..L.M....................#.!BDNp.(.SM......\...F...........2.......T................@...........@...@...................................@...........................................................................$.......D.......L..............................1...................................................................................................................................................................................................................................................................................................+.K...=."..L.M.......B............#.........................................................................................................................................................................................................................................................................................................................................................................................................

          Chrome Cache Entry: 58

          Download File
          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
          File Type:ASCII text, with no line terminators
          Category:downloaded
          Size (bytes):11
          Entropy (8bit):3.2776134368191165
          Encrypted:false
          SSDEEP:
          MD5:825644F747BAAB2C00E420DBBC39E4B3
          SHA1:10588307553E766AB3C7D328D948DC6754893CEF
          SHA-256:7C41B898C5DA0CFA4AA049B65EF50248BCE9A72D24BEF4C723786431921B75AA
          SHA-512:BFE6E8DF36C78CBFD17BA9270C86860EE9B051B82594FB8F34A0ADF6A14E1596D2A9DCDC7EB6857101E1502AFF6FF515A36E8BA6C80DA327BC11831624A5DAEA
          Malicious:false
          Reputation:unknown
          URL:https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.google.com%2Furl%3Fq%3Dhttps%3A%2F%2Fwww.google.com%2Furl%3Fq%253Dhttps%3A%2F%2Fwww.google.com%2Furl%3Fq%25253Ddata%3Aimage%2Fpng%3Bbase64%2CiVBORw0KGgoAAAANSUhEUgAAAXMAAACICAMAAAAiRvvOAAAAnFBMVEX%2F%2F%2F9zc3N%2FugD%2FuQHyUCIBpO9qampvb29paWltbW18fHwAou%2Ft7e309PT8%2FPzAwMCtra3%2FtACNwSnx9%2Bl1tQDc68KLi4vk5OTD3aD%2F4qv%2FvADzZD71fmHySxn1eFzyRgn4sqar2fhSuvP%2F9%2Bn%2F68MAqPC2traZmZmkpKTJycnS0tKBgYGMjIzZ2dnm5ubExMT2i3H6w7i74vpUvfMEYak7AAAH%2B0lEQVR4nO2b6ZacNhBGwY61EKBJ7EAWO4udsNM4yfu%2FW5BKK5vHccO4%2B9Q982PQAuKTVFWS6CBAEARBEARBEARBEARBEARBEARBEARBEARBEARBEARBEARBEARBEARBnp2Pv%2BzwMQhev%2Fh%2Bmxc%2FPHfz75K373b4ddL8zYtt3qDm%2F4e3777ZBDU%2FBtT8fFDz80HNzwc1Px%2FU%2FHxQ8%2FNBzV3SOI6PfwpqboizkAmqox%2F07JpfhxNG1lPIGA8l3dFPurXm6UWTrD6v8bOT7oyB9RR6Eiryox91a80TxgFWrj3OZsPojuj0kuQrEL3i4f1qTnXTo7XHXfSrEan5wOQFW58TJ6IaQlnI2d3ZFqs5G1YeF4We5i1MaHY9%2BjU%2FRS%2BbTeqp8%2BMLJBXZ6ky9AcdpTlcshhpORvOrGucHvdyTSWQ7aK2v07aeYpjsoKcdp3nIlxajor7mQc3oNKHHg17uycBYICaCqqZmhfweNb%2FMM2MTG5j3G%2FOoXzNC59JAw8y1HBv3qPnSi5Z8ofnXwcj99t6l5nTVi9os1Pzmmney0XMvKqMUnlHU%2FBDNwSnNvGgu8qKCOJqnEv8WaTGWWV2Og6qd2kLXZmxip2AzFcwu7Ur%2FTfeos7K5zu6dDCNUsS0Tt74ozfWjYMhkwUrrbsAxmkdBt%2FSiMjDkZezGCL20Nm6xoQoZ4ZROS1XaFyIFJsYUxxX5lMO0pytUQcoJiS6eMkkWTutdkcPC2klvKwrpnPC8UYlduM%2Fq2u6LOErzkSzaK7Vj8dXVXA59YjWPe%2BY4YSIFy8Qg5HXQMmrvmVRuwZCEjX1QS7mTZZKvuVeFReBuOjfxrjVPFl40lfO1D4qF5nY6NMQTABYpsq9orQNNqcFA50rZFUzD3HQj2cgWVeS64HHGeVDPvaiMgVm7p%2FlFq0WFBfA1z%2FR6SmgwuAVnoqu1LSWEiDwt2bhWpXkszYu5F4V3S3c010qSsMrKrKeEW81DUZ2zyYJHdhHAoros605Vm%2FpTAH1D%2BmZoL5PJD%2F17s05UidScERs9ESN6dhFNaLqNsDC4Nb%2F%2BtoPUfI8dzedeVEotwq9NzVP1puEIDjG5OONcZpRFPGSd3UJolZ6Ruhb1UuhrNejTMYKbweYa7QpIb9Qyop8ekySpilvSBEhV3ALXN9f87993%2BHtq9I97vN7RfOZFa%2FCgO5pLXxnSyL5kIh2j0px2kJGaMWsKpuAHibDPkMlMHAP%2FQGOo3RqP4abK4Zwbn98aq3nqedGUqGG1qXlKZ0pqtOZ2BwruXNgiMQQqYucbtofnO5Xd4t5QTm0lPormyouq%2BFi%2BFRHGYEtz2GcizeKWoDk3u9kpzAdvkVubxa3aIvRvA36VexvinbVHJ2v%2Bzx87%2FDO94E97fFjcz9H86nrRyLzgluYV9d%2FbAJrbsySlqreZo9JavRUecm9%2FGOw199aroDOcEZ6r%2Bftvd3gfBB%2B%2B2%2BPPxf0czdWCR778wMxLbGkeO
          Preview:Bad Request

          Chrome Cache Entry: 59

          Download File
          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
          File Type:HTML document, ASCII text, with CRLF line terminators
          Category:downloaded
          Size (bytes):1245
          Entropy (8bit):5.462849750105637
          Encrypted:false
          SSDEEP:
          MD5:5343C1A8B203C162A3BF3870D9F50FD4
          SHA1:04B5B886C20D88B57EEA6D8FF882624A4AC1E51D
          SHA-256:DC1D54DAB6EC8C00F70137927504E4F222C8395F10760B6BEECFCFA94E08249F
          SHA-512:E0F50ACB6061744E825A4051765CEBF23E8C489B55B190739409D8A79BB08DAC8F919247A4E5F65A015EA9C57D326BBEF7EA045163915129E01F316C4958D949
          Malicious:false
          Reputation:unknown
          URL:https://nam04.safelinks.protection.outlook.com/favicon.ico
          Preview:<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">..<html xmlns="http://www.w3.org/1999/xhtml">..<head>..<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"/>..<title>404 - File or directory not found.</title>..<style type="text/css">.. ..body{margin:0;font-size:.7em;font-family:Verdana, Arial, Helvetica, sans-serif;background:#EEEEEE;}..fieldset{padding:0 15px 10px 15px;} ..h1{font-size:2.4em;margin:0;color:#FFF;}..h2{font-size:1.7em;margin:0;color:#CC0000;} ..h3{font-size:1.2em;margin:10px 0 0 0;color:#000000;} ..#header{width:96%;margin:0 0 0 0;padding:6px 2% 6px 2%;font-family:"trebuchet MS", Verdana, sans-serif;color:#FFF;..background-color:#555555;}..#content{margin:0 0 0 2%;position:relative;}...content-container{background:#FFF;width:96%;margin-top:8px;padding:10px;position:relative;}..-->..</style>..</head>..<body>..<div id="header"><h1>Server Error</h1></div>..<div id="content">.. <div class="co

          Static File Info

          General

          File type:CDFV2 Microsoft Outlook Message
          Entropy (8bit):4.419405952710034
          TrID:
          • Outlook Message (71009/1) 36.87%
          • Outlook Form Template (41509/1) 21.55%
          • Perfect Keyboard macro set (36024/1) 18.71%
          • ClickyMouse macro set (36024/1) 18.71%
          • Generic OLE2 / Multistream Compound File (8008/1) 4.16%
          File name:_EXTERNAL_ Action Required_ Access & Approve Closing Document.msg
          File size:173'568 bytes
          MD5:f01c30934ca2b8c7a09e1363faa99c0c
          SHA1:ffdfc1a4f9769bb8bbde22351de0dfc4b38e50dd
          SHA256:57ae29c0a518d14f4e0ae8f79447c1216fabf70b187f4fd24bf2ee4290865bcf
          SHA512:4b88ded6df9f380392ac2ca6531ee21b176159a44cfe6aae5775ee2ff8a757e19b3537cb0ed6016cc406143771c9507cd83c0560e9e82db261e8f48e33d59598
          SSDEEP:3072:S1tXw3Hl8JZ9Dx95/5FX3CATW1Dp2QeD22VH6BlnKk4:uw3OJzDx95/5lyAq1DoVD59fk
          TLSH:4004102539FA4119F3B3EF714BE5A4AF892AFC636D19556E2081730E0632D40ED61B3B
          File Content Preview:........................>.......................................................a..............................................................................................................................................................................

          Static Mail

          General

          Subject:[EXTERNAL] Action Required: Access & Approve Closing Document
          From:e-Doc <no-reply@mvmservico.awsapps.com>
          To:ithelpdesk@olgoonik.com
          Cc:
          BCC:
          Date:Fri, 13 Dec 2024 18:12:23 +0100
          Communications:
          • CAUTION: This email originated from outside of the organization and has a high sense of urgency. Please use caution before opening any attachments, clicking any links, or following instructions below. Do not sign-in with your corporate account. Please report email as phishing if in doubt. Warning Code: [URG1] DocuSign A document is available for you. Please click the button below to see the details. VIEW COMPLETED DOCUMENT _______________________________________________________________________ This email is intended only for the use of the individual(s) to whom it is addressed and may be privileged and confidential. Unauthorised use or disclosure is prohibited. If you receive this e-mail in error, please advise immediately and delete the original message. This message may have been altered without your or our knowledge and the sender does not accept any liability for any errors or omissions in the message. Ce courriel est confidentiel et protg. L'expditeur ne renonce pas aux droits et obligations qui s'y rapportent. Toute diffusion, utilisation ou copie de ce message ou des renseignements qu'il contient par une personne autre que le (les) destinataire(s) dsign(s) est interdite. Si vous recevez ce courriel par erreur, veuillez m'en aviser immdiatement, par retour de courriel ou par un autre moyen. Please see link for RBCCM disclosures. https://www.rbccm.com/rbccm/policies-disclaimers.page. _______________________________________________________________________ This email is intended only for the use of the individual(s) to whom it is addressed and may be privileged and confidential. Unauthorised use or disclosure is prohibited. If you receive this e-mail in error, please advise immediately and delete the original message. This message may have been altered without your or our knowledge and the sender does not accept any liability for any errors or omissions in the message. Ce courriel est confidentiel et protg. L'expditeur ne renonce pas aux droits et obligations qui s'y rapportent. Toute diffusion, utilisation ou copie de ce message ou des renseignements qu'il contient par une personne autre que le (les) destinataire(s) dsign(s) est interdite. Si vous recevez ce courriel par erreur, veuillez m'en aviser immdiatement, par retour de courriel ou par un autre moyen. Please see link for RBCCM disclosures. https://www.rbccm.com/rbccm/policies-disclaimers.page. Thank you Jim! I let Wayne know. He handles our receiving area and blocking of trucks, so hell be ready for you. Thanks and have a great weekend! Quint Brown Sales Manager Crown Lift Trucks 17700 East 32nd Place Denver, CO 80011 Tel 303-344-1000 Mobile 303-419-5513 Quint.brown@crown.com www.crown.com <https://nam04.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.crown.com%2F&data=05%7C02%7Cjperez%40olgoonik.com%7C0bc2ff93f09e442dddab08dd1b994ff8%7C341c5aad39be47a3901e146d297ecd80%7C0%7C0%7C638697068698243785%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C60000%7C%7C%7C&sdata=DBfLyv40QHEapUJU9ERI1B1lN2NrYJQHlfKIvCd7bCM%3D&reserved=0>
          • From: Jim White <jim.white@furniturerow.com> Sent: Friday, December 6, 2024 4:23 PM To: Brown, Quint <Quint.Brown@Crown.com> Cc: Jack Herrera <jack.herrera@furniturerow.com>; Machado, Paul <Paul.Machado@Crown.com>; efrain.figarora@crown.com; Jose Ocon <jose.ocon@furniturerow.com>; Chad Roberts <chad.roberts@furniturerow.com> Subject: Re: sending a picker over to be secured Warning: This email originated from outside of Crown. Do not click on links unless you know the content is safe. If you are prompted for a password, STOP! Contact the Help Desk immediately! Hi Quint, After 9 shouldnt be a problem. We will plan on it Thanks Jim Sent from my iPad On Dec 6, 2024, at 3:52 PM, Brown, Quint <Quint.Brown@crown.com <mailto:Quint.Brown@crown.com> > wrote: Jack, We can do this on Wednesday. Would you be able to have your driver show up after say 9:00 AM? Our dock is pretty busy on Wednesday mornings. Thank you. Quint Brown Sales Manager Crown Lift Trucks 17700 East 32nd Place Denver, CO 80011 Tel 303-344-1000 Mobile 303-419-5513 Quint.brown@crown.com <mailto:Quint.brown@crown.com> www.crown.com <https://nam04.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.crown.com%2F&data=05%7C02%7Cjperez%40olgoonik.com%7C0bc2ff93f09e442dddab08dd1b994ff8%7C341c5aad39be47a3901e146d297ecd80%7C0%7C0%7C638697068698268586%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C60000%7C%7C%7C&sdata=cxFfyD5jsFTaZxhEbj2OY%2B3%2FWyt8IRaQf%2BGLKDddwr0%3D&reserved=0> From: Jack Herrera <jack.herrera@furniturerow.com <mailto:jack.herrera@furniturerow.com> > Sent: Friday, December 6, 2024 2:20 PM To: Machado, Paul <Paul.Machado@Crown.com <mailto:Paul.Machado@Crown.com> >; Brown, Quint <Quint.Brown@Crown.com <mailto:Quint.Brown@Crown.com> >; efrain.figarora@crown.com <mailto:efrain.figarora@crown.com> Cc: Jim White <jim.white@furniturerow.com <mailto:jim.white@furniturerow.com> >; Jose Ocon <jose.ocon@furniturerow.com <mailto:jose.ocon@furniturerow.com> >; Chad Roberts <chad.roberts@furniturerow.com <mailto:chad.roberts@furniturerow.com> > Subject: sending a picker over to be secured Warning: This email originated from outside of Crown. Do not click on links unless you know the content is safe. If you are prompted for a password, STOP! Contact the Help Desk immediately! Good afternoon Paul and Quint. We would like to send a picker over in a trailer to be secured for an over the road trip. We were planning on sending it Wednesday 12-11 mid-morning, having it secured and then bring it back. Let me know if that works. Thanks, Jack Herrera Denver Mattress Co Transportation Manager <image001.jpg> Office: 303-566-8119 Cell: 720-429-9883 Jack.herrera@furniturerow.com <mailto:Jack.herrera@furniturerow.com>
          Attachments:

            Headers

            Key Value
            Receivedfrom a8-76.smtp-out.amazonses.com (54.240.8.76) by
            1714:29 +0000
            by BL3PR08MB7347.namprd08.prod.outlook.com (260310b6:208:356::6) with
            2024 1712:25 +0000
            (260310b6:a02:ee::34) with Microsoft SMTP Server (version=TLS1_3,
            13 Dec 2024 1712:24 +0000
            Authentication-Resultsspf=pass (sender IP is 54.240.8.76)
            Received-SPFPass (protection.outlook.com: domain of amazonses.com designates
            via Frontend Transport; Fri, 13 Dec 2024 1712:23 +0000
            DKIM-Signaturev=1; a=rsa-sha256; q=dns/txt; c=relaxed/simple;
            h=FromSubject:To:Content-Type:MIME-Version:Date:Message-Id:Feedback-ID;
            Frome-Doc <no-reply@mvmservico.awsapps.com>
            Subject[EXTERNAL] Action Required: Access & Approve Closing Document
            Toithelpdesk@olgoonik.com
            Content-Typemultipart/alternative; boundary="bgGwwhBHOu=_xQHAtp4P0yvYrnoS74a42B"
            MIME-Version1.0
            DateFri, 13 Dec 2024 17:12:23 +0000
            Message-ID<01000193c101d4ce-0a0de0db-21a7-49c3-8dc1-c68f9205ec41-000000@email.amazonses.com>
            Feedback-ID::1.us-east-1.l5fVeN3k9ZsgMZBTP0bojd+klxeLwjWh7E2te7amXEk=:AmazonSES
            X-SES-Outgoing2024.12.13-54.240.8.76
            Return-Path01000193c101d4ce-0a0de0db-21a7-49c3-8dc1-c68f9205ec41-000000@amazonses.com
            X-MS-Exchange-Organization-ExpirationStartTime13 Dec 2024 17:12:24.2134
            X-MS-Exchange-Organization-ExpirationStartTimeReasonOriginalSubmit
            X-MS-Exchange-Organization-ExpirationInterval1:00:00:00.0000000
            X-MS-Exchange-Organization-ExpirationIntervalReasonOriginalSubmit
            X-MS-Exchange-Organization-Network-Message-Id0bc2ff93-f09e-442d-ddab-08dd1b994ff8
            X-EOPAttributedMessage0
            X-EOPTenantAttributedMessage341c5aad-39be-47a3-901e-146d297ecd80:0
            X-MS-Exchange-Organization-MessageDirectionalityIncoming
            X-MS-PublicTrafficTypeEmail
            X-MS-TrafficTypeDiagnosticMWH0EPF000989EB:EE_|BL3PR08MB7347:EE_|BY5PR08MB6198:EE_
            X-MS-Exchange-Organization-AuthSourceMWH0EPF000989EB.namprd02.prod.outlook.com
            X-MS-Exchange-Organization-AuthAsAnonymous
            X-MS-Office365-Filtering-Correlation-Id0bc2ff93-f09e-442d-ddab-08dd1b994ff8
            X-MS-Exchange-AtpMessagePropertiesSA|SL
            X-MS-Exchange-Organization-SCL1
            X-Microsoft-AntispamBCL:0;ARA:13230040|240411011799012|32142699015|2092899012|3072899012|12012899012|8096899003|20103199012|46300299015|133740200043;
            X-Forefront-Antispam-ReportCIP:54.240.8.76;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:a8-76.smtp-out.amazonses.com;PTR:a8-76.smtp-out.amazonses.com;CAT:NONE;SFS:(13230040)(240411011799012)(32142699015)(2092899012)(3072899012)(12012899012)(8096899003)(20103199012)(46300299015)(133740200043);DIR:INB;
            X-Auto-Response-SuppressDR, OOF, AutoReply
            X-MS-Exchange-CrossTenant-OriginalArrivalTime13 Dec 2024 17:12:23.9478
            X-MS-Exchange-CrossTenant-Network-Message-Id0bc2ff93-f09e-442d-ddab-08dd1b994ff8
            X-MS-Exchange-CrossTenant-Id341c5aad-39be-47a3-901e-146d297ecd80
            X-MS-Exchange-CrossTenant-AuthSourceMWH0EPF000989EB.namprd02.prod.outlook.com
            X-MS-Exchange-CrossTenant-AuthAsAnonymous
            X-MS-Exchange-CrossTenant-FromEntityHeaderInternet
            X-MS-Exchange-Transport-CrossTenantHeadersStampedBL3PR08MB7347
            X-MS-Exchange-Transport-EndToEndLatency00:02:05.7471685
            X-MS-Exchange-Processed-By-BccFoldering15.20.8207.017
            X-Microsoft-Antispam-Mailbox-Deliveryucf:1;jmr:0;auth:0;dest:C;OFR:CustomRules;ENG:(910001)(944506478)(944626604)(920097)(930097)(140003)(1420198);
            X-Microsoft-Antispam-Message-Info=?us-ascii?Q?h+Ed4rwErEjptuQlZAca0d7je9XSUjSCfjy0djIBHoZDgrBl/8mmiq8slW96?=
            dateFri, 13 Dec 2024 18:12:23 +0100

            File Icon

            Icon Hash:c4e1928eacb280a2