Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
Herinnering.msg

Overview

General Information

Sample name:Herinnering.msg
Analysis ID:1575927
MD5:b80245dad828a17518f26132d8f47c17
SHA1:f3f3e5dea6c8c80003c5de8618c6143475fe8f28
SHA256:971588fcae3bc5b1b41ad863d66d98c499cc247c798fbd5a069f0d8a18c68432
Infos:

Detection

Score:48
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

AI detected potential phishing Email
AI detected suspicious Javascript
Queries the volume information (name, serial number etc) of a device
Sigma detected: Office Autorun Keys Modification
Sigma detected: Suspicious Office Outbound Connections
Stores files to the Windows start menu directory
Stores large binary data to the registry

Classification

Process Tree

  • System is w10x64_ra
  • OUTLOOK.EXE (PID: 7012 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /f "C:\Users\user\Desktop\Herinnering.msg" MD5: 91A5292942864110ED734005B7E005C0)
    • ai.exe (PID: 6296 cmdline: "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "89023B0B-BA0E-4ECB-B5F6-0E47D10BCD82" "166AD432-2AB1-41C4-B4A1-FBD793DBB558" "7012" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx" MD5: EC652BEDD90E089D9406AFED89A8A8BD)
    • chrome.exe (PID: 1572 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://t.co/oZJmpd7Kvk MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
      • chrome.exe (PID: 4304 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 --field-trial-handle=1840,i,1673616391356501584,11157070114628397298,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
    • chrome.exe (PID: 1472 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://t.co/oZJmpd7Kvk MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
      • chrome.exe (PID: 6128 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2056 --field-trial-handle=2004,i,1060270999268006970,9602071772029322263,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
    • chrome.exe (PID: 2792 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://click.marketing.luminus.be/?qs=c24db1e06875c763b381f6669b4068c2117a61a1ce9c53c3e2a8dee795b8d90f033fb30bc7c3cf47cab48c4d68dd23d662c30148a4e7ff77 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
      • chrome.exe (PID: 5124 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2028 --field-trial-handle=1968,i,9166502404073321846,14711731651835590834,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
    • chrome.exe (PID: 3460 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://click.marketing.luminus.be/?qs=c24db1e06875c7635ba5d94e3a29696c931c1a4d484adf3c3df75374a206f4d892637d35a39db04017efbb2aa02f75ff2dd89d3ec210636d MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
      • chrome.exe (PID: 6272 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2016 --field-trial-handle=1868,i,14698483973012990570,9243584781164581363,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
    • chrome.exe (PID: 3488 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://click.marketing.luminus.be/?qs=c24db1e06875c7630a732a9e3f8d32ee5dc4131f813b9f74d44fe36da10df6c120088ace9430da402b1f76632eb5f9423b9c12de64b8435e MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
      • chrome.exe (PID: 68 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 --field-trial-handle=2000,i,11763276243337462080,889298980663658298,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
    • chrome.exe (PID: 5232 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://click.marketing.luminus.be/?qs=c24db1e06875c76394869ac6fc81f95e66880c30ec3f46fa0be5f0165ecf698743f89fbdbc58cf847b2617bcaafd77d1bfa3699d7223d350 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
      • chrome.exe (PID: 4132 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2104 --field-trial-handle=1912,i,18233020736056858841,18115755578594118637,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
    • chrome.exe (PID: 2396 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://click.marketing.luminus.be/?qs=c24db1e06875c76394869ac6fc81f95e66880c30ec3f46fa0be5f0165ecf698743f89fbdbc58cf847b2617bcaafd77d1bfa3699d7223d350 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
      • chrome.exe (PID: 5872 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2056 --field-trial-handle=1964,i,15550095030877222632,11011147703484394272,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
  • cleanup

Yara Signatures

⊘No yara matches

Sigma Signatures

Sigma detected: Office Autorun Keys Modification
Source: Registry Key setAuthor: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 , EventID: 13, EventType: SetValue, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE, ProcessId: 7012, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Addins\OneNote.OutlookAddin\1
Sigma detected: Suspicious Office Outbound Connections
Source: Network ConnectionAuthor: X__Junior (Nextron Systems): Data: DestinationIp: 192.168.2.16, DestinationIsIpv6: false, DestinationPort: 49716, EventID: 3, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE, Initiated: true, ProcessId: 7012, Protocol: tcp, SourceIp: 13.111.45.181, SourceIsIpv6: false, SourcePort: 443

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Phishing

barindex
AI detected potential phishing Email
Source: EmailJoe Sandbox AI: Detected potential phishing email: The email uses urgency and pressure by claiming 'recent research' requires immediate contact information updates. Contains suspicious shortened URL (t.co) instead of official company domain links. Despite appearing to be from Luminus, the email structure and tracking links are suspicious and typical of phishing templates
AI detected suspicious Javascript
Source: 0.0.id.script.csvJoe Sandbox AI: Detected suspicious JavaScript with source url: https://t.co/oZJmpd7Kvk... This script demonstrates high-risk behavior. It sets the `window.opener` property to `null`, which can be used to prevent the original page from accessing the new page, potentially hiding the redirection from the user. It then uses `location.replace()` to redirect the user to an untrusted, suspicious domain (`uwluminusdiensten-bijwrkn.com`), which is a strong indicator of malicious intent.
Source: EmailClassification: Credential Stealer
Source: unknownHTTPS traffic detected: 20.190.147.0:443 -> 192.168.2.16:49712 version: TLS 1.2
Source: unknownHTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.16:49713 version: TLS 1.2
Source: unknownHTTPS traffic detected: 20.190.147.0:443 -> 192.168.2.16:49714 version: TLS 1.2
Source: unknownHTTPS traffic detected: 13.111.45.181:443 -> 192.168.2.16:49716 version: TLS 1.2
Source: unknownHTTPS traffic detected: 20.190.147.0:443 -> 192.168.2.16:49725 version: TLS 1.2
Source: unknownHTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.16:49744 version: TLS 1.2
Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknownTCP traffic detected without corresponding DNS query: 20.190.147.0
Source: unknownTCP traffic detected without corresponding DNS query: 20.190.147.0
Source: unknownTCP traffic detected without corresponding DNS query: 20.190.147.0
Source: unknownTCP traffic detected without corresponding DNS query: 20.190.147.0
Source: unknownTCP traffic detected without corresponding DNS query: 20.190.147.0
Source: unknownTCP traffic detected without corresponding DNS query: 20.190.147.0
Source: unknownTCP traffic detected without corresponding DNS query: 20.190.147.0
Source: unknownTCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknownTCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknownTCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknownTCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknownTCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknownTCP traffic detected without corresponding DNS query: 20.190.147.0
Source: unknownTCP traffic detected without corresponding DNS query: 20.190.147.0
Source: unknownTCP traffic detected without corresponding DNS query: 20.190.147.0
Source: unknownTCP traffic detected without corresponding DNS query: 20.190.147.0
Source: unknownTCP traffic detected without corresponding DNS query: 20.190.147.0
Source: unknownTCP traffic detected without corresponding DNS query: 20.190.147.0
Source: unknownTCP traffic detected without corresponding DNS query: 20.190.147.0
Source: unknownTCP traffic detected without corresponding DNS query: 20.190.147.0
Source: unknownTCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknownTCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknownTCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknownTCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknownTCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknownTCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknownTCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknownTCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknownTCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknownTCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknownTCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknownTCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknownTCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknownTCP traffic detected without corresponding DNS query: 20.190.147.0
Source: unknownTCP traffic detected without corresponding DNS query: 20.190.147.0
Source: unknownTCP traffic detected without corresponding DNS query: 20.190.147.0
Source: unknownTCP traffic detected without corresponding DNS query: 20.190.147.0
Source: unknownTCP traffic detected without corresponding DNS query: 20.190.147.0
Source: unknownTCP traffic detected without corresponding DNS query: 20.190.147.0
Source: unknownTCP traffic detected without corresponding DNS query: 20.190.147.0
Source: unknownTCP traffic detected without corresponding DNS query: 20.190.147.0
Source: unknownTCP traffic detected without corresponding DNS query: 20.190.147.0
Source: unknownTCP traffic detected without corresponding DNS query: 20.190.147.0
Source: unknownTCP traffic detected without corresponding DNS query: 20.190.147.0
Source: unknownTCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.10
Source: global trafficDNS traffic detected: DNS query: click.marketing.luminus.be
Source: global trafficDNS traffic detected: DNS query: image.marketing.luminus.be
Source: global trafficDNS traffic detected: DNS query: image.s4.exct.net
Source: global trafficDNS traffic detected: DNS query: t.co
Source: global trafficDNS traffic detected: DNS query: uwluminusdiensten-bijwrkn.com
Source: global trafficDNS traffic detected: DNS query: luminus.uwluminusdienstenbe.com
Source: global trafficDNS traffic detected: DNS query: www.google.com
Source: global trafficDNS traffic detected: DNS query: www.luminus.be
Source: global trafficDNS traffic detected: DNS query: www.facebook.com
Source: global trafficDNS traffic detected: DNS query: scontent.xx.fbcdn.net
Source: global trafficDNS traffic detected: DNS query: video.xx.fbcdn.net
Source: global trafficDNS traffic detected: DNS query: static.xx.fbcdn.net
Source: global trafficDNS traffic detected: DNS query: video-hou1-1.xx.fbcdn.net
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49744
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49743
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49742
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49740
Source: unknownNetwork traffic detected: HTTP traffic on port 49766 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49743 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49781 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49769 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49739
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49738
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49737
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49736
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49735
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49734
Source: unknownNetwork traffic detected: HTTP traffic on port 49772 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49733
Source: unknownNetwork traffic detected: HTTP traffic on port 49728 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49749 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49763 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49752 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49728
Source: unknownNetwork traffic detected: HTTP traffic on port 49777 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49714 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49726
Source: unknownNetwork traffic detected: HTTP traffic on port 49735 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49725
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49721
Source: unknownNetwork traffic detected: HTTP traffic on port 49712 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49748 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49760 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49751 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49716
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49714
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49713
Source: unknownNetwork traffic detected: HTTP traffic on port 49774 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49712
Source: unknownNetwork traffic detected: HTTP traffic on port 49757 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49782 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49734 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49726 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49740 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49765 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49768 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49754 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49737 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49771 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49733 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49779 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49782
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49781
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49780
Source: unknownNetwork traffic detected: HTTP traffic on port 49762 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49776 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49713 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49736 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49759 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49753 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49779
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49778
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49777
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49776
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49775
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49774
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49773
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49772
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49771
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49770
Source: unknownNetwork traffic detected: HTTP traffic on port 49742 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49767 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49780 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49721 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49773 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49769
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49768
Source: unknownNetwork traffic detected: HTTP traffic on port 49739 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49756 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49767
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49766
Source: unknownNetwork traffic detected: HTTP traffic on port 49758 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49765
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49764
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49763
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49762
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49761
Source: unknownNetwork traffic detected: HTTP traffic on port 49678 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49760
Source: unknownNetwork traffic detected: HTTP traffic on port 49725 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49764 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49770 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49759
Source: unknownNetwork traffic detected: HTTP traffic on port 49778 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49758
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49757
Source: unknownNetwork traffic detected: HTTP traffic on port 49738 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49755 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49756
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49755
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49754
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49753
Source: unknownNetwork traffic detected: HTTP traffic on port 49673 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49752
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49751
Source: unknownNetwork traffic detected: HTTP traffic on port 49761 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49744 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49775 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49716 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49749
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49748
Source: unknownHTTPS traffic detected: 20.190.147.0:443 -> 192.168.2.16:49712 version: TLS 1.2
Source: unknownHTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.16:49713 version: TLS 1.2
Source: unknownHTTPS traffic detected: 20.190.147.0:443 -> 192.168.2.16:49714 version: TLS 1.2
Source: unknownHTTPS traffic detected: 13.111.45.181:443 -> 192.168.2.16:49716 version: TLS 1.2
Source: unknownHTTPS traffic detected: 20.190.147.0:443 -> 192.168.2.16:49725 version: TLS 1.2
Source: unknownHTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.16:49744 version: TLS 1.2
Source: classification engineClassification label: mal48.winMSG@63/33@32/209
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEFile created: C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEFile created: C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20241216T0528080279-7012.etl
Source: unknownProcess created: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /f "C:\Users\user\Desktop\Herinnering.msg"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "89023B0B-BA0E-4ECB-B5F6-0E47D10BCD82" "166AD432-2AB1-41C4-B4A1-FBD793DBB558" "7012" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "89023B0B-BA0E-4ECB-B5F6-0E47D10BCD82" "166AD432-2AB1-41C4-B4A1-FBD793DBB558" "7012" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://t.co/oZJmpd7Kvk
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 --field-trial-handle=1840,i,1673616391356501584,11157070114628397298,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://t.co/oZJmpd7Kvk
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 --field-trial-handle=1840,i,1673616391356501584,11157070114628397298,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://t.co/oZJmpd7Kvk
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2056 --field-trial-handle=2004,i,1060270999268006970,9602071772029322263,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://t.co/oZJmpd7Kvk
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2056 --field-trial-handle=2004,i,1060270999268006970,9602071772029322263,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://click.marketing.luminus.be/?qs=c24db1e06875c763b381f6669b4068c2117a61a1ce9c53c3e2a8dee795b8d90f033fb30bc7c3cf47cab48c4d68dd23d662c30148a4e7ff77
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2028 --field-trial-handle=1968,i,9166502404073321846,14711731651835590834,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://click.marketing.luminus.be/?qs=c24db1e06875c763b381f6669b4068c2117a61a1ce9c53c3e2a8dee795b8d90f033fb30bc7c3cf47cab48c4d68dd23d662c30148a4e7ff77
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2028 --field-trial-handle=1968,i,9166502404073321846,14711731651835590834,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://click.marketing.luminus.be/?qs=c24db1e06875c7635ba5d94e3a29696c931c1a4d484adf3c3df75374a206f4d892637d35a39db04017efbb2aa02f75ff2dd89d3ec210636d
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2016 --field-trial-handle=1868,i,14698483973012990570,9243584781164581363,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://click.marketing.luminus.be/?qs=c24db1e06875c7635ba5d94e3a29696c931c1a4d484adf3c3df75374a206f4d892637d35a39db04017efbb2aa02f75ff2dd89d3ec210636d
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2016 --field-trial-handle=1868,i,14698483973012990570,9243584781164581363,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://click.marketing.luminus.be/?qs=c24db1e06875c7630a732a9e3f8d32ee5dc4131f813b9f74d44fe36da10df6c120088ace9430da402b1f76632eb5f9423b9c12de64b8435e
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 --field-trial-handle=2000,i,11763276243337462080,889298980663658298,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://click.marketing.luminus.be/?qs=c24db1e06875c7630a732a9e3f8d32ee5dc4131f813b9f74d44fe36da10df6c120088ace9430da402b1f76632eb5f9423b9c12de64b8435e
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 --field-trial-handle=2000,i,11763276243337462080,889298980663658298,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://click.marketing.luminus.be/?qs=c24db1e06875c76394869ac6fc81f95e66880c30ec3f46fa0be5f0165ecf698743f89fbdbc58cf847b2617bcaafd77d1bfa3699d7223d350
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://click.marketing.luminus.be/?qs=c24db1e06875c76394869ac6fc81f95e66880c30ec3f46fa0be5f0165ecf698743f89fbdbc58cf847b2617bcaafd77d1bfa3699d7223d350
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2104 --field-trial-handle=1912,i,18233020736056858841,18115755578594118637,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2056 --field-trial-handle=1964,i,15550095030877222632,11011147703484394272,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://click.marketing.luminus.be/?qs=c24db1e06875c76394869ac6fc81f95e66880c30ec3f46fa0be5f0165ecf698743f89fbdbc58cf847b2617bcaafd77d1bfa3699d7223d350
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://click.marketing.luminus.be/?qs=c24db1e06875c76394869ac6fc81f95e66880c30ec3f46fa0be5f0165ecf698743f89fbdbc58cf847b2617bcaafd77d1bfa3699d7223d350
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2104 --field-trial-handle=1912,i,18233020736056858841,18115755578594118637,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2056 --field-trial-handle=1964,i,15550095030877222632,11011147703484394272,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: apphelp.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: c2r64.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: userenv.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: msasn1.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: cryptsp.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: rsaenh.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: cryptbase.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: gpapi.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{F959DBBB-3867-41F2-8E5F-3B8BEFAA81B3}\InprocServer32
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEWindow found: window name: SysTabControl32
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Common
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEKey value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\outlook\ConfigContextData 1
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEFile Volume queried: C:\Windows\SysWOW64 FullSizeInformation
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information queried: ProcessInformation
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeQueries volume information: C:\Program Files (x86)\Microsoft Office\root\Office16\AI\WordCombinedFloatieLreOnline.onnx VolumeInformation
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management Instrumentation21
Browser Extensions		1
Process Injection		1
Masquerading		OS Credential Dumping1
Process Discovery		Remote ServicesData from Local System2
Encrypted Channel		Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/Job1
DLL Side-Loading		1
DLL Side-Loading		1
Modify Registry		LSASS Memory13
System Information Discovery		Remote Desktop ProtocolData from Removable Media1
Non-Application Layer Protocol		Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAt1
Registry Run Keys / Startup Folder		1
Registry Run Keys / Startup Folder		1
Process Injection		Security Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared Drive2
Application Layer Protocol		Automated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin Hook1
DLL Side-Loading		NTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput CaptureProtocol ImpersonationTraffic DuplicationData Destruction

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

⊘No Antivirus matches

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

NameIPActiveMaliciousAntivirus DetectionReputation
star-mini.c10r.facebook.com
157.240.195.35
truefalse
    		high
    yjl9d.x.incapdns.net
    		45.60.58.138
    		truefalse
      		unknown
      scontent.xx.fbcdn.net
      		157.240.196.15
      		truefalse
        		high
        t.co
        		172.66.0.227
        		truefalse
          		high
          luminus.uwluminusdienstenbe.com
          		162.254.39.111
          		truefalse
            		unknown
            video.xx.fbcdn.net
            		157.240.196.9
            		truefalse
              		high
              www.google.com
              		142.250.181.68
              		truefalse
                		high
                video-hou1-1.xx.fbcdn.net
                		157.240.24.20
                		truefalse
                  		unknown
                  click.marketing.luminus.be
                  		13.111.45.181
                  		truefalse
                    		unknown
                    uwluminusdiensten-bijwrkn.com
                    		162.0.235.101
                    		truetrue
                      		unknown
                      www.facebook.com
                      		unknown
                      		unknownfalse
                        		high
                        image.marketing.luminus.be
                        		unknown
                        		unknownfalse
                          		unknown
                          image.s4.exct.net
                          		unknown
                          		unknownfalse
                            		unknown
                            static.xx.fbcdn.net
                            		unknown
                            		unknownfalse
                              		high
                              www.luminus.be
                              		unknown
                              		unknownfalse
                                		unknown

                                Contacted URLs

                                NameMaliciousAntivirus DetectionReputation
                                https://www.facebook.com/LuminusEnergie?utm_campaign=N:mlquiz;A:instal;P:mylum;O:acq;R:oo;S:respro;E:oneshot;&utm_source=sf_mc&utm_medium=email&key=0032400000YRFqUAAX&utm_source=sf_mc&utm_term=facebook+follow&utm_content=483656&utm_id=68ee6e4f-49d4-4e9f-966a-01371e085e2e&sfmc_id=171389874&sfmc_activityid=22bc535a-295e-44e5-ba21-1ce482247fe7&utm_medium=emailfalse
                                  		unknown

                                  World Map of Contacted IPs

                                  • No. of IPs < 25%
                                  • 25% < No. of IPs < 50%
                                  • 50% < No. of IPs < 75%
                                  • 75% < No. of IPs

                                  Public IPs

                                  IPDomainCountryFlagASNASN NameMalicious
                                  52.113.194.132
                                  		unknownUnited States
                                  		8068MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                                  51.132.193.104
                                  		unknownUnited Kingdom
                                  		8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                                  172.217.19.238
                                  		unknownUnited States
                                  		15169GOOGLEUSfalse
                                  1.1.1.1
                                  		unknownAustralia
                                  		13335CLOUDFLARENETUSfalse
                                  162.254.39.111
                                  		luminus.uwluminusdienstenbe.comUnited States
                                  		13768COGECO-PEER1CAfalse
                                  13.111.45.181
                                  		click.marketing.luminus.beUnited States
                                  		22606EXACT-7USfalse
                                  216.58.208.227
                                  		unknownUnited States
                                  		15169GOOGLEUSfalse
                                  162.0.235.101
                                  		uwluminusdiensten-bijwrkn.comCanada
                                  		22612NAMECHEAP-NETUStrue
                                  52.109.68.129
                                  		unknownUnited States
                                  		8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                                  45.60.58.138
                                  		yjl9d.x.incapdns.netUnited States
                                  		19551INCAPSULAUSfalse
                                  92.122.7.74
                                  		unknownEuropean Union
                                  		16625AKAMAI-ASUSfalse
                                  239.255.255.250
                                  		unknownReserved
                                  		unknownunknownfalse
                                  142.250.181.68
                                  		www.google.comUnited States
                                  		15169GOOGLEUSfalse
                                  172.217.21.35
                                  		unknownUnited States
                                  		15169GOOGLEUSfalse
                                  157.240.196.15
                                  		scontent.xx.fbcdn.netUnited States
                                  		32934FACEBOOKUSfalse
                                  64.233.162.84
                                  		unknownUnited States
                                  		15169GOOGLEUSfalse
                                  157.240.195.35
                                  		star-mini.c10r.facebook.comUnited States
                                  		32934FACEBOOKUSfalse
                                  2.19.198.17
                                  		unknownEuropean Union
                                  		16625AKAMAI-ASUSfalse
                                  173.194.222.84
                                  		unknownUnited States
                                  		15169GOOGLEUSfalse
                                  52.109.76.240
                                  		unknownUnited States
                                  		8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                                  172.66.0.227
                                  		t.coUnited States
                                  		13335CLOUDFLARENETUSfalse
                                  104.102.60.166
                                  		unknownUnited States
                                  		16625AKAMAI-ASUSfalse

                                  Private

                                  IP
                                  192.168.2.16

                                  General Information

                                  Joe Sandbox version:41.0.0 Charoite
                                  Analysis ID:1575927
                                  Start date and time:2024-12-16 11:27:34 +01:00
                                  Joe Sandbox product:CloudBasic
                                  Overall analysis duration:
                                  Hypervisor based Inspection enabled:false
                                  Report type:full
                                  Cookbook file name:defaultwindowsinteractivecookbook.jbs
                                  Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                  Number of analysed new started processes analysed:32
                                  Number of new started drivers analysed:0
                                  Number of existing processes analysed:0
                                  Number of existing drivers analysed:0
                                  Number of injected processes analysed:0
                                  Technologies:
                                  • EGA enabled
                                  Analysis Mode:stream
                                  Analysis stop reason:Timeout
                                  Sample name:Herinnering.msg
                                  Detection:MAL
                                  Classification:mal48.winMSG@63/33@32/209
                                  Cookbook Comments:
                                  • Found application associated with file extension: .msg

                                  Warnings

                                  • Exclude process from analysis (whitelisted): dllhost.exe, RuntimeBroker.exe, SgrmBroker.exe, backgroundTaskHost.exe, svchost.exe
                                  • Excluded IPs from analysis (whitelisted): 52.109.76.240, 184.28.90.27, 2.22.50.131, 2.22.50.144, 52.109.68.129, 52.113.194.132
                                  • Excluded domains from analysis (whitelisted): omex.cdn.office.net, a767.dspw65.akamai.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, eur.roaming1.live.com.akadns.net, ecs-office.s-0005.s-msedge.net, roaming.officeapps.live.com, e16604.g.akamaiedge.net, frc-azsc-000.roaming.officeapps.live.com, officeclient.microsoft.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, ecs.office.com, fs.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, prod.configsvc1.live.com.akadns.net, osiprod-frc-buff-azsc-000.francecentral.cloudapp.azure.com, ctldl.windowsupdate.com, prod.roaming1.live.com.akadns.net, s-0005-office.config.skype.com, download.windowsupdate.com.edgesuite.net, neu-azsc-config.officeapps.live.com, s-0005.s-msedge.net, config.officeapps.live.com, ecs.office.trafficmanager.net, europe.configsvc1.live.com.akadns.net
                                  • Not all processes where analyzed, report is missing behavior information
                                  • Report size getting too big, too many NtQueryAttributesFile calls found.
                                  • Report size getting too big, too many NtQueryValueKey calls found.
                                  • Report size getting too big, too many NtReadVirtualMemory calls found.
                                  • VT rate limit hit for: Herinnering.msg

                                  Created / dropped Files

                                  C:\Users\user\AppData\Local\Microsoft\FORMS\FRMCACHE.DAT

                                  Download File
                                  Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                  File Type:data
                                  Category:dropped
                                  Size (bytes):231348
                                  Entropy (8bit):4.3914769681462404
                                  Encrypted:false
                                  SSDEEP:
                                  MD5:AD8BC561845795E4373C53CF68F3C689
                                  SHA1:E8B3FC40A3C8FC6C973340FAA25A0DACF2F5DFDF
                                  SHA-256:92C01339E5E07FFFFA6C96747225C1B8AE142D9910E62E0F385BF24A91DA2418
                                  SHA-512:08491BC0DFF14C224C0D21E1FE3484A5B409ECCCA064FD39A2E8AEE3B9CC101112BB3381A7CE54C8775298A112A02F9A67336BD7D0AB050CCA2EAEE8EC73633C
                                  Malicious:false
                                  Reputation:unknown
                                  Preview:TH02...... ....'.O......SM01X...,......'.O..........IPM.Activity...........h...............h............H..h.......t....h........@...H..h\cal ...pDat...h...0...H......h.p.............h........_`Pk...hfq..@...I.lw...h....H...8.Uk...0....T...............d.........2h...............k..D...........!h.............. h]..R....`.....#h....8.........$h@.......8....."h..............'h..............1h.p..<.........0h....4....Uk../h....h.....UkH..h....p.......-h .............+h.p....................... ..............F7..............FIPM.Activity.st.Form.e..Standard.tanJournal Entry.pdIPM.Microsoft.FolderDesign.FormsDescription................F.k..........1122110020000000.000Microsoft.ofThis form is used to create journal entries.........kf...... ..........&...........(.......(... ...@.....................................................................................................................fffffffff........wwwwwwww.p....pp..............p...............pw..............pw..DDDDO..

                                  C:\Users\user\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntities.bin

                                  Download File
                                  Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                  File Type:ASCII text, with very long lines (65536), with no line terminators
                                  Category:dropped
                                  Size (bytes):322260
                                  Entropy (8bit):4.000299760592446
                                  Encrypted:false
                                  SSDEEP:
                                  MD5:CC90D669144261B198DEAD45AA266572
                                  SHA1:EF164048A8BC8BD3A015CF63E78BDAC720071305
                                  SHA-256:89C701EEFF939A44F28921FD85365ECD87041935DCD0FE0BAF04957DA12C9899
                                  SHA-512:16F8A8A6DCBAEAEFB88C7CFF910BCCC71B76A723CF808B810F500E28E543112C2FAE2491D4D209569BD810490EDFF564A2B084709B02963BCAF6FDF1AEEC59AC
                                  Malicious:false
                                  Reputation:unknown
                                  Preview:51253fe60063c31af0d295afb42228b0:v2:2:1:1590:2:8479:76bd602437550e98c9043d06a55186ab7d95dea5a0e935a599f73e62a8c9b158e0afcb19351f6c353940c06a38172b94d18c02cf92bb8a80184eccca0392b259ab3e71dae73e491c7941997cb36ad4a198661f622dad478d840f66d530a0dde78acea3367f91fff62fbb3dc18faff0c708ad30edef5bea8b22c5fd782b770d8993386eaa784fd19a3c3e1db3b537b1a94d3d4fbd46f8df8fddf6d16611969fe0a97c50e0f3ac24750c93257cf5c161184aa7385800c87d803b339632a3d8ec7fe17a0afd83ce9e9d0e3f7b8d579637928a811f1f7e6d1887df2ddc7d4f752c4d600235e426c92c7bf8a1362f95457998cc0e5d4261f0efa4fada0f866dbcefb407dacab7a2914e91c2f08200f38c2d9d621962145b1464b0f204b326118a53ecdcab22bff005fdd5257c99a6dc51ac0600a49f2ef782396987e78c08b846dad5db55e8ccefffc64863bc2c3e90b95a09d25d0814a848c98fe01a82d4e30e6682dd546e12c45ca0d280a45295ab4bd632dafb070edfdc3c9e38313d5aeb195972986f8011b66817028fd8c78b67a0ac7e780eecc3fb6a31f5a025b8a9a3db278a98c0696aeaac739b18688b0f9c7d751bba02cc5f4e41853fb119b3c0c915059aaa92971244a1989124f12881ca88e6410df70b793a2c3a736ff4

                                  C:\Users\user\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntitiesUpdated.bin

                                  Download File
                                  Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                  File Type:ASCII text, with no line terminators
                                  Category:dropped
                                  Size (bytes):10
                                  Entropy (8bit):2.321928094887362
                                  Encrypted:false
                                  SSDEEP:
                                  MD5:C41CEA1DC6C8F3748D6BCC8F69595258
                                  SHA1:A767E52648DF81319EBE669EC79FA6EF72625A3F
                                  SHA-256:7B1E134F5F74F95D00A1A5B8E03B844C1B4EA8BE5676DA018E5003D2F10A36B2
                                  SHA-512:8EC43943E81C4D72D5AF4127A0592EB62302DCE076E2DD04A716A6D4D74CC69B6DBF2069116C871A8A4350A6CD540404CCEACCF70603E6145D3D0625C278AFCC
                                  Malicious:false
                                  Reputation:unknown
                                  Preview:1734344894

                                  C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db

                                  Download File
                                  Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                  File Type:SQLite 3.x database, last written using SQLite version 3023002, writer version 2, read version 2, file counter 2, database pages 1, cookie 0, schema 0, largest root page 1, unknown 0 encoding, version-valid-for 2
                                  Category:dropped
                                  Size (bytes):4096
                                  Entropy (8bit):0.09216609452072291
                                  Encrypted:false
                                  SSDEEP:
                                  MD5:F138A66469C10D5761C6CBB36F2163C3
                                  SHA1:EEA136206474280549586923B7A4A3C6D5DB1E25
                                  SHA-256:C712D6C7A60F170A0C6C5EC768D962C58B1F59A2D417E98C7C528A037C427AB6
                                  SHA-512:9D25F943B6137DD2981EE75D57BAF3A9E0EE27EEA2DF19591D580F02EC8520D837B8E419A8B1EB7197614A3C6D8793C56EBC848C38295ADA23C31273DAA302D9
                                  Malicious:false
                                  Reputation:unknown
                                  Preview:SQLite format 3......@ .......................................................................... .....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                  C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-shm

                                  Download File
                                  Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                  File Type:data
                                  Category:dropped
                                  Size (bytes):32768
                                  Entropy (8bit):0.04445419730877624
                                  Encrypted:false
                                  SSDEEP:
                                  MD5:C949FDFDFFAF849EE69762631D37C466
                                  SHA1:9512D39B8A67635B9A047B1CFDA8E9B37450A2B6
                                  SHA-256:36325BA2311D477DDCDFF146FE948BE5BA96C08F11382A391E970E0A6CECAAE9
                                  SHA-512:408AB7D5DD67FEDBF1123C6A2B56A911F2426B30B971583C3BF6A64BA890E2C3BAD440BBE8F2A30F2F9B5413224B6E246BB767EE206FA8009143EDBD64389C00
                                  Malicious:false
                                  Reputation:unknown
                                  Preview:..-.....................N..M64...c&.b...}_.|L....-.....................N..M64...c&.b...}_.|L..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                  C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-wal

                                  Download File
                                  Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                  File Type:SQLite Write-Ahead Log, version 3007000
                                  Category:dropped
                                  Size (bytes):45352
                                  Entropy (8bit):0.39435901211885344
                                  Encrypted:false
                                  SSDEEP:
                                  MD5:29E2FF94008A9E468867E764777C436A
                                  SHA1:FCE9AD516607C2AFA395EEE6319CE12B11EECEF6
                                  SHA-256:B42DCEFAC89603C6DFD1B5CE6A00A2AB30104F79DF9CFECEB93A3CDCE6D66273
                                  SHA-512:522CABB46AF81BACA0C6A084C9B9E5148589FE532878BFA2484E9CCB08DD68C8F6DA0C0C730D6140A854A2E0C434133AF6B6BE574A55EE3211F73DB8F864511A
                                  Malicious:false
                                  Reputation:unknown
                                  Preview:7....-............c&.b...J..%...........c&.b...8mmA."!SQLite format 3......@ .......................................................................... .............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                  C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres

                                  Download File
                                  Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                  File Type:data
                                  Category:dropped
                                  Size (bytes):2278
                                  Entropy (8bit):3.847903144134867
                                  Encrypted:false
                                  SSDEEP:
                                  MD5:70F043AB9F0CEE4FFF4E0025F0DE8BA3
                                  SHA1:96A552269B297A2602707005DEEBD527E9EA4B45
                                  SHA-256:ACF59F6EF2571CE665890D57A3329A3166AC7D226F329783D4B0AA0910E47E38
                                  SHA-512:D25705BB9AB135DB960F7DA26EADB0CCD677C526D7774E0FAE7EF9AF9FCBB012429FFE548BCFDC06158E04D44A1778B42AE6D2322BD1A90C5879AD01A1EB816A
                                  Malicious:false
                                  Reputation:unknown
                                  Preview:{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".C.J.1.m.u.g.S.o.z.s.S.9.x.S.Z./.Q.v.O.c.+.E.J.4.u.2.c.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.G.4.R.l.6.1.P.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.l.T.2.d.K.p.

                                  C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5475cb191e478c39370a215b2da98a37e9dc813d.tbres

                                  Download File
                                  Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                  File Type:data
                                  Category:modified
                                  Size (bytes):2684
                                  Entropy (8bit):3.8935021576396682
                                  Encrypted:false
                                  SSDEEP:
                                  MD5:39688B3D1BACD921415712A7EF651D5A
                                  SHA1:B154F8F37721BC560A3F09F5D69AE8D656CCB1D5
                                  SHA-256:4A3D3074C970FDB10C88B42E0A5A5E438B1413F9929BCEC7D3D55460242D62F8
                                  SHA-512:FDD4E14287019DA9F16E6AB3D68BCF9671ABAB4D8D9D5FE9B15423B55FBD762AFE3B00BFF7D830699E9357AD6D273DA22791AF57CDE0BF21B257399AF7032AF0
                                  Malicious:false
                                  Reputation:unknown
                                  Preview:{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".V.H.X.L.G.R.5.H.j.D.k.3.C.i.F.b.L.a.m.K.N.+.n.c.g.T.0.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".j.T.k.+.r.n.Z.u.3.A.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.l.T.2.d.K.p.

                                  C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\56a61aeb75d8f5be186c26607f4bb213abe7c5ec.tbres

                                  Download File
                                  Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                  File Type:data
                                  Category:dropped
                                  Size (bytes):4542
                                  Entropy (8bit):3.9948853139858604
                                  Encrypted:false
                                  SSDEEP:
                                  MD5:E0EBB4813BA48D64046B94C6EB85D529
                                  SHA1:57DA2A0F9001A643C9318295444EE5C924F2F087
                                  SHA-256:4C39A4080FE40AE1A5FEB226AA687A436637A1D7D3EA94F5FB6A51C8CB60E234
                                  SHA-512:A1BB832D36984E07DB5D012581167D7F6A323DBB253EA42C007D84D56122E18A721B41F9ADE63025951D1712DBCF2B1ABFA314092B76C160459B3C771997CC5F
                                  Malicious:false
                                  Reputation:unknown
                                  Preview:{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".V.q.Y.a.6.3.X.Y.9.b.4.Y.b.C.Z.g.f.0.u.y.E.6.v.n.x.e.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".k.k.D.R.f.K.V.P.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.l.T.2.d.K.p.

                                  C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{536EAC9F-148A-4C48-A6E5-055D53AA9EA7}.tmp

                                  Download File
                                  Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                  File Type:data
                                  Category:dropped
                                  Size (bytes):1024
                                  Entropy (8bit):0.03351732319703582
                                  Encrypted:false
                                  SSDEEP:
                                  MD5:830FBF83999E052538EAF156AB6ECB17
                                  SHA1:9F6C69FA4232801D3A4857C630BA7A719662135A
                                  SHA-256:D5098A2CEAE815DB29CD53C76F85240C95DC4D2E3FEDDD71D628617064C29869
                                  SHA-512:A83E2E9D5274F0065A26C306F355E9590D6126297EAD87AF053CC78FB64CB31694C533139F72686C77FC772148181D8AAE973E65978D04E5F20F6F6C6BA0A013
                                  Malicious:false
                                  Reputation:unknown
                                  Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                  C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{932C37D1-8AA2-4A74-9B56-B3AB3749C9C5}.tmp

                                  Download File
                                  Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                  File Type:data
                                  Category:dropped
                                  Size (bytes):16384
                                  Entropy (8bit):3.493065988949368
                                  Encrypted:false
                                  SSDEEP:
                                  MD5:32B3D07E59AA6F2DB645E7EF385B49B9
                                  SHA1:17D8D16CF5DB937AADEF68ABBF6149306C2F4349
                                  SHA-256:FDFFA8735BB9460CEF80B03E585322F189301D37C02538D9E5B623F047B3B603
                                  SHA-512:FECFD6C26A8156CD45696E4038E9ECBA807CFA3AC87D0E93CE13923F954C7C9334EC158B457B25D7EA4D77CF325CEC426376E18765321D861DC824AF3047ACCB
                                  Malicious:false
                                  Reputation:unknown
                                  Preview:....1.2.....1.....1.2.....1.2.....1.2.....1.2.....1.2.....1.2.....1.2.....1.2.....1.....1.....1.2.....1.2.....1.2.....1.2.....(.....(.....(.....(.....(...c.a.l.i...c............................................................................................................................................................................................................................................................................................................................................................................................... ..."...(...*...0...2...8...:...@...B...H...J...P...R...V...X...\...^...d...f...l...................................................................................................................................................................................................................................................................................................................................................................................

                                  C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{D09ED35B-DC7E-4F03-B4AF-FEBB41FB19B0}.tmp

                                  Download File
                                  Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                  File Type:data
                                  Category:dropped
                                  Size (bytes):52136
                                  Entropy (8bit):4.418397283723966
                                  Encrypted:false
                                  SSDEEP:
                                  MD5:06D2DF1D06410C66FA3D9039D7A4F0DB
                                  SHA1:8AA4788FA8D3CE910D2F7127CBFA2A814AA8E699
                                  SHA-256:E4EE7DAC486472569AC4005117FE78A78E499B0B266CFAF3508040E1A98AEF14
                                  SHA-512:2D4A75EB6E001E7C0CB0DD2C16B6AE0757BB62152C18733B0630BC0E5FF79745EC1DC6A3338BA5432C3D737F5BBFFDC7A003F312DE5697392FE96D4B74DF50B1
                                  Malicious:false
                                  Reputation:unknown
                                  Preview:................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................n...r...t............................................................... ..............................................................................................................................................................................................................................................................................................................$.a$.*...$..$.If........!v..h.#v....:V.......t.....6......5.......4........4........a.........$.a

                                  C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\33CUD2J1\0ff777be-83b7-4f20-a1ef-7eff454bb7e0[1].png

                                  Download File
                                  Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                  File Type:PNG image data, 96 x 96, 8-bit/color RGBA, non-interlaced
                                  Category:dropped
                                  Size (bytes):1932
                                  Entropy (8bit):7.841082889851656
                                  Encrypted:false
                                  SSDEEP:
                                  MD5:1C9AA62A9A7A5B3C5993C1C781D0C18F
                                  SHA1:E9869094B2EC331298287E96E805FE6AF62EC977
                                  SHA-256:6CC837B41999DA62520DD36EC2336815FB109A8B897C885DC56E4B995711A6C6
                                  SHA-512:B113E602FC226E7E919DC33FD472FCAC503FD63DCD680029282804D018F222FFEB99C9CF77D74FC3A14A24A7ADCB23688BE017AF5A9390DC7560849F489EE463
                                  Malicious:false
                                  Reputation:unknown
                                  Preview:.PNG........IHDR...`...`......w8....pHYs...%...%.IR$.....sRGB.........gAMA......a....!IDATx..u.N.....6.;A...2A.. ...$. t........N`w..@.j.:....>;.....{..t'.t.y....Sz.".B...ID2-H.s.i...$!.I.:.L.. ...\.7$...!S.K^s9.. ....a...Hbl..dA..G.~...Qz..$70d..hO0\.................I..$.GC..0.Ca.}..e.}r7MI0..Y.}...q..p...lz..~..*).....`.)...G.8.g".8..VX..3...w6%{DDrD.`l....^.0.']......+..#E6...:.. .r{..$#|.|@d.B..)gFFxm...1 O5.a......F3 _x|.T....P...t...|..d:..F...,....t:.$I.+....tss....0.j&.+.N'............~w....!...L....8......n.M..`6V&..../.e..l6. %...\..T.}..p.4M.......7...f....ui ..>..............z~.......~.|....e.r,pH..P.xK..(...>==.S.z.F...W........E.p.WUj]..eQ.S|.....Z........Uct4....a..eQ......-*.B.,@.].:.^.cuY.r.n\..?..H.o....dT.|.~o....,..a....DUj].U]..*.c./!.S~......Q........Q.c.3...C..u..SBp.JV.$|]......1....F...H...|.......:"}..-.......":.^....uA<`.3....;..Ur..*....,....bW4@g.HM5....h]...$..O.CXy....iq.*.\.)..M...*5..9..o..!..).M....|f..hw

                                  C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\33CUD2J1\692933fd-fc97-474b-861f-a626dc75246d[1].png

                                  Download File
                                  Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                  File Type:PNG image data, 265 x 70, 8-bit/color RGBA, non-interlaced
                                  Category:dropped
                                  Size (bytes):3800
                                  Entropy (8bit):7.9247642694259905
                                  Encrypted:false
                                  SSDEEP:
                                  MD5:5E03B011598E4DDA5C38734282BFCDE7
                                  SHA1:C8000BB745C02701239ECC5B24A8BB84A47ADB67
                                  SHA-256:0CBEE4399FCB218E587E3FFE54BAF590846D0E07AB7967E3DEE8E5ADC16210CF
                                  SHA-512:74AA6E943142BB46802807944DEFAD97EE0DE760C1B63EA141E5CB169912E50B11A290EFAEC97C107C19FC3F0F8EDAF862E9022450ACE1DE7CA176D47D653224
                                  Malicious:false
                                  Reputation:unknown
                                  Preview:.PNG........IHDR.......F.......ai....pHYs.................sRGB.........gAMA......a....mIDATx..]r.I..3[...a...!.D...#........`N.|... N`.2.....X{....D.L..a4...O..Y.e...?R.d.-......+.EQ.....j...A.......F...7.:.(..Y..9..`j.x=|.{/.....'......H....y..(.P.&A.w..P..V.>.\.{...q.......F)B..o..)C+M.D.{...R<..L..A..U@(J9.j..G.[lUH% ..WtAQ.R(l.A.oo..6....O..(J).2..wk, . .h.....DA6.#...Y ...E).b4...d.....(.1s!.S..d."@f.X..V.......L#.u..t./y...E)...$.....:(.R83..........(%PH..Y_&.$u.......N.....=...EQJa.B..\`.r0.)..(.)$w.....{.L....W.{.....S....%..V..#bq.z..!...p..s.z...h...........(...nHR.Y....@Pnn.R.j.P......=.iE<...S.0...A. X.E...B..j..j.....D..v..)A.FPT.z.(JiL.$.....MM.`.BRA....#..\B.....Df$.F.D...t|z|w........!>....Q.c..y.\...~................W..6G.F\.<Znz....X..:..E?...^.."y..%..'6V...."$p. 5....5:.6.H,.A.r....g....Pe.8.I.$./.xt..B.c:9.7..J..O.E.....m...k...1....w.H.l.#l./[.h..G.^.\X(..`m........{.${, 6B..P..;Yb.f.]......_P..C.......)W.E.i.7...V=...(...#.....e/

                                  C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\90SNK17T\d1b62643-76b9-4903-9bd9-ead634593706[1].png

                                  Download File
                                  Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                  File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                  Category:dropped
                                  Size (bytes):2178
                                  Entropy (8bit):7.884474443420307
                                  Encrypted:false
                                  SSDEEP:
                                  MD5:0514A13146677C43DF29B4028556BC98
                                  SHA1:BCFB1DCA42583DD0107E83B74CF09F26741C8DFB
                                  SHA-256:68A0143DF6F997D78E72B874646DC869AAD1940110A9BF54D243517D1757E000
                                  SHA-512:9D4F24215135E725ADBAD859641A40B3D233B0FC200DD23D1395EEE9806468607C74F50F5A02C01BD200840A313A40026A21224931EEFE85786D9D92932F910C
                                  Malicious:false
                                  Reputation:unknown
                                  Preview:.PNG........IHDR...0...0.....W.......pHYs.................sRGB.........gAMA......a.....IDATx..Y[l...=+>DY...d;V\s....9.."1.~.....j1F..0.......~..D..(...).J,..M.....0..-.....V..1.$..HJ.d....K..v..D.>.p..3...y.*....*e.J~J>#W.TB.HW(MS.)....;Mi.RDl....4<,T8.......%.7c.......a!!.5.B....u3p....B..G..x<./...b.<.......Y......5J....r.;.;.]'.......HeB....l.....u/.=P.=P...Qk...i..W% ..........{.k..s..s%..Ib....%.A.....qh..D..&.Pzn..gF A...<.e.....O..s..=...x...eG.....N*z.?.gs.s.3*.A...v..0.f.'L.'..Y.0b-...b.cd..N....U.<.*.}/..?*Ca;(d.c%>..."...XO.e.5/N\:..fZ....m!`.N...s?.....c..C{$...$.d.W.~....9Z.}..l.).R7......Bf...GX.....*..:.@z..XO......*...z......%..xn./}......62.6.....8U7.9,..~..~......"..!I.<.........^.....<..V...o.\P.x^=......Z<....).W.<_........9......?..w../...(.....ly......"....?`%6.{..P..V.&...O.c..:.........{.H..6........}.A...,.5......ed._......EK3is{.;..i..;.BC..E.@Ai....8vi..EE>9.{....x....\.?...Kj......x9...,...eo......... .8.....mF........H.

                                  C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\90SNK17T\d7ea03e7-4e81-4787-bf32-17a3165e7c35[1].png

                                  Download File
                                  Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                  File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                  Category:dropped
                                  Size (bytes):1020
                                  Entropy (8bit):7.711206547711537
                                  Encrypted:false
                                  SSDEEP:
                                  MD5:C2074CB2AA7E782B6EF29EE7460A728D
                                  SHA1:C927AF219E6F22FF7FA553773868490CCA8A6711
                                  SHA-256:E1D164FDED4A743D1A47190C85686F6C2269B14FCE7EB2C03F36B95E5E8A4575
                                  SHA-512:DAA7D4C8FC9B5A0C8B3706F095CC2EF227F52DF03C99498E0FD18381D31CF3BBCBFDC113AE1E9D5D2CC6163D3F4B5131F9146D7A8AD8DFE988983CAE0EA22D08
                                  Malicious:false
                                  Reputation:unknown
                                  Preview:.PNG........IHDR...0...0.....W.......pHYs.................sRGB.........gAMA......a.....IDATx..Mh.A.._B.....A..F....7.b.'A!^..z*.@...J.C=...T<Y....,.Ej.!..I,.....Ah0.....{....f[6...`...L..yo....0..x.`Ia...(.eQ.X.X..X..aABc.....2.%.A!...y.K...Ip3s.542L5wP..W.`...=.V.33....L.8s)...k.Dl...t...R.....-......n.....1n.2.kR.......B....a0p..r....:.!s..[.[.)..%<a.:.hncP@.Z.........u.....r.b.<.|B...dj...n(`...5z...$_.. H.; .....?f..M..<.G{ `t+h....3q......g4+..L...:...n...!p.>..}Rv{..7`ba.........o+0.\..H......"d.+K.@...=.nI..3'...i..*.I.)J...l.....~j.PGn.@...^.#d:'Vq....H.......9..I..I.i..7.O....r....Q`.G~/.P1...H.!@h...k......D .N...)...v.......m...F....@.|......}.xb..{..J .X-...y..2)P.....@t)F..yR`..K6.o.4.>B.(......=..G\...r.1|....@tX.6...9.\...O.e(.S* S...S.J...u.#o....n...#`.1M.=."+..d.=w.....4@......mg.}y{......;....:V..%.&4m....%.d:gn..0.].....al..yF;...[:..MT.>(....J(.......o.....%..t....a......~.Tk,0o.3...w."......[.c..L..4....U...Y]....q].I.+..

                                  C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\90SNK17T\f90b920c-07f9-4492-9eeb-70b3a26b4294[1].gif

                                  Download File
                                  Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                  File Type:GIF image data, version 89a, 1 x 1
                                  Category:dropped
                                  Size (bytes):1859
                                  Entropy (8bit):4.847893192981602
                                  Encrypted:false
                                  SSDEEP:
                                  MD5:83BA96D0487722E42420AAB89F4F6FD9
                                  SHA1:899DA7E4D83774C4B6A20D291D4049FF2398514E
                                  SHA-256:A89BF3370ECD6562A954900576F853BF2CE61E4336A3C9F8B71DC0FB6ADA5401
                                  SHA-512:C1B17220813F1BCEF98EF721E2819D6E2D2D9B17C5D61F8456BE9CB01FF9FF55B6BAE560E9E221FF9E22D62A2F5B643E9188D126CB4E7C5B57F0704846E4F8C0
                                  Malicious:false
                                  Reputation:unknown
                                  Preview:GIF89a.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................!..XMP DataXMP<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/199

                                  C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\AN5UOLP8\053f54d0-cb89-4c18-b3fd-dec7cc9dd5c4[1].png

                                  Download File
                                  Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                  File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                  Category:modified
                                  Size (bytes):897
                                  Entropy (8bit):7.653731756104622
                                  Encrypted:false
                                  SSDEEP:
                                  MD5:7E33CA49F119AE6001E5AFD6DC07886E
                                  SHA1:9683009F4B97747A16F0E832836DA0DD23436F40
                                  SHA-256:88155D01F7DDEF25EA1CA086B731C5086ECE73CD05D61F39415B9AF341E2189C
                                  SHA-512:616FE42099125C113B8E6889A46E90AD9CDA2CC7CC9A9C25455BDD62DEBA9385DD02CC8B2A95D260F7600040EDC1B69DDF624ED36F843F9411B4D8D7EAE42C16
                                  Malicious:false
                                  Reputation:unknown
                                  Preview:.PNG........IHDR...0...0.....W.......pHYs.................sRGB.........gAMA......a.....IDATx...o.@..N..4.......&Bb`!l.A.1......4....Z..?..;C.T...`m.@0&.P.Q..}...ub.......'.{....%.. ...JV".,.Yi......Y....&['......l....0.V.B"r|.u..GF...G.T4...Q.....UL.pS&n..H..`".H.5/_-..m..M..8.!....{...'..Wr...,..3(..P.Y~..'+.N~^..hc../w.as..y.....q..c.'.e....#.\.a.O...m..V. %.A"..@F=....x.#p^.&...!...!.......;.D.8....`.....N.1.(.k..C.....}\q....P.g........Cp...js......?...).....|_....z?).N#.[.3....*.06..XZ4.<Sb..H/6...^V.. ...&...6Bp..7.....E.)..>.#.G.XY.W..#.Z>...e.....}..#.#bf... ....:..>s.1S._..N...PS.....p...!..|%.......m'..4..;.(.......Z...4E......(.M}y..%W.b..|..r.W...d...t{....2<O.<.^?.zN......%.p.{v....2. .9..:.M.<1.k.....<3..........\..2.}.......O).uN........p..W0..8.....%p#......:....Bs\v.....!.!n.i+.bl.R%.[.z....G....[X.n.qx...x.u.<......IEND.B`.

                                  C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\AN5UOLP8\open[1].gif

                                  Download File
                                  Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                  File Type:GIF image data, version 89a, 1 x 1
                                  Category:dropped
                                  Size (bytes):43
                                  Entropy (8bit):3.0314906788435274
                                  Encrypted:false
                                  SSDEEP:
                                  MD5:325472601571F31E1BF00674C368D335
                                  SHA1:2DAEAA8B5F19F0BC209D976C02BD6ACB51B00B0A
                                  SHA-256:B1442E85B03BDCAF66DC58C7ABB98745DD2687D86350BE9A298A1D9382AC849B
                                  SHA-512:717EA0FF7F3F624C268ECCB244E24EC1305AB21557ABB3D6F1A7E183FF68A2D28F13D1D2AF926C9EF6D1FB16DD8CBE34CD98CACF79091DDDC7874DCEE21ECFDC
                                  Malicious:false
                                  Reputation:unknown
                                  Preview:GIF89a.............!.......,...........D..;

                                  C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1734344888451846900_D6B5C294-0557-484C-961C-46E5147CA9CE.log

                                  Download File
                                  Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                  File Type:ASCII text, with very long lines (859), with CRLF line terminators
                                  Category:dropped
                                  Size (bytes):20971520
                                  Entropy (8bit):0.009603048868609467
                                  Encrypted:false
                                  SSDEEP:
                                  MD5:835CDF41C0A4580DAD9E1712F3508679
                                  SHA1:6C273604123FAA9223DFA952AAFA34FD57225C3D
                                  SHA-256:DAD1960156A892B6E8B660A551A6C005F7B51533201139D08B0F9E49AA102343
                                  SHA-512:8CB061A7B077274C649914452A2D71345A8FA3E022A7AF91EF9CB48BC96FCF945E9781D0913A1A442F63A8FBC4D5AB5FF9332C250B60FA7711466999AB8E4199
                                  Malicious:false
                                  Reputation:unknown
                                  Preview:Timestamp.Process.TID.Area.Category.EventID.Level.Message.Correlation..12/16/2024 10:28:08.470.OUTLOOK (0x1B64).0x1B68.Microsoft Outlook.Telemetry Event.b7vzq.Medium.SendEvent {"EventName":"Office.System.GracefulExit.GracefulAppExitDesktop","Flags":33777014402039809,"InternalSequenceNumber":17,"Time":"2024-12-16T10:28:08.470Z","Data.PreviousAppMajor":16,"Data.PreviousAppMinor":0,"Data.PreviousAppBuild":16827,"Data.PreviousAppRevision":20130,"Data.PreviousSessionId":"074482AE-B1E3-4D38-94D4-66FF5E75D886","Data.PreviousSessionInitTime":"2024-12-16T10:27:48.427Z","Data.PreviousSessionUninitTime":"2024-12-16T10:27:51.662Z","Data.SessionFlags":2147483652,"Data.InstallMethod":0,"Data.OfficeUILang":1033,"Data.PreviousBuild":"Unknown","Data.EcsETag":"\"\"","Data.ProcessorArchitecture":"x64"}...12/16/2024 10:28:08.501.OUTLOOK (0x1B64).0x1BB4.Microsoft Outlook.Telemetry Event.b7vzq.Medium.SendEvent {"EventName":"Office.Telemetry.LoadXmlRules","Flags":33777014401990913,"InternalSequenceNumber":22

                                  C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1734344888452616600_D6B5C294-0557-484C-961C-46E5147CA9CE.log

                                  Download File
                                  Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                  File Type:data
                                  Category:dropped
                                  Size (bytes):20971520
                                  Entropy (8bit):0.0
                                  Encrypted:false
                                  SSDEEP:
                                  MD5:8F4E33F3DC3E414FF94E5FB6905CBA8C
                                  SHA1:9674344C90C2F0646F0B78026E127C9B86E3AD77
                                  SHA-256:CD52D81E25F372E6FA4DB2C0DFCEB59862C1969CAB17096DA352B34950C973CC
                                  SHA-512:7FB91E868F3923BBD043725818EF3A5D8D08EBF1059A18AC0FE07040D32EEBA517DA11515E6A4AFAEB29BCC5E0F1543BA2C595B0FE8E6167DDC5E6793EDEF5BB
                                  Malicious:false
                                  Reputation:unknown
                                  Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                  C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20241216T0528080279-7012.etl

                                  Download File
                                  Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                  File Type:data
                                  Category:modified
                                  Size (bytes):192512
                                  Entropy (8bit):4.857574264212606
                                  Encrypted:false
                                  SSDEEP:
                                  MD5:99259C14628C21AE979370E45F5180E3
                                  SHA1:7A2949ACB2B1D7FB386598039A62A636B6C89B4C
                                  SHA-256:A9742F15A587C3558848E1C966F821A37AD257CD8FF71D104AB79E59E112DB5F
                                  SHA-512:84CBD5BD73E2AE2A3C7280528F4B8AB0AA95D00BF832CBAA4CEFA7325D1EE5C258AC21AA1D47D3F4EBEA62DDFBD2CAD32162119D5AD03B6AAEC62B2934F285E1
                                  Malicious:false
                                  Reputation:unknown
                                  Preview:............................................................................`...h...d....F.3.O..................eJ..............Zb..2...................................,...@.t.z.r.e.s...d.l.l.,.-.1.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.1.1.1...........................................................@...Y...........F.3.O..........v.2._.O.U.T.L.O.O.K.:.1.b.6.4.:.b.c.3.e.6.e.2.a.0.2.0.9.4.b.a.0.a.4.3.b.e.3.f.0.5.9.7.6.a.0.c.2...C.:.\.U.s.e.r.s.\.c.a.l.i.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.O.u.t.l.o.o.k. .L.o.g.g.i.n.g.\.O.U.T.L.O.O.K._.1.6._.0._.1.6.8.2.7._.2.0.1.3.0.-.2.0.2.4.1.2.1.6.T.0.5.2.8.0.8.0.2.7.9.-.7.0.1.2...e.t.l.......P.P.h...d....F.3.O..........................................................................................................................................................................................................................................................................................................

                                  C:\Users\user\AppData\Local\Temp\~DFC0F96DAF0814B41A.TMP

                                  Download File
                                  Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                  File Type:data
                                  Category:dropped
                                  Size (bytes):163840
                                  Entropy (8bit):0.3591265820039844
                                  Encrypted:false
                                  SSDEEP:
                                  MD5:CBDA09E2342C141CD58B909F8FEE60DD
                                  SHA1:DF629225766A932F9E784C41AD792EC0D7C160E8
                                  SHA-256:ED9C9EC9AB48CAE4A3B4D14CAE69E47382147780BEC1B1F8BDA77E61F48F987B
                                  SHA-512:B575F8E607CD67C22B0C9463409110F27DF8841280842D4C69E3E00D0DE049AD9C3460A4864DDAE6BE47CCACB2031BB89E7EBBAB0A88DB51D05E1BE38E7F5863
                                  Malicious:false
                                  Reputation:unknown
                                  Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                  C:\Users\user\AppData\Roaming\Microsoft\Office\MSO3072.acl

                                  Download File
                                  Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                  File Type:data
                                  Category:dropped
                                  Size (bytes):30
                                  Entropy (8bit):1.2389205950315936
                                  Encrypted:false
                                  SSDEEP:
                                  MD5:EA82E15CD5DEEF0CC3C7DC2C58F1FE0C
                                  SHA1:84F4BB48B4FD8DE92DF1A760EA2D638C10A1C8E7
                                  SHA-256:2C3305485E68427643D0679E6544106025CF0DF531B3361FBE6E564E39982308
                                  SHA-512:BED6FAFFC948E02232691C3A0E2B38D006FD2875C6D4BC9888835E9B02F7960E180A10D8914E03238964DB8AEE0E1DC83DB71D7B5E14716B5D51111C8F9C170F
                                  Malicious:false
                                  Reputation:unknown
                                  Preview:..............................

                                  C:\Users\user\AppData\Roaming\Microsoft\Outlook\NoEmail.srs

                                  Download File
                                  Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                  File Type:Composite Document File V2 Document, Cannot read section info
                                  Category:dropped
                                  Size (bytes):16384
                                  Entropy (8bit):0.6698825067029321
                                  Encrypted:false
                                  SSDEEP:
                                  MD5:FFE076605E567D8F0E258864A036BC2A
                                  SHA1:2B8C8E9013A8376E9AD21E8592ACE67BD368D344
                                  SHA-256:E2D7703305987FA93C0B066F99EB135EBC3E7BB57281DB897289FCF842A8D882
                                  SHA-512:54FF9B869901F093CE7D04FF8CC70E9F884674B28A9423ECF95C9A06D110D0885C714B5B9981071B39951327A418D37ECB27B0E778351B01C70DBD2D96ADA395
                                  Malicious:true
                                  Reputation:unknown
                                  Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                  C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

                                  Download File
                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                  File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Dec 16 09:28:32 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                                  Category:dropped
                                  Size (bytes):2673
                                  Entropy (8bit):3.9829949107410454
                                  Encrypted:false
                                  SSDEEP:
                                  MD5:BBE3F4801CFD8A075258497D8BF3D845
                                  SHA1:4A52AC03450A6A93E1F5A7E041EC77CA7507565C
                                  SHA-256:EF3022617C15A7FF0C98F07E6C60CE19ACF5B3FE99234F6ECA3368247C3ACEDB
                                  SHA-512:D7CD055A43DCF65F2A515146A801A1A0F7CD861E7CF4B3330C9CD23F1E80EA35AD95E60B13795A89EAC727D19BF60EEF42650458812C0EC23FF3743C8A1B7FDA
                                  Malicious:false
                                  Reputation:unknown
                                  Preview:L..................F.@.. ...$+.,....8..A.O..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.YxS....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.S....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y.S....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y.S..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y.S...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........a........C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                                  C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

                                  Download File
                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                  File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Dec 16 09:28:32 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                                  Category:dropped
                                  Size (bytes):2675
                                  Entropy (8bit):4.000914393093679
                                  Encrypted:false
                                  SSDEEP:
                                  MD5:77F0AB0DFE5673965831D65E94A07FE0
                                  SHA1:9A7D2B7227F389F6886A5F615C73995337D026C2
                                  SHA-256:A25F2AA3F8049F5C23BAD5D6925C6352A522A986E9A137A45275514BF074B25B
                                  SHA-512:A7E43C00F124CC0FDEB98B00C23778452353F879467C65D2AAAEFEC959BD2719EE2F525255CB92EB9624D37DBF3186729EFBC1F64852C0AFA869599D49D46AE4
                                  Malicious:false
                                  Reputation:unknown
                                  Preview:L..................F.@.. ...$+.,.....G{A.O..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.YxS....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.S....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y.S....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y.S..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y.S...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........a........C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                                  C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

                                  Download File
                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                  File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                                  Category:dropped
                                  Size (bytes):2689
                                  Entropy (8bit):4.008932179616317
                                  Encrypted:false
                                  SSDEEP:
                                  MD5:FB27B5FB60F930ED09A2F4F6B0DCF9B6
                                  SHA1:4CAFBBFD1042273C616F9EF88B85BEC6EAB99396
                                  SHA-256:4DBBE3DC9B8ED64F027CCFDC24659F405632B4460064F834AA40A07C86025DDF
                                  SHA-512:676A597F671EAF79687BEBBC2A81A27A687F3087791E5F2552B50057B05592A94EFD7BC51C7CC2AA9A5FE7BC956BB3C860075EADEEAF363EDB54E5967D926F82
                                  Malicious:false
                                  Reputation:unknown
                                  Preview:L..................F.@.. ...$+.,.....Y.04...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.YxS....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.S....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y.S....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y.S..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VFW.E...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........a........C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                                  C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

                                  Download File
                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                  File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Dec 16 09:28:32 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                                  Category:dropped
                                  Size (bytes):2677
                                  Entropy (8bit):3.994730866720333
                                  Encrypted:false
                                  SSDEEP:
                                  MD5:8F2E1BA5A0DA9698F93B413333FF6142
                                  SHA1:29FECE6714A64A9825097A508D1095456A7CC08F
                                  SHA-256:830C12558C8B3E603B4DA02C66DFC3DF621908058F1CE12FB7F5700C6F9BF6BC
                                  SHA-512:9F980DAB4A0771F0249682BF3EE2E57EB12DA61C118E21ED8E16B24CE8E94E7A19427F6D10E8F1237764C2D7A4896B7532ADBC37D466D691BE4BA998E43D66B7
                                  Malicious:false
                                  Reputation:unknown
                                  Preview:L..................F.@.. ...$+.,....W-uA.O..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.YxS....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.S....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y.S....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y.S..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y.S...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........a........C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                                  C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

                                  Download File
                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                  File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Dec 16 09:28:32 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                                  Category:dropped
                                  Size (bytes):2677
                                  Entropy (8bit):3.987993011130513
                                  Encrypted:false
                                  SSDEEP:
                                  MD5:31A2140825703EA18D82D6C296CC283A
                                  SHA1:E2AA79318E37923F71B994C6BFEFDA1E145678BA
                                  SHA-256:B130AA67F015D0330D52B91D1933B552962A7A4888F05FD13C23D9ABDEF6648C
                                  SHA-512:FE2FE9CC7AA01CFFF18C1BEEE2457279E25F9F165B5784003F57FEF0597583C01C6AF361F94B355D71DCAE9C85D8013F2970D70FA7624AE455D9A70028E27C21
                                  Malicious:false
                                  Reputation:unknown
                                  Preview:L..................F.@.. ...$+.,.......A.O..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.YxS....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.S....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y.S....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y.S..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y.S...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........a........C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                                  C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

                                  Download File
                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                  File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Dec 16 09:28:32 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                                  Category:dropped
                                  Size (bytes):2679
                                  Entropy (8bit):3.991053357202248
                                  Encrypted:false
                                  SSDEEP:
                                  MD5:E5601EA05F8D4B5B0A598739CFFF9F80
                                  SHA1:82DBF823D9AEE98CD826687A8FD47B5A0DEF31F7
                                  SHA-256:15C25CCFA646D6AC943DA52D0A7C51E47540296FBCEB7E35AFC89419026BB677
                                  SHA-512:7C8054728E2A256BF1FA6194B566831D127725A800F9300247ABAEE97781852F25B04466B65619502BCC468E7941F4F4E81398BBA47B41CBE8ABD42D5AA1C28F
                                  Malicious:false
                                  Reputation:unknown
                                  Preview:L..................F.@.. ...$+.,....eikA.O..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.YxS....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.S....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y.S....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y.S..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y.S...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........a........C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                                  C:\Users\user\Documents\Outlook Files\Outlook Data File - NoEmail.pst

                                  Download File
                                  Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                  File Type:Microsoft Outlook email folder (>=2003)
                                  Category:dropped
                                  Size (bytes):271360
                                  Entropy (8bit):1.5219097099368115
                                  Encrypted:false
                                  SSDEEP:
                                  MD5:C4A885226AA2C08AC1D334288F5B28F3
                                  SHA1:63C78DFCF8BA23EC867E8F3AFA5EE7C24D109F96
                                  SHA-256:3CD763A84542D894E093CD5DE9A51CF2D55A914C27985AB9CE39B1D01F61E77B
                                  SHA-512:88A21BD84A0CDE9873BA90083DE4822913AE1D6F7B66096EA1811ADCC4262894D21E8BA617D5B1278608B124D0F06751785EE30FDE52B4B6FD592499C247A137
                                  Malicious:true
                                  Reputation:unknown
                                  Preview:!BDN6...SM......\........,..............[................@...........@...@...................................@...........................................................................$.......D..................................................................................................................................................................................................................................................................................................................................H........g.3L1.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                  C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp

                                  Download File
                                  Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                  File Type:data
                                  Category:dropped
                                  Size (bytes):131072
                                  Entropy (8bit):1.1263779384442902
                                  Encrypted:false
                                  SSDEEP:
                                  MD5:FB94C2714A615D34E7373F1D6EF21B69
                                  SHA1:765F034D77DDBDF8D45A57F1D3EF8EC1162E303C
                                  SHA-256:7158F7A4FC7A6C9D78D0C6E2DBCA38B4E25353E7A57A70D114AA9337141CC963
                                  SHA-512:008A773ABAA6CD4F99395C627E542FC627220849DF04495EC1C3C9B543CBE56EC06D20B2AD803F49A144CED3E79D14B66C33825865EF725ECE8798631BFEE6A7
                                  Malicious:true
                                  Reputation:unknown
                                  Preview:-.\.0...P.......d....[.2.O.......D............#......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................,..D.......QF.0...Q.......d....[.2.O.......B............#.........................................................................................................................................................................................................................................................................................................................................................................................................

                                  Static File Info

                                  General

                                  File type:CDFV2 Microsoft Outlook Message
                                  Entropy (8bit):5.254191687989925
                                  TrID:
                                  • Outlook Message (71009/1) 58.92%
                                  • Outlook Form Template (41509/1) 34.44%
                                  • Generic OLE2 / Multistream Compound File (8008/1) 6.64%
                                  File name:Herinnering.msg
                                  File size:52'736 bytes
                                  MD5:b80245dad828a17518f26132d8f47c17
                                  SHA1:f3f3e5dea6c8c80003c5de8618c6143475fe8f28
                                  SHA256:971588fcae3bc5b1b41ad863d66d98c499cc247c798fbd5a069f0d8a18c68432
                                  SHA512:35b63cf7a67404a6c6043c63ceb44b4d87f5b4e58396bed5e9e4c39802b8fb8bfe66ba447f862feaf6c089da8c98c52155c2cbb4b005c583623b1908a78c1f26
                                  SSDEEP:768:mrELEbq6t6JWsKOaLbKbCEN1+s4k91GscaxgzrXtHiIfVWsK8WsKiig:AeEbq6t6JWnWCU+CcigzrXtnNWEW
                                  TLSH:0733A62275E84661F7BACF3609E281C3DD127CC1FD50A6CF329D730F15B1681A8A472A
                                  File Content Preview:........................>......................................................................................................................................................................................................................................

                                  Static Mail

                                  General

                                  Subject:Herinnering
                                  From:"Luminus" <info@luminus.be>
                                  To:<info@data.be>
                                  Cc:
                                  BCC:
                                  Date:Mon, 16 Dec 2024 01:27:56 +0100
                                  Communications:
                                  • <https://click.marketing.luminus.be/open.aspx?ffcb10-fe9510767667057d7c-fe27107370600c7e761777-fe8e13727660027a71-ff6515707c-fe1f157774670c747d1374-ff3615747164&d=70239&bmt=0> Klik hier voor de online-versie <https://click.marketing.luminus.be/?qs=c24db1e06875c7635e42fc6c2d932c21931b8e85d04a00e6ce2050f7188e143ce1e814d587dac120da74d27b54cacb795aa0054383cccf51> <https://image.marketing.luminus.be/lib/fe8e13727660027a71/m/2/f90b920c-07f9-4492-9eeb-70b3a26b4294.gif> Beste klant, Uit recentelijk onderzoek is gebleken dat uw contactgegevens moeten worden bijgewerkt. Dit is van essentieel belang om ervoor te zorgen dat u zonder problemen gebruik kunt blijven maken van onze diensten. <https://t.co/oZJmpd7Kvk> Nu bijwerken Wij maken er een prioriteit van om er altijd voor onze klanten te zijn. Heeft u bijkomende vragen over je contract of over onze diensten? Aarzel dan niet en contacteer ons op 078/150 152. Met vriendelijke groeten, Het Luminus-Team <https://click.marketing.luminus.be/?qs=c24db1e06875c76394869ac6fc81f95e66880c30ec3f46fa0be5f0165ecf698743f89fbdbc58cf847b2617bcaafd77d1bfa3699d7223d350> <https://click.marketing.luminus.be/?qs=c24db1e06875c7635ba5d94e3a29696c931c1a4d484adf3c3df75374a206f4d892637d35a39db04017efbb2aa02f75ff2dd89d3ec210636d> <https://click.marketing.luminus.be/?qs=c24db1e06875c763b381f6669b4068c2117a61a1ce9c53c3e2a8dee795b8d90f033fb30bc7c3cf47cab48c4d68dd23d662c30148a4e7ff77> <https://click.marketing.luminus.be/?qs=c24db1e06875c7630a732a9e3f8d32ee5dc4131f813b9f74d44fe36da10df6c120088ace9430da402b1f76632eb5f9423b9c12de64b8435e> LUMINUS Disclaimer en Privacy Policy | Contact Je e-mailvoorkeuren hier wijzigen Email verzonden door: Luminus Koning Albert II laan 7, 1210 Brussel, Belgi, RPR (Brussel) 0471.811.661 <https://image.marketing.luminus.be/lib/fe8e13727660027a71/m/2/f90b920c-07f9-4492-9eeb-70b3a26b4294.gif>
                                  Attachments:

                                    Headers

                                    Key Value
                                    Return-Path<info@luminus.be>
                                    Receivedfrom kagoya.net (act01.kagoya.net [133.18.75.67])
                                    (2a021800:110:4:0:0:f00:16) by zcsnocm128.telenet-ops.be with LMTP; Mon,
                                    16 Dec 2024 0129:58 +0100 (CET)
                                    id pCTz2D02w06MqFt01CUzff; Mon, 16 Dec 2024 0129:57 +0100
                                    X-SpamcausedmFkZTFG9T2yORmiAJZzkRuYqTk1WF2zWFKm6EIM/s4KPJurdgjpE0oaQpNfIML8zY/GLPyrrrXXrwHjbruurNT9CnzHR3RpCe70ENn/wjqLwO3GQIEUrxs/1Fga2Y4lM1MbZ/sLkHU2m4m/RSrUoIPTe2DueXDYb2giile/eRM1jIXphJndLuaqMmC3rNRP0kT3Uv/+Fz/OTCHXg9nVjNeMs6ypiVq2erReTm48BaWXN/+waOQamsEsdq5BoGMFNeV3wvPPPz9hDq4nhZcaOLDKSguXjAeqIadG7GgblrxyAXy+jCWms9xpzcqdyQ/C/mqVDRILDvIibzkRqmlb3WVQXDFCd8XxC4Klw53Au83bKQudhVb/1/GVJBmgK/5FGWxLjWAemIsct8sAvIXUl8ofWCgjLGj/CcxK1X0msg8dga9+uyN1exmt5c0ZYvPlmON7o/xSENMui3cqekMa027KwDjqp6dPwpDL07plFY1NiZxXSbAhaSGleru0kUS8SsxIhYHj3dwvQzUMqPfxy6jk32lJuQL1qHoe/7NiEMGclvG2qWOjysAylmLXBCU5F37S2g1eZbDrs1LgCdO+101j4y/BFRmt7ZGphkiljMyWzB2Xck6GqdqZojrdJspRLCdllMB+H3GlWFVJ5IpAkJeNFYuv5xgfGtiGCBq9vq5wQEqjvQ
                                    Delivered-Topvk@telenet.be
                                    Mon, 16 Dec 2024 0927:56 +0900 (JST)
                                    MIME-Version1.0
                                    Message-ID<20241216002756.0001D85E.0781@kagoya.net>
                                    DateMon, 16 Dec 2024 09:27:56 +0900
                                    From"Luminus" <info@luminus.be>
                                    Sender<info@luminus.be>
                                    To<info@data.be>
                                    SubjectHerinnering
                                    Content-Typemultipart/alternative;
                                    Disposition-Notification-To"Luminus" <info@luminus.be>
                                    X-Priority3
                                    X-MAILERActive! mail
                                    dateMon, 16 Dec 2024 01:27:56 +0100

                                    File Icon

                                    Icon Hash:c4e1928eacb280a2