Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
5diately.msg

Overview

General Information

Sample name:5diately.msg
renamed because original name is a hash value
Original sample name:Fw Item shared with you Unuthrized Lg-In Nticed - Pls Rviw Your Aunt Immdiately.msg
Analysis ID:1580001
MD5:7f1aa2d6460550f65f31c1ff5d8d26a2
SHA1:941492c6b390d39fda5b76d7c2c73a621b02ed93
SHA256:e0dc5d2ee93a312d18124bd317fadc22c46400ca3bbdd12c73ffee8fba5b7c4b
Infos:

Detection

Score:56
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

AI detected phishing page
AI detected landing page (webpage, office document or email)
AI detected potential phishing Email
HTML body contains low number of good links
HTML body contains password input but no form action
HTML page contains hidden javascript code
HTML page contains obfuscated script src
Queries the volume information (name, serial number etc) of a device
Sigma detected: Office Autorun Keys Modification
Stores files to the Windows start menu directory
Stores large binary data to the registry

Classification

Process Tree

  • System is w10x64_ra
  • OUTLOOK.EXE (PID: 1608 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /f "C:\Users\user\Desktop\5diately.msg" MD5: 91A5292942864110ED734005B7E005C0)
    • ai.exe (PID: 1228 cmdline: "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "7A3775C4-277D-44C4-968F-1E2607DA7F13" "841B4473-A12B-4E08-A3F9-32E771B1975D" "1608" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx" MD5: EC652BEDD90E089D9406AFED89A8A8BD)
    • chrome.exe (PID: 1836 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://drive.google.com/file/d/1ZZpf4Zlhtjh56ENC16Nv6BpqzFszHoSg/view?usp=sharing_eip&ts=676471c2 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
      • chrome.exe (PID: 5672 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2104 --field-trial-handle=1876,i,10324559526721791315,4912027283420163942,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
  • cleanup

Yara Signatures

⊘No yara matches

Sigma Signatures

Sigma detected: Office Autorun Keys Modification
Source: Registry Key setAuthor: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: 2, EventID: 13, EventType: SetValue, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE, ProcessId: 1608, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Outlook\AddinsData\ColleagueImport.ColleagueImportAddin\LoadCount

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Phishing

barindex
AI detected phishing page
Source: https://online.access.secure001.chase-business.com/web/auth/dashboard/dashboard/index/indexJoe Sandbox AI: Score: 9 Reasons: The legitimate domain for Chase is chase.com., The URL contains additional subdomains and elements such as 'online', 'access', 'secure001', and 'chase-business', which are not part of the official Chase domain., The presence of multiple hyphens and subdomains is a common tactic used in phishing to mimic legitimate sites., Chase is a well-known financial institution, and its official online services are typically hosted on chase.com or subdomains directly under chase.com., The URL does not match the full legitimate domain name associated with Chase. DOM: 6.13.pages.csv
AI detected landing page (webpage, office document or email)
Source: EmailJoe Sandbox AI: Page contains button: 'Open' Source: 'Email'
Source: EmailJoe Sandbox AI: Email contains prominent button: 'open'
AI detected potential phishing Email
Source: EmailJoe Sandbox AI: Detected potential phishing email: The email uses a suspicious domain 'monitor.accesssecurelogin.me' which is a clear red flag. The subject line contains intentionally misspelled words ('Unuthrized Lg-In') to evade spam filters. The email is mass-sent to many recipients with unusual email patterns (multiple addresses with '+' symbols)
Source: https://online.access.secure001.chase-business.com/web/auth/dashboard/dashboard/index/indexHTTP Parser: Number of links: 0
Source: https://online.access.secure001.chase-business.com/web/auth/dashboard/dashboard/index/indexHTTP Parser: <input type="password" .../> found but no <form action="...
Source: https://online.access.secure001.chase-business.com/secure/HTTP Parser: Base64 decoded: function _0x5f48(_0x2c5e02,_0xe19f15){var _0x1b34d0=_0x1b34();return _0x5f48=function(_0x5f482d,_0x502389){_0x5f482d=_0x5f482d-0x143;var _0x72c7d7=_0x1b34d0[_0x5f482d];return _0x72c7d7;},_0x5f48(_0x2c5e02,_0xe19f15);}(function(_0x471b0b,_0x52b3dd){var _0x...
Source: https://online.access.secure001.chase-business.com/secure/HTTP Parser: Script src: data:text/javascript;base64,ZnVuY3Rpb24gXzB4NWY0OChfMHgyYzVlMDIsXzB4ZTE5ZjE1KXt2YXIgXzB4MWIzNGQwPV8weDFiMzQoKTtyZXR1cm4gXzB4NWY0OD1mdW5jdGlvbihfMHg1ZjQ4MmQsXzB4NTAyMzg5KXtfMHg1ZjQ4MmQ9XzB4NWY0ODJkLTB4MTQzO3ZhciBfMHg3MmM3ZDc9XzB4MWIzNGQwW18weDVmNDgyZF
Source: https://online.access.secure001.chase-business.com/secure/HTTP Parser: Script src: data:text/javascript;base64,dmFyIF8weDNmZDY5MD1fMHg0Y2VkOyhmdW5jdGlvbihfMHg4ZTVlOTgsXzB4NGFhOTEwKXt2YXIgXzB4MmJjNjY1PV8weDRjZWQsXzB4NDMwNGQ4PV8weDhlNWU5OCgpO3doaWxlKCEhW10pe3RyeXt2YXIgXzB4MzA1MjJhPS1wYXJzZUludChfMHgyYmM2NjUoMHgzZDcpKS8weDErcGFyc2VJbn
Source: https://online.access.secure001.chase-business.com/secure/HTTP Parser: Script src: data:text/javascript;base64,dmFyIF8weDVkM2JjYj1fMHgyZmZlOyhmdW5jdGlvbihfMHgyMzhlYmEsXzB4M2Q4NzJhKXt2YXIgXzB4MTZlNGQ3PV8weDJmZmUsXzB4MzdiMzJjPV8weDIzOGViYSgpO3doaWxlKCEhW10pe3RyeXt2YXIgXzB4M2YxYmFkPS1wYXJzZUludChfMHgxNmU0ZDcoMHgxMTMpKS8weDErLXBhcnNlSW
Source: https://online.access.secure001.chase-business.com/secure/HTTP Parser: Script src: data:text/javascript;base64,ZnVuY3Rpb24gXzB4OTdjOChfMHgxNTEwOWIsXzB4MjYyNmRlKXtjb25zdCBfMHg1NDdlMDc9XzB4NTQ3ZSgpO3JldHVybiBfMHg5N2M4PWZ1bmN0aW9uKF8weDk3YzhmMSxfMHgyNjU4N2Epe18weDk3YzhmMT1fMHg5N2M4ZjEtMHgxN2M7bGV0IF8weDNhYjRlMj1fMHg1NDdlMDdbXzB4OTdjOG
Source: EmailClassification: Credential Stealer
Source: https://online.access.secure001.chase-business.com/web/auth/dashboard/dashboard/index/indexHTTP Parser: <input type="password" .../> found
Source: https://drive.google.com/file/d/1ZZpf4Zlhtjh56ENC16Nv6BpqzFszHoSg/view?ts=676471c2HTTP Parser: No favicon
Source: https://online.access.secure001.chase-business.com/secure/HTTP Parser: No favicon
Source: https://online.access.secure001.chase-business.com/web/auth/dashboard/dashboard/index/indexHTTP Parser: No <meta name="copyright".. found
Source: unknownHTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.16:49705 version: TLS 1.2
Source: unknownHTTPS traffic detected: 40.126.53.17:443 -> 192.168.2.16:49709 version: TLS 1.2
Source: unknownHTTPS traffic detected: 40.126.53.17:443 -> 192.168.2.16:49710 version: TLS 1.2
Source: unknownHTTPS traffic detected: 40.126.53.17:443 -> 192.168.2.16:49713 version: TLS 1.2
Source: unknownHTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.16:49802 version: TLS 1.2
Source: unknownTCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknownTCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknownTCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknownTCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknownTCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknownTCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknownTCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknownTCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknownTCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknownTCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknownTCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknownTCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknownTCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknownTCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknownTCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknownTCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknownTCP traffic detected without corresponding DNS query: 40.126.53.17
Source: unknownTCP traffic detected without corresponding DNS query: 40.126.53.17
Source: unknownTCP traffic detected without corresponding DNS query: 40.126.53.17
Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknownTCP traffic detected without corresponding DNS query: 40.126.53.17
Source: unknownTCP traffic detected without corresponding DNS query: 40.126.53.17
Source: unknownTCP traffic detected without corresponding DNS query: 40.126.53.17
Source: unknownTCP traffic detected without corresponding DNS query: 40.126.53.17
Source: unknownTCP traffic detected without corresponding DNS query: 40.126.53.17
Source: unknownTCP traffic detected without corresponding DNS query: 40.126.53.17
Source: unknownTCP traffic detected without corresponding DNS query: 40.126.53.17
Source: unknownTCP traffic detected without corresponding DNS query: 40.126.53.17
Source: unknownTCP traffic detected without corresponding DNS query: 40.126.53.17
Source: unknownTCP traffic detected without corresponding DNS query: 40.126.53.17
Source: unknownTCP traffic detected without corresponding DNS query: 40.126.53.17
Source: unknownTCP traffic detected without corresponding DNS query: 40.126.53.17
Source: unknownTCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknownTCP traffic detected without corresponding DNS query: 40.126.53.17
Source: unknownTCP traffic detected without corresponding DNS query: 40.126.53.17
Source: unknownTCP traffic detected without corresponding DNS query: 40.126.53.17
Source: unknownTCP traffic detected without corresponding DNS query: 40.126.53.17
Source: unknownTCP traffic detected without corresponding DNS query: 40.126.53.17
Source: unknownTCP traffic detected without corresponding DNS query: 40.126.53.17
Source: unknownTCP traffic detected without corresponding DNS query: 40.126.53.17
Source: unknownTCP traffic detected without corresponding DNS query: 40.126.53.17
Source: unknownTCP traffic detected without corresponding DNS query: 40.126.53.17
Source: unknownTCP traffic detected without corresponding DNS query: 40.126.53.17
Source: unknownTCP traffic detected without corresponding DNS query: 40.126.53.17
Source: unknownTCP traffic detected without corresponding DNS query: 40.126.53.17
Source: unknownTCP traffic detected without corresponding DNS query: 40.126.53.17
Source: unknownTCP traffic detected without corresponding DNS query: 40.126.53.17
Source: unknownTCP traffic detected without corresponding DNS query: 40.126.53.17
Source: global trafficDNS traffic detected: DNS query: drive.google.com
Source: global trafficDNS traffic detected: DNS query: www.google.com
Source: global trafficDNS traffic detected: DNS query: play.google.com
Source: global trafficDNS traffic detected: DNS query: apis.google.com
Source: global trafficDNS traffic detected: DNS query: blobcomments-pa.clients6.google.com
Source: global trafficDNS traffic detected: DNS query: scone-pa.clients6.google.com
Source: global trafficDNS traffic detected: DNS query: peoplestackwebexperiments-pa.clients6.google.com
Source: global trafficDNS traffic detected: DNS query: online.access.secure001.chase-business.com
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49865
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49864
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49862
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49861
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49740
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49860
Source: unknownNetwork traffic detected: HTTP traffic on port 49875 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49720 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49852 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49739
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49738
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49859
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49858
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49857
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49856
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49855
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49854
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49853
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49731
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49852
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49730
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49851
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49850
Source: unknownNetwork traffic detected: HTTP traffic on port 49858 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49784 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49749 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49806 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49823 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49849
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49848
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49847
Source: unknownNetwork traffic detected: HTTP traffic on port 49886 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49846
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49845
Source: unknownNetwork traffic detected: HTTP traffic on port 49869 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49844
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49843
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49721
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49842
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49720
Source: unknownNetwork traffic detected: HTTP traffic on port 49731 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49840
Source: unknownNetwork traffic detected: HTTP traffic on port 49697 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49834 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49828 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49805 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49839
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49838
Source: unknownNetwork traffic detected: HTTP traffic on port 49715 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49847 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49715
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49836
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49835
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49713
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49834
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49712
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49833
Source: unknownNetwork traffic detected: HTTP traffic on port 49887 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49832
Source: unknownNetwork traffic detected: HTTP traffic on port 49709 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49710
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49830
Source: unknownNetwork traffic detected: HTTP traffic on port 49839 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49864 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49870 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49853 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49796 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49709
Source: unknownNetwork traffic detected: HTTP traffic on port 49811 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49828
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49827
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49705
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49826
Source: unknownNetwork traffic detected: HTTP traffic on port 49754 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49823
Source: unknownNetwork traffic detected: HTTP traffic on port 49771 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49785
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49784
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49783
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49781
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49780
Source: unknownNetwork traffic detected: HTTP traffic on port 49836 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49785 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49807 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49776 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49713 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49845 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49868 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49779
Source: unknownNetwork traffic detected: HTTP traffic on port 49885 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49778
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49776
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49775
Source: unknownNetwork traffic detected: HTTP traffic on port 49862 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49771
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49770
Source: unknownNetwork traffic detected: HTTP traffic on port 49780 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49879 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49802 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49851 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49830 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49767
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49887
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49886
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49885
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49763
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49884
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49762
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49761
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49882
Source: unknownNetwork traffic detected: HTTP traffic on port 49840 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49880
Source: unknownNetwork traffic detected: HTTP traffic on port 49693 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49857 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49770 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49797 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49801 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49879
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49878
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49756
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49877
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49755
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49876
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49754
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49875
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49874
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49873
Source: unknownNetwork traffic detected: HTTP traffic on port 49730 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49750
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49871
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49870
Source: unknownNetwork traffic detected: HTTP traffic on port 49835 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49874 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49747 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49880 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49775 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49749
Source: unknownNetwork traffic detected: HTTP traffic on port 49846 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49869
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49747
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49868
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49867
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49866
Source: unknownNetwork traffic detected: HTTP traffic on port 49695 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49781 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49878 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49826 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49849 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49866 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49697
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49696
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49695
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49694
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49693
Source: unknownNetwork traffic detected: HTTP traffic on port 49763 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49855 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49861 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49712 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49844 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49873 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49793 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49850 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49797
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49796
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49794
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49793
Source: unknownNetwork traffic detected: HTTP traffic on port 49694 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49740 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49856 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49884 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49867 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49821
Source: unknownNetwork traffic detected: HTTP traffic on port 49865 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49710 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49842 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49779 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49859 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49871 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49762 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49833 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49810 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49816
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49815
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49811
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49810
Source: unknownNetwork traffic detected: HTTP traffic on port 49816 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49696 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49767 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49721 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49794 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49827 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49876 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49807
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49806
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49805
Source: unknownNetwork traffic detected: HTTP traffic on port 49848 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49882 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49802
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49801
Source: unknownNetwork traffic detected: HTTP traffic on port 49756 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49739 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49783 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49838 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49678 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49821 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49815 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49877 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49854 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49860 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49778 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49755 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49738 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49673 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49705 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49843 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49761 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49832 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49750 -> 443
Source: unknownHTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.16:49705 version: TLS 1.2
Source: unknownHTTPS traffic detected: 40.126.53.17:443 -> 192.168.2.16:49709 version: TLS 1.2
Source: unknownHTTPS traffic detected: 40.126.53.17:443 -> 192.168.2.16:49710 version: TLS 1.2
Source: unknownHTTPS traffic detected: 40.126.53.17:443 -> 192.168.2.16:49713 version: TLS 1.2
Source: unknownHTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.16:49802 version: TLS 1.2
Source: classification engineClassification label: mal56.phis.winMSG@22/14@36/252
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEFile created: C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEFile created: C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20241223T1137130598-1608.etl
Source: unknownProcess created: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /f "C:\Users\user\Desktop\5diately.msg"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "7A3775C4-277D-44C4-968F-1E2607DA7F13" "841B4473-A12B-4E08-A3F9-32E771B1975D" "1608" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "7A3775C4-277D-44C4-968F-1E2607DA7F13" "841B4473-A12B-4E08-A3F9-32E771B1975D" "1608" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://drive.google.com/file/d/1ZZpf4Zlhtjh56ENC16Nv6BpqzFszHoSg/view?usp=sharing_eip&ts=676471c2
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2104 --field-trial-handle=1876,i,10324559526721791315,4912027283420163942,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://drive.google.com/file/d/1ZZpf4Zlhtjh56ENC16Nv6BpqzFszHoSg/view?usp=sharing_eip&ts=676471c2
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2104 --field-trial-handle=1876,i,10324559526721791315,4912027283420163942,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: apphelp.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: c2r64.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: userenv.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: msasn1.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: cryptsp.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: rsaenh.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: cryptbase.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: gpapi.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{F959DBBB-3867-41F2-8E5F-3B8BEFAA81B3}\InprocServer32
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEWindow found: window name: SysTabControl32
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Common
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEKey value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\outlook\ConfigContextData 1
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEFile Volume queried: C:\Windows\SysWOW64 FullSizeInformation
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information queried: ProcessInformation
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeQueries volume information: C:\Program Files (x86)\Microsoft Office\root\Office16\AI\WordCombinedFloatieLreOnline.onnx VolumeInformation
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management Instrumentation21
Browser Extensions		1
Process Injection		1
Masquerading		OS Credential Dumping1
Process Discovery		Remote ServicesData from Local System2
Encrypted Channel		Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/Job1
DLL Side-Loading		1
DLL Side-Loading		1
Modify Registry		LSASS Memory13
System Information Discovery		Remote Desktop ProtocolData from Removable Media1
Non-Application Layer Protocol		Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAt1
Registry Run Keys / Startup Folder		1
Registry Run Keys / Startup Folder		1
Process Injection		Security Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared Drive2
Application Layer Protocol		Automated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin Hook1
DLL Side-Loading		NTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput CaptureProtocol ImpersonationTraffic DuplicationData Destruction

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

⊘No Antivirus matches

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

NameIPActiveMaliciousAntivirus DetectionReputation
blobcomments-pa.clients6.google.com
172.217.18.42
truefalse
    		high
    scone-pa.clients6.google.com
    		142.250.200.234
    		truefalse
      		high
      play.google.com
      		172.217.19.206
      		truefalse
        		high
        plus.l.google.com
        		142.251.37.238
        		truefalse
          		high
          drive.google.com
          		142.250.200.238
          		truefalse
            		high
            www.google.com
            		216.58.211.196
            		truefalse
              		high
              peoplestackwebexperiments-pa.clients6.google.com
              		142.250.181.138
              		truefalse
                		high
                online.access.secure001.chase-business.com
                		188.119.66.154
                		truefalse
                  		high
                  apis.google.com
                  		unknown
                  		unknownfalse
                    		high

                    Contacted URLs

                    NameMaliciousAntivirus DetectionReputation
                    https://drive.google.com/file/d/1ZZpf4Zlhtjh56ENC16Nv6BpqzFszHoSg/view?ts=676471c2false
                      		unknown
                      https://online.access.secure001.chase-business.com/web/auth/dashboard/dashboard/index/indextrue
                        		unknown
                        https://online.access.secure001.chase-business.com/secure/false
                          		unknown

                          World Map of Contacted IPs

                          • No. of IPs < 25%
                          • 25% < No. of IPs < 50%
                          • 50% < No. of IPs < 75%
                          • 75% < No. of IPs

                          Public IPs

                          IPDomainCountryFlagASNASN NameMalicious
                          142.250.203.238
                          		unknownUnited States
                          		15169GOOGLEUSfalse
                          172.217.19.206
                          		play.google.comUnited States
                          		15169GOOGLEUSfalse
                          142.251.37.170
                          		unknownUnited States
                          		15169GOOGLEUSfalse
                          172.217.19.142
                          		unknownUnited States
                          		15169GOOGLEUSfalse
                          142.250.181.138
                          		peoplestackwebexperiments-pa.clients6.google.comUnited States
                          		15169GOOGLEUSfalse
                          52.109.68.129
                          		unknownUnited States
                          		8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                          142.251.37.227
                          		unknownUnited States
                          		15169GOOGLEUSfalse
                          172.217.19.170
                          		unknownUnited States
                          		15169GOOGLEUSfalse
                          172.217.21.35
                          		unknownUnited States
                          		15169GOOGLEUSfalse
                          142.251.37.163
                          		unknownUnited States
                          		15169GOOGLEUSfalse
                          142.250.201.10
                          		unknownUnited States
                          		15169GOOGLEUSfalse
                          172.217.18.234
                          		unknownUnited States
                          		15169GOOGLEUSfalse
                          172.217.21.36
                          		unknownUnited States
                          		15169GOOGLEUSfalse
                          188.119.66.154
                          		online.access.secure001.chase-business.comRussian Federation
                          		209499FLYNETRUfalse
                          52.113.194.132
                          		unknownUnited States
                          		8068MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                          172.217.19.238
                          		unknownUnited States
                          		15169GOOGLEUSfalse
                          1.1.1.1
                          		unknownAustralia
                          		13335CLOUDFLARENETUSfalse
                          2.20.68.229
                          		unknownEuropean Union
                          		37457Telkom-InternetZAfalse
                          142.250.200.234
                          		scone-pa.clients6.google.comUnited States
                          		15169GOOGLEUSfalse
                          172.217.17.35
                          		unknownUnited States
                          		15169GOOGLEUSfalse
                          142.250.200.238
                          		drive.google.comUnited States
                          		15169GOOGLEUSfalse
                          216.58.211.196
                          		www.google.comUnited States
                          		15169GOOGLEUSfalse
                          57.150.87.129
                          		unknownBelgium
                          		2686ATGS-MMD-ASUSfalse
                          142.251.173.84
                          		unknownUnited States
                          		15169GOOGLEUSfalse
                          172.217.171.195
                          		unknownUnited States
                          		15169GOOGLEUSfalse
                          239.255.255.250
                          		unknownReserved
                          		unknownunknownfalse
                          142.251.37.238
                          		plus.l.google.comUnited States
                          		15169GOOGLEUSfalse
                          172.217.171.234
                          		unknownUnited States
                          		15169GOOGLEUSfalse
                          172.217.18.42
                          		blobcomments-pa.clients6.google.comUnited States
                          		15169GOOGLEUSfalse
                          142.251.37.174
                          		unknownUnited States
                          		15169GOOGLEUSfalse
                          142.250.181.78
                          		unknownUnited States
                          		15169GOOGLEUSfalse
                          142.250.201.42
                          		unknownUnited States
                          		15169GOOGLEUSfalse
                          52.168.117.168
                          		unknownUnited States
                          		8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                          142.250.181.74
                          		unknownUnited States
                          		15169GOOGLEUSfalse

                          Private

                          IP
                          192.168.2.16

                          General Information

                          Joe Sandbox version:41.0.0 Charoite
                          Analysis ID:1580001
                          Start date and time:2024-12-23 17:36:31 +01:00
                          Joe Sandbox product:CloudBasic
                          Overall analysis duration:
                          Hypervisor based Inspection enabled:false
                          Report type:full
                          Cookbook file name:defaultwindowsinteractivecookbook.jbs
                          Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                          Number of analysed new started processes analysed:13
                          Number of new started drivers analysed:0
                          Number of existing processes analysed:0
                          Number of existing drivers analysed:0
                          Number of injected processes analysed:0
                          Technologies:
                          • EGA enabled
                          Analysis Mode:stream
                          Analysis stop reason:Timeout
                          Sample name:5diately.msg
                          renamed because original name is a hash value
                          Original Sample Name:Fw Item shared with you Unuthrized Lg-In Nticed - Pls Rviw Your Aunt Immdiately.msg
                          Detection:MAL
                          Classification:mal56.phis.winMSG@22/14@36/252
                          Cookbook Comments:
                          • Found application associated with file extension: .msg

                          Warnings

                          • Exclude process from analysis (whitelisted): dllhost.exe, RuntimeBroker.exe, SIHClient.exe, backgroundTaskHost.exe
                          • Excluded IPs from analysis (whitelisted): 52.113.194.132, 52.109.68.129, 2.20.68.229, 2.20.68.223, 52.168.117.168, 172.217.21.35, 172.217.19.238, 142.251.173.84, 142.251.37.170, 172.217.17.46
                          • Excluded domains from analysis (whitelisted): slscr.update.microsoft.com
                          • Not all processes where analyzed, report is missing behavior information
                          • Report size getting too big, too many NtQueryAttributesFile calls found.
                          • Report size getting too big, too many NtQueryValueKey calls found.
                          • Report size getting too big, too many NtReadVirtualMemory calls found.
                          • VT rate limit hit for: 5diately.msg

                          Created / dropped Files

                          C:\Users\user\AppData\Local\Microsoft\FORMS\FRMCACHE.DAT

                          Download File
                          Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                          File Type:data
                          Category:dropped
                          Size (bytes):231348
                          Entropy (8bit):4.382181050610794
                          Encrypted:false
                          SSDEEP:
                          MD5:9ECB22D11E07433AEC99AA3C3CE61317
                          SHA1:36C0E90F0665BB759658A59AC63E38519A3200B5
                          SHA-256:94A4DDCC87680A76BD770933D909859778C1C29BFEBEECCC0D3BB92D3F7DF2BA
                          SHA-512:94B11DB23BCB8A2A502BCBCB8AB278B4FF0696D07AFDD30A4BF33C77E8A00DE28EDABFFB16A99C57755C1B0755B25079511F374BF3EC2EB0F3368FF7D697C431
                          Malicious:false
                          Reputation:unknown
                          Preview:TH02...... .P...XU......SM01X...,....,..XU..........IPM.Activity...........h...............h............H..h.........gSy...h........@.0.H..h\cal ...pDat...h .&.0.........h.`....9........h........_`Pk...h^b..@...I.lw...h....H...8.Uk...0....T...............d.........2h...............k..............!h.............. h...-..........#h....8.........$h@.0.....8....."h0....... .....'h..............1h.`..<.........0h....4....Uk../h....h.....UkH..h.=9.p.........-h .......4.....+h.`.................. ...... ..............F7..............FIPM.Activity....Form....Standard....Journal Entry...IPM.Microsoft.FolderDesign.FormsDescription................F.k..........1122110020000000....Microsoft...This form is used to create journal entries.........kf...... ..........&...........(.......(... ...@.....................................................................................................................fffffffff........wwwwwwww.p....pp..............p...............pw..............pw..DDDDO..

                          C:\Users\user\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntities.bin

                          Download File
                          Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                          File Type:ASCII text, with very long lines (65536), with no line terminators
                          Category:dropped
                          Size (bytes):322260
                          Entropy (8bit):4.000299760592446
                          Encrypted:false
                          SSDEEP:
                          MD5:CC90D669144261B198DEAD45AA266572
                          SHA1:EF164048A8BC8BD3A015CF63E78BDAC720071305
                          SHA-256:89C701EEFF939A44F28921FD85365ECD87041935DCD0FE0BAF04957DA12C9899
                          SHA-512:16F8A8A6DCBAEAEFB88C7CFF910BCCC71B76A723CF808B810F500E28E543112C2FAE2491D4D209569BD810490EDFF564A2B084709B02963BCAF6FDF1AEEC59AC
                          Malicious:false
                          Reputation:unknown
                          Preview:51253fe60063c31af0d295afb42228b0:v2:2:1:1590:2:8479:76bd602437550e98c9043d06a55186ab7d95dea5a0e935a599f73e62a8c9b158e0afcb19351f6c353940c06a38172b94d18c02cf92bb8a80184eccca0392b259ab3e71dae73e491c7941997cb36ad4a198661f622dad478d840f66d530a0dde78acea3367f91fff62fbb3dc18faff0c708ad30edef5bea8b22c5fd782b770d8993386eaa784fd19a3c3e1db3b537b1a94d3d4fbd46f8df8fddf6d16611969fe0a97c50e0f3ac24750c93257cf5c161184aa7385800c87d803b339632a3d8ec7fe17a0afd83ce9e9d0e3f7b8d579637928a811f1f7e6d1887df2ddc7d4f752c4d600235e426c92c7bf8a1362f95457998cc0e5d4261f0efa4fada0f866dbcefb407dacab7a2914e91c2f08200f38c2d9d621962145b1464b0f204b326118a53ecdcab22bff005fdd5257c99a6dc51ac0600a49f2ef782396987e78c08b846dad5db55e8ccefffc64863bc2c3e90b95a09d25d0814a848c98fe01a82d4e30e6682dd546e12c45ca0d280a45295ab4bd632dafb070edfdc3c9e38313d5aeb195972986f8011b66817028fd8c78b67a0ac7e780eecc3fb6a31f5a025b8a9a3db278a98c0696aeaac739b18688b0f9c7d751bba02cc5f4e41853fb119b3c0c915059aaa92971244a1989124f12881ca88e6410df70b793a2c3a736ff4

                          C:\Users\user\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntitiesUpdated.bin

                          Download File
                          Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                          File Type:ASCII text, with no line terminators
                          Category:dropped
                          Size (bytes):10
                          Entropy (8bit):2.5219280948873624
                          Encrypted:false
                          SSDEEP:
                          MD5:BF7FC026F510389A24D9C74368E5500C
                          SHA1:605C69CAF5F44848B1CCFA768D805586EB15CD14
                          SHA-256:5363AAD172163EC510792A38FB9E7EBB4BFA45FB1A3A2C77BF26FE76F084C349
                          SHA-512:255459638559B9D40C9EE34F862FD5B559547C6BB99226055304E955AC8BE64C3358CC446AAFC4622400B2616D04A593C01A1F78A077A075B5D40DA094BED9E7
                          Malicious:false
                          Reputation:unknown
                          Preview:1734971838

                          C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-journal

                          Download File
                          Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                          File Type:SQLite Rollback Journal
                          Category:dropped
                          Size (bytes):4616
                          Entropy (8bit):0.13700485453793962
                          Encrypted:false
                          SSDEEP:
                          MD5:3D52667FB2DE31829C84D34CC665696B
                          SHA1:5CF61BA6E781D8B30A4986761B97CABF68869723
                          SHA-256:9A934ABC4363DDA10E66DB9C91E14741BF4E00B8E3E59F00CAD7ED7133A6BFD3
                          SHA-512:AB7BF581EEC7C18CC4438D3439033FDAB2169E90939F90A2E3E7D4071C00720B438A64C2BEF402C54F44D797C946DEFC462E57F4E837556670B696403A1D71FC
                          Malicious:false
                          Reputation:unknown
                          Preview:.... .c.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................SQLite format 3......@ .......................................................................... .................................................................................................................................................................................................................................................................................................................................................................................................

                          C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres

                          Download File
                          Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                          File Type:data
                          Category:dropped
                          Size (bytes):2278
                          Entropy (8bit):3.8455539376949623
                          Encrypted:false
                          SSDEEP:
                          MD5:EF3D1F9CE14FEF39C880C78545B45F5C
                          SHA1:F0B6798611EFB3BE1FA68F1D93ADC3E3B0E06420
                          SHA-256:92E5A66AEB6606943D961DC3F2C0403BB345D7C8FC640B24B823F215F5DF5C81
                          SHA-512:6D08984474A5B40CEF83EF17DF97975E819C949330EACABD18619A04D744BCD237AC461D74F477A101A54E47684625D63DE584FB60588B17A0D022559726EA2C
                          Malicious:false
                          Reputation:unknown
                          Preview:{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".C.J.1.m.u.g.S.o.z.s.S.9.x.S.Z./.Q.v.O.c.+.E.J.4.u.2.c.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.M.G.e.T.W.F.V.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.z.x.R.2.V.d.

                          C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5475cb191e478c39370a215b2da98a37e9dc813d.tbres

                          Download File
                          Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                          File Type:data
                          Category:dropped
                          Size (bytes):2684
                          Entropy (8bit):3.9091319199892833
                          Encrypted:false
                          SSDEEP:
                          MD5:DDC6DF1F23119099BDF6E506C3511D24
                          SHA1:1A62AE0C7F5236E183546CC4E14802A8D74146FE
                          SHA-256:9A06E5E4736E934790554B1AEBE33BF0FE8FB662472349751126FABC133A1E2C
                          SHA-512:46294F19548E4D51C3188EA12F5D1CCD72207626BE7A3A7298687B87F8118B2AAE22F520D5559144C56C4A226A89408EEC3D8C9C0FD8BB946366373C4FF41E64
                          Malicious:false
                          Reputation:unknown
                          Preview:{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".V.H.X.L.G.R.5.H.j.D.k.3.C.i.F.b.L.a.m.K.N.+.n.c.g.T.0.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".B.C.3.8.Z.C.p.0.3.A.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.z.x.R.2.V.d.

                          C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\56a61aeb75d8f5be186c26607f4bb213abe7c5ec.tbres

                          Download File
                          Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                          File Type:data
                          Category:dropped
                          Size (bytes):4542
                          Entropy (8bit):4.00481185063636
                          Encrypted:false
                          SSDEEP:
                          MD5:11322C5EE307708F26D9A8282BFABDA1
                          SHA1:662C0394183BEEF729C0C3D752BEC319B20C9000
                          SHA-256:5E7CA0B204E4E7949EC4559514355E9A2357A67543994502DFF04346D61A1008
                          SHA-512:6978FAA374D66267910138A6B480CE2431F31FCD12681C7EEBD1B84D465918C720B3D30D7BF89986E1FD159D07F46BCB9FF8700A517A42860E695E7656F0634B
                          Malicious:false
                          Reputation:unknown
                          Preview:{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".V.q.Y.a.6.3.X.Y.9.b.4.Y.b.C.Z.g.f.0.u.y.E.6.v.n.x.e.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".v.f.K.A.M.1.l.V.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.z.x.R.2.V.d.

                          C:\Users\user\AppData\Roaming\Microsoft\Office\MSO3072.acl

                          Download File
                          Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                          File Type:data
                          Category:dropped
                          Size (bytes):30
                          Entropy (8bit):1.2389205950315936
                          Encrypted:false
                          SSDEEP:
                          MD5:1FE472F9B662E0422F87A0F6C7013912
                          SHA1:91CE572B4FB7890BC86841BF7F53EF1035BB6B69
                          SHA-256:9D05A69342455DC3D7439A6E173A273850A53FD44A35EF493CFE5511FF7FE342
                          SHA-512:7E5E401BA7541CCBAB30DD7EB4960DAE4E7E343A75A29729ECC719F51E29C2F74AA504105CE398D863BE275DEF71C47E43DE01EADAC334E9B17363BEA52D86B0
                          Malicious:false
                          Reputation:unknown
                          Preview:....].........................

                          C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

                          Download File
                          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                          File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Dec 23 15:37:31 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                          Category:dropped
                          Size (bytes):2673
                          Entropy (8bit):3.990164676905255
                          Encrypted:false
                          SSDEEP:
                          MD5:1609BA484B410B6E17A36AB11B39AD86
                          SHA1:7EE1B707AE9AC4FB204A33B8E0C04D1CA0FB85E7
                          SHA-256:B8B043733756D309207283F2E236A74D356467544FD64175B27DBC3C0AE7355A
                          SHA-512:EE4684AE998DB1ED0B3C15F4BA622EFD884BA2517C8D40FD3116F3CED28A29A43ECADC3875D036FDB89C07362967007C28EF3BBD696EC3EF2FA039CB73167D00
                          Malicious:false
                          Reputation:unknown
                          Preview:L..................F.@.. ...$+.,.....l..XU..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.Y......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........3t]j.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                          C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

                          Download File
                          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                          File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Dec 23 15:37:31 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                          Category:dropped
                          Size (bytes):2675
                          Entropy (8bit):4.003967136170359
                          Encrypted:false
                          SSDEEP:
                          MD5:AABBE7CBD73DEB0D2784B34B3272259A
                          SHA1:805CDB83A4114A6376A36626CDB8341EF18EAB5E
                          SHA-256:570227BA7645EC6D1A641CC95A7B2B9AC7B6159EBE3FA280C3C701784FE321BD
                          SHA-512:831D540391CCF8749D24FDEE6B7718372606BD9D4309C938817C86AE88EA671E2B6272C0096C55962ACD07FD5836C84184193247A6666170D0AF746DBF260A8D
                          Malicious:false
                          Reputation:unknown
                          Preview:L..................F.@.. ...$+.,....pt..XU..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.Y......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........3t]j.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                          C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

                          Download File
                          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                          File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                          Category:dropped
                          Size (bytes):2689
                          Entropy (8bit):4.014289468274292
                          Encrypted:false
                          SSDEEP:
                          MD5:E6C8F49FE36FF0C982293E95DCF2BBFB
                          SHA1:C43636C6FEE3EA5FCCF3C3A35DE4595FDFE99657
                          SHA-256:5E55335F6020CCF943711F7A7403CA88FCC20586ED214941BF963C09C3CF1DB6
                          SHA-512:DA6182D19D517358D379BA51E55A612F158034EA826D537BE085D1AFD31C81EF7AE216824217310EECE52F6F35BD27FB72C6EE2605DCA200B8D043A0C6353DED
                          Malicious:false
                          Reputation:unknown
                          Preview:L..................F.@.. ...$+.,.....Y.04...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.Y......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VFW.E...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........3t]j.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                          C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

                          Download File
                          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                          File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Dec 23 15:37:30 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                          Category:dropped
                          Size (bytes):2677
                          Entropy (8bit):4.004097932121071
                          Encrypted:false
                          SSDEEP:
                          MD5:993FFB92EF69FE36E08209949B1C1036
                          SHA1:EEE88DD334E34A7D7FD4A923645B78D044B496CE
                          SHA-256:0F0CD63B2986CA8F64FFC1FF246D62DF63C6F20D7EF8D0082730E0CFE2D780EA
                          SHA-512:F0F48EF672834F80908533AB5E14BBF35B8D440E7D668FB3CD90A17FEA68852ED5CB35E836CA2B81777014E26D57076C49493C92B6560EE26220A01F45158E99
                          Malicious:false
                          Reputation:unknown
                          Preview:L..................F.@.. ...$+.,........XU..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.Y......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........3t]j.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                          C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

                          Download File
                          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                          File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Dec 23 15:37:31 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                          Category:dropped
                          Size (bytes):2677
                          Entropy (8bit):3.9916818949624813
                          Encrypted:false
                          SSDEEP:
                          MD5:C04804BAB34522BD349128FDF6D48310
                          SHA1:7F4B2D8409188B657149C07F754B328355FAAF60
                          SHA-256:64A8DA9150C10F7F852C3B98B439CB5030D1F884AD346D819D738AA3EE40ABA9
                          SHA-512:DB70F3BF46BFDC5D099D6BE5DCB3EAE71E59A6A08097EF957D30D2D216EC1A44C6DCFB1D35F07FEAD4FBD971637534FBABEC437F614B82C95E526A7BA0521C80
                          Malicious:false
                          Reputation:unknown
                          Preview:L..................F.@.. ...$+.,........XU..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.Y......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........3t]j.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                          C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

                          Download File
                          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                          File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Dec 23 15:37:30 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                          Category:dropped
                          Size (bytes):2679
                          Entropy (8bit):4.001560932721731
                          Encrypted:false
                          SSDEEP:
                          MD5:855989CE3780FC0DEA191EF0109D5B75
                          SHA1:19E543F5E3E3B47616E2DB4EE6E99A45ACE6E642
                          SHA-256:29AD33EF4D26EC9ADC01B60F92B752760BE34B50A04473E181373C4C3B5F0315
                          SHA-512:ADE19B08EE3F4089E51C7BBFA2B8C1FDCEB98005E76444A8B98A4CD9E7B23B90AF35B010E26C8B9B6638C34B6E96A0D19902C0888C755DD745C871F69B0B326E
                          Malicious:false
                          Reputation:unknown
                          Preview:L..................F.@.. ...$+.,..... ..XU..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.Y......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........3t]j.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                          Static File Info

                          General

                          File type:CDFV2 Microsoft Outlook Message
                          Entropy (8bit):4.120160863822686
                          TrID:
                          • Outlook Message (71009/1) 58.92%
                          • Outlook Form Template (41509/1) 34.44%
                          • Generic OLE2 / Multistream Compound File (8008/1) 6.64%
                          File name:5diately.msg
                          File size:92'672 bytes
                          MD5:7f1aa2d6460550f65f31c1ff5d8d26a2
                          SHA1:941492c6b390d39fda5b76d7c2c73a621b02ed93
                          SHA256:e0dc5d2ee93a312d18124bd317fadc22c46400ca3bbdd12c73ffee8fba5b7c4b
                          SHA512:ba045da4f3beaa3039a8a8e5b13e0a70b141ba169cf94fefc5f301607aa81f2cb682ceda957ca3632f8f21729a91b7612a7dba33806ed4b108c616fc90a98fb5
                          SSDEEP:1536:sfBKaRLoRnrQKtTVlSMVWi5WgWeUNoYrsEm43FSECMHKeK1:bwoRnrQKZVlN9UNoYrsEmYFSEFKeK1
                          TLSH:7C93DB253AFA0219F2B79F3559F290939937BC92AD35CA4F2195330E0A73941DC61B3B
                          File Content Preview:........................>.......................................................h..............................................................................................................................................................................

                          Static Mail

                          General

                          Subject:Fw: Item shared with you: "Unuthrized Lg-In Nticed - Pls Rviw Your Aunt Immdiately"
                          From:Rhonny Rowden <rhonny@eligibilitytrackingcalculators.com>
                          To:CoreRecon Support <support@corerecon.com>
                          Cc:
                          BCC:
                          Date:Thu, 19 Dec 2024 22:44:06 +0100
                          Communications:
                          • spoof... ________________________________
                          • From: se | nfirm Your ... (via Google Drive) <drive-shares-noreply@google.com> Sent: Thursday, December 19, 2024 1:19 PM To: etcbilling+haater187@etctracking.com <etcbilling+haater187@etctracking.com> Cc: johnredmon+hiybloc644@gmail.com <johnredmon+hiybloc644@gmail.com>; bean086+writpar443@gmail.com <bean086+writpar443@gmail.com>; janmarcusesq+harmo587@gmail.com <janmarcusesq+harmo587@gmail.com>; jpabisaleh+monthas739@hotmail.com <jpabisaleh+monthas739@hotmail.com>; justin+exhal945@lindyrealty.com <justin+exhal945@lindyrealty.com>; john+bortthyl757@madetoo.com <john+bortthyl757@madetoo.com>; notarybytoni+beyspac216@gmail.com <notarybytoni+beyspac216@gmail.com>; rollingthunderranchllc+discons339@gmail.com <rollingthunderranchllc+discons339@gmail.com>; scott+exun166@jacksonsells.com <scott+exun166@jacksonsells.com>; calimeetsnyccandles+icclim389@gmail.com <calimeetsnyccandles+icclim389@gmail.com>; hello+adlel883@sipnslaytea.com <hello+adlel883@sipnslaytea.com>; ncholmes3434+coakrath816@gmail.com <ncholmes3434+coakrath816@gmail.com>; ralph+ilat380@blessingsolutionsllc.com <ralph+ilat380@blessingsolutionsllc.com>; tracystoloff+jahrbit135@gmail.com <tracystoloff+jahrbit135@gmail.com>; chet+crabit770@genuinebellinger.com <chet+crabit770@genuinebellinger.com>; abps02+killking169@gmail.com <abps02+killking169@gmail.com>; jdickey+izup434@jtechsolutions.us <jdickey+izup434@jtechsolutions.us>; scalyconcepts+raihar175@outlook.com <scalyconcepts+raihar175@outlook.com>; gaincoffice+zosop442@gmail.com <gaincoffice+zosop442@gmail.com>; paul.baltierra+stopir461@ironmountain.com <paul.baltierra+stopir461@ironmountain.com>; safetyshieldusa+ovac797@gmail.com <safetyshieldusa+ovac797@gmail.com>; toby+milncric690@pelctire.com <toby+milncric690@pelctire.com>; appraisalpartnersinc+permo718@gmail.com <appraisalpartnersinc+permo718@gmail.com> Subject: Item shared with you: "Unuthrized Lg-In Nticed - Pls Rviw Your Aunt Immdiately" se | nfirm Your Credentials shared an item <https://lh3.googleusercontent.com/a/ACg8ocLlVBAYOXbJP5xut0SrWiR-BH_NZUAAtDpDxzd_AZM0CJOXZAU=s64> se | nfirm Your Credentials (mormabeno2000@monitor.accesssecurelogin.me <mailto:mormabeno2000@monitor.accesssecurelogin.me> ) has shared the following item: <https://drive.google.com/file/d/1ZZpf4Zlhtjh56ENC16Nv6BpqzFszHoSg/view?usp=sharing_eil&ts=676471c2> <https://ssl.gstatic.com/docs/doclist/images/mediatype/icon_3_pdf_x64.png> Unuthrized Lg-In Nticed - Pls Rviw Your Aunt Immdiately Open <https://drive.google.com/file/d/1ZZpf4Zlhtjh56ENC16Nv6BpqzFszHoSg/view?usp=sharing_eip&ts=676471c2> Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA You have received this email because mormabeno2000@monitor.accesssecurelogin.me <mailto:mormabeno2000@monitor.accesssecurelogin.me> shared a file or folder located in Google Drive with you. <https://workspace.google.com/> <http://www.theetccompanies.com> Remittance address: PO Box 700970, San Antonio, TX 78270 The ETC Companies does not provide tax, legal, or accounting advice. The material in this email is not intended to provide, and should not be relied on for, tax, legal, or accounting advice. This message may contain confidential information and is intended only for the individual named. If you are not the named addressee, you should not disseminate, distribute, or copy this email. Please notify the sender immediately by email if you have received this email by mistake and delete this email from your system. While ETC prides itself on a secure environment, email transmission without encryption cannot be guaranteed to be secure or error-free, as information could be intercepted, corrupted, lost, destroyed, arrive late or incomplete, or contain viruses. Therefore, this practice should be avoided. Please make sure that all sensitive/private data is uploaded to https://v2.etctracking.com/login <https://v2.etctracking.com/login> .
                          Attachments:

                            Headers

                            Key Value
                            Receivedfrom SA1P221MB1548.NAMP221.PROD.OUTLOOK.COM ([2603:1036:305:4966::5])
                            2144:13 +0000
                            by SA3PR11MB7488.namprd11.prod.outlook.com (260310b6:806:313::12) with
                            2024 2144:10 +0000
                            (260310b6:806:27::15) with Microsoft SMTP Server (version=TLS1_3,
                            19 Dec 2024 2144:10 +0000
                            Authentication-Resultsspf=pass (sender IP is 209.85.167.175)
                            Received-SPFPass (protection.outlook.com: domain of
                            via Frontend Transport; Thu, 19 Dec 2024 2144:10 +0000
                            for <support@corerecon.com>; Thu, 19 Dec 2024 1344:10 -0800 (PST)
                            DKIM-Signaturev=1; a=rsa-sha256; c=relaxed/relaxed;
                            h=content-languagemime-version:msip_labels:accept-language
                            message-id:reply-to;
                            X-Google-DKIM-Signaturev=1; a=rsa-sha256; c=relaxed/relaxed;
                            X-Gm-Message-StateAOJu0YxDhdxQOJTI6/rMX9ENqGare7fpoBsEcpDhK1KXGApRRb6knWB4
                            X-Gm-GgASbGnctjef26hHJJUWYkePUuC2AvU+OU//C68OQVRZ0fX4motUuGIlRl5sIOfGy1pw6
                            X-Google-Smtp-SourceAGHT+IFf+0UMm/di3cgUFaAHadjEvjfRLK/Bq0kfDppx0ZS/cVDo6C/Hk4sUnVZ2uQWZg84BbyM0xw==
                            X-Receivedby 2002:a05:6808:2183:b0:3eb:63c9:fe7f with SMTP id 5614622812f47-3ed890e3c2emr178235b6e.40.1734644649216;
                            Thu, 19 Dec 2024 1344:08 -0800 (PST)
                            Return-Pathrhonny@eligibilitytrackingcalculators.com
                            FromRhonny Rowden <rhonny@eligibilitytrackingcalculators.com>
                            ToCoreRecon Support <support@corerecon.com>
                            Subject=?utf-8?B?Rnc6IEl0ZW0gc2hhcmVkIHdpdGggeW91OiAiVW7QsHV0aNC+cml6ZWQgTNC+?=
                            Thread-Topic=?utf-8?B?SXRlbSBzaGFyZWQgd2l0aCB5b3U6ICJVbtCwdXRo0L5yaXplZCBM0L5nLUlu?=
                            Thread-IndexAWEyYjQwoxFOqRlN1Gzxn+8xVYM+IWI5NC0t8S4wGV0=
                            X-MS-Exchange-MessageSentRepresentingType1
                            DateThu, 19 Dec 2024 21:44:06 +0000
                            Message-ID<SA1P221MB15480EAA65EF66D7E875FD3AAD062@SA1P221MB1548.NAMP221.PROD.OUTLOOK.COM>
                            References<93ecdad0-e2e7-405a-aab0-02a92196c2ea@docs-share.google.com>
                            In-Reply-To<autogen-java-bc4c0cef-403e-4be4-ba87-e098d6106bab@google.com>
                            Accept-Languageen-US
                            X-MS-Has-AttachX-MS-TNEF-Correlator:
                            msip_labelsMIME-Version: 1.0
                            Content-Languageen-US
                            Content-Typemultipart/alternative;
                            X-MS-Exchange-Organization-ExpirationStartTime19 Dec 2024 21:44:10.4635
                            X-MS-Exchange-Organization-ExpirationStartTimeReasonOriginalSubmit
                            X-MS-Exchange-Organization-ExpirationInterval1:00:00:00.0000000
                            X-MS-Exchange-Organization-ExpirationIntervalReasonOriginalSubmit
                            X-MS-Exchange-Organization-Network-Message-Id6d8f0693-adab-4070-ad23-08dd207645bb
                            X-EOPAttributedMessage0
                            X-EOPTenantAttributedMessagefd95b4e8-ccc7-4e27-b8dc-ec4c54e4a14d:0
                            X-MS-Exchange-Organization-MessageDirectionalityIncoming
                            X-MS-PublicTrafficTypeEmail
                            X-MS-TrafficTypeDiagnosticSA2PEPF00003AE9:EE_|SA3PR11MB7488:EE_|IA1PR11MB6291:EE_
                            X-MS-Exchange-Organization-AuthSourceSA2PEPF00003AE9.namprd02.prod.outlook.com
                            X-MS-Exchange-Organization-AuthAsAnonymous
                            X-MS-Office365-Filtering-Correlation-Id6d8f0693-adab-4070-ad23-08dd207645bb
                            X-MS-Exchange-Organization-SCL1
                            X-Microsoft-AntispamBCL:0;ARA:13230040|43022699015|1032899013|69100299015|2066899003|8096899003;
                            X-Forefront-Antispam-ReportCIP:209.85.167.175;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:mail-oi1-f175.google.com;PTR:mail-oi1-f175.google.com;CAT:NONE;SFS:(13230040)(43022699015)(1032899013)(69100299015)(2066899003)(8096899003);DIR:INB;
                            X-MS-Exchange-CrossTenant-OriginalArrivalTime19 Dec 2024 21:44:10.3541
                            X-MS-Exchange-CrossTenant-Network-Message-Id6d8f0693-adab-4070-ad23-08dd207645bb
                            X-MS-Exchange-CrossTenant-Idfd95b4e8-ccc7-4e27-b8dc-ec4c54e4a14d
                            X-MS-Exchange-CrossTenant-AuthSourceSA2PEPF00003AE9.namprd02.prod.outlook.com
                            X-MS-Exchange-CrossTenant-AuthAsAnonymous
                            X-MS-Exchange-CrossTenant-FromEntityHeaderInternet
                            X-MS-Exchange-Transport-CrossTenantHeadersStampedSA3PR11MB7488
                            X-MS-Exchange-Transport-EndToEndLatency00:00:03.0618079
                            X-MS-Exchange-Processed-By-BccFoldering15.20.8272.000
                            X-Microsoft-Antispam-Mailbox-Deliveryucf:0;jmr:0;auth:0;dest:I;ENG:(910001)(944506478)(944626604)(920097)(930097)(140003);
                            X-Microsoft-Antispam-Message-Info=?us-ascii?Q?mFWdQ646Pn9fl/aWHcYzL4iOB/KDLHY8CbOZnHEdHXvAecRYGjWGVa6iguBE?=
                            dateThu, 19 Dec 2024 22:44:06 +0100

                            File Icon

                            Icon Hash:c4e1928eacb280a2