Edit tour

Windows Analysis Report
phish_alert_sp2_2.0.0.0.eml

Overview

General Information

Sample name:	phish_alert_sp2_2.0.0.0.eml
Analysis ID:	1580004
MD5:	be5088c3968719dec3c819dde72d44d4
SHA1:	6ccfdd38ba2047e89c8b5bc9b7674e4442525229
SHA256:	c41c5434239023f0d075e0fb1149552bbbd2d0a8dd071b0c6ed78e2c91e097d1
Infos:

Detection

Score:	48
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

AI detected landing page (webpage, office document or email)

AI detected potential phishing Email

Queries the volume information (name, serial number etc) of a device

Sigma detected: Office Autorun Keys Modification

Stores files to the Windows start menu directory

Classification

Process Tree

System is w10x64_ra

OUTLOOK.EXE (PID: 2660 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\user\Desktop\phish_alert_sp2_2.0.0.0.eml" MD5: 91A5292942864110ED734005B7E005C0)

ai.exe (PID: 6656 cmdline: "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "FE491BB9-64FC-4565-A1D2-AA0E3386F49A" "D6407390-DA1A-4703-9341-3D3EDB6675E3" "2660" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx" MD5: EC652BEDD90E089D9406AFED89A8A8BD)

chrome.exe (PID: 4320 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://1drv.ms/v/c/9e074ca6193b2ab0/EZ7P27rGCMNLhgyDJhriBm8Bb7mOpqxeTdEkIA6QZ4QufQ?e=4%3aSxQQ0F&sharingv2=true&fromShare=true&at=9 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 5464 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 --field-trial-handle=1736,i,12209984474440310689,12111156678106355062,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 8108 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4240 --field-trial-handle=1736,i,12209984474440310689,12111156678106355062,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Sigma Signatures

Sigma detected: Office Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: 1, EventID: 13, EventType: SetValue, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE, ProcessId: 2660, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Addins\SearchToolbarsDisabled

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Phishing

AI detected landing page (webpage, office document or email)

Source: Email

Joe Sandbox AI: Email contains prominent button: 'open'

AI detected potential phishing Email

Source: Email

Joe Sandbox AI: Detected potential phishing email: The email claims to be about payment issues but includes suspicious OneDrive links and multiple attachments, a common phishing tactic. The sender email (joebstream@msn.com) appears unrelated to Vail Health despite claiming to be a patient. The message is repetitive and poorly formatted, showing signs of automated generation or manipulation

Source: Email

Classification: Invoice Scam

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

File opened: C:\Program Files (x86)\Microsoft Office\root\vfs\SystemX86\MSVCR100.dll

Source: unknown

HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.16:49766 version: TLS 1.2

Source: chrome.exe

Memory has grown: Private usage: 21MB later: 27MB

Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.214.172
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.214.172
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.214.172
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.214.172
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.8

Source: global traffic	DNS traffic detected: DNS query: 1drv.ms
Source: global traffic	DNS traffic detected: DNS query: photos.onedrive.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: my.microsoftpersonalcontent.com
Source: global traffic	DNS traffic detected: DNS query: spo.nel.measure.office.net
Source: global traffic	DNS traffic detected: DNS query: api-badgerp.svc.ms
Source: global traffic	DNS traffic detected: DNS query: p.sfx.ms
Source: global traffic	DNS traffic detected: DNS query: canadacentral1-mediap.svc.ms
Source: global traffic	DNS traffic detected: DNS query: m365cdn.nel.measure.office.net

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 49697 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49697
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49877 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49854 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49843 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49888 -> 443

Source: unknown

HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.16:49766 version: TLS 1.2

Source: classification engine

Classification label: mal48.winEML@20/16@36/222

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

File created: C:\Program Files (x86)\Microsoft Office\root\vfs\Common AppData\Microsoft\Office\Heartbeat\HeartbeatCache.xml

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

File created: C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

File created: C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20241223T1148220508-2660.etl

Source: unknown	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\user\Desktop\phish_alert_sp2_2.0.0.0.eml"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "FE491BB9-64FC-4565-A1D2-AA0E3386F49A" "D6407390-DA1A-4703-9341-3D3EDB6675E3" "2660" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://1drv.ms/v/c/9e074ca6193b2ab0/EZ7P27rGCMNLhgyDJhriBm8Bb7mOpqxeTdEkIA6QZ4QufQ?e=4%3aSxQQ0F&sharingv2=true&fromShare=true&at=9
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 --field-trial-handle=1736,i,12209984474440310689,12111156678106355062,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "FE491BB9-64FC-4565-A1D2-AA0E3386F49A" "D6407390-DA1A-4703-9341-3D3EDB6675E3" "2660" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://1drv.ms/v/c/9e074ca6193b2ab0/EZ7P27rGCMNLhgyDJhriBm8Bb7mOpqxeTdEkIA6QZ4QufQ?e=4%3aSxQQ0F&sharingv2=true&fromShare=true&at=9
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 --field-trial-handle=1736,i,12209984474440310689,12111156678106355062,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4240 --field-trial-handle=1736,i,12209984474440310689,12111156678106355062,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4240 --field-trial-handle=1736,i,12209984474440310689,12111156678106355062,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8

Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: apphelp.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: c2r64.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: userenv.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: msasn1.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: cryptsp.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: rsaenh.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: gpapi.dll

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{529A9E6B-6587-4F23-AB9E-9C7D683E3C50}\InProcServer32

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Window found: window name: SysTabControl32

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Common

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

File opened: C:\Program Files (x86)\Microsoft Office\root\vfs\SystemX86\MSVCR100.dll

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

File Volume queried: C:\Windows\SysWOW64 FullSizeInformation

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Process information queried: ProcessInformation

Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe

Queries volume information: C:\Program Files (x86)\Microsoft Office\root\Office16\AI\WordCombinedFloatieLreOnline.onnx VolumeInformation

Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	21 Browser Extensions	1 Process Injection	2 Masquerading	OS Credential Dumping	1 Process Discovery	Remote Services	Data from Local System	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	1 DLL Side-Loading	1 Process Injection	LSASS Memory	13 System Information Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 Registry Run Keys / Startup Folder	1 Registry Run Keys / Startup Folder	1 DLL Side-Loading	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 Extra Window Memory Injection	1 Extra Window Memory Injection	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction

Name	IP	Active	Malicious	Reputation
dual-spov-0006.spov-msedge.net	13.107.137.11	true	false	high
dual-spo-0005.spo-msedge.net	13.107.136.10	true	false	high
www.google.com	142.250.181.68	true	false	high
1drv.ms	13.107.42.12	true	false	high
photos.onedrive.com	unknown	unknown	false	unknown
my.microsoftpersonalcontent.com	unknown	unknown	false	high
api-badgerp.svc.ms	unknown	unknown	false	high
p.sfx.ms	unknown	unknown	false	high
canadacentral1-mediap.svc.ms	unknown	unknown	false	unknown
m365cdn.nel.measure.office.net	unknown	unknown	false	high
spo.nel.measure.office.net	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://photos.onedrive.com/share/9E074CA6193B2AB0!sbadbcf9e08c64bc3860c83261ae2066f?cid=9E074CA6193B2AB0&resId=9E074CA6193B2AB0!sbadbcf9e08c64bc3860c83261ae2066f&ithint=video&e=4%3aSxQQ0F&sharingv2=true&fromShare=true&at=9&migratedtospo=true&redeem=aHR0cHM6Ly8xZHJ2Lm1zL3YvYy85ZTA3NGNhNjE5M2IyYWIwL0VaN1AyN3JHQ01OTGhneURKaHJpQm04QmI3bU9wcXhlVGRFa0lBNlFaNFF1ZlE_ZT00OlN4UVEwRiZzaGFyaW5ndjI9dHJ1ZSZmcm9tU2hhcmU9dHJ1ZSZhdD05	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
13.107.138.10	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
20.175.153.177	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
172.217.19.206	unknown	United States	15169	GOOGLEUS	false
95.100.135.98	unknown	European Union	16625	AKAMAI-ASUS	false
13.107.136.10	dual-spo-0005.spo-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
52.178.17.233	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
23.32.238.209	unknown	United States	2828	XO-AS15US	false
20.189.173.16	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
95.100.135.123	unknown	European Union	16625	AKAMAI-ASUS	false
2.19.198.51	unknown	European Union	16625	AKAMAI-ASUS	false
51.105.104.217	unknown	United Kingdom	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.250.181.68	www.google.com	United States	15169	GOOGLEUS	false
172.217.21.35	unknown	United States	15169	GOOGLEUS	false
52.113.194.132	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.250.203.227	unknown	United States	15169	GOOGLEUS	false
1.1.1.1	unknown	Australia	13335	CLOUDFLARENETUS	false
13.107.137.11	dual-spov-0006.spov-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
23.32.238.185	unknown	United States	2828	XO-AS15US	false
23.32.238.168	unknown	United States	2828	XO-AS15US	false
20.42.65.93	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.250.181.142	unknown	United States	15169	GOOGLEUS	false
13.107.42.12	1drv.ms	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
52.109.28.46	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
173.194.220.84	unknown	United States	15169	GOOGLEUS	false
52.109.76.243	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false

Private

IP
192.168.2.16

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1580004
Start date and time:	2024-12-23 17:47:53 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled
Analysis Mode:	stream
Analysis stop reason:	Timeout
Sample name:	phish_alert_sp2_2.0.0.0.eml
Detection:	MAL
Classification:	mal48.winEML@20/16@36/222
Cookbook Comments:	Found application associated with file extension: .eml

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 52.109.28.46, 52.113.194.132, 52.109.76.243, 2.19.198.51, 2.19.198.56
Excluded domains from analysis (whitelisted): ecs.office.com, omex.cdn.office.net, fs.microsoft.com, slscr.update.microsoft.com, prod.configsvc1.live.com.akadns.net, prod.roaming1.live.com.akadns.net, s-0005-office.config.skype.com, eur.roaming1.live.com.akadns.net, neu-azsc-000.roaming.officeapps.live.com, fe3cr.delivery.mp.microsoft.com, ecs-office.s-0005.s-msedge.net, roaming.officeapps.live.com, s-0005.s-msedge.net, config.officeapps.live.com, osiprod-neu-buff-azsc-000.northeurope.cloudapp.azure.com, officeclient.microsoft.com, ecs.office.trafficmanager.net, omex.cdn.office.net.akamaized.net, europe.configsvc1.live.com.akadns.net, uks-azsc-config.officeapps.live.com, a1864.dscd.akamai.net
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadFile calls found.
Report size getting too big, too many NtSetInformationFile calls found.
VT rate limit hit for: phish_alert_sp2_2.0.0.0.eml

LLM Input / Output

Input	Output
URL: email Model: Joe Sandbox AI	{ "explanation": [ "The email claims to be about payment issues but includes suspicious OneDrive links and multiple attachments, a common phishing tactic", "The sender email (joebstream@msn.com) appears unrelated to Vail Health despite claiming to be a patient", "The message is repetitive and poorly formatted, showing signs of automated generation or manipulation" ], "phishing": true, "confidence": 9, "generated_by_ai": false }
{ "date": "Sat, 21 Dec 2024 04:26:45 +0000", "subject": "joe bartner shared \"Vail Health Portal Payment Issues Documentation\" with you", "communications": [ " This email came from outside VAIL HEALTHSTOP, LOOK, THINK!This email was sent from an external source. Do NOT click links or open attachments from an unknown or unexpected sender. Report suspicious e-mails using the Phish-Alert button in Outlook, if available, or forward to aa-spam@vailhealth.org joe bartner invited you to access a file Hi Will;Resolving the inability to pay my invoices as illustrated in this video should improve Vail's financial position, as I am sure I am not the only patient having this issue.Thanks;Joe Bartner Vail Health Portal Payment Issues Documentation This link will work for anyone. Open Privacy Statement This email came from outside VAIL HEALTHSTOP, LOOK, THINK!This email was sent from an external source. Do NOT click links or open attachments from an unknown or unexpected sender. Report suspicious e-mails using the Phish-Alert button in Outlook, if available, or forward to aa-spam@vailhealth.org joe bartner invited you to access a file Hi Will;Resolving the inability to pay my invoices as illustrated in this video should improve Vail's financial position, as I am sure I am not the only patient having this issue.Thanks;Joe Bartner Vail Health Portal Payment Issues Documentation This link will work for anyone. Open Privacy Statement This email came from outside VAIL HEALTH This email came from outside VAIL HEALTH This email came from outside VAIL HEALTH STOP, LOOK, THINK! STOP, LOOK, THINK! STOP, LOOK, THINK! This email was sent from an external source. Do NOT click links or open attachments from an unknown or unexpected sender. Report suspicious e-mails using the Phish-Alert button in Outlook, if available, or forward to aa-spam@vailhealth.org This email was sent from an external source. Do NOT click links or open attachments from an unknown or unexpected sender. Report suspicious e-mails using the Phish-Alert button in Outlook, if available, or forward to aa-spam@vailhealth.org Phish-Alert button aa-spam@vailhealth.org aa-spam@vailhealth.org joe bartner invited you to access a file Hi Will;Resolving the inability to pay my invoices as illustrated in this video should improve Vail's financial position, as I am sure I am not the only patient having this issue.Thanks;Joe Bartner Vail Health Portal Payment Issues Documentation This link will work for anyone. Open Privacy Statement @font-face { font-family: \"Segoe UI\"; src: local(\"Segoe UI Light\"), url(\"https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-westeuropean/segoeui-light.woff2\") format(\"woff2\"), url(\"https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-westeuropean/segoeui-light.woff\") format(\"woff\"), url(\"https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-westeuropean/segoeui-light.ttf\") format(\"truetype\"); font-weight: 100; font-style: normal; } @font-face { font-family: \"Segoe UI\"; src: local(\"Segoe UI Semilight\"), url(\"https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-westeuropean/segoeui-semilight.woff2\") format(\"woff2\"), url(\"https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-westeuropean/segoeui-semilight.woff\") format(\"woff\"), url(\"https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-westeuropean/segoeui-semilight.ttf\") format(\"truetype\"); font-weight: 300; font-style: normal; } @font-face { font-family: \"Segoe UI\"; src: local(\"Segoe UI\"), url(\"https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-westeuropean/segoeui-regular.woff2\") format(\"woff2\"), url(\"https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-westeuropean/segoeui-regular.woff\") format(\"woff\"), url(\"https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-westeuropean/segoeui-regular.ttf\") format(\"truetype\"); font-weight: 400; font-style: normal; } @font-face { font-family: \"Segoe UI\"; src: local(\"Segoe UI Semibold\"), url(\"https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-westeuropean/segoeui-semibold.woff2\") format(\"woff2\"), url(\"https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-westeuropean/segoeui-semibold.woff\") format(\"woff\"), url(\"https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-westeuropean/segoeui-semibold.ttf\") format(\"truetype\"); font-weight: 600; font-style: normal; } @media only screen and (max-width: 640px) { body { background-color: #ffffff; } div.grey-bg-container { background-color: #ffffff; } } @media only screen and (min-width: 640px) { .CommentMention-TextRow-rightColumn { width: 52px !important; } } /* Responsive visibility clases. / .u-largeOnly { display: none !important; } @media only screen and (min-width: 640px) { .u-smallOnly { display: none !important; } .u-largeOnly { display: block !important; } } / Adjustments to the Sharing template. */ @media only screen and (min-width: 640px) { .Sharing-main { padding: 40px !important; } } @media only screen and (max-width: 640px) { .NotificationHeader-icon { width: 36px !important; } .NotificationHeader-title { padding-left: 28px !important; padding-right: 28px !important; } .NotificationHeader-title-text { font-size: 20px !important; line-height: 28px !important; } } .word-button:hover { background-color: #124078 !important; border-color: #124078 !important; } .word-button:active { background-color: #002050 !important; border-color: #002050 !important; } .powerpoint-button:hover { background-color: #a92b1a !important; border-color: #a92b1a !important; } .powerpoint-button:active { background-color: #740912 !important; border-color: #740912 !important; } .excel-button:hover { background-color: #217346 !important; border-color: #217346 !important; } .excel-button:active { background-color: #004b1c !important; border-color: #004b1c !important; } joe bartner invited you to access a file Hi Will;Resolving the inability to pay my invoices as illustrated in this video should improve Vail's financial position, as I am sure I am not the only patient having this issue.Thanks;Joe Bartner Vail Health Portal Payment Issues Documentation This link will work for anyone. Open Privacy Statement joe bartner invited you to access a file Hi Will;Resolving the inability to pay my invoices as illustrated in this video should improve Vail's financial position, as I am sure I am not the only patient having this issue.Thanks;Joe Bartner Vail Health Portal Payment Issues Documentation This link will work for anyone. Open joe bartner invited you to access a file Hi Will;Resolving the inability to pay my invoices as illustrated in this video should improve Vail's financial position, as I am sure I am not the only patient having this issue.Thanks;Joe Bartner Vail Health Portal Payment Issues Documentation This link will work for anyone. Open joe bartner invited you to access a file joe bartner invited you to access a file joe bartner invited you to access a file Hi Will;Resolving the inability to pay my invoices as illustrated in this video should improve Vail's financial position, as I am sure I am not the only patient having this issue.Thanks;Joe Bartner Hi Will;Resolving the inability to pay my invoices as illustrated in this video should improve Vail's financial position, as I am sure I am not the only patient having this issue.Thanks;Joe Bartner Hi Will;Resolving the inability to pay my invoices as illustrated in this video should improve Vail's financial position, as I am sure I am not the only patient having this issue.Thanks;Joe Bartner Vail Health Portal Payment Issues Documentation Vail Health Portal Payment Issues Documentation Vail Health Portal Payment Issues Documentation https://1drv.ms/v/c/9e074ca6193b2ab0/EZ7P27rGCMNLhgyDJhriBm8Bb7mOpqxeTdEkIA6QZ4QufQ?e=4%3aSxQQ0F&sharingv2=true&fromShare=true&at=9 Vail Health Portal Payment Issues Documentation Vail Health Portal Payment Issues Documentation Vail Health Portal Payment Issues Documentation Vail Health Portal Payment Issues Documentation This link will work for anyone. This link will work for anyone. This link will work for anyone. This link will work for anyone. This link will work for anyone. This link will work for anyone. This link will work for anyone. Open Open Open https://1drv.ms/v/c/9e074ca6193b2ab0/EZ7P27rGCMNLhgyDJhriBm8Bb7mOpqxeTdEkIA6QZ4QufQ?e=4%3aSxQQ0F&sharingv2=true&fromShare=true&at=9 Privacy Statement Privacy Statement Privacy Statement Privacy Statement Privacy Statement Privacy Statement https://aka.ms/privacy " ], "from": "joe bartner <joebstream@msn.com>", "to": "valdentist@outlook.com, Will Cook <will.cook@vailhealth.org>", "attachements": [ "AttachedImage", "AttachedImage", "AttachedImage", "AttachedImage" ] }
URL: Email Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "joe bartner invited you to access a file", "prominent_button_name": "Open", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": true, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: Email Model: Joe Sandbox AI	{ "brands": [ "Vail Health" ] }
	{ "brands": [ "Vail Health" ] }
URL: Email Model: Joe Sandbox AI	{"classification":"Invoice Scam"}
Email: Detected potential phishing email: The email claims to be about payment issues but includes suspicious OneDrive links and multiple attachments, a common phishing tactic. The sender email (joebstream@msn.com) appears unrelated to Vail Health despite claiming to be a patient. The message is repetitive and poorly formatted, showing signs of automated generation or manipulation	{"classification":"Invoice Scam"}
URL: https://photos.onedrive.com/share/9E074CA6193B2AB0... Model: Joe Sandbox AI	{ "risk_score": 2, "reasoning": "The provided JavaScript snippet appears to be a configuration object for the OneDrive Photos service. It contains various properties related to the user's session, environment, and configuration settings. While it includes some potentially sensitive information like the client ID and tenant ID, the overall behavior seems to be benign and related to legitimate service functionality. There are no clear indicators of high-risk activities like dynamic code execution, data exfiltration, or suspicious redirects. The script appears to be part of a trusted Microsoft service, so the risk is relatively low." }
window.SessionInformation = {"accountType":"consumer","ariaToken":"a23e4f242c9c4097a968f28c62633e19-62d0d830-5afd-4df3-8e40-351c8711cf5c-7157","clientId":"073204aa-c1e0-4e66-a200-e5815a0aa93d","clientVersion":"onedrive-photos-ci_20241217.2","dogfoodUser":false,"embedded":false,"environment":"production","locale":"en","loginAuthority":"login.microsoftonline.com","ramps":{"EnableMemoriesPage":false,"EnableMOJNotificationBanner":true,"DisableVideoPlaybackForItalianLanguageUsers":false,"EnableTagPagination":false,"EnableMOJDirectToOneup":false,"OnlyHighMatches":false,"ShowAutoGeneratedAlbums":false,"EnableServerZipDownload":true},"experiments":{"EnableMOJDirectToOneup":"Default"},"ring":"1","redirectUri":"https://photos.onedrive.com/auth/login","refreshUri":"https://photos.onedrive.com/auth/refresh","serverVersion":"onedrive-photos-ci_20241112.1","tenantId":"9188040d-6c67-4c5b-b112-36a304b66dad","telemetryEndpoint":"https://browser.events.data.microsoft.com/OneCollector/1.0/"};
URL: https://photos.onedrive.com Model: Joe Sandbox AI	{ "typosquatting": false, "unusual_query_string": false, "suspicious_tld": false, "ip_in_url": false, "long_subdomain": false, "malicious_keywords": false, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": true, "brand_spoofing_attempt": false, "third_party_hosting": false }
URL: https://photos.onedrive.com
URL: https://res.cdn.office.net/onedrvphotospcdn/static... Model: Joe Sandbox AI	```json { "risk_score": 1, "reasoning": "The script primarily involves DOM manipulation and state management for a web application, with no high-risk behaviors such as dynamic code execution or data exfiltration. It uses modern JavaScript practices and interacts with the DOM in a controlled manner. There are no interactions with external domains or obfuscated code present." }
"use strict";(this.webpackChunkonedrive_photos=this.webpackChunkonedrive_photos\|\|[]).push([[179],{8128:(e,t,n)=>{n.d(t,{n:()=>d});var o=n(72243),r=n(2408),a=n(84851),i=n(82435);let s=0;const l=[],c="data-modal-generation";function d(e){const{selector:t}=e,[n]=o.useState((()=>s++));return(0,r.OR)(document,"focusin",(e=>{if(n===l[l.length-1]){const{body:n}=document,o=n.querySelector(t);let r=e.target;for(;r&&r!==n&&null!==r.parentElement;){if(r.getAttribute("data-modal-generation")){const t=(0,a.$)(o);if(t.length){let n=0;for(;n<t.length-1&&"-1"===t[n].getAttribute("tabIndex");)n++;t[n].focus(),e.stopImmediatePropagation();break}}r=r.parentElement}}}),{capture:!0}),o.useEffect((()=>{const{body:e}=document,o=e.querySelector(t);if(o){let t=o;for(l.push(n);t!==e&&null!==t.parentElement;){const e=t.parentElement.children;for(const o of e)o===t\|\|"SCRIPT"===o.nodeName\|\|"STYLE"===o.nodeName\|\|o.getAttribute("aria-hidden")\|\|o.querySelector("[data-modal-generation]")\|\|(o.setAttribute(c,n.toString()),o.setAttribute("aria-hidden","true"));t=t.parentElement}return()=>{const t=e.querySelectorAll(`*[data-modal-generation='${n}']`);for(const e of t)e.removeAttribute("aria-hidden"),e.removeAttribute(c);l.splice(l.indexOf(n),1)}}}),[n,t]),(0,i.jsx)(i.Fragment,{children:e.children})}},26107:(e,t,n)=>{n.d(t,{U:()=>c});var o=n(72243),r=n(23190),a=n(67280),i=n(8128),s=n(82435);let l=0;function c(e){const{children:t,componentRef:n,contentClassName:c,modal:d}=e,u=o.useRef(null),[h]=o.useState((()=>"aria-callout-element-"+ ++l));o.useImperativeHandle(n,(()=>({updateLayout:()=>{var e;return null===(e=u.current)\|\|void 0===e?void 0:e.updateLayout()}})));let m=t;return d&&(m=(0,s.jsx)(i.n,{selector:`.${h}`,children:t})),(0,s.jsx)(r.UW,{...e,contentClassName:(0,a.iv)(c,h),ref:u,children:m})}},37140:(e,t,n)=>{n.d(t,{V:()=>c});var o=n(72243),r=n(14766),a=n(14288),i=n(78465),s=n(63693),l=n(82435);function c(e){const t={default:void 0};let n;const c=()=>(n=n\|\|new Promise(((n,o)=>e().then((e=>{t.default=e.default,n(e)})).catch(o))),n);return function(e){const n=o.useContext(r.A),d=o.useContext(a.r),u=o.useRef(void 0),h=o.useRef(void 0),{trackPromise:m}=(0,i.f)(),[,p]=o.useState(0),[{reject:v,resolve:f,promise:g}]=o.useState((()=>(0,s.PQ)()));let x;if(!t.default){const e=m(c(),"Shim.componentPromise"),o=d.getScenario();o&&(u.current=o.waitUntil(g,{scenarioName:"lazyLoad",scenarioType:"scriptDownload"},(e=>{var n;Object.assign(e.properties,{componentName:null===t\|\|void 0===t\|\|null===(n=t.default)\|\|void 0===n?void 0:n.name})}))),e.then((()=>p((e=>e+1)))).catch((e=>{e.isCanceled\|\|n.dispatchEvent("telemetryAvailable",{action:"exception",error:e,name:"lazyLoad"}),v(e)}))}h.current\|\|(h.current=o.lazy(c));if(x=o.createElement(h.current,e),u.current){const e=u.current;x=(0,l.jsx)(a.r.Provider,{value:{getScenario:()=>{if("working"===e.status())return e}},children:x})}return o.useEffect((()=>{t.default&&f()})),x}}},77357:(e,t,n)=>{n.d(t,{Q:()=>a});var o=n(18421),r=n(72243);function a(e){const{children:t,values:n}=e,[,a]=r.useState(0),[i]=r.useState((()=>new Set)),s={};i.forEach((e=>{let{delegate:t,observableValue:n}=e;return n.unsubscribe(t)})),i.clear();for(const r in n){const e=n[r];if(o.PY.isObservable(e)){const t=n[r].value,o=e=>{e!==t&&a((e=>e+1))};e.subscribe(o),i.add({delegate:o,observableValue:e,resolvedValue:t}),s[r]=t}else s[r]=n[r]}return r.useEffect((()=>()=>{i.forEach((e=>{let{delegate:t,observableValue:n}=e;return n.unsubscribe(t)})),i.clear()}),[i]),t?t(s):null}},69902:(e,t,n)=>{n.d(t,{b:()=>i});var o=n(72243),r=n(69873),a=n(43409);function i(e){const{children:t,containerElement:n,responsiveSelectors:i}=e,s=o.useRef(-1),[,l]=o.useState(0),{setTimeout:c}=(0,a.K)();return(0,r.a)(n,o.useCallback(d,[i])),o.useLayoutEffect((()=>{const e=u();let t=s.current;for(;t>=0;){const n=e[i[t--]];n&&n.forEach((e=>e.classList.add("hidden")))}d()})),t({responsiveIndex:s.current});function d(){const{current:e}=n,t=u();if(e){let n=s.current;if(e.scrollWidth>e.clientWidth)for(;n<i.le
URL: https://res.cdn.office.net/onedrvphotospcdn/static... Model: Joe Sandbox AI	```json { "risk_score": 1, "reasoning": "The script appears to be part of a larger application, likely related to OneDrive Photos, and does not exhibit any high-risk behaviors such as dynamic code execution, data exfiltration, or redirects to suspicious domains. It primarily involves event handling and DOM manipulation, which are typical for interactive web applications. There are no indicators of malicious intent or interaction with untrusted domains." }
"use strict";(this.webpackChunkonedrive_photos=this.webpackChunkonedrive_photos\|\|[]).push([[4937],{44937:(e,t,n)=>{n.r(t),n.d(t,{PhotoView:()=>ze,default:()=>We});var o=n(75894),i=n(18421),l=n(87501),a=n(78070),s=n(98381),r=n(2243),d=n(67280),c=n(72243),u=n(52557),h=n(37140),m=n(77357),v=n(69902),f=n(32580),p=n(14766),g=n(13812),x=n(7803),b=n(25496),w=n(2408),P=n(98667),y=n(98540),j=n(71914);var C=n(1632),A=n(36003);function S(e,t){const{limitPadding:n=50,onEventCallback:o}=t,i=function(e,t){const n=c.useRef();return n.current&&n.current.key===e\|\|(n.current={key:e,value:"function"===typeof t?t():t}),n.current.value}(e,{containerBounds:void 0,lastPoints:[],lastAveragePoint:void 0,scale:1,xPosition:0,yPosition:0}),{onMouseDown:l}=(0,C.Y)((function(e){if(i.scale<=1)return;e.preventDefault();const n=[{x:e.pageX,y:e.pageY}],o=n.reduce(d);if(i.lastAveragePoint){const e=i.xPosition+o.x-i.lastAveragePoint.x,t=i.yPosition+o.y-i.lastAveragePoint.y;r(e,t,i.scale)}t.onEventCallback(i.xPosition,i.yPosition,i.scale),i.lastPoints=n,i.lastAveragePoint=o})),{onTouchStart:a}=(0,A.R)((function(e){if(1===i.scale)return;const n=Array.from(e.touches).map((e=>({x:e.pageX,y:e.pageY}))),o=n.reduce(d),l=t.containerReference.current.getBoundingClientRect();if(i.lastAveragePoint){const e=i.xPosition+o.x-i.lastAveragePoint.x,t=i.yPosition+o.y-i.lastAveragePoint.y;if(n.length>1){const a=(0,j.TE)(n[0],n[1])/(0,j.TE)(i.lastPoints[0],i.lastPoints[1]);r(e-(o.x-l.left)(a-1),t-(o.y-l.top)(a-1),i.scalea,l)}else r(e,t,i.scale)}t.onEventCallback(i.xPosition,i.yPosition,i.scale),i.lastPoints=n,i.lastAveragePoint=o}));return s(),(0,w.OR)(window,"resize",s),{onWheel:function(e){var n;s();const l=null===(n=t.containerReference.current)\|\|void 0===n?void 0:n.getBoundingClientRect();if(!l)return;let a=-1e.deltaY;1===e.deltaMode&&(a=15);a=Math.max(Math.min(a,60),-60);const d=a/300+1;if(i.scaled>10)return;r(i.xPosition-(e.pageX-l.left)(d-1),i.yPosition-(e.pageY-l.top)(d-1),i.scaled,l),o(i.xPosition,i.yPosition,i.scale)},onMouseDown:function(e){if("mousedown"===e.type&&0!==e.button)return;i.lastPoints=[{x:e.pageX,y:e.pageY}],i.lastAveragePoint=i.lastPoints.reduce(d),l(e)},onTouchStart:function(e){i.lastPoints=Array.from(e.touches).map((e=>({x:e.pageX,y:e.pageY}))),i.lastAveragePoint=i.lastPoints.reduce(d),a(e)}};function s(){var e,n,o;const l=null===(e=t.imageReference.current)\|\|void 0===e?void 0:e.getBoundingClientRect();(!i.containerBounds\|\|l&&(l.height<(null===(n=i.containerBounds)\|\|void 0===n?void 0:n.height)\|\|(null===l\|\|void 0===l?void 0:l.width)<(null===(o=i.containerBounds)\|\|void 0===o?void 0:o.width)))&&(i.containerBounds=l,r(i.xPosition,i.yPosition,i.scale))}function r(e,o,l,a){if(t.containerReference.current!==t.imageReference.current&&i.containerBounds&&(a=a\|\|t.containerReference.current.getBoundingClientRect(),e!==i.xPosition\|\|o!==i.yPosition\|\|l!==i.scale)){const t=1/(i.scale/l);o=Math.min(0,Math.max(o,i.containerBounds.height-a.heightt-n)),e=Math.min(0,Math.max(e,i.containerBounds.width-a.width*t-n))}i.scale=Math.max(1,l),i.xPosition=e,i.yPosition=o}function d(e,t){return{x:(e.x+t.x)/2,y:(e.y+t.y)/2}}}var k=n(69873),D=n(43409),N=n(1375),E=n(98444),I=n(84851),B=n(6558),R=n(74278),M=n(44721),L=n(22400),T=n(51150),U=n(96827),V=n(960),F=n(60946),z=n(48090),$=n(67502),W=n(39086),H=n(13097),Q=n(23990),G=n(18365),O=n(10995),K=n(39146),X=n(14260),Y=n(78649),_=n(64126),J=n(13854),q=n(46303),Z=n(75864),ee=n(68684),te=n(29993),ne=n(15690),oe=n(71197);const ie="SEFH",le="SEFT",ae=ie.length,se=le.length;function re(e){return new Promise(((t,n)=>{const o=new FileReader;o.onload=()=>{const e=o.result;try{const o=new DataView(e),l={startSignature:"",formatVersion:0,dataCount:0,dataReferences:[],endSignature:""},a=e.byteLength-se;l.endSignature=String.fromCharCode(o.getInt8(a),o.getInt8(a+1),o.getInt8(a+2),o.getInt8(a+3));const s=4+se,r=o.getUint32(e.byteLength-s,!0)+s;let d=e.byteLength-r;const c=d+ae,u=c+4;l.startSignature=String.fromCharCode(o.getInt8(d),o.getInt8(d+1),
URL: https://res.cdn.office.net/onedrvphotospcdn/static... Model: Joe Sandbox AI	```json { "risk_score": 1, "reasoning": "The script appears to be part of a legitimate application, likely related to OneDrive Photos, and does not exhibit any high-risk behaviors such as dynamic code execution or data exfiltration. It primarily involves UI component rendering and state management, with no interactions with untrusted domains or obfuscated code." }
/! For license information please see 324.657729a4.js.LICENSE.txt / (this.webpackChunkonedrive_photos=this.webpackChunkonedrive_photos\|\|[]).push([[324],{8945:(e,t,n)=>{"use strict";n.d(t,{J:()=>u});var r=n(72243),o=function(e){if(!(null===e\|\|void 0===e?void 0:e.friendlyName))return"ME";var t=e.friendlyName.split(" ",2),n=t[0],r=t[1];return"".concat(n[0]).concat(r?r[0]:"")},i=function(){return i=Object.assign\|\|function(e){for(var t,n=1,r=arguments.length;n<r;n++)for(var o in t=arguments[n])Object.prototype.hasOwnProperty.call(t,o)&&(e[o]=t[o]);return e},i.apply(this,arguments)},a={height:36,width:36,backgroundColor:"transparent",borderColor:"white",borderRadius:"50%",borderStyle:"solid",borderWidth:"1px",display:"inline-block",fontSize:14,cursor:"pointer",color:"white"},s=function(e){var t=e.onClick,n=e.placeholderStyles,o=e.initials;return r.createElement("button",{type:"button",onClick:t,style:i(i({},a),n)},r.createElement("span",null,o))},l=r.lazy((function(){return Promise.all([n.e(4345),n.e(9667)]).then(n.bind(n,4345))})),u=function(e){var t=e.handlers,n=e.currentAccount,i=e.locale,a=e.theme,u=e.rememberedAccounts,c=e.additionalLinks,d=e.placeholderStyles,f=(0,r.useState)(!1),p=f[0],h=f[1],m=r.createElement(s,{onClick:function(){h(!0),n\|\|t.signIn()},initials:o(n),placeholderStyles:d}),v=p&&n;return r.createElement("div",null,v?r.createElement(r.Suspense,{fallback:r.createElement("div",null,m)},r.createElement(l,{startWithMenuOpened:!0,locale:i,theme:a,handlers:t,placeholderComponent:m,currentAccount:n,rememberedAccounts:u,additionalLinks:c})):m)}},52953:(e,t,n)=>{"use strict";n.d(t,{Z:()=>R});var r=n(87020),o=n(69844),i=n(7223),a=n(68258),s=n(19507),l=n(19648),u=n(30114),c=(((0,u.Rd)()\|\|{}).Symbol,((0,u.Rd)()\|\|{}).Reflect,l.rl,function(e,t){return c=l.Pw.setPrototypeOf\|\|{__proto__:[]}instanceof Array&&function(e,t){e.__proto__=t}\|\|function(e,t){for(var n in t)t[l.bO](n)&&(e[n]=t[n])},c(e,t)});function d(e,t){function n(){this.constructor=e}typeof t!==l.cb&&null!==t&&(0,u.ZU)("Class extends value "+String(t)+" is not a constructor or null"),c(e,t),e[l.hB]=null===t?(0,u.pu)(t):(n[l.hB]=t[l.hB],new n)}function f(e,t){for(var n=0,r=t.length,o=e.length;n<r;n++,o++)e[o]=t[n];return e}var p=n(61692),h=n(779),m=n(19012),v=n(13594),g=n(59078),y=n(79340),b=n(42821),w=500;function x(e,t,n,r){t&&(0,a.kJ)(t)&&t.length>0&&(t=t.sort((function(e,t){return e.priority-t.priority})),(0,a.tO)(t,(function(e){e.priority<w&&(0,a._y)("Channel has invalid priority - "+e.identifier)})),e.push({queue:(0,a.FL)(t),chain:(0,h.jV)(t,n,r)}))}var E=function(e){function t(){var n,r,i=e.call(this)\|\|this;function l(){n=0,r=[]}return i.identifier="TelemetryInitializerPlugin",i.priority=199,l(),(0,p.Z)(t,i,(function(e,t){e.addTelemetryInitializer=function(e){var t={id:n++,fn:e};return r.push(t),{remove:function(){(0,a.tO)(r,(function(e,n){if(e.id===t.id)return r.splice(n,1),-1}))}}},e.processTelemetry=function(t,n){for(var i=!1,l=r.length,u=0;u<l;++u){var c=r[u];if(c)try{if(!1===c.fn.apply(null,[t])){i=!0;break}}catch(d){(0,o.kP)(n.diagLog(),1,64,"One of telemetry initializers failed, telemetry item will not be sent: "+(0,a.jj)(d),{exception:(0,s.eU)(d)},!0)}}i\|\|e.processNext(t,n)},e[b.Ho]=function(){l()}})),i}return d(t,e),t}(n(57042).i),C=n(5479),S=n(96831),k="Plugins must provide initialize method",I="SDK is still unloading...",T={loggingLevelConsole:1};function P(e,t){return new i.Jk(t)}function M(e,t){var n=!1;return(0,a.tO)(t,(function(t){if(t===e)return n=!0,-1})),n}function D(e,t,n,r){(0,a.tO)(e,(function(e){if(e&&e[t])if(n)setTimeout((function(){return r(e)}),0);else try{r(e)}catch(o){}}))}var _=function e(t){this.listeners=[];var n=!!(t\|\|{}).perfEvtsSendAll;(0,p.Z)(e,this,(function(e){e[b.dV]=function(t){e.listeners.push(t)},e[b.XP]=function(t){for(var n=(0,a.UA)(e.listeners,t);n>-1;)e.listeners.splice(n,1),n=(0,a.UA)(e.listeners,t)},e[b.eO]=function(t){D(e.listeners,b.eO,!0,(function(e){e[b.eO](t)}))},e[b.H4]=function(t,n){D(e.listeners,b.H4,!0,(funct
URL: https://photos.onedrive.com/share/9E074CA6193B2AB0!sbadbcf9e08c64bc3860c83261ae2066f?cid=9E074CA6193B2AB0&resId=9E074CA6193B2AB0!sbadbcf9e08c64bc3860c83261ae2066f&ithint=video&e=4%3aSxQQ0F&sharingv2=true&fromShare=true&at=9&migratedtospo=true&redeem=aHR0c Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "BALANCE REQUIRING ACTION", "prominent_button_name": "PAY NOW", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://photos.onedrive.com/share/9E074CA6193B2AB0!sbadbcf9e08c64bc3860c83261ae2066f?cid=9E074CA6193B2AB0&resId=9E074CA6193B2AB0!sbadbcf9e08c64bc3860c83261ae2066f&ithint=video&e=4%3aSxQQ0F&sharingv2=true&fromShare=true&at=9&migratedtospo=true&redeem=aHR0c Model: Joe Sandbox AI	{ "brands": [ "VAIL HEALTH" ] }
	{ "brands": [ "VAIL HEALTH" ] }

Created / dropped Files

C:\Program Files (x86)\Microsoft Office\root\vfs\Common AppData\Microsoft\OFFICE\Heartbeat\HeartbeatCache.xml

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	118
Entropy (8bit):	3.5700810731231707
Encrypted:	false
SSDEEP:
MD5:	573220372DA4ED487441611079B623CD
SHA1:	8F9D967AC6EF34640F1F0845214FBC6994C0CB80
SHA-256:	BE84B842025E4241BFE0C9F7B8F86A322E4396D893EF87EA1E29C74F47B6A22D
SHA-512:	F19FA3583668C3AF92A9CEF7010BD6ECEC7285F9C8665F2E9528DBA606F105D9AF9B1DB0CF6E7F77EF2E395943DC0D5CB37149E773319078688979E4024F9DD7
Malicious:	false
Reputation:	unknown
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.H.e.a.r.t.b.e.a.t.C.a.c.h.e./.>.

C:\Users\user\AppData\Local\Microsoft\FORMS\FRMCACHE.DAT

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	245980
Entropy (8bit):	4.205492264099148
Encrypted:	false
SSDEEP:
MD5:	B17108168F94B9493D0A3E0EF18067BB
SHA1:	3FBDD01914C6BE81B65F07A0B37BF9D29405E7B8
SHA-256:	013303CF46CD9D2F8BFEA81F9252A611770A9BC754EA7558F3EAFF95F5D16F35
SHA-512:	566D84F09B11DBADBD74EF9657669DA3E1E351D531BC618CB6B2F097731BE061A904663DDBE874811526CEBAC438E6DABB081D490AEBF75DCCE0C14183BA4457
Malicious:	false
Reputation:	unknown
Preview:	TH02...... ...Z.ZU......SM01........pj.pZU..........IPM.TaskRequest.Decline........h...............h............H..h.X.....r......h........x(..H..h\cal ...pDat...h.^..0...8.X....h..,............h........_`Pk...h..,.H...I.lw...h....P...8.Uk...0....\...............l.........2h...............kTask..........!h.............. h.......P.X...#h....8.........$hx(......@....."h..............'h..............1h..,...........0h.........Uk../h..........UkH..h.... ....X...-h ...0...\|.X...+h".,.4....X.......#hx...... ..............FS..............FIPM.TaskRequest.Decline.Form.d.dStandard.PM.Task Decline.PM.IPM.Microsoft.FolderDesign.FormsDescription................F.k..........1111110000000000.icrMicrosoft.isThis form is used to decline a task request.........kf...... ..........&...........(.......(... ...@...............................................................................................................................D@..............D@x.............DG...p..........DH..www.wwp.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntities.bin

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	322260
Entropy (8bit):	4.000299760592446
Encrypted:	false
SSDEEP:
MD5:	CC90D669144261B198DEAD45AA266572
SHA1:	EF164048A8BC8BD3A015CF63E78BDAC720071305
SHA-256:	89C701EEFF939A44F28921FD85365ECD87041935DCD0FE0BAF04957DA12C9899
SHA-512:	16F8A8A6DCBAEAEFB88C7CFF910BCCC71B76A723CF808B810F500E28E543112C2FAE2491D4D209569BD810490EDFF564A2B084709B02963BCAF6FDF1AEEC59AC
Malicious:	false
Reputation:	unknown
Preview:	51253fe60063c31af0d295afb42228b0:v2:2:1:1590:2:8479:76bd602437550e98c9043d06a55186ab7d95dea5a0e935a599f73e62a8c9b158e0afcb19351f6c353940c06a38172b94d18c02cf92bb8a80184eccca0392b259ab3e71dae73e491c7941997cb36ad4a198661f622dad478d840f66d530a0dde78acea3367f91fff62fbb3dc18faff0c708ad30edef5bea8b22c5fd782b770d8993386eaa784fd19a3c3e1db3b537b1a94d3d4fbd46f8df8fddf6d16611969fe0a97c50e0f3ac24750c93257cf5c161184aa7385800c87d803b339632a3d8ec7fe17a0afd83ce9e9d0e3f7b8d579637928a811f1f7e6d1887df2ddc7d4f752c4d600235e426c92c7bf8a1362f95457998cc0e5d4261f0efa4fada0f866dbcefb407dacab7a2914e91c2f08200f38c2d9d621962145b1464b0f204b326118a53ecdcab22bff005fdd5257c99a6dc51ac0600a49f2ef782396987e78c08b846dad5db55e8ccefffc64863bc2c3e90b95a09d25d0814a848c98fe01a82d4e30e6682dd546e12c45ca0d280a45295ab4bd632dafb070edfdc3c9e38313d5aeb195972986f8011b66817028fd8c78b67a0ac7e780eecc3fb6a31f5a025b8a9a3db278a98c0696aeaac739b18688b0f9c7d751bba02cc5f4e41853fb119b3c0c915059aaa92971244a1989124f12881ca88e6410df70b793a2c3a736ff4

C:\Users\user\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntitiesUpdated.bin

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	ASCII text, with no line terminators
Category:	modified
Size (bytes):	10
Entropy (8bit):	2.6464393446710157
Encrypted:	false
SSDEEP:
MD5:	ACF5B2D7416AEDE6F6ED916B04B6A6AE
SHA1:	AEF46BE85403BEFE7B64EE7F0C77654ED25385BE
SHA-256:	069639A8A6EDD304D5759654DB9B19F2B3731DC6A85FAECF839CC173B71BD8F8
SHA-512:	AF2483C4024797DB3F4ABCBBF95808E217188741EF3C7276993DB4DB14D8E7E8E400B54729B90C98C473178C162D362A877342262CF799F9953E01B256C57FA3
Malicious:	false
Reputation:	unknown
Preview:	1734972517

C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\11205D8A-60ED-4384-A3FE-218ACDC740D1

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	183024
Entropy (8bit):	5.293758247932474
Encrypted:	false
SSDEEP:
MD5:	0CE5243E8F92B058D7896E0F6FB35EA5
SHA1:	F5CD4EB1BA0BA270435DD18A6002D649D7F71F73
SHA-256:	D56E03E73BDD3ECC52BD7DDB8EB8E1096502CBF5191DB7378DB060A85AB2E7A7
SHA-512:	A737128D96D28472B4D44722548B1432BF46F346FD319D7F072120D1ED98990F12E7388C71D9ECC9286EA61367A11A10352D803EBAC9FD82D2107AD1DD744B4C
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8"?>..<o:OfficeConfig xmlns:o="urn:schemas-microsoft-com:office:office">.. <o:services o:GenerationTime="2024-12-23T16:48:33">.. Build: 16.0.18406.40129-->.. <o:default>.. <o:ticket o:headerName="Authorization" o:headerValue="{}" />.. </o:default>.. <o:service o:name="Research">.. <o:url>https://word-edit.officeapps.live.com/we/rrdiscovery.ashx</o:url>.. </o:service>.. <o:service o:name="ORedir">.. <o:url>https://o15.officeredir.microsoft.com/r</o:url>.. </o:service>.. <o:service o:name="ORedirSSL">.. <o:url>https://o15.officeredir.microsoft.com/r</o:url>.. </o:service>.. <o:service o:name="ClViewClientHelpId" o:authentication="1">.. <o:url>https://[MAX.BaseHost]/client/results?fullframe=yes</o:url>.. <o:ticket o:policy="DELEGATION" o:idprovider="1" o:target="[MAX.AuthHost]" o:headerValue="Bearer {}" />.. <o:ticket o:idprovider="3" o:headerValue="Bearer {}" o:resourceId="[MAX.Resourc

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\95A4C9B9.dat

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	PNG image data, 96 x 96, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2877
Entropy (8bit):	7.9028514706867385
Encrypted:	false
SSDEEP:
MD5:	1E13EE0ED09C4AF1ADFB6C0D280879B0
SHA1:	1192A79F7B4C4FF814583743F8C66ACA7ECB8ACF
SHA-256:	E2395FBA25D3FB8A971345CA65D144F7D9C9D933F70409165446E63D18C0958D
SHA-512:	4D86A41DE4B3CA8BB73BF641838953BE03FFF34A890B7BDDC506276186D42979BC99A7DC5553005F135AA1C02137C85C6A2623498C78A617CC195E28FD8B3C95
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...`...`......w8....sRGB.........IDATx..\}l.G..o..Z....$%i....4P5. Q.........@...nZ.wg.....%.$M........-.T>$..B.........MA..4Q...v...g..v....q..H.}......};o.D:h.4.....F.rC ..MBp..6.n@x..{(.?.6..1..z.............&....D....P.3A. ....).?.4...2...&..?.$...J.d...a&....M@5..^..A....".LBo.q.d.......B.a_I.....i....#...k.. 'h..-.;QmTG...1an...cN..i.."%....5...j...'bQ-...$.s.......T.8.. .$..N...Y..k..P...a..g....>`...Y[#.-..._M.m. .$.^Ed,.Z..}Y..}.2.c..X....c...$.e{..I.+.+.n.TH........7..k..wCm.....6.'..rd..U0.A..WT.vi.O@"..Jq'F...........NH`.:eb.9.gJ.5..=s.....\...F;.."@fH.i..%\..Z......N3.x..%.n...............}.i..a.....~.IL.c...7...b....j.!<...ufR.{.._....>..wc...b+.\..._....8.L..f..&..".0...@.%.g ..%...I.-R*D..3!^!..2.(k[..VS.......&.w.I......-..;.{.p..H.4..G.C./.z..UpB.S.2=.U.s.U..]....c...x.4P...c2.{.>.g..v....T.=G..`....:AqJb..{.v.4.......3h.R...3....$u......oVZ.7..a.)b.T..!........Z5.y.H.....h.UCgdr-.?...~..~yF.R,.{.$Hg.=..LB.3!.W...

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\9CDD6564.dat

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	PNG image data, 172 x 40, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	5135
Entropy (8bit):	7.947582392550244
Encrypted:	false
SSDEEP:
MD5:	10756BD9D810A0202CF4B5E7828160C0
SHA1:	42DFDBE0F7B69C4A1A37958F63A242C143209699
SHA-256:	8BA923AECE3E1731B7CDF398D30EEE632B285A5CC91F3E6A062BB72713F38644
SHA-512:	EABC98A8D29D57C356679CB3E67BA7DAD4684D9F73083FD2D68E17413061DFD2F2626AA7073D71170633C316EB08AF55DD1D5D7490BA3DAF760A25146F68B140
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.......(.....c.......sRGB.........IDATx...x....;IN.D.`HP....S.T].eUJ...BE...>...E@.......P)....n..Z.u.V(n....4.......{N........w.I.I..C...df.y.wf.y.w.1...@'......'&..........)..$Y....&.:.^.mRMy...f.....-..T..C..R.@..Vi..e4.c..=..6v......k4.u....Z.ju...57....//#^.......}-n...%-.GaS...........WG@IIVm._4)..-.t..u......RLe]..A.P..ExIS8..=.m.n.5.R...+.%..v}m......uS.7Ha.:../m.....p"$$.y$.P..3W.."...&.SI ..v..':..%0u......,kdccc..........>.......+.E.......Q[[.733....y.gN\H..z....6..>...z..4_%..z..O?...G"..&r...?$...LJJ..m...bP.zboH.Jl....]........e.~.Bpb(....o@..."...9s........V..V...W.....No./P..B.NSS.:`...%.-I.,,....@...r.tN7Q.6..wz.....X-.."F....Q7...G.-dd......%..._..!2Y.......(....6..^...e.h.BA.a^.....x..{./....&d.X.~}#.\QQQ../.h#...g.WX..-..8.....@2I.._...RnF.'N.. .Ap...".q.A.\|..4...R..Q.H....O3,.......g!.1.'...0...j.....=w..i......8..=..W..]..`.y..Fy.y....o.......y....`........:.7.1s......M.,.m}..^.1..\|._Y..?..E.A..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\C1D90D2F.dat

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2315
Entropy (8bit):	7.889034273165268
Encrypted:	false
SSDEEP:
MD5:	778A1154ABC8197D7400570AFC1DE067
SHA1:	68AA872CD051FAA9D78F5647CD35C8C6B81E2AC6
SHA-256:	872B38DE556D3505248BA0D19A9F23DB7B359A8151DD460F30ECAFC1AAAF088B
SHA-512:	2F6385011658ACACC403704D88290909972CAF466A487CD3A8067A4E782820A94FD4910D52CDDC53D5305837F645E2347E7C62CC608F4AEAAC16D18A98787E4C
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...0...0.....W.......pHYs...%...%.IR$.....sRGB.........gAMA......a.....IDATx..Z]hTG.>w.....m.m..A...?.Q...F.UQ...(...&.&Z\|..I.4..c..F.]...Q!.(.i".T..>D..?f.n.;..wg...~..?s.sf..3g... T..E.......x.CN.n'~..........x..._{..... ....=..;.)Ne4.8.L..(...I.)...#<.4.`.........b.72g$.....{..<}@..;..z..^o.k...X,.>SE2R...t.!..........X.1..a?._.....Q..o.R .,....=......3h..<.C.[.n..[h...\|...K..T?..V..e....m.44..qT_Q.Ty...I..,......E.....zg.W#(.T..9K.,.....pL!....1...5..=.F.o^.Q.bA..l..\|_..........<_..Z...&?.q.<..{.t....h...\|.......9.]..K.#.F,.1;............t..(.n..W^TN....:....?F..7<...)....^.i:.1.;..]gv..t.(...Tw..2p.x....X..n.N.... ...<hc.F\|a.B:.y.)R.WL=.{...{r.IZ....!&....mc.....=.io.^..P.F1...O.M.......oV..h.fC........?.x..lSe...)`ep}`...\..~...h.....<..heS......0f.... )%NK[@N@.1.....i..T...s..F.t...r...g..........f...2&@1.o@..jd.)..@...0..K....V>._PO.g.gE..7..b...m.{j<..@.5'90B..M..R&.JxN!....%.0..r..7.y...."..zW.Bf.X.@.....q...

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\F4CEF466.dat

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	PNG image data, 96 x 96, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	866
Entropy (8bit):	7.524214283914571
Encrypted:	false
SSDEEP:
MD5:	85EC506F74AED7E81276EFFF62C1E07F
SHA1:	032DF3D9F48EAC08148B5BF1318C35D1691D4613
SHA-256:	FA572806503D90E258E60C8F880A006D8FB65E910E5340C55F2429CBCEC28227
SHA-512:	48350EBCED5219AE09D17751354A0C05694F2498FBEA3D48E44EC064BA39CEEA229C17C600807F6C8D0BF6EE018DD2D80C4857743C9CAB3459E36255F452AFF9
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...`...`......w8....tEXtSoftware.Adobe ImageReadyq.e<....IDATx..1h.Q..1..... ....b...]\..&..:.UtR\...n....K.]2(..t.T\D.5U..m....}!......~?8..q$..............Yc.Z.\.;_.N..1@.zb!8w..........7.Vc.\|........Kg.......<..m..u?...{S...^b.J@..l..h.... ....@....... ....@....... .....y...y.z...~.;O?...._....P...X...?.d.n.%.f....9sd.=/.W....Lu....E..S...%3=...:.>...[.9.DM.i..?...7mM.h.Y2. RP...O...Ey........ 9......t.f...7{hD,.V.g..}V.# b...~n..i. .k3.lz.P{..K.R.S....v.pu.......}.[....m.....I#"..!ukA..G..Z...F...q..T.....M.q.:.\&..]#...B...B=..%RP..g.G.....R.KA.......J7.]....Y.K...x7.Q.....~...!j..s.l.q.8.;j...&kz....wNA...S-@).A....\|.x.6k.>..-G.<..r........<.......Nx%.sK..X.$....bS>b..'....$7R....F...\|.....k...g......@....... ....@....... ....@..`....\|M...:Va......t`......c.T.......a......?.-...>4..ys.....IEND.B`.

C:\Users\user\AppData\Roaming\Microsoft\Office\MSO3072.acl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	30
Entropy (8bit):	1.2389205950315936
Encrypted:	false
SSDEEP:
MD5:	87B178D794E9B84D0A888E979682F76C
SHA1:	403B3EEC2FBDE2B7A23B1C5781D019656E3051E8
SHA-256:	166CE0C99B11A84D4B651F2C8A93E3A336B3CB5FFFEC458A5A570E536DFCF606
SHA-512:	06A26B132045B0E89473630D40410C44635E32AAF79CD15E95D3800113C120728047CFCAC768BC290D5C427A30EC006393495E903805DFCF5932C81EA03B3A43
Malicious:	false
Reputation:	unknown
Preview:	....`.........................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Dec 23 15:48:41 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2673
Entropy (8bit):	3.9922159016330996
Encrypted:	false
SSDEEP:
MD5:	0F4B79E6BC8B4F9F2FFF9CB799886948
SHA1:	D8F8AA2A429CF58F30C6A66452254F0EAB8EC4A8
SHA-256:	2BD14C68CD35F1239D955A7D0554097D76A9FE20AEF04E7747780B7EF93DCE2C
SHA-512:	A43ABA572104DD5552E5F73CB6608DCBAFEC3ECF7ACC3ECDAA1E64D8A44A9E577B2153CF830737257EE00908A04F3FFEDE312173A94DA9C61AD1FABDBFA49D56
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,........ZU..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.Y......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............i.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Dec 23 15:48:41 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2675
Entropy (8bit):	4.006606510193222
Encrypted:	false
SSDEEP:
MD5:	425F3E2B23311D95368CA9B912E8AC74
SHA1:	828C8F73E036FBE58A49D83951C820DB1E240E53
SHA-256:	174EF270C20332A18C8BBB7E9013A2828F3C2C90B9D2DDF13438D72A3148CB94
SHA-512:	E67F270BA423EEC0C13163E53D42EC91D99EB06B136499181F51D64ABD34192C8A032CBC570D40E16E14D0175281318E7484ABFA608DD5AD8660749A853AC14B
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.....N..ZU..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.Y......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............i.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2689
Entropy (8bit):	4.011890246287923
Encrypted:	false
SSDEEP:
MD5:	D937FC0B353120CFECB4C054223F2C1D
SHA1:	4005680F0653CF120C3D8F4F73A586F1E130DCF9
SHA-256:	80AE726297F09F4C1A407458C4899E830EAE93D1361E0147FAE644868A6E2792
SHA-512:	8C6906D323D424A974A2B4A1CA27A2EEF862B554DDEB27DD67B9C5BD19FD9F72343DCEABC98A13A8A4EF548E3BFB40A8666AEF6540C1EBE04EE2830B39D71EC0
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.....Y.04...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.Y......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VFW.E...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............i.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Dec 23 15:48:41 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	4.005445472403606
Encrypted:	false
SSDEEP:
MD5:	B043B622FB2A5F5D3628D9980C20F11B
SHA1:	2405BB6A90E86EEA2668C2CDAE0355F9204417D7
SHA-256:	B0C43ED1FEC8FD8C958D8C418A6F7DB49A623E724279FF62EAC981949D188F99
SHA-512:	F90B15CB77314B5A7F34348152C42A88609EF2D9A15405D4960B83E4B02FC4A401DB72C02286424158825635125C68967BD328DED92E1AE15DA8A05C0930EBBF
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,........ZU..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.Y......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............i.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Dec 23 15:48:41 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9923275142098396
Encrypted:	false
SSDEEP:
MD5:	926604EBEA29F78B3AC7082A10135948
SHA1:	4481520062B6E20C8683A0872101C1C176A51C4C
SHA-256:	F5029E8BB0F8B66E234C3CACCD7AC70B609B13F1942A58212DF2ABC7031F2BE1
SHA-512:	3D904450439A5805161813F6C74C8F676EDF90585FA2AD5CCA7863E9022E6A6C7FA6E8822B6149E6C02F1986723BA6560A840A381132553BAC76E3D9AAC20426
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,....pB..ZU..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.Y......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............i.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Dec 23 15:48:41 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	4.002235897632461
Encrypted:	false
SSDEEP:
MD5:	930226B2191CDDC0EE11C963E648DAC8
SHA1:	3A06B3AAFA6AC58B3F5A2C8ADC9453F83124812D
SHA-256:	EF7085636C357DCC6B3F074BBEFE79B59DAC06D960F4845CD2D5E2A90CC083E4
SHA-512:	74BE6A1FFD318A128F978F6F27C00BF93637992174B4E210B2ABAF938156A596381989C940298EA26EEB7FC28101B020E5CC286D4064E10933CF6AE1F59EC22C
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,........ZU..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.Y......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............i.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Static File Info

General

File type:	RFC 822 mail, ASCII text, with very long lines (2241), with CRLF line terminators
Entropy (8bit):	6.1347198458689745
TrID:	E-Mail message (Var. 5) (54515/1) 100.00%
File name:	phish_alert_sp2_2.0.0.0.eml
File size:	57'071 bytes
MD5:	be5088c3968719dec3c819dde72d44d4
SHA1:	6ccfdd38ba2047e89c8b5bc9b7674e4442525229
SHA256:	c41c5434239023f0d075e0fb1149552bbbd2d0a8dd071b0c6ed78e2c91e097d1
SHA512:	76ffae0da8821459ece8eb97b325569b190a30a6987b021b5cde3fad9a820da14e9b09b74094ff1900cdf62ef8aa7cbaf80011f1163edefcfc3f8a94f9c7dea0
SSDEEP:	1536:CC6hoSrzSxJpwJ/bqz6PdsThvoAFcutGIjkWjV7EYYFy4u7oUUhj:gzSxYJT1OjCy4usfx
TLSH:	CF43BF71EA402405A5628798F2137A54FFA0105397275490FFAE72E32BF24606E3FBED
File Content Preview:	Received: from LV8PR17MB7184.namprd17.prod.outlook.com.. (2603:10b6:408:193::14) by SA6PR17MB7299.namprd17.prod.outlook.com with.. HTTPS; Sat, 21 Dec 2024 04:27:38 +0000..Received: from SA0PR13CA0005.namprd13.prod.outlook.com.. (2603:10b6:806:130::10) by

Static Mail

General

Subject:	joe bartner shared "Vail Health Portal Payment Issues Documentation" with you
From:	joe bartner <joebstream@msn.com>
To:	valdentist@outlook.com, Will Cook <will.cook@vailhealth.org>
Cc:
BCC:
Date:	Sat, 21 Dec 2024 04:26:45 +0000
Communications:	This email came from outside VAIL HEALTHSTOP, LOOK, THINK!This email was sent from an external source. Do NOT click links or open attachments from an unknown or unexpected sender. Report suspicious e-mails using the Phish-Alert button in Outlook, if available, or forward to aa-spam@vailhealth.org joe bartner invited you to access a file Hi Will;Resolving the inability to pay my invoices as illustrated in this video should improve Vail's financial position, as I am sure I am not the only patient having this issue.Thanks;Joe Bartner Vail Health Portal Payment Issues Documentation This link will work for anyone. Open Privacy Statement This email came from outside VAIL HEALTHSTOP, LOOK, THINK!This email was sent from an external source. Do NOT click links or open attachments from an unknown or unexpected sender. Report suspicious e-mails using the Phish-Alert button in Outlook, if available, or forward to aa-spam@vailhealth.org joe bartner invited you to access a file Hi Will;Resolving the inability to pay my invoices as illustrated in this video should improve Vail's financial position, as I am sure I am not the only patient having this issue.Thanks;Joe Bartner Vail Health Portal Payment Issues Documentation This link will work for anyone. Open Privacy Statement This email came from outside VAIL HEALTH This email came from outside VAIL HEALTH This email came from outside VAIL HEALTH STOP, LOOK, THINK! STOP, LOOK, THINK! STOP, LOOK, THINK! This email was sent from an external source. Do NOT click links or open attachments from an unknown or unexpected sender. Report suspicious e-mails using the Phish-Alert button in Outlook, if available, or forward to aa-spam@vailhealth.org This email was sent from an external source. Do NOT click links or open attachments from an unknown or unexpected sender. Report suspicious e-mails using the Phish-Alert button in Outlook, if available, or forward to aa-spam@vailhealth.org Phish-Alert button aa-spam@vailhealth.org aa-spam@vailhealth.org joe bartner invited you to access a file Hi Will;Resolving the inability to pay my invoices as illustrated in this video should improve Vail's financial position, as I am sure I am not the only patient having this issue.Thanks;Joe Bartner Vail Health Portal Payment Issues Documentation This link will work for anyone. Open Privacy Statement @font-face { font-family: "Segoe UI"; src: local("Segoe UI Light"), url("https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-westeuropean/segoeui-light.woff2") format("woff2"), url("https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-westeuropean/segoeui-light.woff") format("woff"), url("https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-westeuropean/segoeui-light.ttf") format("truetype"); font-weight: 100; font-style: normal; } @font-face { font-family: "Segoe UI"; src: local("Segoe UI Semilight"), url("https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-westeuropean/segoeui-semilight.woff2") format("woff2"), url("https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-westeuropean/segoeui-semilight.woff") format("woff"), url("https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-westeuropean/segoeui-semilight.ttf") format("truetype"); font-weight: 300; font-style: normal; } @font-face { font-family: "Segoe UI"; src: local("Segoe UI"), url("https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-westeuropean/segoeui-regular.woff2") format("woff2"), url("https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-westeuropean/segoeui-regular.woff") format("woff"), url("https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-westeuropean/segoeui-regular.ttf") format("truetype"); font-weight: 400; font-style: normal; } @font-face { font-family: "Segoe UI"; src: local("Segoe UI Semibold"), url("https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-westeuropean/segoeui-semibold.woff2") format("woff2"), url("https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-westeuropean/segoeui-semibold.woff") format("woff"), url("https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-westeuropean/segoeui-semibold.ttf") format("truetype"); font-weight: 600; font-style: normal; } @media only screen and (max-width: 640px) { body { background-color: #ffffff; } div.grey-bg-container { background-color: #ffffff; } } @media only screen and (min-width: 640px) { .CommentMention-TextRow-rightColumn { width: 52px !important; } } /* Responsive visibility clases. / .u-largeOnly { display: none !important; } @media only screen and (min-width: 640px) { .u-smallOnly { display: none !important; } .u-largeOnly { display: block !important; } } / Adjustments to the Sharing template. */ @media only screen and (min-width: 640px) { .Sharing-main { padding: 40px !important; } } @media only screen and (max-width: 640px) { .NotificationHeader-icon { width: 36px !important; } .NotificationHeader-title { padding-left: 28px !important; padding-right: 28px !important; } .NotificationHeader-title-text { font-size: 20px !important; line-height: 28px !important; } } .word-button:hover { background-color: #124078 !important; border-color: #124078 !important; } .word-button:active { background-color: #002050 !important; border-color: #002050 !important; } .powerpoint-button:hover { background-color: #a92b1a !important; border-color: #a92b1a !important; } .powerpoint-button:active { background-color: #740912 !important; border-color: #740912 !important; } .excel-button:hover { background-color: #217346 !important; border-color: #217346 !important; } .excel-button:active { background-color: #004b1c !important; border-color: #004b1c !important; } joe bartner invited you to access a file Hi Will;Resolving the inability to pay my invoices as illustrated in this video should improve Vail's financial position, as I am sure I am not the only patient having this issue.Thanks;Joe Bartner Vail Health Portal Payment Issues Documentation This link will work for anyone. Open Privacy Statement joe bartner invited you to access a file Hi Will;Resolving the inability to pay my invoices as illustrated in this video should improve Vail's financial position, as I am sure I am not the only patient having this issue.Thanks;Joe Bartner Vail Health Portal Payment Issues Documentation This link will work for anyone. Open joe bartner invited you to access a file Hi Will;Resolving the inability to pay my invoices as illustrated in this video should improve Vail's financial position, as I am sure I am not the only patient having this issue.Thanks;Joe Bartner Vail Health Portal Payment Issues Documentation This link will work for anyone. Open joe bartner invited you to access a file joe bartner invited you to access a file joe bartner invited you to access a file Hi Will;Resolving the inability to pay my invoices as illustrated in this video should improve Vail's financial position, as I am sure I am not the only patient having this issue.Thanks;Joe Bartner Hi Will;Resolving the inability to pay my invoices as illustrated in this video should improve Vail's financial position, as I am sure I am not the only patient having this issue.Thanks;Joe Bartner Hi Will;Resolving the inability to pay my invoices as illustrated in this video should improve Vail's financial position, as I am sure I am not the only patient having this issue.Thanks;Joe Bartner Vail Health Portal Payment Issues Documentation Vail Health Portal Payment Issues Documentation Vail Health Portal Payment Issues Documentation https://1drv.ms/v/c/9e074ca6193b2ab0/EZ7P27rGCMNLhgyDJhriBm8Bb7mOpqxeTdEkIA6QZ4QufQ?e=4%3aSxQQ0F&sharingv2=true&fromShare=true&at=9 Vail Health Portal Payment Issues Documentation Vail Health Portal Payment Issues Documentation Vail Health Portal Payment Issues Documentation Vail Health Portal Payment Issues Documentation This link will work for anyone. This link will work for anyone. This link will work for anyone. This link will work for anyone. This link will work for anyone. This link will work for anyone. This link will work for anyone. Open Open Open https://1drv.ms/v/c/9e074ca6193b2ab0/EZ7P27rGCMNLhgyDJhriBm8Bb7mOpqxeTdEkIA6QZ4QufQ?e=4%3aSxQQ0F&sharingv2=true&fromShare=true&at=9 Privacy Statement Privacy Statement Privacy Statement Privacy Statement Privacy Statement Privacy Statement https://aka.ms/privacy
Attachments:	AttachedImage AttachedImage AttachedImage AttachedImage

Headers

Key	Value
Received	from MN0P220MB0816.NAMP220.PROD.OUTLOOK.COM ([fe80::de3d:d67f:7d71:43f5]) by MN0P220MB0816.NAMP220.PROD.OUTLOOK.COM ([fe80::de3d:d67f:7d71:43f5%7]) with mapi id 15.20.8272.013; Sat, 21 Dec 2024 04:26:45 +0000
Arc-Seal	i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=bDk+8GT2nF2EDPVaIEwXJFmzvrLC30ZJx7hWK57yhP9SvH/0Zj/swt6jOVrOowkbiUpj4O8qgIlkGJVYOWsmjeUnPrST5rVTr52jTfkcDeptCRnt0YlVBHqyoPyyni9AcQw2ENAjoawHaS0XmyVTiJCGurmjcoaR73wcbgK0mlfyRn2eoK2K6zadLGac0FJLJibH2hc3WwZeW8J9KE1AF54FqVOk3ydn6Na70fzIAAiAjJEe8KLMWaWLJVT8ZAZrfOWV9e/HH4f4I9Yum6i932fmxdVPYF2PEIYpycUZiXtNTE+jDJuGpJS/iKyackX9c+Sp2lhSNT4hP2C6VlulCg==
Arc-Message-Signature	i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=bYumfY9n4lvKvq81K7qogofHqQXsm/BNp2v1sNoFNYA=; b=PrIaZCtnoCuUuGK8J/AEKpLfVGXaox4KBFJ6fDjnD7Rh61DFNQRkDcfcnwhQmmsKAcG1vPEZkUhOf9sStyaM2uZiPMDZxkrXq4LtdzOpNYYfwUwKMGLSNYKErug1pAp77cNogyBskwZ4UB7LCTcbmEJRZgZ3aPfIeEQ5mtz6cPvipv2wkuUjscr1fiAyChxGJWJCkkt0Hw7hpB3mGlnfoBH2vAtSg4LUM385hLc/TUdtsnPqIQpdMW5dMXp6vk42sgYqZAwr68ppSP9yy/jqFk2YhYQVhCoV2/UDF1SGObVJnUHDMRleplTVC7Za8akWwJocn9QfUv86TEzTvLZBPg==
Arc-Authentication-Results	i=1; mx.microsoft.com 1; spf=none; dmarc=none; dkim=none; arc=none
Authentication-Results	spf=softfail (sender IP is 216.71.149.123) smtp.mailfrom=msn.com; dkim=pass (signature was verified) header.d=msn.com;dmarc=pass action=none header.from=msn.com;compauth=pass reason=100
Received-Spf	Pass (esa1.hc2054-55.iphmx.com: domain of postmaster@NAM11-BN8-obe.outbound.protection.outlook.com designates 40.92.20.53 as permitted sender) identity=helo; client-ip=40.92.20.53; receiver=esa1.hc2054-55.iphmx.com; envelope-from="joebstream@msn.com"; x-sender="postmaster@NAM11-BN8-obe.outbound.protection.outlook.com"; x-conformance=spf_only; x-record-type="v=spf1"; x-record-text="v=spf1 ip4:40.92.0.0/15 ip4:40.107.0.0/16 ip4:52.100.0.0/15 ip4:52.102.0.0/16 ip4:52.103.0.0/17 ip4:104.47.0.0/17 ip6:2a01:111:f400::/48 ip6:2a01:111:f403::/49 ip6:2a01:111:f403:8000::/51 ip6:2a01:111:f403:c000::/51 ip6:2a01:111:f403:f000::/52 -all"
X-Cse-Connectionguid	wuPQPewnSPOwhiA36nQ9Gg==
X-Cse-Msgguid	lEdVJoxVRz2ZMVbrXw+Unw==
Authentication-Results-Original	esa1.hc2054-55.iphmx.com; spf=Pass smtp.mailfrom=joebstream@msn.com; spf=Pass smtp.helo=postmaster@NAM11-BN8-obe.outbound.protection.outlook.com
Ironport-Sdr	67664388_dNr/ah9ftBwXlJpdpy/ZJA+PNLUm+HjFOHQ9P0pqCbgOQ9w zhEfEoIfPPUHyJkqhIbRPkPdbaL7BkiY7BSkIMQ==
X-Ironport-Remoteip	40.92.20.53
X-Ironport-Mid	17893960
X-Ironport-Reputation	2.9
X-Ironport-Listener	IncomingMail
X-Ironport-Sendergroup	UNKNOWNLIST
X-Ironport-Mailflowpolicy	$ACCEPTED
X-Threatscanner-Verdict	Negative
X-Ipas-Result	A0EEAwCAQmZngTUUXChagQmBU4FBMVJ9PR4yBwhIgwuFFwOFLYhyklIcYYh2gVaBJQMYFigIBwEBAQEBAQEBAQQDAj0HBAEBAwSEK1WKcCAGATYHDgECBAEBAQEDAgMBAQEBAQEBAQEBAQsBAQEEAQEBAgEBAgQDAgEBAhABATsHDjuFew2CRYFCUQ0DBAMGOAEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQUCDRkMFSQsDBsTAQE4EQElAQEBFRMFDw8MJwQBEQ8Ugl8Bgi8BAzEEAg47oiQBgRUBFj8CKAFAAQECCYELig2BHAEBFoEBggwBAQbaWxE6FGWBXQcDBoEwGIRUIA0cTmSBfwEqET9gAoE8SmMVgReEcUKCDTSBE4UIgQ8BAxiBcw6FZyKCJRc2FoUHexFMAQGDMIgMgUGERotLYhqBaQNZLAFLCjUMOQR8DiAMAyIMNhUeVUkSSQglFBWBD4NMgTI3Ag0CgkM3GAEgHzGDGygFg2yCf4EEXkIeAywDAwMDgiEFT0eBa15VgnyCFxhkfwGBeh1AA3g9JBMGDhsGggMDDTRUlkQIHIENgXQBgQNHhQEDKQUXBAIuQR6BDDyeBYQfgguTLYMYixqEJBWBTogqAoIJjRSIegOaZ49VhTyIeYpGIoRuC4hnlSeFWAIEAgQFAg8BAQaBbQEzgT8dcIM3EwwwAxkPkhuEPrJbRDQ8AgcLAQEDCY9igUsBAQ
Ironport-Phdr	A9a23:XdbJmxAi2ajEIKJsnBk1UyQU90oY04WdBeb1wqQuh78GSKm/5ZOqZ BWZua40ygaRBs6FurptsKn/jePJYSQ4+5GPsXQPItRndiQuroE7uTJlK+O+TXPBEfjxciYhF 95DXlI2t1uyMExSBdqsLwaK+i764jEdAAjwOhRoLerpBIHSk9631+ev8JHPfglEnjWwbL1vI BmssAndqscbjYRjJ6s11xDEvmZGd+NKyGxnIl6egwzy7dqq8p559CRQtfMh98peXqj/Yq81U 79WAik4Pm4s/MHlugHNQgSW6nYCXWsYjwJEDAfZ4h70WJfxqTb6ufFm2CaGJ832TKs7Viqk4 qx2VRLnkiYHNzo+8GHKlsx9ib9QrRy9qxBjxYPffYaaOudjfqPGZdMVW3ZOXtpfWSxGB4Ozd YoPD+wcNupcoITwo14CoB2jDgeuGezv0CdFiH/o06Mnz+QvHwLI0xAvEN8VqnTYsM/4Ob0OX eyp0qXFyyjIYfNM2Tf67YjFahIhofaSUrltasXe01MvFx/DjlqOs4zuIjSY1uYKs2eF9OVgT v6vi3Q5pA5rpzii3cIsipLPho4P1l/E8iB5zZ8zKNalR0F1fcSqH4FMtyGGKYR2WMUiTnlmt Ss+xLMKp4O2cDYOxZkl2hLTdvyKfpaL7x/sWuucPDV1iG5qdb+wmxq8/lSsx+7+W8S131tHs iVLnNbSu30N0RHY98aJSvx4/ki72DaP0Rje5vxZLkAui6rXMZshwqUompUJskTMBDX6mEDtj KKQa04q+fCo5vzob7n6vJORM5F4hhvgPqgygMCyAeo1PhAQU2Wa5eix2rju8VDlTLpRj/A7l 7fVvIzZKMkeqKO0ABFZ34Mm5hu8CTqtzc4WkmMdLF1ffRKKl4jpNE/KIPD/Ffqxm0ihnjB2y /zbJ7HsH43DI3vanLfmZrly9VRQyA0uzdBD/J1UDawBIPTuVUPrrNzYFBg5MxCqzOn7FNV91 4QeWWSVDq+eLaPSrVuI5uUoI+mPfoMapDH9K/096/7vi382h0MdcLGm0JcLcny1GupqL1+Hb XbwmNsMEWkHshI7TOPwiV2CVTBTZ2y1X6I5/jw7CoWmApnYSYC2nLyBxjm0EYdTZm1dD1CMC nHoe5+YVPcLbSKeOtVhnSAcVbi9V48h0gmjtQH7y7pjKurY4DEXtZXk1Nh2/ODTiws99T1wD 8SdzW6CVWV0nn8IRzMs26B/u0N9xk+F0adjm/NYD8Bc5+tVUgcmMp7R1/F2B8j9Wg3fedeHS 0yoT82oDj8sVt4x2cEBY1h+Fdu4lh3D2jClA74Rl7CSH5M09KHR337rKMZ41nrKya4hj10lQ stJK2Gqmq5y+gbJC47OjkWZi72ldaMB3C7L6WiP13KOvFtfUA5sT6rKQWwfZkrRrdT//E/CS KKuCagjMgtGzs6CKbFGZcHujVVDXPvsJdfeY2O0m2qoHRiGyb2DYpT2dWgB2ivREFULkwUJ8 nacKQczHj+vrXvGAjJhDV7veFvs8edmpX2hUkI60hyEY1V617qt9B4anfycRO0X3rIDoCovs Sl5Ekug0YGeN93V7RRoeKlRZ888+0tv0n/Fswt6PdqrKKUozgoAegB7skXy1g5rIoJdjcwtq 3Bsxw13f+bQmkxAczfe1pf3OZXJI2j2/B2mb7LWnFbE35zerrgO7PB+oFLkvym3H0sm83hu1 8VVlXyG6cOZIhAVVMfzVUt//RFgu7fXeGFp5YTZ32ZwK6S9txfHwNRvD+wgnEXzN+xDOb+JQ VehW/YRANKjfbB787DIRh8fNbkU9KVuZ576Mqbbnq+zPONw2jmhiDcP+5hzh3qF7DE0UevUx 9AAyvCc0BGAUmL+i1qrqdztlIlBTTQJGCy0zi23TJVJaPhKdJ0QQXyrP9Xxxth6gMv1XGVE8 Ve4G14c8OmAXEPLKnbbjUhX30lRpmG7kyylyTAyiysusqeUwC3JxaLlaQYDPWlIAmJliD8AO KCMhssBFAildAFw0huuvx6nm+0G+eJ+N2nWUQFDeC2kZ21lV6KxsPKFbastoNsqtihdS/imb FmfYrvmpV0R1CarE2ZFxT89fi2nod2lx1or0iTHdDAu9zLQYoloyA3a5cDASPI0vHJOXyR+h TTNRxC9M9Sv4dSIhsLGu+G6WXimU84bei3qwIWc8SqjsDEyR0zl2arr3IC8Qm1YmWfh2tJnV DvFtkPxeYCykaSxa7o6Igw1WRn988p/Csd1lY5j4fNYkXUcmJiR+mIK1GnpNtAOk6D5YXAWW SQGytv95RPjnkZkKzjaouCxHmXY2cZna9SgNykU3S839NxQBa6RxLlfm21+pV/y/krBJPN6m Dka0/4n7nUX1voRtj0qyCGMUdVwVQFIeDbhnBOS45Wivb1aMSyxJKOo2hM0zpixSauPqQZGV DPld4c+SGVuu95nPgupsjW765m4KoWIK4NJ8EXSy1CZ0qBUMM5jyqJM3HI4fzq75Tp8laY6l UA8gMv85dDfbT0rpOXgX3s6fnX0f59Bp2ur1P4E2J7Qh8f2QN1gAmlZAcGuFKrzVmpU7bO+a E6PCGFu8y/HX+aAW1fZsAA/8BetW9iqLy/FfnBBlIc7HUDPKhAH2FJGG2lq1p8hSFLwzZS4I h4gv2Ifugaj+EkLlrMNVVG3U3+B9l2hMm5mEcHGfhQKtloQtx+NaZ7Mqb8qVyBAoM/7pVTUe DXCPlZGUTlSCEfcXwixbP7zvLyiu6CZHrTsdfKWOOfX8LUMWavQnsChitM+rWTLa5/He3BmC 7dTNlNrZXliAIyZli4GEmoXnHiVMpLe+Ur6+zV3q9D5+/PuCkrj4o6GCr0aNtsKmVj+maCYK +uZnzp0Mx5+/7ZVnDri7uha21QfzSZzazOqDLIM8zbXS77dkbNWCBhdbD5vMMxP7OQ32QwoW 4aTht7u17F+h+I4EB8ZDRqwwIfzPYpXeCm0LxvfCVyONaiaKDGD2Mzxba6mCPVRgOhSqxysq GObHkvkbVHh33HiUxGiN/0JjTnOYEQY6dv7KE4rVDOwBMjrYRC6LtJt2DAtyORyhniQbTNAd GUhNUJVrriAqyhfh6YaeSQJ43x7IO2Dgyvc4fPfL8Ncs/xmCD9oje9T5Vw/0L0T5yZBDq8Q+ mOavpt1rleqn/PagCJgSwZLoy1XiZijm2xHYPyc3L8QHHHO8VQK8HmaDAkMq519ENrztqtMy 9/J0qXuNDNF9NGS9swZTZuxSorPID8qNhznHyTRBQ0OQGuwLW/ogEpZgaLa5jiPo5M9sJSph IsWR+oRSgkuDv1DQBcAfpRKMNJtUzgji7LekMMY+S/0skzKXMsD9pHfCqDOWbO+cnDBy+EDP kZAwKukf9hLcNSjhAo6LAE9xdqveQKYXMgR8HA7KFZs+AMVtiA5FzB72lq5OF73piZLT7js2 EZx01U2YPxxpmq2pQ5vfRyS4nN3yRZU+52tgCjNImepcOHsAscOTXKz7hd5M4ulEVx8NVTgx BU9ZjmYH+oD3fw8JQUJwEfdocUdQ/cEFP8dOUZCy63PPKd6lggN4iS/mx0d7LOcW8I7zVkkL cb3/SIYg1oxPplofMmybOJI1gYC3KvW533xj7ljzlNGfBQGqDvKKnxP5RVAN6F4dXChprU+s FXbyTUfIDNeWaJy+qA4sR5nc6GJyyaqu1aiAmaYErXGaom/6y3Hn8PORU4s3EQVkUUD5aJxz coob0uTUQYo0aeVEBMKc8HFLFMMByK93H3Ie2CFtuCfmPpI
Ironport-Data	A9a23:jgXxI6n1ON9736oLOGWT/pbo5gyHL0RdPkR7XQ2eYbSJt16W5oE+e lBvKC3Ca6zSNzaMJoghPb0CxjpTu5Xcy4AxGQBp+SpjRSJD+JWcXojEJU6uYi/LcpHNE0425 JQSO4KbIp9sEieN/0nwbuS/oCcn2fjYTeKtVb7IUswdqW6IbQ944f40s7Rp3dEAbaGFPj6xV boewiG1EHa5xzd/Mm8YyqeKpx4HUJ/atjpF4QZuPa4W5ATSxiEYVs9PKP/pJCv2EtkMF7biG eqTwrvno26Ipk8gV4j5yr2mL0NQHuSDNgKFh3EMC/L43XCuysBTPoMTbZLwPm8H1Wvhc6lN9 ehxWfVcKOtDFoTQhO0WUxRUMiR3MqAuFNTvcSflu5fDw0CbLiXgmKg2URtqbYcRououUGgf+ 6ZDJDpSZEve1uvmme/iRuUw2Jwtd5HmN4oRsShpxDjXVaZ2S/gvL0mrCfpwhV/c0egURq+DD yZgVQdSUPipj3yjUH8+FI43l+elilj6ejJVwL7+jfo96jmJlwV827W2PYOKIYWAGs5ZkB3J9 m6dp2n0D09BbtbFmWeMr3mn17bBxi6lUdpMTreyqaQ12QadnTxNVEF+uTdXwBWcohfWt4V3d hVPp0LC1JQPyXFHbuURfjXjqXTc5URCBYNcTuFitgvTlvXf6VrBCjVZRzVMMoMv7ZNvFW0h2 3a3xO/kVGdl2FG3pdNx1Vs2QReaY3V9wboqPHdcJec9y4C95tl11lSXE4oL/Jed1rXdASv3z y2BsB8wjrASid9j/6ig9BXMjinESqLhF2bZ3S2JGDv/hu9FTNT9PdDxswKDta0owLuxFzFtg lBVw6By08hTVflhpATVKM0REbeg4eqyMTG0qTZHA5k7+j2xzGWodIZW7SsWDB8B3hEsIGKBj Of74Gu91bcLVJeYRfYfj7GZUKzG+ZPd+eHNDZg4WDbsjq9ZL2dr9Ak2DaKZMvuEfEIEyMnTM r/CGSqg4Opz5Q2KA1NaSs9EuYLHyBzSykvMWKjC9xm414GmQ2GVSJ5ebl23P882ufbsTAX9q 76zNuOs4jAGCajURHmS9oQea1cXMXI8GJb67dRNcfKOKRZnH2dnDOLNxbQmeMpumKE9euXgo in7CxUekgK52CavxQaiMhiPbJvtWpt1tm4hMCUpFVOz3T4oZoPHAKI3LsRnLOJ2qrQLIfhcS 9QJReeHEsp1WG713goXd6ni77Fka0H+7e6JF3H+OmRgF3J6fCTW+9vgOADo8yomECO2scszq rm81kXcW5Vreuh5JMPfafbqxVXhu3EYwbt1W0jOeIEOIwPr7ZRgLDH3grkvOcYQJB7fxzyck QGLHRMfouqLqIgwmDXUuUyah5i0K9JGE1VcJFH88ra3HHKE+FPy7oAVBY5kYgvhfG/z/ayjY 8BcwPf9LOALkT52X2xUQ+cDIUUWt4qHmlNK8jmICkkneLhCN1+NCnyP3M0KvKsdwLZc4FKxX kGJoIEHYvOOJd/vF0MXKEw9dOOf2PoImz7Uq/MoPEH94ywx972COamzA/VuoHIARFeWGNp/q QvEhCLww1Dn4vbNGore5h24D0zWchQ9v1wP7/n2+rPDhAsx0U1lapfBECLw65znQ4wTaRV1e 27J2PqS3+Q0Kq/+n5wbRSmlMQ111cVmhfy25AFSfw3hdift2qFogUUNr2hfovp9kkwbjrkiU oSUC6GFDf7VpWs37CSyd2WtEBtGHxqX5gT6zEER/FA1vGH5PlEh2FYVYL7XlGhAqzw0VmECo Nmwljy5OR60J5uZ9nVpBiZYRwnLF40ZGvvqw5j/R5zt8lhTSWaNv5JCkkJS8kS7WJ5o2BKcz QSolc4pAZDG2ecri/VTI+GnOX44EXho/UQbGaA5rpAaV3rRYi+z0jWoIkW8MJEFbf/T/EPyT 4QkKstTXl7snGyDvxIKN54qerVUpf8O4MZdW7XJIWVdjaCTgAA0u73t9w//plQRffNQregHJ LnsKg2ySl6ruSMMmkvmjtV1BW6jUNxVOCz+xL+U9csKJbIiscZtU1g4iIW1tC6vITlY0Q6tk 1rRba6LzeY4kYVItKnvG5VlGA+bB47SVuOJ0QbrqPVIT4rFHvnvvjMviGvMHlppL4pKfu9oh JKxv8XSzmqcmJoLC0Xnw4KgEYtN7uWMBNtnCNr9diRmrHHTSf3S7Asm0EHmD55wyfd2xNStH im8Y+uOLe8lYc9XniBpWnIPAiQmKvrFa4n7rnmAtNWKMB8W1DLHIP6B9XPEaWJ6dDcCC6bhC z3b6uqf2dRFkLtiXBM0JelqI5tdEm/RXaELc97Qtz7BKkKKhliEmKXplDt+yDXtJ0SHLv3H4 sP+dkCjTCixhaDG98EGkopQuhZMMm1xr9NtdW0g+vl3qQuAMkg4EconP64rMKpkyh7J6MmgZ RXmTncTNiHmbDEVLTT++IvCWymcNMwvO/D4BCUjpX2VYHyMFbG/LqdY2X5y6XYreDG5lOCDA vMd803WIRKe7MxIR+ES7/nqhcZI5PPRwEgVy3DcksLJHBcVB4sR5kFhBAZgUS/mEdnHskfAN UwZZDlja16pbGLMCuBcQm5lIw4YtzbR0DkYVyeD79LBsYG9zucb6vnAF8zs878ENuImGaUvQ C7pem6z/Gym4Hwflq83sdYPg6UvK/aqHNC/HZDzVz8pgKC8xWQ2DfwsxRNVYpkZxzdeNFfBm h2HwXs0Xh2FIX8M/oym81wC/pYpX08cCz3MshXEmgbHth4E1PncRQmhyVPqCJP3qpW7hX5if hUpUB+zrWGV5RzenhsvktQAp1eCP9MdKmmcbAAsUaHJs0mNTE1zKelf9n8UhvNrzW1854RLd ayu/c0316C5UwiugQ31vtcrTYJ2jrUGGzgApZnMwD93L9jsiKfEIteLEeukQjYogBstZ0kz+ ZDMYFmOUTDpl1FYYW14n8iAEpBT+qqyjakl2Q9uEeFbpb6u/ZwNkLGo4QSVWVp3VIfQca2hf Unu8fKAPhJvGm7Ua+9UmUcezovD3PBHr2zNpxfBJUDN8bqq4ERqSoZ98ZAl1MiUUnFTAWcrz BjtS/TUqtq/xlaAl2jr3lG3nIQXOCKVx90KdhjAAHjYHCUbgIJ0gaemsPn6iS0wZrt+LaRf/ WRTIEDh+PfD5FccHBjLW0VwUgjJNDuCCIqJDcM/FomqkPyrCulLVYUAvlYJR9Za9HNKiN5eF Rq1GLGT0uNXAaxfftmRlFC1QRFpNrj2ETGzrZOFiVsDY7fDN7vR8Z2dSbXTxMbqOQWJkWv2k vcPhuIx0jvZ3t821xlAyQoXjM6lrP5P6niFITmRnDtpnj3JOovd3Heg8zyUbGUkh3RAeKEjP ouEn6go9JUDaZKpM1KYQ6r/2UrBRwXNZRye0iuLKRAfPl2zo18ksJP2N7LmyuaY9yWVoC2D6 0jBV9cJXdexDX5jPTdt/XB3mzKS9GprJ1mpGYNFiGrfL6JNghwc3yQdum2xG5hto2jeH4+vL amf+tpNgZS9UHygG3ARxXG6
Ironport-Hdrordr	A9a23:K7ZnqqO6zyijp8BcT+D155DYdb4zR+YMi2TDiHoddfUFSKalfp 6V98jzjSWE7gr5K0tQ4OxoWZPwM080kKQY3WB/B8bHYOCLggqVxeJZnP7fKl/bakrDH4dmvM 8OHZSWY+eAbmSS+PyKhTVQZOxQouVvnprJuc7ui1NWCS16YaBp6Al0TiyBFFdteQVADZ0lUL KB+8tuvVObCAMqR/X+IkNAc/nIptXNmp6jSwUBHQQb5A6Hii7twKLmEiKfwgwVX1p0sMEfGC n+4kTEDujKiYDz9vbv7R6Y031koqqt9jJ3Pr3GtiBMQg+cxjpAKr4RFIFq9wpF2N1HoGxa6+ Uk5S1QS/ibxkmhAF1dmyGdqjXIwXIr8Tvv2FWYiXzsrYjwQy87EdNIgcZcfgHC40Qtsdlg2O YTtljpxKZ/HFfFhmDw9tLIXxZlmg69pmcji/caizhaXZEFYLFcoIQD9AdeEYsGHij99Ic7ed MefP01z55tACmnhlzizxZSKYaXLwkO9z+9MzQ/hvA=
X-Talos-Cuid	9a23:Lg/P22B8Qy8JD776EzZ6zHcsF98jSUX603fRChTmD184Z7LAHA==
X-Talos-Muid	9a23:RkNNxggZq47++5nTmHdsXMMpMOpk3YapGH43g880nveOLxxveAqbk2Hi
X-Ironport-Anti-Spam-Filtered	true
X-Ironport-Av	E=Sophos;i="6.12,252,1728972000"; d="scan'208,217,150";a="17893960"
X-Amp-Result	UNKNOWN
X-Amp-Original-Verdict	FILE UNKNOWN
X-Amp-File-Uploaded	False
X-Mga-Submission	MDG18P+H1Njzlz8ScX6z7hHH8tlTa1PIhMuMykycsxC1MFpTdF8GB3iv64LTWOXJg6BFHNr/IS/61VuSdctbZu5ReGpdFmrZ4/ln5crjYwD5AMdB3xaIfK/WZd9/6FDAY2+Iv0RnYkx7dS8UMvqSjwZt
Dkim-Signature	v=1; a=rsa-sha256; c=relaxed/relaxed; d=msn.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=bYumfY9n4lvKvq81K7qogofHqQXsm/BNp2v1sNoFNYA=; b=gIVtptHUwdJQ4j5DUbfKCh1suszJjIyemE21l6c9xOemaCmYP23M/yHeZYbQr4QAGh05JaL7XWKshBaGBavABm9x69NQU0j34f2mItZtJ57M4fjRyb/oQ6+TLQ/cUkHVkj/nzHhfvOHQ0fhIBsIw0s/V9TJFHqHzBiyWCsA2AIgmSjmjRjjZetimFnXHqbPXV1vMXEAU8fZmacAqxYIqsl1+Wco+R0AYyLLqJmyaB5PDjbPQte7dxwx5m1j9WmY5zcsiG2xpfzQjG8PU5zSMNZ2Jle74b7MvpX5ujYoqSf+cwIJiTZ67wQn1VzIVan+HM5eLFAy8FeY7YTamf/vE2Q==
From	joe bartner <joebstream@msn.com>
To	valdentist@outlook.com, Will Cook <will.cook@vailhealth.org>
Subject	joe bartner shared "Vail Health Portal Payment Issues Documentation" with you
Thread-Topic	joe bartner shared "Vail Health Portal Payment Issues Documentation" with you
Thread-Index	AQHbU2CLSa/x2Odz5k6mGqjQc1S7eA==
Date	Sat, 21 Dec 2024 04:26:45 +0000
Message-Id	<Share-479a6fa1-c0f8-7000-41cc-6cf7290d9ca8-ff741e6d-6c46-43f4-b56c-28b17df69a13-SendEmail-PreprocessPayload@odspnotify>
Accept-Language	en-US
Content-Language	en-US
X-Ms-Has-Attach	yes
X-Ms-Exchange-Messagesentrepresentingtype	1
X-Ms-Traffictypediagnostic	MN0P220MB0816:EE_\|PH7P220MB1424:EE_\|SN1PEPF000252A3:EE_\|LV8PR17MB7184:EE_\|SA6PR17MB7299:EE_
X-Ms-Office365-Filtering-Correlation-Id	51a02262-5405-497c-cc9c-08dd2177b0b4
X-Microsoft-Antispam-Untrusted	BCL:0;ARA:14566002\|19110799003\|461199028\|8060799006\|42300799018\|38102599003\|6092099012\|9400799030\|8062599003\|12050799009\|15080799006\|7092599003\|1602099012\|56899033\|20055399003\|102099032\|3412199025\|4302099013\|440099028\|4601999015;
X-Microsoft-Antispam-Message-Info-Original	jLDRPaAzmuzpAnx2QJiiucDtIbHLDwyxG/cEmcUaXasdxfEv/5bZSX0ArItutYKVgp/ZkgOWfX0WxGj6T7VriwF01uZkA0n30CV8o6/QnKLIrPmJfa+D+HfX8sAdGZbNi/cgCPBdJgOmJaQLqBi/Irn8ichu0fr+R7EfAlZprwNF7hbZWfjlVOhZS54x/qaRzYkVmj5b9cQSH7S4fb81IwSKmmaaf4CWKmVGPzCYefY+lgi5eTzbtn6UdhrveUNIxYTm0kO32Ae1xv8668LN6u/Chtq6IDYz0IBdt0cfqFP/0cDlbyd3wHPuLXzR7XDdQ+cIDOQ76HAqNrDpm7SDrThJqeRRW24IW4uauHeqTWPa29ERzWkvdY4v1U3UBm887XejdrPGA36fHdMZfI9hAkJ2m6eEYQEAcCjpsXtS7cfSi9jwt2s30nMPViQgZL38ednw4U+xYYdRRWEZHNjAfXmdhd3Zc0Wx3tHpqOicvPdGv1qvCF88GayVH4SuF87sW9Uxr/T9I2PF//LLI7BqHdYjUozQU0nbsFXPu0XvsbGMi41ygIApMcjFqoBhvl0XMYM49bu5eJpEWTQbvi630tNtmzQ4tG/dZn0dkeq7ne20O3UrYxyyG5r7EaNgiMd3AMyZeNLLcnDk0p2jRGp3QTHwhkH7Ry+9IR0edAcLFuZo0b7ZDsOEk060/c9RE2EFT/We632TkwNux6wRPo7W3k6ZQVSx2hJULBAjq6QBpxc4haSSzyyyws2nug8tfs8fGPiiKY4rkCxa3Hqk5iiTduDeqIbPSY+K4jBmuhjT0YVNVJrXNhibLTN0A8oZDU6W672M+BOkTH+KzxfWekw5fmvXRbfyJQpH/6o9oBgLhqP1xidsoZagtTInZUCNjGdzS7r4MDwSsViWLW17eNrC534PVuoQBh2Gi35iwCk4c44pOWmFhbZ7JMGiDoqf8LDhT4zXfH/ogrxSqBJJ06t8YmMWDrYTIJBgt2/dEoTT44kTQAgOzZzM0IRFCZfePoBv/Ecu+0MH0DCSgOnumf8hZLXsiUYQbzNhuzmFeWhSank/S+Si3vfyQyx2nAatXZxZ++EzlzZa6qepPhtrPLmBqPhw7A1pGmCKB2qAEcOvnis0lgWRHpP9C1F6nZoZ5TBp7zfQS6Q3plFC2eNnJ6gL/Nbplh05rIp/AfAsGLKjqlYQZB5No12evzKIaR6W+xLOaKK5en3gnlMz6HcDpgZSnHs8TR/vOCOf7dzbzRrmrYEzguoe4X/o2B7nuwHX9VlZONaAuIApYMnJPPyh2Nsy+wT1hdKV0/iNhorUAMXDNK5gkTbal7+fLzSt1eAeT0qRevGqQNFjqP47KGwE/+/D8Q==
X-Ms-Exchange-Antispam-Messagedata-Original-Chunkcount	1
X-Ms-Exchange-Antispam-Messagedata-Original-0	kivQTfJszpYFcTKBu34ZpQqEmMqpBHBRj7gQg89fdelxD4guIENQA7+b2+1KwGDmKrSYm1lGihEqTtcvA15HvOPCctqnkWRo3+8dQ6Oe47aiAjd55EzxxAqWtz/14EChxWbkwVMG8tHvDGvK07mSbzsrzeD1WJ1DkKGt1eVfGyOIzmZmLB1HAuxkHGEhbQo7j6Eh4qGFWO3MEGg5oNpRX1LwBscUYHyZnpHb1pCz/oOFGFDe5touQ6YKJdLa1bbA7myYgN1F81bTPbsWaAz+leqv3EUYvXg+nQkidE95ChSIz+ahdsjwp5rkeDJDrQ1M9/t048fcX8UrPHalSYf284ZZ+puT2SEkBTHMqiF1Nl5ZTnEIHPo3q+/aHzVycES4teo6ONEcMXA13YaQ6fpSGm8Wy5+C/tSYTWAzS1A7WQB3FXUW65ISSCdrdayQ1LQ596ImXcLO8pxO06JdgS4B8MMb2FxqAZhiJ5IDbmYRA/y0Sj1rJh6Nj4CvFxZiW+G5K1TJXwJRx65Qbq5JGRfGeOlVUaqUYUNmdMlLowvHfTjlyNeknZeFALG0vD7juEqGeci1at+U6zbKOw0Vey848Wu2CyBM8jMLV/vAfbWfGLa8hb4YlLMTn+QZggoxwa8M1CiBaN1ThN6ysupDOKQj4XNQrumD6oDXytoeLLAuu02/wxF1YPPvAHxR1VzCFUWI5xTlL2L/FyQPQfKykGdG3ltjsSyIK9PNjDjDv+AF10wH3NZaSPauFtXmrSOykKZPfH8Y/6VBm/6D3PF1YlW8HsDNE4suOmfZz4fvFd9gZjjnRoyolSZwwk/q1mGdob2mtl2QufIr/fQWsKUAoqUR8iGPezWJB9b4hlSQFwhfEr2NI/6kLSJRdOlTP3R+e9k++gNWXD4MWNuCpo4YsThfiuXTfWLhfghe8yW0qBqa8aIgdnO6PrVAO4rjrEt6OYZfJzB4Ns4/wEcKU4rdf/rR1V7K5DleiSN4HY3IQpHfroiNsxhu14FMoVvRaXP8XZOLt1Rew6ZD9d+k4JAB574pFYxSFwW1mSX6d6zle1s4rmhPfkxaTGhB5pqJvIYlEtga9HuqOZtNpw5fr1sd1sNECHLZEHpEoogkNS8d1K9Yd2xpH5cxJy1p4ffcpxk2sXO5JVHHhSOU5BXFHSGX1M4dusYMutdEueAh+r2sgIntrLU0gHgtAJwS6Piqge7dLjCxIY3KoksZfk7Gh+nkkf7TqA==
Content-Type	multipart/mixed; boundary="----sinikael-?=_1-17348182883970.3050533987933297"
MIME-Version	1.0
X-Ms-Exchange-Transport-Crosstenantheadersstamped	LV8PR17MB7184
Return-Path	joebstream@msn.com
X-Ms-Exchange-Organization-Expirationstarttime	21 Dec 2024 04:26:50.5942 (UTC)
X-Ms-Exchange-Organization-Expirationstarttimereason	OriginalSubmit
X-Ms-Exchange-Organization-Expirationinterval	1:00:00:00.0000000
X-Ms-Exchange-Organization-Expirationintervalreason	OriginalSubmit
X-Ms-Exchange-Organization-Network-Message-Id	51a02262-5405-497c-cc9c-08dd2177b0b4
X-Eopattributedmessage	0
X-Eoptenantattributedmessage	959b1606-71b2-4d25-b5e6-337349399b4f:0
X-Ms-Exchange-Organization-Messagedirectionality	Incoming
X-Ms-Exchange-Transport-Crosstenantheadersstripped	SN1PEPF000252A3.namprd05.prod.outlook.com
X-Ms-Publictraffictype	Email
X-Ms-Exchange-Organization-Authsource	SN1PEPF000252A3.namprd05.prod.outlook.com
X-Ms-Exchange-Organization-Authas	Anonymous
X-Ms-Office365-Filtering-Correlation-Id-Prvs	9e4f13f5-fe7f-4dfb-3cd0-08dd2177ad95
X-Ms-Exchange-Atpmessageproperties	SA\|SL
X-Ms-Exchange-Organization-Scl	1
X-Microsoft-Antispam	BCL:0;ARA:13230040\|240411011799012\|28032699018\|5063199012\|5073199012\|4073199012\|7093399012\|22003199012\|26013499003\|69100299015\|3613699012\|8096899003;
X-Forefront-Antispam-Report	CIP:216.71.149.123;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:esa1.hc2054-55.iphmx.com;PTR:esa1.hc2054-55.iphmx.com;CAT:NONE;SFS:(13230040)(240411011799012)(28032699018)(5063199012)(5073199012)(4073199012)(7093399012)(22003199012)(26013499003)(69100299015)(3613699012)(8096899003);DIR:INB;
X-Ms-Exchange-Crosstenant-Originalarrivaltime	21 Dec 2024 04:26:50.3129 (UTC)
X-Ms-Exchange-Crosstenant-Network-Message-Id	51a02262-5405-497c-cc9c-08dd2177b0b4
X-Ms-Exchange-Crosstenant-Id	959b1606-71b2-4d25-b5e6-337349399b4f
X-Ms-Exchange-Crosstenant-Authsource	SN1PEPF000252A3.namprd05.prod.outlook.com
X-Ms-Exchange-Crosstenant-Authas	Anonymous
X-Ms-Exchange-Crosstenant-Fromentityheader	Internet
X-Ms-Exchange-Transport-Endtoendlatency	00:00:47.7445372
X-Ms-Exchange-Processed-By-Bccfoldering	15.20.8272.000
X-Microsoft-Antispam-Mailbox-Delivery	ucf:0;jmr:0;auth:0;dest:I;ENG:(910001)(944506478)(944626604)(920097)(930097)(140003);
X-Microsoft-Antispam-Message-Info	b4r63GM21Ww1AHjBg9ONLFZ69rkCpAmqjinN193CXHb/pRp5ug/4H8/uoTgvxJnCM31HD64L0c8EM/q4vGCCJy2UHm4rAh5Mk8SojLKHsEUJC6V5YOcHwjj35wXSTY7z07liirI5TRdWvcCx7Skjg4YfaasHQn5PJgxThaqTHFJg+bRNHZhwmTQfhlDtj7QyDtSXiTp1kOMs2s1X0mh3qKPLXMaAKhV8sPd8FikFE3KzBVJ+ZrAts8cnfrM5OFD6Vq/l/Y5LivZU0v7pgc1eIRGBemN0twoRJLcc2XWOEM2e3I1b0Ky1ZgiNs5ehawBRAZDjnx05Fy+hGFBSXdVBiJy1yXkjMrBl60N12a0rItUa++U9wD7Yh7AQIa/4Y/jIPIpr+ZQ3p9fZ/H0zUH5i6a7F28WqnKkqi1hsbVQ3LnNCOF66qqDZGj2d2GM2f1/S1JyBOQ8/r23dQ5+H7CBLmkywGX3ya40Pqx2H3+lAK/PpCR1z6qNhpxR6b+A4B09KAK+Vl2+CWMn8XZLa/E+yP4k8zwrmIhShXrVU7C+C0stTIdCklTFBoatOgIRPY8SYbTZ67GnA8LxCVUAeY8pQbPb7VHnqsMMFzhcIVnMhjaSguaq6PN4AcKakhiEpf/pqyTnNCkIQ94bRZfNOYSnSnvgcCLIuPmBOizKFVLFPY5YeWQ6cNJVJw+vddclyvi7Znnc+HfRALDj+TQTcyS1QRUadMVhCmh/2bDWLrjHaDpk9iK5agOsQPxN34NSQ627cj/43xfLq5fywVaU4EEiJ4GofQRn34GmEgt46jv9xOoRNMb70Y9TYRx8QUYsW3LcOoou0d9xDMGchVpJtx36m6PKNcxXbHkxTcVhv7vez7IlCNXUouG0CvTntzapZAxW9Xhti7jQGPs4Zg8aY6RrPVwXZlaSXj2cKjWjwo2K9cbOZnwOchPJ8QdUiRAYfx/sLGT+jeilG9ekC+oEqM+ooJsV3OOoHrh+Xm55g2dIr1fJQzd70gqq7s+D3OXVpE7bRS8caqCcQstdIoBlDHDYFPMVSPOMRi/wG+5eP4PvLtPZuHpfKRA0NUTYxIXJElJE4u3setadAMXa3Kd8vT3IghD7WMI6jVrVXLp0CM44bGUYQBrvTN4UHs9XMgzG/6aJqix/Ycq0QWY9303XzQHhFhIGXvMIINuyz1+XJ2OW77WgGW6qTZytZMweXFqXMQI6JtkG1gCD52cJ7xqKzliS5B0VPceBF6Ic3twdEyJNZMiNed1+C4KdN3PGR7m8KZ5Itr8BCXTRdS4F4s1bed2urrXXuBULFNo926JizfrOqKYMToYH2zYGC6ETu1tXtchLLhRm0oAfPN7opb4QMH6iabgct/o0TsOpmkw58VlJvnb036cGh/A8wYgMpcauu+nBnKT+pOpwZkfGfpzUaXgHX/nG0H+wo8Ao7+Xciu7+feOq9Xm7N6HoMnaApAiNJzDk52g/RbKEPCHwR5/joHMyKAi0lLDFNNyo74kGfAo45Ru2na+Ozn8pQDaiEcBOdIHb3xenw8Z/C04AnTGfp4JqX67VcuSUPRXn01BRUr/4yPQ+A7S4sywrutZ7kad8NctQzD5C2eXKlQ0DYE0bMV1ffsnFCEQ9wG/0AAeF7yYviS3rXdnQLAS2vYHz8mVd0zi0zgBdQB491GvVZH48fBbllsz8cdoIDrLPYyt25JO+3Vgx5iqf+bR+5Il/SfmH/omo0aJExbOJbEsS3yGahP4HKFHJDhg1/ZZL78Uf1N6Ifj4w7bFILNlMSybKwWW4En3CpFr2oi5+HqnIKPI4TDh50o82ZvZfA+dj340sG3zj+9maOfGAvEjUhURB+f+5wqP8zqtwTivTdqLBBdSNoL7ig+/b8CdZu+RiQ13VnT8znmzprn9RhB/s+eYDH42edIAJysUZEFfyJOMOd7MNU6im3v3kVvN54THz5bdJ9+DmeTAyVigMC8xKqmv1fUqWx891Tgb5VUck5wmgnGVEi8Xh8a6T3GZarkVnFsluwq/RSgFG+FTsohGytBQtYILwIpWz7EMbfFLO6oMRpry1gS8XlluTqDCT9LoQ0H3EOk9qfd7GPwyFXZRSUH06eeI+Sjrq9WrJJVEjquPQbQDXh8lwtpIVhcVg+rokw4WHUaX7fkjxoS7Ohe4gH6xtJ56Vu2UzYFW7fVysB+IEUGOS01CetYjCIiOV5dw445VAErKqLh4nz3Dl4CZIQg9jSBWvBl3gH
Content-Transfer-Encoding	7bit

File Icon


Icon Hash:	46070c0a8e0c67d6

Description:	Adversaries may abuse Internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality and customize aspects of Internet browsers. They can be installed directly or through a browser's app store and generally have access and permissions to everything that the browser can access.
Tactics:	Persistence
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Process: Process Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report phish_alert_sp2_2.0.0.0.eml

Overview

General Information

Detection

Signatures

Classification

Process Tree

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Software Vulnerabilities

Networking

System Summary

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

LLM Input / Output

Created / dropped Files

C:\Program Files (x86)\Microsoft Office\root\vfs\Common AppData\Microsoft\OFFICE\Heartbeat\HeartbeatCache.xml

C:\Users\user\AppData\Local\Microsoft\FORMS\FRMCACHE.DAT

C:\Users\user\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntities.bin

C:\Users\user\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntitiesUpdated.bin

C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\11205D8A-60ED-4384-A3FE-218ACDC740D1

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\95A4C9B9.dat

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\9CDD6564.dat

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\C1D90D2F.dat

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\F4CEF466.dat

C:\Users\user\AppData\Roaming\Microsoft\Office\MSO3072.acl

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Static File Info

General

Static Mail

General

Headers

File Icon

Windows Analysis Report
phish_alert_sp2_2.0.0.0.eml