Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
phish_alert_iocp_v1.4.48 - 2024-12-27T140703.193.eml

Overview

General Information

Sample name:phish_alert_iocp_v1.4.48 - 2024-12-27T140703.193.eml
Analysis ID:1581506
MD5:88351bd7b79959a13a0cc6392d4f9d1c
SHA1:86918a79840e057f79534814d4292bb0a3eb3413
SHA256:439748a7f2e06ceda80893848fb30c9ff352505cf7e784d85ff2fba001484f0f
Infos:

Detection

Score:48
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

AI detected potential phishing Email
AI detected suspicious URL
Creates a window with clipboard capturing capabilities
Queries the volume information (name, serial number etc) of a device
Sigma detected: Office Autorun Keys Modification
Sigma detected: Office Macro File Download
Stores files to the Windows start menu directory

Classification

Process Tree

  • System is w10x64_ra
  • OUTLOOK.EXE (PID: 5336 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\user\Desktop\phish_alert_iocp_v1.4.48 - 2024-12-27T140703.193.eml" MD5: 91A5292942864110ED734005B7E005C0)
    • ai.exe (PID: 6840 cmdline: "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "1E72A487-8895-431D-A59D-B50CE9FB35DA" "6AC2D326-5DA4-4D31-8722-A1DC604828E2" "5336" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx" MD5: EC652BEDD90E089D9406AFED89A8A8BD)
    • chrome.exe (PID: 7148 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://clicktime.cloud.postoffice.net/clicktime.php?U=https://csdmap.onefiserv.net/DeviceManager/auth/reset_password%3Ftoken%3D2LH1F5Zp7hTOum2oriAMP_nZvZ4%3D&E=cgarlich%40firstfedweb.com&X=XID838CLAmRc9677Xd2&T=FF1001&HV=U,E,X,T&H=05e50c019d6b37b95f6f97e83ad5b7d9a0a10e56 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
      • chrome.exe (PID: 6484 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 --field-trial-handle=1904,i,114093303957720058,6749689482654902522,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
  • cleanup

Yara Signatures

⊘No yara matches

Sigma Signatures

Sigma detected: Office Autorun Keys Modification
Source: Registry Key setAuthor: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 , EventID: 13, EventType: SetValue, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE, ProcessId: 5336, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Addins\OneNote.OutlookAddin\1
Sigma detected: Office Macro File Download
Source: File createdAuthor: Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE, ProcessId: 5336, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Templates\~$rmalEmail.dotm
Sigma detected: Office Macro File Creation
Source: File createdAuthor: Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE, ProcessId: 5336, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Templates\~$rmalEmail.dotm

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Phishing

barindex
AI detected potential phishing Email
Source: EmailJoe Sandbox AI: Detected potential phishing email: The URL contains multiple redirects and suspicious domains (clicktime.cloud.postoffice.net) masking the final destination. The email claims to be from Fiserv but uses an unusual redirect chain instead of a direct Fiserv domain link. Password reset emails that use third-party redirect services are a common phishing tactic
AI detected suspicious URL
Source: EmailJoe Sandbox AI: AI detected Brand spoofing attempt in URL: https://clicktime.cloud.postoffice.net
Source: EmailClassification: Credential Stealer
Source: https://clicktime.cloud.postoffice.net/clicktime.php?U=https://csdmap.onefiserv.net/DeviceManager/auth/reset_password%3Ftoken%3D2LH1F5Zp7hTOum2oriAMP_nZvZ4%3D&E=cgarlich%40firstfedweb.com&X=XID838CLAmRc9677Xd2&T=FF1001&HV=U,E,X,T&H=05e50c019d6b37b95f6f97e83ad5b7d9a0a10e56HTTP Parser: No favicon
Source: https://clicktime.cloud.postoffice.net/clicktime.php?U=https://csdmap.onefiserv.net/DeviceManager/auth/reset_password%3Ftoken%3D2LH1F5Zp7hTOum2oriAMP_nZvZ4%3D&E=cgarlich%40firstfedweb.com&X=XID838CLAmRc9677Xd2&T=FF1001&HV=U,E,X,T&H=05e50c019d6b37b95f6f97e83ad5b7d9a0a10e56HTTP Parser: No favicon
Source: unknownHTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.16:49708 version: TLS 1.2
Source: unknownHTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.16:49714 version: TLS 1.2
Source: unknownHTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.16:49715 version: TLS 1.2
Source: unknownHTTPS traffic detected: 204.79.197.222:443 -> 192.168.2.16:49737 version: TLS 1.2
Source: unknownHTTPS traffic detected: 204.79.197.200:443 -> 192.168.2.16:49738 version: TLS 1.2
Source: unknownHTTPS traffic detected: 13.107.4.254:443 -> 192.168.2.16:49739 version: TLS 1.2
Source: unknownHTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.16:49740 version: TLS 1.2
Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknownTCP traffic detected without corresponding DNS query: 20.190.147.9
Source: unknownTCP traffic detected without corresponding DNS query: 20.190.147.9
Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknownTCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknownTCP traffic detected without corresponding DNS query: 20.190.147.9
Source: unknownTCP traffic detected without corresponding DNS query: 20.190.147.9
Source: unknownTCP traffic detected without corresponding DNS query: 20.190.147.9
Source: unknownTCP traffic detected without corresponding DNS query: 20.190.147.9
Source: unknownTCP traffic detected without corresponding DNS query: 20.190.147.9
Source: unknownTCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknownTCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknownTCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknownTCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknownTCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknownTCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknownTCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknownTCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknownTCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknownTCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknownTCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknownTCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknownTCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknownTCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknownTCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknownTCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknownTCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknownTCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknownTCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknownTCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknownTCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknownTCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknownTCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknownTCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknownTCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknownTCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknownTCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknownTCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknownTCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknownTCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknownTCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknownTCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknownTCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.10
Source: global trafficDNS traffic detected: DNS query: clicktime.cloud.postoffice.net
Source: global trafficDNS traffic detected: DNS query: maxcdn.bootstrapcdn.com
Source: global trafficDNS traffic detected: DNS query: cdnjs.cloudflare.com
Source: global trafficDNS traffic detected: DNS query: www.google.com
Source: global trafficDNS traffic detected: DNS query: cloud.postoffice.net
Source: global trafficDNS traffic detected: DNS query: csdmap.onefiserv.net
Source: global trafficDNS traffic detected: DNS query: google.com
Source: unknownNetwork traffic detected: HTTP traffic on port 49733 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49708 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49699 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49740
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49739
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49738
Source: unknownNetwork traffic detected: HTTP traffic on port 49717 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49736 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49737
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49736
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49735
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49734
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49733
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49732
Source: unknownNetwork traffic detected: HTTP traffic on port 49675 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49699
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49731
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49730
Source: unknownNetwork traffic detected: HTTP traffic on port 49732 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49696
Source: unknownNetwork traffic detected: HTTP traffic on port 49696 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49724 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49728 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49721 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49729
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49728
Source: unknownNetwork traffic detected: HTTP traffic on port 49714 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49725
Source: unknownNetwork traffic detected: HTTP traffic on port 49735 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49724
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49723
Source: unknownNetwork traffic detected: HTTP traffic on port 49739 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49722
Source: unknownNetwork traffic detected: HTTP traffic on port 49674 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49721
Source: unknownNetwork traffic detected: HTTP traffic on port 49731 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49678 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49725 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49729 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49719 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49722 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49719
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49717
Source: unknownNetwork traffic detected: HTTP traffic on port 49715 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49716
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49715
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49714
Source: unknownNetwork traffic detected: HTTP traffic on port 49738 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49734 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49673 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49730 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49677 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49740 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49723 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49683 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49708
Source: unknownNetwork traffic detected: HTTP traffic on port 49716 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49737 -> 443
Source: unknownHTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.16:49708 version: TLS 1.2
Source: unknownHTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.16:49714 version: TLS 1.2
Source: unknownHTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.16:49715 version: TLS 1.2
Source: unknownHTTPS traffic detected: 204.79.197.222:443 -> 192.168.2.16:49737 version: TLS 1.2
Source: unknownHTTPS traffic detected: 204.79.197.200:443 -> 192.168.2.16:49738 version: TLS 1.2
Source: unknownHTTPS traffic detected: 13.107.4.254:443 -> 192.168.2.16:49739 version: TLS 1.2
Source: unknownHTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.16:49740 version: TLS 1.2
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEWindow created: window name: CLIPBRDWNDCLASS
Source: classification engineClassification label: mal48.winEML@20/25@27/196
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEFile created: C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEFile created: C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20241227T1708550128-5336.etl
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEFile read: C:\Users\desktop.ini
Source: unknownProcess created: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\user\Desktop\phish_alert_iocp_v1.4.48 - 2024-12-27T140703.193.eml"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "1E72A487-8895-431D-A59D-B50CE9FB35DA" "6AC2D326-5DA4-4D31-8722-A1DC604828E2" "5336" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://clicktime.cloud.postoffice.net/clicktime.php?U=https://csdmap.onefiserv.net/DeviceManager/auth/reset_password%3Ftoken%3D2LH1F5Zp7hTOum2oriAMP_nZvZ4%3D&E=cgarlich%40firstfedweb.com&X=XID838CLAmRc9677Xd2&T=FF1001&HV=U,E,X,T&H=05e50c019d6b37b95f6f97e83ad5b7d9a0a10e56
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 --field-trial-handle=1904,i,114093303957720058,6749689482654902522,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "1E72A487-8895-431D-A59D-B50CE9FB35DA" "6AC2D326-5DA4-4D31-8722-A1DC604828E2" "5336" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://clicktime.cloud.postoffice.net/clicktime.php?U=https://csdmap.onefiserv.net/DeviceManager/auth/reset_password%3Ftoken%3D2LH1F5Zp7hTOum2oriAMP_nZvZ4%3D&E=cgarlich%40firstfedweb.com&X=XID838CLAmRc9677Xd2&T=FF1001&HV=U,E,X,T&H=05e50c019d6b37b95f6f97e83ad5b7d9a0a10e56
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 --field-trial-handle=1904,i,114093303957720058,6749689482654902522,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: apphelp.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: c2r64.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: userenv.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: msasn1.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: cryptsp.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: rsaenh.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: cryptbase.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: gpapi.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{F959DBBB-3867-41F2-8E5F-3B8BEFAA81B3}\InprocServer32
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEWindow found: window name: SysTabControl32
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Common
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information queried: ProcessInformation
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeQueries volume information: C:\Program Files (x86)\Microsoft Office\root\Office16\AI\WordCombinedFloatieLreOnline.onnx VolumeInformation
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management Instrumentation21
Browser Extensions		1
Process Injection		1
Masquerading		OS Credential Dumping1
Process Discovery		Remote Services1
Clipboard Data		2
Encrypted Channel		Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/Job1
DLL Side-Loading		1
DLL Side-Loading		1
Process Injection		LSASS Memory1
File and Directory Discovery		Remote Desktop ProtocolData from Removable Media1
Non-Application Layer Protocol		Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAt1
Registry Run Keys / Startup Folder		1
Registry Run Keys / Startup Folder		1
DLL Side-Loading		Security Account Manager12
System Information Discovery		SMB/Windows Admin SharesData from Network Shared Drive2
Application Layer Protocol		Automated ExfiltrationData Encrypted for Impact

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

⊘No Antivirus matches

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

NameIPActiveMaliciousAntivirus DetectionReputation
google.com
142.250.181.110
truefalse
    		high
    cloud.postoffice.net
    		165.212.65.209
    		truefalse
      		high
      cdnjs.cloudflare.com
      		104.17.24.14
      		truefalse
        		high
        clicktime.cloud.postoffice.net
        		165.212.65.140
        		truefalse
          		high
          maxcdn.bootstrapcdn.com
          		104.18.11.207
          		truefalse
            		high
            www.google.com
            		142.250.181.68
            		truefalse
              		high
              csdmap.onefiserv.net
              		unknown
              		unknownfalse
                		unknown

                Contacted URLs

                NameMaliciousAntivirus DetectionReputation
                https://clicktime.cloud.postoffice.net/clicktime.php?U=https://csdmap.onefiserv.net/DeviceManager/auth/reset_password%3Ftoken%3D2LH1F5Zp7hTOum2oriAMP_nZvZ4%3D&E=cgarlich%40firstfedweb.com&X=XID838CLAmRc9677Xd2&T=FF1001&HV=U,E,X,T&H=05e50c019d6b37b95f6f97e83ad5b7d9a0a10e56false
                  		unknown

                  World Map of Contacted IPs

                  • No. of IPs < 25%
                  • 25% < No. of IPs < 50%
                  • 50% < No. of IPs < 75%
                  • 75% < No. of IPs

                  Public IPs

                  IPDomainCountryFlagASNASN NameMalicious
                  52.113.194.132
                  		unknownUnited States
                  		8068MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                  104.17.24.14
                  		cdnjs.cloudflare.comUnited States
                  		13335CLOUDFLARENETUSfalse
                  165.212.65.209
                  		cloud.postoffice.netUnited States
                  		14454PERIMETER-ESECURITYUSfalse
                  1.1.1.1
                  		unknownAustralia
                  		13335CLOUDFLARENETUSfalse
                  52.109.89.18
                  		unknownUnited States
                  		8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                  142.250.181.142
                  		unknownUnited States
                  		15169GOOGLEUSfalse
                  165.212.65.140
                  		clicktime.cloud.postoffice.netUnited States
                  		14454PERIMETER-ESECURITYUSfalse
                  104.18.11.207
                  		maxcdn.bootstrapcdn.comUnited States
                  		13335CLOUDFLARENETUSfalse
                  8.8.8.8
                  		unknownUnited States
                  		15169GOOGLEUSfalse
                  239.255.255.250
                  		unknownReserved
                  		unknownunknownfalse
                  2.19.198.40
                  		unknownEuropean Union
                  		16625AKAMAI-ASUSfalse
                  20.189.173.18
                  		unknownUnited States
                  		8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                  142.250.181.68
                  		www.google.comUnited States
                  		15169GOOGLEUSfalse
                  172.217.21.35
                  		unknownUnited States
                  		15169GOOGLEUSfalse
                  173.194.220.84
                  		unknownUnited States
                  		15169GOOGLEUSfalse
                  172.217.17.42
                  		unknownUnited States
                  		15169GOOGLEUSfalse
                  52.109.76.243
                  		unknownUnited States
                  		8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                  142.250.181.74
                  		unknownUnited States
                  		15169GOOGLEUSfalse

                  Private

                  IP
                  192.168.2.16

                  General Information

                  Joe Sandbox version:41.0.0 Charoite
                  Analysis ID:1581506
                  Start date and time:2024-12-27 23:08:25 +01:00
                  Joe Sandbox product:CloudBasic
                  Overall analysis duration:
                  Hypervisor based Inspection enabled:false
                  Report type:full
                  Cookbook file name:defaultwindowsinteractivecookbook.jbs
                  Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                  Number of analysed new started processes analysed:16
                  Number of new started drivers analysed:0
                  Number of existing processes analysed:0
                  Number of existing drivers analysed:0
                  Number of injected processes analysed:0
                  Technologies:
                  • EGA enabled
                  Analysis Mode:stream
                  Analysis stop reason:Timeout
                  Sample name:phish_alert_iocp_v1.4.48 - 2024-12-27T140703.193.eml
                  Detection:MAL
                  Classification:mal48.winEML@20/25@27/196
                  Cookbook Comments:
                  • Found application associated with file extension: .eml

                  Warnings

                  • Exclude process from analysis (whitelisted): dllhost.exe, svchost.exe
                  • Excluded IPs from analysis (whitelisted): 52.109.89.18
                  • Excluded domains from analysis (whitelisted): config.officeapps.live.com, prod.configsvc1.live.com.akadns.net, officeclient.microsoft.com, weu-azsc-config.officeapps.live.com, europe.configsvc1.live.com.akadns.net
                  • Not all processes where analyzed, report is missing behavior information
                  • Report size getting too big, too many NtQueryAttributesFile calls found.
                  • Report size getting too big, too many NtQueryValueKey calls found.
                  • VT rate limit hit for: phish_alert_iocp_v1.4.48 - 2024-12-27T140703.193.eml

                  Created / dropped Files

                  C:\Users\user\AppData\Local\Microsoft\FORMS\FRMCACHE.DAT

                  Download File
                  Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                  File Type:data
                  Category:dropped
                  Size (bytes):231348
                  Entropy (8bit):4.390316162149756
                  Encrypted:false
                  SSDEEP:
                  MD5:31D045E9DCD5FF9E3342B50D119F2035
                  SHA1:59C26979F511369F40A24F4F0655BAE7CD9EC57A
                  SHA-256:54862539317DA327ABCD3A34883B6169FEE7BE9241B7B7C943A11C3397202654
                  SHA-512:AC24FFEFED25C029D5F525F8215A230B879ED5F83A76260F306CC53EF55227F78ED0CD2B2E0B52245D9146A7BACDC2A32CAB0C15BFAD0387D0CDE51F52E6D3D1
                  Malicious:false
                  Reputation:unknown
                  Preview:TH02...... ..{.X......SM01X...,....Lm.X..........IPM.Activity...........h...............h............H..h........k..>...h...........H..h\cal ...pDat...h ...0..........h.4W...........h........_`Pk...h..4W@...I.lw...h....H...8.Uk...0....T...............d.........2h...............k..............!h.............. hx.@.....(.....#h....8.........$h.......8....."h..............'h..............1h.4W<.........0h....4....Uk../h....h.....UkH..h.q..p.........-h .......T.....+hS.4W........................ ..............F7..............FIPM.Activity.st.Form.e..Standard.tanJournal Entry.pdIPM.Microsoft.FolderDesign.FormsDescription................F.k..........1122110020000000.000Microsoft.ofThis form is used to create journal entries.........kf...... ..........&...........(.......(... ...@.....................................................................................................................fffffffff........wwwwwwww.p....pp..............p...............pw..............pw..DDDDO..

                  C:\Users\user\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntities.bin

                  Download File
                  Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                  File Type:ASCII text, with very long lines (65536), with no line terminators
                  Category:dropped
                  Size (bytes):322260
                  Entropy (8bit):4.000299760592446
                  Encrypted:false
                  SSDEEP:
                  MD5:CC90D669144261B198DEAD45AA266572
                  SHA1:EF164048A8BC8BD3A015CF63E78BDAC720071305
                  SHA-256:89C701EEFF939A44F28921FD85365ECD87041935DCD0FE0BAF04957DA12C9899
                  SHA-512:16F8A8A6DCBAEAEFB88C7CFF910BCCC71B76A723CF808B810F500E28E543112C2FAE2491D4D209569BD810490EDFF564A2B084709B02963BCAF6FDF1AEEC59AC
                  Malicious:false
                  Reputation:unknown
                  Preview:51253fe60063c31af0d295afb42228b0:v2:2:1:1590:2:8479:76bd602437550e98c9043d06a55186ab7d95dea5a0e935a599f73e62a8c9b158e0afcb19351f6c353940c06a38172b94d18c02cf92bb8a80184eccca0392b259ab3e71dae73e491c7941997cb36ad4a198661f622dad478d840f66d530a0dde78acea3367f91fff62fbb3dc18faff0c708ad30edef5bea8b22c5fd782b770d8993386eaa784fd19a3c3e1db3b537b1a94d3d4fbd46f8df8fddf6d16611969fe0a97c50e0f3ac24750c93257cf5c161184aa7385800c87d803b339632a3d8ec7fe17a0afd83ce9e9d0e3f7b8d579637928a811f1f7e6d1887df2ddc7d4f752c4d600235e426c92c7bf8a1362f95457998cc0e5d4261f0efa4fada0f866dbcefb407dacab7a2914e91c2f08200f38c2d9d621962145b1464b0f204b326118a53ecdcab22bff005fdd5257c99a6dc51ac0600a49f2ef782396987e78c08b846dad5db55e8ccefffc64863bc2c3e90b95a09d25d0814a848c98fe01a82d4e30e6682dd546e12c45ca0d280a45295ab4bd632dafb070edfdc3c9e38313d5aeb195972986f8011b66817028fd8c78b67a0ac7e780eecc3fb6a31f5a025b8a9a3db278a98c0696aeaac739b18688b0f9c7d751bba02cc5f4e41853fb119b3c0c915059aaa92971244a1989124f12881ca88e6410df70b793a2c3a736ff4

                  C:\Users\user\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntitiesUpdated.bin

                  Download File
                  Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                  File Type:ASCII text, with no line terminators
                  Category:modified
                  Size (bytes):10
                  Entropy (8bit):2.1219280948873624
                  Encrypted:false
                  SSDEEP:
                  MD5:0384CD028C38A7CABD40E2F33CBA3767
                  SHA1:E0992C560D29ECCB2439D9C534ADB4D53AC8B973
                  SHA-256:BACD0A71E53D5FB5918A9C303012CAB8A7810EAAB7C84EAF5C2D9398F382B1D3
                  SHA-512:780D4E181C29076BB38E04AC037528414CBCF3E3AF582F96700273C2FE15D747E58656582A083F862ADC187156DC1288001F7304F8AA6E540A944544AC812679
                  Malicious:false
                  Reputation:unknown
                  Preview:1735337341

                  C:\Users\user\AppData\Local\Microsoft\Office\16.0\Floodgate\Outlook.CampaignStates.json

                  Download File
                  Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                  File Type:JSON data
                  Category:dropped
                  Size (bytes):1538
                  Entropy (8bit):5.170046666246265
                  Encrypted:false
                  SSDEEP:
                  MD5:F903C4A051E8AA36E9E085B08D1BC55E
                  SHA1:FF9AF9BBA28D4F3FF2238A64425CABE8123250AB
                  SHA-256:59D97433D58543D3CAE4BFDF9AC0DC6990A99BFB10D118B0D62D32DA15D30968
                  SHA-512:7B9A526C71B8DF94CF6556AB827C07E2265ACF6F81B4A12B3303ACCD6601C92735ECAA0F4AD5DC054FD1E7EA19B29FC220F41213822CD04E71DC27FDA8C9027B
                  Malicious:false
                  Reputation:unknown
                  Preview:{"CampaignStates":[{"CampaignId":"398f8b35-ef06-4a2b-a5dc-d85540d6fff3","LastNominationTimeUtc":"2023-10-06T09:25:18Z","LastNominationBuildNumber":"16.0.16827.20130","DeleteAfterSecondsWhenStale":31536000,"ForceCandidacy":false,"IsCandidate":true,"DidCandidateTriggerSurvey":false,"LastSurveyActivatedTimeUtc":"1601-01-01T00:00:00Z","LastSurveyId":"7e1f72bd-2c13-423b-93cf-2786588bccbb","LastSurveyStartTimeUtc":"2023-10-06T09:25:18Z","LastSurveyExpirationTimeUtc":"2024-10-05T09:25:18Z","LastCooldownEndTimeUtc":"1601-01-01T00:00:00Z"},{"CampaignId":"8a42827d-29d2-473e-998e-3217724c5b68","LastNominationTimeUtc":"2023-10-06T09:25:18Z","LastNominationBuildNumber":"16.0.16827.20130","DeleteAfterSecondsWhenStale":31536000,"ForceCandidacy":false,"IsCandidate":true,"DidCandidateTriggerSurvey":false,"LastSurveyActivatedTimeUtc":"1601-01-01T00:00:00Z","LastSurveyId":"0bb7f335-0b8a-4926-bb93-540e4e5b86c8","LastSurveyStartTimeUtc":"2023-10-06T09:25:18Z","LastSurveyExpirationTimeUtc":"2024-10-05T09:25

                  C:\Users\user\AppData\Local\Microsoft\Office\16.0\Floodgate\Outlook.GovernedChannelStates.json

                  Download File
                  Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                  File Type:JSON data
                  Category:dropped
                  Size (bytes):740
                  Entropy (8bit):4.578658879460996
                  Encrypted:false
                  SSDEEP:
                  MD5:439A34DE8DA5C04AF25AADB84A2120D4
                  SHA1:F12F9FF6E03A5762BD03061557029446680B1DAE
                  SHA-256:32B560C75C25C6F56C0439F67A3FA7D4F271F07B435EE41575A3D82C6C612880
                  SHA-512:BE704CD0DF8041945D16B8103135650B33D5E97D6F7C202E9C9499C3AE57E33855C2CC3A8F73B578DB482F47026C756F1FAA411A2CC58B5E53CE23CD24229834
                  Malicious:false
                  Reputation:unknown
                  Preview:{"ChannelStates":[{"ChannelType":0,"CooldownStartTimeUtc":"1601-01-01T00:00:00Z","Cooldown":1209600},{"ChannelType":1,"CooldownStartTimeUtc":"1601-01-01T00:00:00Z","Cooldown":0},{"ChannelType":2,"CooldownStartTimeUtc":"1601-01-01T00:00:00Z","Cooldown":0},{"ChannelType":3,"CooldownStartTimeUtc":"1601-01-01T00:00:00Z","Cooldown":3600},{"ChannelType":4,"CooldownStartTimeUtc":"1601-01-01T00:00:00Z","Cooldown":10800},{"ChannelType":5,"CooldownStartTimeUtc":"1601-01-01T00:00:00Z","Cooldown":7776000},{"ChannelType":6,"CooldownStartTimeUtc":"1601-01-01T00:00:00Z","Cooldown":1800},{"ChannelType":7,"CooldownStartTimeUtc":"1601-01-01T00:00:00Z","Cooldown":0},{"ChannelType":8,"CooldownStartTimeUtc":"1601-01-01T00:00:00Z","Cooldown":1209600}]}

                  C:\Users\user\AppData\Local\Microsoft\Office\16.0\Floodgate\Outlook.Settings.json

                  Download File
                  Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                  File Type:JSON data
                  Category:dropped
                  Size (bytes):87
                  Entropy (8bit):4.576828956814449
                  Encrypted:false
                  SSDEEP:
                  MD5:E4E83F8123E9740B8AA3C3DFA77C1C04
                  SHA1:5281EAE96EFDE7B0E16A1D977F005F0D3BD7AAD0
                  SHA-256:6034F27B0823B2A6A76FE296E851939FD05324D0AF9D55F249C79AF118B0EB31
                  SHA-512:BD6B33FD2BBCE4A46991BC0D877695D16F7E60B1959A0DEFC79B627E569E5C6CAC7B4AD4E3E1D8389A08584602A51CF84D44CF247F03BEB95F7D307FBBA12BB9
                  Malicious:false
                  Reputation:unknown
                  Preview:{"ShouldFloodgateTakePrecedenceOverRateAndReview":false,"AreRatingSurveysEnabled":true}

                  C:\Users\user\AppData\Local\Microsoft\Office\16.0\Floodgate\Outlook.SurveyHistoryStats.json

                  Download File
                  Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                  File Type:JSON data
                  Category:dropped
                  Size (bytes):14
                  Entropy (8bit):3.378783493486176
                  Encrypted:false
                  SSDEEP:
                  MD5:6CA4960355E4951C72AA5F6364E459D5
                  SHA1:2FD90B4EC32804DFF7A41B6E63C8B0A40B592113
                  SHA-256:88301F0B7E96132A2699A8BCE47D120855C7F0A37054540019E3204D6BCBABA3
                  SHA-512:8544CD778717788B7484FAF2001F463320A357DB63CB72715C1395EF19D32EEC4278BAB07F15DE3F4FED6AF7E4F96C41908A0C45BE94D5CDD8121877ECCF310D
                  Malicious:false
                  Reputation:unknown
                  Preview:{"Surveys":{}}

                  C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-shm

                  Download File
                  Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                  File Type:data
                  Category:dropped
                  Size (bytes):32768
                  Entropy (8bit):0.04505311694506435
                  Encrypted:false
                  SSDEEP:
                  MD5:C110F488F649F83977E2367177F751C6
                  SHA1:44E46110D0877748E4249BA57CF9DBA2C491FB01
                  SHA-256:1C4631A4FBF58C7FE49EC552273A78D67C533CB7BCF12B3F2ED4D9F65CC448CC
                  SHA-512:7AFD1C19FDDDD3C2BB5B0466C1979261435FE6A9F2CE9DC10427E30F2577BAE90963BA8995889AD6B237150C92D75D466F36E8777D35662F457635975906D493
                  Malicious:false
                  Reputation:unknown
                  Preview:..-...........................>.....\:7.?Y)......-...........................>.....\:7.?Y)............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-wal

                  Download File
                  Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                  File Type:SQLite Write-Ahead Log, version 3007000
                  Category:dropped
                  Size (bytes):49472
                  Entropy (8bit):0.4846269586080851
                  Encrypted:false
                  SSDEEP:
                  MD5:40B05BF57B5D9FE6F39975D5FC9533ED
                  SHA1:02EE875EA55B761921EFCDC486D4B2EC5FF62A58
                  SHA-256:B6B49C79D0B239B5DD4CB178895928CC1ED032521E3757127EBDC6417F9E5788
                  SHA-512:1E864228E25CBAC43672DAF2E2BD823EE6BCF9370DEFD9F5AB0D4C67A7BACA33E0EB1B1870686E233C2AAC7DF9D3298494F0EB178617CA2620F637D8F63FFC98
                  Malicious:false
                  Reputation:unknown
                  Preview:7....-...............\:7.v....q.............\:7.. ....SQLite format 3......@ .......................................................................... .............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{366FA643-94DC-4D37-B8D8-58AE0202624D}.tmp

                  Download File
                  Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                  File Type:data
                  Category:modified
                  Size (bytes):2528
                  Entropy (8bit):2.197175387184546
                  Encrypted:false
                  SSDEEP:
                  MD5:CA47C072AFA88A95305D40BB01C7ECDF
                  SHA1:08D6F20D557755E475A3889A53629BE6D50C233B
                  SHA-256:DB6FD54B8934974C09C8FAA75966489CCAFBBCCF743F7658921AFECAB12491A4
                  SHA-512:B32AC7F2163C36B25F6DFA1B4A9430B710CFA14B5D12B3C50AEFB7B2D2A5707AA49F5B6B179D849C6B41BDCE9BC3316B1B10FE5E9ADBE3D96828F49C418A5809
                  Malicious:false
                  Reputation:unknown
                  Preview:....[.E.X.T.E.R.N.A.L. .E.M.A.I.L.:. .T.a.k.e. .c.a.u.t.i.o.n. .w.i.t.h. .l.i.n.k.s. .a.n.d. .a.t.t.a.c.h.m.e.n.t.s... .]. .............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1735337335330422600_39F819EE-199D-4AEF-B2AE-88BC9ABE8CC3.log

                  Download File
                  Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                  File Type:ASCII text, with very long lines (28758), with CRLF line terminators
                  Category:dropped
                  Size (bytes):20971520
                  Entropy (8bit):0.16085824090191334
                  Encrypted:false
                  SSDEEP:
                  MD5:A9AAA5A9DE639E9C5F3605A7C5ED58F3
                  SHA1:3ECCC614BC854DD8A1F8618CF65D743A58107DE8
                  SHA-256:6E8393F3F73097ADCF93BC1AB525D881AE080CF250E45A2CD9081F53B098A2F5
                  SHA-512:163C408EBCEEEF850499EAEB94840CDA31AD12D2E3A171344391717FFBD416B694A2F85F3E704C88668BCE4F0F7EBBB8F608F6D72504F0AFFBCE3C24606A255A
                  Malicious:false
                  Reputation:unknown
                  Preview:Timestamp.Process.TID.Area.Category.EventID.Level.Message.Correlation..12/27/2024 22:08:55.368.OUTLOOK (0x14D8).0x10CC.Microsoft Outlook.Telemetry Event.b7vzq.Medium.SendEvent {"EventName":"Office.Text.GDIAssistant.HandleCallback","Flags":30962256044949761,"InternalSequenceNumber":22,"Time":"2024-12-27T22:08:55.368Z","Contract":"Office.System.Activity","Activity.CV":"7hn4OZ0Z70qyroi8mr6Mww.4.9","Activity.Duration":11,"Activity.Count":1,"Activity.AggMode":0,"Activity.Success":true,"Data.GdiFamilyName":"","Data.CloudFontStatus":6,"Data.CloudFontTypes":256}...12/27/2024 22:08:55.384.OUTLOOK (0x14D8).0x10CC.Microsoft Outlook.Telemetry Event.b7vzq.Medium.SendEvent {"EventName":"Office.Text.ResourceClient.Deserialize","Flags":30962256044949761,"InternalSequenceNumber":24,"Time":"2024-12-27T22:08:55.384Z","Contract":"Office.System.Activity","Activity.CV":"7hn4OZ0Z70qyroi8mr6Mww.4.10","Activity.Duration":11913,"Activity.Count":1,"Activity.AggMode":0,"Activity.Success":true,"Data.JsonFileMajorV

                  C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1735337335331131500_39F819EE-199D-4AEF-B2AE-88BC9ABE8CC3.log

                  Download File
                  Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                  File Type:data
                  Category:dropped
                  Size (bytes):20971520
                  Entropy (8bit):0.0
                  Encrypted:false
                  SSDEEP:
                  MD5:8F4E33F3DC3E414FF94E5FB6905CBA8C
                  SHA1:9674344C90C2F0646F0B78026E127C9B86E3AD77
                  SHA-256:CD52D81E25F372E6FA4DB2C0DFCEB59862C1969CAB17096DA352B34950C973CC
                  SHA-512:7FB91E868F3923BBD043725818EF3A5D8D08EBF1059A18AC0FE07040D32EEBA517DA11515E6A4AFAEB29BCC5E0F1543BA2C595B0FE8E6167DDC5E6793EDEF5BB
                  Malicious:false
                  Reputation:unknown
                  Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20241227T1708550128-5336.etl

                  Download File
                  Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                  File Type:data
                  Category:dropped
                  Size (bytes):98304
                  Entropy (8bit):4.498593032766591
                  Encrypted:false
                  SSDEEP:
                  MD5:32F13BD0C1AABEF1B88BE1BE2F91F32D
                  SHA1:51B498E3BB638A01D8B95F0DC89A643CF50F2F99
                  SHA-256:D441CF1F99BC6722A9B30695AC2E76EDFC26DC0788B87303866C56945CD6A134
                  SHA-512:4741566F9779E177C97D31987818943B7A96B0B3D9D9943CF10AF0C6D5FF0A3FFEFF72AE42FAD0AA5025DC6C7C4269EF7954D320348D7459E18A67B058C761DC
                  Malicious:false
                  Reputation:unknown
                  Preview:............................................................................`..............X..................eJ..............Zb..2...................................,...@.t.z.r.e.s...d.l.l.,.-.1.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.1.1.1.............................................................v^.Y.............X..........v.2._.O.U.T.L.O.O.K.:.1.4.d.8.:.0.8.2.7.6.2.f.c.f.b.6.1.4.2.9.6.8.7.1.9.6.a.1.9.9.f.a.9.2.2.8.a...C.:.\.U.s.e.r.s.\.c.a.l.i.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.O.u.t.l.o.o.k. .L.o.g.g.i.n.g.\.O.U.T.L.O.O.K._.1.6._.0._.1.6.8.2.7._.2.0.1.3.0.-.2.0.2.4.1.2.2.7.T.1.7.0.8.5.5.0.1.2.8.-.5.3.3.6...e.t.l.......P.P............X..........................................................................................................................................................................................................................................................................................................

                  C:\Users\user\AppData\Roaming\Microsoft\Office\MSO3072.acl

                  Download File
                  Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                  File Type:data
                  Category:dropped
                  Size (bytes):30
                  Entropy (8bit):1.2389205950315936
                  Encrypted:false
                  SSDEEP:
                  MD5:D185900CD3D48C1C0146A5EDF583A631
                  SHA1:C62DCC1902BC277FB0818AA999F18C336CAC75E7
                  SHA-256:24135C71AEB1393A08D12BAC0474ED230686F4D4433D06E781BCF7E83078DA97
                  SHA-512:92BD79336F495E42CC167C773EE030E9496F497E634BA95D9689CA9A1FAA1432218B24E3F4EDAF4678E0025D817A331D198F95CA4B37C8E9DC977C00513D1CFD
                  Malicious:false
                  Reputation:unknown
                  Preview:..............................

                  C:\Users\user\AppData\Roaming\Microsoft\Outlook\NoEmail.srs

                  Download File
                  Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                  File Type:Composite Document File V2 Document, Cannot read section info
                  Category:dropped
                  Size (bytes):16384
                  Entropy (8bit):0.6703186366138589
                  Encrypted:false
                  SSDEEP:
                  MD5:3C0E583EFD511CDCEC2FA7346C461FB4
                  SHA1:AE7215302F342CC27611B14132156AC91BE7FEDA
                  SHA-256:9969BF73F8D5FF74E283125C55A16473865B6191FC191B0C0A0635FCC9390561
                  SHA-512:56989240283484C8F1D7BE5E85568DB8DC1CA3AD99E8C17E9344ADBED2F2FCE6D26985D4DE47BD8B99DCA8BA58D217426AB99551BC001BFA6AA2B2750BEE6172
                  Malicious:true
                  Reputation:unknown
                  Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\AppData\Roaming\Microsoft\Templates\NormalEmail.dotm (copy)

                  Download File
                  Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                  File Type:Microsoft Word 2007+
                  Category:dropped
                  Size (bytes):0
                  Entropy (8bit):0.0
                  Encrypted:false
                  SSDEEP:
                  MD5:36FBBA6FFA9DF0363DC7D39340250F15
                  SHA1:06EA21DE2C931DD87D6CB5FFF716030FE2FAA5A1
                  SHA-256:C30AE29F1FDCA7A3C50BCED957BD44ADE6202BF1655AE90BED4E1B8D17ADB3A8
                  SHA-512:C332048EB6DABE65E91CAD24FC518BBAC292F5ECF2B51BF4ECE0CE368EF3386295DC324FFE8F6724AB39E7559CD3CC84F1F19E243DB48F719E283ACB021EEAC2
                  Malicious:true
                  Reputation:unknown
                  Preview:PK..........!.Q3.p............[Content_Types].xml ...(.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J\X ......J..0....K......H...R*.D.g..3.H....M!`.l.....J.j;*...>.b.Fa...B....wz...<`F..K6.._s.r.F`.<X.T....7....U.._t:.\:...<&....A%&:f.9..H.hd..*1y.Lx.k)".........e..k.g.....)....&......A...3..WNN.U..e...<....'4(.....x.....nh.t.....p7..j..s...I@.w6.X..C.Tp...r+..^..F.N...".az...h.[!F.!...g...i"...C..n9.~l...3.....H..V..9.2.,)s..GZD..mo6M..a.!...q$.......O..r-.........PK..........!.........N......

                  C:\Users\user\AppData\Roaming\Microsoft\Templates\~$rmalEmail.dotm

                  Download File
                  Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                  File Type:data
                  Category:modified
                  Size (bytes):162
                  Entropy (8bit):3.6917757090118957
                  Encrypted:false
                  SSDEEP:
                  MD5:5573DAA03600E02C7147234B30EF85A4
                  SHA1:D2A82BAC24642B829145DCFD311FBEAB08FFE329
                  SHA-256:609543DC47DED992FB46B4FA698EA72C7A2DC377CFFC06BE00A82ED4FC1F9D96
                  SHA-512:8F0AD2D29B11B4923FDCA6926B256F30F0DC87854D2BFF5C1D993F0409B86CDFC0B518D6C9B86F558FA9DDD97C9FE00F7F3C3410E7E1E4246DEB13AE082C5932
                  Malicious:true
                  Reputation:unknown
                  Preview:.user...................................................c.a.l.i...,C...<.u....._K...H..X..Xz7^M....C.....\....._K...H..j......x...x...M...........x...._K.@Y...j..

                  C:\Users\user\AppData\Roaming\Microsoft\Templates\~WRD0000.tmp

                  Download File
                  Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                  File Type:Microsoft Word 2007+
                  Category:dropped
                  Size (bytes):19600
                  Entropy (8bit):7.476158976097073
                  Encrypted:false
                  SSDEEP:
                  MD5:36FBBA6FFA9DF0363DC7D39340250F15
                  SHA1:06EA21DE2C931DD87D6CB5FFF716030FE2FAA5A1
                  SHA-256:C30AE29F1FDCA7A3C50BCED957BD44ADE6202BF1655AE90BED4E1B8D17ADB3A8
                  SHA-512:C332048EB6DABE65E91CAD24FC518BBAC292F5ECF2B51BF4ECE0CE368EF3386295DC324FFE8F6724AB39E7559CD3CC84F1F19E243DB48F719E283ACB021EEAC2
                  Malicious:false
                  Reputation:unknown
                  Preview:PK..........!.Q3.p............[Content_Types].xml ...(.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J\X ......J..0....K......H...R*.D.g..3.H....M!`.l.....J.j;*...>.b.Fa...B....wz...<`F..K6.._s.r.F`.<X.T....7....U.._t:.\:...<&....A%&:f.9..H.hd..*1y.Lx.k)".........e..k.g.....)....&......A...3..WNN.U..e...<....'4(.....x.....nh.t.....p7..j..s...I@.w6.X..C.Tp...r+..^..F.N...".az...h.[!F.!...g...i"...C..n9.~l...3.....H..V..9.2.,)s..GZD..mo6M..a.!...q$.......O..r-.........PK..........!.........N......

                  C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

                  Download File
                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                  File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Dec 27 21:09:06 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                  Category:dropped
                  Size (bytes):2673
                  Entropy (8bit):3.988851802497629
                  Encrypted:false
                  SSDEEP:
                  MD5:2A70A0B980CD02C26322620CB496B740
                  SHA1:19DF037A7559055327B9475D75CE15BD8598D94C
                  SHA-256:FA07FC397993E5ABC563C48B11C90959C37538A5B5CDDEC055E2374C49C8F863
                  SHA-512:93A18C51155B04EDA43F1B42B3874291A233C5B109CC7D737C07E64ADA3717260338CCDDA265B572BCAE4EB7DDA53061280BC411CED403D7AFF910533326CE1B
                  Malicious:false
                  Reputation:unknown
                  Preview:L..................F.@.. ...$+.,.....t..X..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.Y......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y".....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y".....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y"............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y#............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i....................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                  C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

                  Download File
                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                  File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Dec 27 21:09:05 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                  Category:dropped
                  Size (bytes):2675
                  Entropy (8bit):4.005883592104222
                  Encrypted:false
                  SSDEEP:
                  MD5:40C05AD3CA976900A2D8320A78FA7767
                  SHA1:39B6A777C0F7D2818E249DDA9BFA861B7D64FF00
                  SHA-256:6A4FC3854BC01FF100CDB4A9C503A34D872D3AFD67675FFEC51793D86083C916
                  SHA-512:24037EEA9D5067A047F2364630C93780074BB95D530794659924726F5884B7D6F9CD9B2205C642539CEBB2AF7188CE1F98F3330186AAAEC24E534A3CFA577082
                  Malicious:false
                  Reputation:unknown
                  Preview:L..................F.@.. ...$+.,.....U..X..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.Y......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y".....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y".....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y"............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y#............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i....................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                  C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

                  Download File
                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                  File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                  Category:dropped
                  Size (bytes):2689
                  Entropy (8bit):4.0117272725198765
                  Encrypted:false
                  SSDEEP:
                  MD5:3E92B6D2C81AC0E95560C6F4E94B1445
                  SHA1:BA00AC6399D8D88F11E41F433B3A818415508DD9
                  SHA-256:9D21E88ED5D4ECDD0E043B85FF4CA8A03D67AD1E11511C086B1BC601C845BB6C
                  SHA-512:1BE978D367D1FF6ACBDF8CA96F3136AF55F94F6DE4060150BC9E3AB2FC1883B72864A7EA425ACD72FD943A2EC9AC1E3013EBA65C1BCA232B54E254CA963D0128
                  Malicious:false
                  Reputation:unknown
                  Preview:L..................F.@.. ...$+.,.....Y.04...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.Y......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y".....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y".....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y"............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VFW.E...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i....................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                  C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

                  Download File
                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                  File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Dec 27 21:09:05 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                  Category:dropped
                  Size (bytes):2677
                  Entropy (8bit):4.001427102144994
                  Encrypted:false
                  SSDEEP:
                  MD5:283243BC51803FA811CF8ACE7CD5226C
                  SHA1:4DBB480F84C9B9A6F83B19977B4B6F828A33CFCF
                  SHA-256:A840F06B7D15EDABCCECD1E63DF156D49A1830E1B9331C3FC1B3D68507BD1A8E
                  SHA-512:4CBDA2BE0376318387DAEFA417B9265B22AB90263C7C974F4D5F8C09C81770BB0FA7D797A41D28E9F60B2319DF83CD65154C35026F9622D7A97F7CD63D9F3279
                  Malicious:false
                  Reputation:unknown
                  Preview:L..................F.@.. ...$+.,....3b..X..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.Y......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y".....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y".....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y"............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y#............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i....................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                  C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

                  Download File
                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                  File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Dec 27 21:09:06 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                  Category:dropped
                  Size (bytes):2677
                  Entropy (8bit):3.9940403275864074
                  Encrypted:false
                  SSDEEP:
                  MD5:F57E14F58A16CF9A415B89B37FE04A6B
                  SHA1:9C4682925A7F5A7274BC0CF09A59439A688663C1
                  SHA-256:167DC58542C4A0373A9A522655FE8047318C82B76A590609A5E31858564AE9DE
                  SHA-512:CC7313FBC778B4FA517ADB8F58EE6B816F9EF0573CCA4CA82C09BF36FDA5CF87CDA19FD19CD5653A6F1101E872406E306C12EEB1E536AB072DA37FFC15FCE31C
                  Malicious:false
                  Reputation:unknown
                  Preview:L..................F.@.. ...$+.,........X..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.Y......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y".....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y".....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y"............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y#............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i....................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                  C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

                  Download File
                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                  File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Dec 27 21:09:05 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                  Category:dropped
                  Size (bytes):2679
                  Entropy (8bit):4.001429165325333
                  Encrypted:false
                  SSDEEP:
                  MD5:1813D343779BCE4563438E2722BAC567
                  SHA1:1CAFAEF997BF440268B210AA8CDBFBBBCB6CA377
                  SHA-256:3D4D7A9B2FC21B4858FE59633B8CF7D09667D4F60C00E6521BC43A50AE1AFA15
                  SHA-512:BFA66AD3DAD4E8B2BD699CFA5B6B64596CE313B95BC34D9C0B41286D9438EF74080CA007A1FE94EF8C39279A6B8145528E496D7558BE2B3680E838CFD019B640
                  Malicious:false
                  Reputation:unknown
                  Preview:L..................F.@.. ...$+.,.....:..X..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.Y......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y".....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y".....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y"............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y#............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i....................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                  C:\Users\user\Documents\Outlook Files\Outlook Data File - NoEmail.pst

                  Download File
                  Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                  File Type:Microsoft Outlook email folder (>=2003)
                  Category:dropped
                  Size (bytes):271360
                  Entropy (8bit):2.6194684591303066
                  Encrypted:false
                  SSDEEP:
                  MD5:6C89621F8BA5CF065ECEE88391B61011
                  SHA1:FE68B5DF14586950C4EF34BF3037B840B11B1C62
                  SHA-256:B35DF74A1C7077363321CBFEFBF58079A5C6382494B016988287FB23924BB8C3
                  SHA-512:A86B5C67A69170713CC827E7E5B408B396982A6BB947D524AE94E02152793834812F350E42476BD45A2384A6E4C5F8EFE350D9FC158C780C0BE04CB0E0CEA8ED
                  Malicious:true
                  Reputation:unknown
                  Preview:!BDN....SM......\...............l.......V................@...........@...@...................................@...........................................................................$.......D......@%..............e...............k...........................................................................................................................................................................................................................................................................................H.......7..u.>s.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp

                  Download File
                  Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                  File Type:data
                  Category:dropped
                  Size (bytes):131072
                  Entropy (8bit):3.4114895379799877
                  Encrypted:false
                  SSDEEP:
                  MD5:142558A91E878AED4684D4E89AA68958
                  SHA1:DD52634113CD6610DCF9B4C093CE703DE2668451
                  SHA-256:327CDE0569EE8B9D65E5B99366F575FE89B9F637BA928979B53A6B7651BC94EA
                  SHA-512:B1DE00FB3A392D543C9159FB100930DB66524AED9931FA0E0DBBC8649E94163250FCC9406A43E95ADDDA5BCCC752AF252BBA2AA07FF975AFE47F8967898C48D8
                  Malicious:true
                  Reputation:unknown
                  Preview:_...0...[...........CRS.X.......D............#...|.......................................................|........................................................................................?...................................................................................................................................................................................................................................................................................................................................................................].D.......l.0...\...........CRS.X.......B............#.........................................................................................................................................................................................................................................................................................................................................................................................................

                  Static File Info

                  General

                  File type:RFC 822 mail, ASCII text, with very long lines (347), with CRLF line terminators
                  Entropy (8bit):5.982122308205286
                  TrID:
                  • E-Mail message (Var. 5) (54515/1) 100.00%
                  File name:phish_alert_iocp_v1.4.48 - 2024-12-27T140703.193.eml
                  File size:18'957 bytes
                  MD5:88351bd7b79959a13a0cc6392d4f9d1c
                  SHA1:86918a79840e057f79534814d4292bb0a3eb3413
                  SHA256:439748a7f2e06ceda80893848fb30c9ff352505cf7e784d85ff2fba001484f0f
                  SHA512:d2165656965804f9213ff71c6e40cda3c652a0be3930545a1b396840652c598886c599a7b33a5e2a3ac5837bd23dd9db4a1194110db62accea60702ad923bcca
                  SSDEEP:384:bqikR8UDYDbqt41CDHyHpbNxG4mZ/rj9XHFP9jgOzUPcwOPKsxK12DADzFR:bqikmUDYDbqt41CDHyHpbS4mZ/v919ja
                  TLSH:C4825BA3C8105039FE9626C93E057A0F726139DB8CF2ECD07BF171A56DDB42A1710E82
                  File Content Preview:Received: from SA1PR22MB3097.namprd22.prod.outlook.com.. (2603:10b6:806:22a::7) by CO6PR22MB2724.namprd22.prod.outlook.com with.. HTTPS; Fri, 27 Dec 2024 12:17:13 +0000..ARC-Seal: i=2; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=pass;.. b=vBxDOh

                  Static Mail

                  General

                  Subject:Device Manager Password Reset Link
                  From:"DeviceManager@fiserv.com" <DeviceManager@fiserv.com>
                  To:Cale Garlich <CGarlich@firstfedweb.com>
                  Cc:
                  BCC:
                  Date:Fri, 27 Dec 2024 04:17:00 -0800
                  Communications:
                  • [EXTERNAL EMAIL: Take caution with links and attachments. ] A password reset was requested for your Device Manager login. If you did not request it, it is safe to ignore this email. Otherwise, click this link to reset your password: https://clicktime.cloud.postoffice.net/clicktime.php?U=https://csdmap.onefiserv.net/DeviceManager/auth/reset_password%3Ftoken%3D2LH1F5Zp7hTOum2oriAMP_nZvZ4%3D&E=cgarlich%40firstfedweb.com&X=XID838CLAmRc9677Xd2&T=FF1001&HV=U,E,X,T&H=05e50c019d6b37b95f6f97e83ad5b7d9a0a10e56
                  Attachments:

                    Headers

                    Key Value
                    ReceivedFri, 27 Dec 2024 04:17:14 -0800
                    ARC-Seali=1; a=rsa-sha256; d=silversky.com; s=silversky-20150623192408; t=1735301829; cv=none; b=CgZjUHja0KdfGd7bvHhOB0kRRV0oKsdV1E2R+UrUFhDqVrkhwJgGCZ8yEwzjFz6ByrZf9T4Doyibg84wOVSpqZuZOxh/QD+oYbDeuRq1lXKPmW18GQxIhBbFwj2AiO64RbowftXYefcqgkSk4nk+A+i8DF5CcI71HWleDn7WZs4=
                    ARC-Message-Signaturei=1; a=rsa-sha256; d=silversky.com; s=silversky-20150623192408; t=1735301829; c=relaxed/simple; bh=5eon+dFQhI0hQ5ifJ1UD5rJeb9WbSuUj6/ARyTMQhr0=; h=To:From:Subject:Date; b=dBW6LkXyacVqOeRNTn8/yjufLAgsr/SxjYPtGohHwDO2SEYfXsaEtcks496jWomU7tnvaWRg4wXKX7bvGf1wrrs8SOysubezUXj5yZL9AlWy9TODOjzzNFewaqfYDXlTc1DBb4Qk0NxYTyQWvP8TnEpZvlYJBpQJiTwo2Qk7tG8=
                    ARC-Authentication-Resultsi=1; gwsin.silversky.com; dmarc=pass policy.dmarc=none header.from=fiserv.com; dkim=pass header.d=fiserv.com; spf=pass smtp.mailfrom=fiserv.com; arc=none smtp.remote-ip=205.220.171.231
                    Authentication-Resultsspf=softfail (sender IP is 165.212.64.87) smtp.mailfrom=fiserv.com; dkim=fail (body hash did not verify) header.d=fiserv.com;dmarc=fail action=oreject header.from=fiserv.com;compauth=none reason=451
                    received-spfSoftFail (protection.outlook.com: domain of transitioning fiserv.com discourages use of 165.212.64.87 as permitted sender)
                    X-USANET-Receivedfrom emd2.mbox.net [165.212.64.9] by gws3.mbox.net via mtad (GIT.BUILD.5.0.3133) with ESMTP id 393CLAmRc9552Ms3; Fri, 27 Dec 2024 12:17:02 -0000
                    X-USANET-TAP-Score1
                    Authentication-Results-Originalgwsin.silversky.com; dmarc=pass policy.dmarc=none header.from=fiserv.com; dkim=pass header.d=fiserv.com; spf=pass smtp.mailfrom=fiserv.com; arc=none smtp.remote-ip=205.220.171.231
                    X-USANET-Routed100 IN-RELAY R:gwsin-int:625
                    X-USANET-GWS2-Servicegwsdin-tap preclick-never
                    X-USANET-GWS2-Tenantfirstfedweb.com
                    X-USANET-GWS2-TagidFF1001
                    X-USANET-GWS2-MailFromDnsResultDnsFound
                    X-USANET-GWS2-SecurityTLSv1.2;ECDHE-RSA-AES256-GCM-SHA384
                    X-USANET-Source205.220.171.231 IN DeviceManager@fiserv.com mx0a-0090d002.pphosted.com TLS
                    X-USANET-MsgIdXID838CLAmRc9677Xd2
                    X-BAEAI-Trust-Score100
                    X-BAEAI-Trust-ReasonsSNDRAUTH; PAYTRM; SNDRNEW; DOMFRQ,fiserv.com; DOMWHT,devicemanager@fiserv.com; DOMREPA,fiserv.com;
                    DKIM-Signaturev=1; a=rsa-sha256; c=relaxed/relaxed; d=fiserv.com; h= content-type:date:from:message-id:mime-version:subject:to; s= PoD1; bh=rFoZkfx65lF1+XXSmDiFmrvBn19LqQ7CV8SXg6oUZWE=; b=Q3G1Neo 5a1v+eErEtmjaGkRqHGK8Rhiyfr2waaE/83VqAWv/Bb9LUs+YrXMFuFJ/2LK3x4r 6VxmJFXhJbuUtSwrtwHJykkBj9hY2iM/AOEbhkQtSihpqW80i8o799HO0zeMP0pf TfFd2F9y6vm5v+RIsprCTvA1usXRrgYotjCdh1cjuGjuU7aqSTRTkJptie52M3JY s1+MPmACUGHpunNFWkcWJfKRM3TAuiuw7UuIdK4l6C94iADnpqwawJ0RymtkrDo0 y1xWbm3onlyazNV1FEUGNOZYWn8j1oGKA5z0VVdQJA/imfLNzxKvYbwWQfQgQ/tH VnMCn0rfJh3Bq1g==
                    X-Proofpoint-GUID8FVB7AQaR4Pp5djN_vijMFuJe1ICjFqf
                    X-Proofpoint-ORIG-GUID8FVB7AQaR4Pp5djN_vijMFuJe1ICjFqf
                    X-Proofpoint-Virus-Versionvendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1039,Hydra:6.0.680,FMLib:17.12.60.29 definitions=2024-09-10_12,2024-09-09_02,2024-09-02_01
                    X-Proofpoint-Spam-Detailsrule=notspam policy=default score=0 spamscore=0 mlxscore=0 adultscore=1 bulkscore=0 phishscore=0 suspectscore=0 mlxlogscore=629 malwarescore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.19.0-2411120000 definitions=main-2412270099
                    X-Cloudmark-Trackerv=2.4 cv=ca4ZrWDM c=1 sm=1 tr=0 ts=676e9abf b=1 cx=a_idp_d a=VWOnXiBbr/pGjXxRIS4Dlg==:117 a=VWOnXiBbr/pGjXxRIS4Dlg==:17 a=1oJP67jkp3AA:10 a=RZcAm9yDv7YA:10 a=WVSIkJScxn0A:10 a=sWKEhP36mHoA:10 a=-USYyflhAAAA:8 a=4QEOanMb61ma-VkTUWEA:9 a=_W_S_7VecoQA:10 a=QEXdDO2ut3YA:10 a=ZXulRonScM0A:10 a=hG04hj95D_oErZnau5vw:22 a=8RYlvNRTLsSkW-wCn2Mp:22 a=5Rr8YrPzd4iEL6kI1iSL:22 awl=host:20919
                    X-LASED-VersionAntispam-Engine: 5.1.4, AntispamData: 2024.12.27.113346
                    X-LASED-SpamProbability0.119203
                    X-LASED-SpamNonSpam
                    X-LASED-HitsBODYTEXTH_SIZE_10000_LESS 0.000000, BODY_SIZE_1000_LESS 0.000000, BODY_SIZE_2000_LESS 0.000000, BODY_SIZE_5000_LESS 0.000000, BODY_SIZE_7000_LESS 0.000000, BODY_SIZE_800_899 0.000000, DKIM_SIGNATURE 0.000000, HREF_LABEL_TEXT_ONLY 0.000000, HTML_ATTACHED_NEG 0.000000, KNOWN_MTA_TFX 0.000000, MIME_HTML_ONLY_MULTI 1.000000, NO_REAL_NAME 0.000000, PHISH_TRUSTED_RDNS 0.000000, SENDER_NO_AUTH 0.000000, SINGLE_HREF_LABEL_PHISH_MED 0.000000, SINGLE_HREF_URI_IN_BODY 0.000000, SINGLE_URI_IN_BODY 0.000000, SMALL_BODY 0.000000, SUSP_DH_NEG 0.000000, SXL_IP_TFX_WM 0.000000, TRANSACTIONAL 0.000000, URI_WITH_PATH_ONLY 0.000000, __ANY_URI 0.000000, __ATTACH_CTE_BASE64 0.000000, __BODY_NO_MAILTO 0.000000, __CP_URI_IN_BODY 0.000000, __CT 0.000000, __CTYPE_HAS_BOUNDARY 0.000000, __CTYPE_MULTIPART 0.000000, __CTYPE_MULTIPART_ALT 0.000000, __DKIM_ALIGNS_2 0.000000, __DQ_NEG_DOMAIN 0.000000, __DQ_NEG_HEUR 0.000000, __DQ_NEG_IP 0.000000, __FROM_DOMAIN_NOT_IN_BODY 0.000000, __FROM_NAME_NOT_IN_ADDR 0.000000, __FROM_NAME_NOT_IN_BODY 0.000000, __FUR_HEADER 0.000000, __FUR_RDNS_PROOFPOINT 0.000000, __HAS_FROM 0.000000, __HAS_HTML 0.000000, __HAS_MSGID 0.000000, __HEADER_ORDER_FROM 0.000000, __HREF_LABEL_PHISH 0.000000, __HREF_LABEL_TEXT 0.000000, __HREF_LABEL_URI 0.000000, __HTML_AHREF_TAG 0.000000, __HTTPS_URI 0.000000, __MIME_BOUND_DIGITS_19 0.000000, __MIME_HTML 0.000000, __MIME_HTML_ONLY 0.000000, __MIME_TEXT_H 0.000000, __MIME_TEXT_H1 0.000000, __MIME_TEXT_H2 0.000000, __MIME_VERSION 0.000000, __PART_TYPE_HTML 0.000000, __PASSWORD_IN_BODY 0.000000, __PHISH_SPEAR_PASSWORD_1 0.000000, __PHISH_SPEAR_SUBJ_SUBJECT 0.000000, __SANE_MSGID 0.000000, __SINGLE_URI_MPART_HTML 0.000000, __SUBJ_ALPHA_END 0.000000, __SUBJ_TRANSACTIONAL 0.000000, __SUBJ_TR_GEN 0.000000, __TAG_EXISTS_BODY 0.000000, __TAG_EXISTS_HEAD 0.000000, __TAG_EXISTS_HTML 0.000000, __TO_MALFORMED_2 0.000000, __TO_NO_NAME 0.000000, __URI_IN_BODY 0.000000, __URI_NOT_IMG 0.000000, __URI_NO_MAILTO 0.000000, __URI_NO_WWW 0.000000, __URI_NS_SERVFAIL 0.000000, __URI_WITH_PATH 0.000000
                    X-LASED-ImpersonationFalse
                    X-Sophos-Tracker0.119203 52ab507dc33ae8f2d52ee8d276cdb4b7c1b8d047
                    X-BAEAI-Source-GeoIP"US" "N/A" "N/A"
                    X-BAEAI-SPFPASS
                    X-BAEAI-DKIMPASS
                    X-BAEAI-DMARCpass
                    X-SilverSky-ARCnone
                    X-BAEAI-Authentication-Ratingstrong
                    X-Spam-StatusWHITELISTED
                    X-BAEAI-Trust-Levelgreen
                    Return-PathDeviceManager@fiserv.com
                    X-MS-Exchange-Organization-ExpirationStartTime27 Dec 2024 12:17:10.4877 (UTC)
                    X-MS-Exchange-Organization-ExpirationStartTimeReasonOriginalSubmit
                    X-MS-Exchange-Organization-ExpirationInterval1:00:00:00.0000000
                    X-MS-Exchange-Organization-ExpirationIntervalReasonOriginalSubmit
                    X-MS-Exchange-Organization-Network-Message-Id 2c9b3f36-13d7-40fb-5595-08dd2670638d
                    X-EOPAttributedMessage0
                    X-EOPTenantAttributedMessage3778f0b2-789a-4d43-b25e-d4fe25a4c3c0:0
                    X-MS-Exchange-Organization-MessageDirectionalityIncoming
                    x-ms-publictraffictypeEmail
                    X-MS-TrafficTypeDiagnostic DS3PEPF000099E0:EE_|SA1PR22MB3097:EE_|CO6PR22MB2724:EE_
                    x-ms-exchange-organization-authsource DS3PEPF000099E0.namprd04.prod.outlook.com
                    x-ms-exchange-organization-authasAnonymous
                    X-MS-Office365-Filtering-Correlation-Id 2c9b3f36-13d7-40fb-5595-08dd2670638d
                    X-MS-Exchange-AtpMessagePropertiesSA|SL
                    X-MS-Exchange-Organization-SCL-1
                    X-MS-Exchange-Organization-BypassClutter$true
                    X-Microsoft-Antispam BCL:0;ARA:13230040|82310400026|8096899003|43540500003;
                    X-Forefront-Antispam-Report CIP:165.212.64.87;CTRY:US;LANG:en;SCL:-1;SRV:;IPV:NLI;SFV:NSPM;H:postin03.mbox.net;PTR:postin03.mbox.net;CAT:NONE;SFS:(13230040)(82310400026)(8096899003)(43540500003);DIR:INB;
                    X-MS-Exchange-CrossTenant-OriginalArrivalTime27 Dec 2024 12:17:10.2846 (UTC)
                    X-MS-Exchange-CrossTenant-Network-Message-Id 2c9b3f36-13d7-40fb-5595-08dd2670638d
                    X-MS-Exchange-CrossTenant-Id3778f0b2-789a-4d43-b25e-d4fe25a4c3c0
                    X-MS-Exchange-CrossTenant-AuthSource DS3PEPF000099E0.namprd04.prod.outlook.com
                    X-MS-Exchange-CrossTenant-AuthAsAnonymous
                    X-MS-Exchange-CrossTenant-FromEntityHeaderInternet
                    X-MS-Exchange-Transport-CrossTenantHeadersStampedSA1PR22MB3097
                    X-MS-Exchange-Transport-EndToEndLatency00:00:03.5480929
                    X-MS-Exchange-Processed-By-BccFoldering15.20.8293.000
                    X-Microsoft-Antispam-Mailbox-Delivery ucf:0;jmr:0;auth:0;dest:I;ENG:(910001)(944506478)(944626604)(920097)(930097)(140003);
                    X-Microsoft-Antispam-Message-Info X9ziKU7/h650TBk91XjvCPQZYP/84d6ZSxtswBmNkB3LhXnEgoBBwQfj8vF7dm6/5Q0XkJnInG0UsHUW6BvSSu9wVjr/EgORE4LWsABEX3Di9hcZtiQsF9uUrJNjNkvyvMACvDQM702W70U3NsMgR4vl6QP70IHpITg6NzhevVLJumaZLfxHet0teyx5/x6l7jsD6YFaJsFSlMBClOWIGHAsncTqdaq9uNM1atvuYmJa0yOnrdP6CHY5uQtIDVRmnIqVZ4oPZAnzuV6Jl8EOVLIgvnrIkXmuFA5W677Gc0k31nLXQmhRCc8dK/dfiePJUymoJYDFjcqP5dPtDiURp+qXlFdNFnNTHZlwYHXWa+9nvvshWw0ZA3kYRAJcIFeKiMoUdGrK0h0uv/VtKQHrM1lRjKNSvRsA29nLUVaRY4E9KTKkpJvS/NNGTQi527Vei8+HQlDz7JI5p7i8KzPN2n4ZWyTxmRDrrao7IpfnBukIbvuFVQSrShk+IgT+9xue7ajOpgglUpXDtuk8HsyZtM5hA+g5yU/SDB7cM4QLMo6PIaOBIbWBVw3+aWmLzq6Gu0j0ShtcwVTT7dAkgYY1GnbwOxytoxyZV2CXzFNE0a807JdAD6gc2r70V+4sErRIOm1zGyGLVTsa15ZfE1GAj2Mtymnbw76Acc2vcxhnEVSmFh6wTwRsNlXWNchcK8EzET16jBozFvu54ienHlRuNhgtqgMEICtWPUWAC6AegSrpfvvtsHekIEp5VV0/SnfdVLD5WrV62ik5mWjacjELx2mpfNU5DdLiZSrrn3/FdwrUXgqtYTAF7+AqppO57SSUG6UnFQxjGZxZAI3J5sb2bvr4OpBazg7znOUdlptnnQUqj9rxKv8RRN0xvQxLhwVBsvrqWsvev94p1IKRuZzSaINnrLBbRQTng8pjF/AWLT6pdDFBq0exUS+SEZolxdrkqASODia2AENOHop00K8JxUFIugu0d2cIbIkDOWF0IP0JwoWisScqIdulC5hhuPFDY1dpIcG6bxPZXwRlF3EaxBQmI2en2ZzHJWOxprFthXa9O6/GQAfhSexxoSf5tjhJkyLnumsk6/A+d6WN2ksicX6vPjL6+FYfrkmJTbEu9BjBiFrb23iJj1ZDK+UJ3nsJBp33wjjDFcdvZC7KnHTPUTHKQCTyg/UpJdwD0vbjgNyyi+bjH/HgHLvg9id9lGDWM0xutzK/LyC/SR4U9mQRq4HU7nS5g3mD4er2QOJnIzrOLGyg2TofYxjfFZ2B1k47BlIVHIQfIUPGbyD7WGGjVo4CPTlhY24uuAIm/FQWmRXeKIby58ArzTs8JhlYrvUUbG2FhZqzdroMfCfA/A5yCQociknSU/4Cp8Qemh5CXGw7YGYygl2lCB6uFpr111kclunJoVRmU0VEcSnDg7UayVU6kYREOK/YerNkP6jIfA2q8YTrCvuAIkRVvl6aK52ZKLpbxTzxuALbkiAVBX8oxcfVZt+VMlvciClXZub7Q07Oyju3EkX7m1yAUR05TcA3XXbUp3pfHQtAEGSsqmm8C6QlL8vxtBSrdkQp99KyGSTCiFo2tSo1MfgBI7USAwqKn/5RkZjDRpJcOQtyH4DIA5gZsUJGg6mWm+8KY1pjFs2cVVjvi6PXfRNUR3Gub6rJkHngSXaYt3+euIRx0mZ4K+DMtAoTjNZo6N6/jQLuguZ5pQCWfLKjiRuDAVlypzsQ4Z8I6ayNJgtp/dj/NrGa+Nps75AF/6ySZ20fBberaF4sSD8UYLj/8i+qanPmSm+YTEPEK6XyRsUEYsp+pOd+MJMDT+KjnvAvFcUw4K07YeYwumRi2iM+RpMY77fpLCQAiHx8vQ+qJt5xFTQAJs/sdKc3zK6B+jCzlCvSYbJsmflg2+7Woz5BJ/9n6dX1d1sA+I6AHFnL16lj4+3fRE3UcU23gsf99WBdmHU0rSWAztxm3M2vBXgWyUEupi6eleE/mkofnZH8kwT3YalLebHWLzAGWxa3Pyebr5rj2oG1mEKijfe6ae3ob41KGJT85aGoJ7Oy7IuCaYPn3zdehyoJcDTyKOPO3Lr+B0+02RXu3U8Wg+0vlvPnkW9UzsMMTqEL88iu7zpNhPjFOnPujrSYNoFMz8BdEfK5kDBOFgS1hpLFHS8oVDuTegesvDh1u4bX+4KTE7XBuKrgmzNuFtJpk2RvNnMqG600yOXAuDI4py4mX5eCRvltHy7Ku1nFC04+LzBuEtxxGpq3hhy0eXDA/5SaCwWoj4MKznmdU+GSoU2MdDnATfdz09/OS59ZdsM/FZIj/Sw4LlI3Dl+MKV9HmTCX56B6VqG6+nsDUVVfYPQ2/GceKJb48yLBGKnqTW/P
                    x-ms-exchange-organization-originalclientipaddress165.212.64.87
                    x-ms-exchange-organization-originalserveripaddress10.167.17.203
                    X-Priority3
                    X-MSMail-PriorityNormal
                    Thread-IndexAQHbWFlDLDjPe5V4IkqP/rlOg7ibjQ==
                    Message-ID<43p8wcvjgc-1@rfxt2mgwppa0001.fiserv.one>
                    From"DeviceManager@fiserv.com" <DeviceManager@fiserv.com>
                    ToCale Garlich <CGarlich@firstfedweb.com>
                    SubjectDevice Manager Password Reset Link
                    DateFri, 27 Dec 2024 04:17:00 -0800
                    MIME-Version1.0
                    Content-typeMultipart/alternative; charset="utf-8"; boundary="00B0FEED_message_boundary"
                    Content-DescriptionMultipart message

                    File Icon

                    Icon Hash:46070c0a8e0c67d6