Edit tour

Windows Analysis Report
5b118cb6-e85d-926b-b917-b9317aeed46c.eml

Overview

General Information

Sample name:	5b118cb6-e85d-926b-b917-b9317aeed46c.eml
Analysis ID:	1587479
MD5:	8899a38f624820b3345d3f3a7b03636e
SHA1:	bfeee49a7ac5432e68a87be81631c8d96bc295d1
SHA256:	470720569b33f4e1790b2bf8e40516555a669c4b41e043daf2646a556c0ecffc
Infos:

Detection

Score:	52
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

AI detected landing page (webpage, office document or email)

AI detected potential phishing Email

AI detected suspicious Javascript

Detected non-DNS traffic on DNS port

HTML page contains hidden javascript code

Queries the volume information (name, serial number etc) of a device

Sigma detected: Office Autorun Keys Modification

Stores files to the Windows start menu directory

Classification

Process Tree

System is w10x64_ra

OUTLOOK.EXE (PID: 6568 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\user\Desktop\5b118cb6-e85d-926b-b917-b9317aeed46c.eml" MD5: 91A5292942864110ED734005B7E005C0)

ai.exe (PID: 6912 cmdline: "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "7574D7D3-115E-42F2-A18E-CDA200208921" "76146226-275F-4169-B543-964858205304" "6568" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx" MD5: EC652BEDD90E089D9406AFED89A8A8BD)

chrome.exe (PID: 6292 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://akirapowered84501.emlnk.com/lt.php?x=3DZy~GDLVnab5KCs-Nu4WOae1qEoiN9xvxk1XaPMVXahD5B9-Uy.xuO-2I2imNL MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 4064 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 --field-trial-handle=1880,i,9364508247106260134,16425168768327660314,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7140 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6088 --field-trial-handle=1880,i,9364508247106260134,16425168768327660314,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Sigma Signatures

Sigma detected: Office Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 , EventID: 13, EventType: SetValue, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE, ProcessId: 6568, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Addins\OneNote.OutlookAddin\1

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Phishing

AI detected landing page (webpage, office document or email)

Source: Email	Joe Sandbox AI: Page contains button: 'Enviar una Apelacin' Source: 'Email'
Source: Email	Joe Sandbox AI: Email contains prominent button: 'enviar una apelacin'
Source: https://systemcheckai.com/	Joe Sandbox AI: Page contains button: 'View account status' Source: '2.3.pages.csv'

AI detected potential phishing Email

Source: Email

Joe Sandbox AI: Detected potential phishing email: The email claims to be from Salesforce but contains Facebook-related content, indicating domain spoofing. Contains a suspicious external link (akirapowered84501.emlnk.com) masked as an 'appeal' button. Creates urgency with threats of permanent deactivation and tight deadlines, a common phishing tactic

AI detected suspicious Javascript

Source: 0.12.id.script.csv

Joe Sandbox AI: Detected suspicious JavaScript with source url: https://systemcheckai.com/... This script demonstrates several high-risk behaviors, including dynamic code execution, data exfiltration, and redirects to potentially malicious domains. The use of an iframe to load additional scripts and the obfuscated nature of the code further increase the risk. While the script may have a legitimate purpose, such as implementing a security challenge, the overall behavior is highly suspicious and indicative of potential malicious intent.

Source: https://systemcheckai.com/

HTTP Parser: Base64 decoded: <svg xmlns="http://www.w3.org/2000/svg" width="32" height="32" fill="none"><path fill="#B20F03" d="M16 3a13 13 0 1 0 13 13A13.015 13.015 0 0 0 16 3m0 24a11 11 0 1 1 11-11 11.01 11.01 0 0 1-11 11"/><path fill="#B20F03" d="M17.038 18.615H14.87L14.563 9.5h2....

Source: Email

Classification: Credential Stealer

Source: https://systemcheckai.com/	HTTP Parser: No favicon
Source: https://systemcheckai.com/	HTTP Parser: No favicon
Source: https://systemcheckai.com/	HTTP Parser: No favicon
Source: https://systemcheckai.com/?__cf_chl_tk=0RIHzV06vLvMh8I5uIaM5gzGpcF5grXQCHZAqykR5cY-1736509452-1.0.1.1-MeAo3B16Fd1_7SjJAv6VzOspJOTkp.S8AKWOUxKbuNQ	HTTP Parser: No favicon

Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.16:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.3.187.198:443 -> 192.168.2.16:65134 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.16:65152 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.16:65195 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.16:65229 version: TLS 1.2

Source: chrome.exe

Memory has grown: Private usage: 1MB later: 30MB

Source: global traffic	TCP traffic: 192.168.2.16:65127 -> 162.159.36.2:53
Source: global traffic	TCP traffic: 192.168.2.16:65127 -> 162.159.36.2:53
Source: global traffic	TCP traffic: 192.168.2.16:65127 -> 162.159.36.2:53
Source: global traffic	TCP traffic: 192.168.2.16:65127 -> 162.159.36.2:53
Source: global traffic	TCP traffic: 192.168.2.16:65127 -> 162.159.36.2:53
Source: global traffic	TCP traffic: 192.168.2.16:65127 -> 162.159.36.2:53

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.17
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.17
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.17
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.17
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: akirapowered84501.emlnk.com
Source: global traffic	DNS traffic detected: DNS query: akirapowered84501.activehosted.com
Source: global traffic	DNS traffic detected: DNS query: systemcheckai.com
Source: global traffic	DNS traffic detected: DNS query: a.nel.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: challenges.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: static.xx.fbcdn.net
Source: global traffic	DNS traffic detected: DNS query: code.jquery.com
Source: global traffic	DNS traffic detected: DNS query: cdn.jsdelivr.net
Source: global traffic	DNS traffic detected: DNS query: scontent.fhan2-4.fna.fbcdn.net
Source: global traffic	DNS traffic detected: DNS query: www.facebook.com
Source: global traffic	DNS traffic detected: DNS query: 198.187.3.20.in-addr.arpa
Source: global traffic	DNS traffic detected: DNS query: moonito.net
Source: global traffic	DNS traffic detected: DNS query: scontent-hou1-1.xx.fbcdn.net

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 65426 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65506 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65220 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65186 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65461 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 65381 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65140 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 65278 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 65198 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65473 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65152 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65300 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65438 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 65346 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 65254 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 65174 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65219 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65324 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65129 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 65404 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 65358 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65242 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65485 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65256 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65194
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65195
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65192
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 65497 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65193
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65198
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 65210 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65336 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65199
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65196
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65197
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 65371 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65190
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65191
Source: unknown	Network traffic detected: HTTP traffic on port 65310 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65189
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65276 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65402 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 65448 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 65209 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65244 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65162 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65139 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65414 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65184 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65309 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 65232 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 65475 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65393 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65288 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65150 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65518 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65436 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 65348 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 65172 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65493 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65378 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65521 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65137 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65217 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65406 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65205 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65314 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65286 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65240 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65332 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65441 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65149 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65418 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65508 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65264 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65463 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65366 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 65471 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 65160 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65302 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65298 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65344 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 65239 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65147 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65451 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65191 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65262 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65416 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65182 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65322 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65368 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65511 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65356 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65391 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65159 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65483 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65428 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65296 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65495 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65334 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65170 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65229 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65274 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65207 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65312 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65252 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65317 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65398 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65309
Source: unknown	Network traffic detected: HTTP traffic on port 65352 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65307
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65308
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65301
Source: unknown	Network traffic detected: HTTP traffic on port 65490 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65302
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65300
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65305
Source: unknown	Network traffic detected: HTTP traffic on port 65295 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65306
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65303
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65304
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65364 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65320
Source: unknown	Network traffic detected: HTTP traffic on port 65226 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65261 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65318
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65319
Source: unknown	Network traffic detected: HTTP traffic on port 65329 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65455 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65312
Source: unknown	Network traffic detected: HTTP traffic on port 65512 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65313
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65310
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65311
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65316
Source: unknown	Network traffic detected: HTTP traffic on port 65145 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65317
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65314
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65315
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65330
Source: unknown	Network traffic detected: HTTP traffic on port 65193 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65331
Source: unknown	Network traffic detected: HTTP traffic on port 65443 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65500 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65248 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65135 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65329
Source: unknown	Network traffic detected: HTTP traffic on port 65305 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65323
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65324
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65321
Source: unknown	Network traffic detected: HTTP traffic on port 65180 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65322
Source: unknown	Network traffic detected: HTTP traffic on port 65479 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65327
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65328
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65325
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65326
Source: unknown	Network traffic detected: HTTP traffic on port 65421 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65341
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65342
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65340
Source: unknown	Network traffic detected: HTTP traffic on port 65330 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65157 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65334
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65335
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65332
Source: unknown	Network traffic detected: HTTP traffic on port 65214 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65333
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65338
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65339
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65336
Source: unknown	Network traffic detected: HTTP traffic on port 65386 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65273 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65337
Source: unknown	Network traffic detected: HTTP traffic on port 65204 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65342 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65502 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65507
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65508
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65505
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65506
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65509
Source: unknown	Network traffic detected: HTTP traffic on port 65179 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65480 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65167 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65500
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65503
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65504
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65501
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65502
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65465 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65431 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65518
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65519
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65516
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65510
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65511
Source: unknown	Network traffic detected: HTTP traffic on port 65216 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65271 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65514
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65515
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65512
Source: unknown	Network traffic detected: HTTP traffic on port 65388 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65513
Source: unknown	Network traffic detected: HTTP traffic on port 65315 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65453 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65155 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65283 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65408 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65354 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65521
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65522
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65520
Source: unknown	Network traffic detected: HTTP traffic on port 65238 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65492 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65320 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65133 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65376 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65189 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65150
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65392
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65151
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65393
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65390
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65391
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65154
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65396
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65155
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65397
Source: unknown	Network traffic detected: HTTP traffic on port 65195 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65152
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65394
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65153
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65395
Source: unknown	Network traffic detected: HTTP traffic on port 65487 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65246 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65281 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65435 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65349 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65147
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65389
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65148
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65145
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65387
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65146
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65388
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65149
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65161
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65162
Source: unknown	Network traffic detected: HTTP traffic on port 65469 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65160
Source: unknown	Network traffic detected: HTTP traffic on port 65423 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65165
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65166
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65163
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65164
Source: unknown	Network traffic detected: HTTP traffic on port 65177 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65131 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65158
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65159
Source: unknown	Network traffic detected: HTTP traffic on port 65212 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65156
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65398
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65157
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65399
Source: unknown	Network traffic detected: HTTP traffic on port 65258 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65384 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65172
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65173
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65170
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65171
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65176
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65177
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65174
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65175
Source: unknown	Network traffic detected: HTTP traffic on port 65319 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65293 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65222 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65350 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65167
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65168
Source: unknown	Network traffic detected: HTTP traffic on port 65165 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65234 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65183
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65184
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65181
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65182
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65187
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65188
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65185
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65186
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65372 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65180
Source: unknown	Network traffic detected: HTTP traffic on port 65327 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65457 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65200 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65143 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65178
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65179
Source: unknown	Network traffic detected: HTTP traffic on port 65401 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65499 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65514 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65352
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65353
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65350
Source: unknown	Network traffic detected: HTTP traffic on port 65445 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65351
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65153 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65307 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65345
Source: unknown	Network traffic detected: HTTP traffic on port 65477 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65236 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65346
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65343
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65344
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65349
Source: unknown	Network traffic detected: HTTP traffic on port 65291 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65347
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65348
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65360
Source: unknown	Network traffic detected: HTTP traffic on port 65339 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65363
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65364
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65361
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65362
Source: unknown	Network traffic detected: HTTP traffic on port 65268 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65374 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65187 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65356
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65357
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65354
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65355
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65358
Source: unknown	Network traffic detected: HTTP traffic on port 65516 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65141 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65359
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65370
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65371
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65132
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65374
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65133
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65375
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65130
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65372
Source: unknown	Network traffic detected: HTTP traffic on port 65197 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65131
Source: unknown	Network traffic detected: HTTP traffic on port 65340 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65373
Source: unknown	Network traffic detected: HTTP traffic on port 65489 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65202 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65504 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65396 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65433 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65367
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65368
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65365
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65366
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65129
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65369
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65128
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65381
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65140
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65382
Source: unknown	Network traffic detected: HTTP traffic on port 65362 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65380
Source: unknown	Network traffic detected: HTTP traffic on port 65175 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65143
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65385
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65144
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65386
Source: unknown	Network traffic detected: HTTP traffic on port 65467 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65141
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65383
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65142

Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.16:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.3.187.198:443 -> 192.168.2.16:65134 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.16:65152 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.16:65195 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.16:65229 version: TLS 1.2

Source: classification engine

Classification label: mal52.winEML@25/238@45/185

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

File created: C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

File created: C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20250110T0643550873-6568.etl

Source: unknown	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\user\Desktop\5b118cb6-e85d-926b-b917-b9317aeed46c.eml"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "7574D7D3-115E-42F2-A18E-CDA200208921" "76146226-275F-4169-B543-964858205304" "6568" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://akirapowered84501.emlnk.com/lt.php?x=3DZy~GDLVnab5KCs-Nu4WOae1qEoiN9xvxk1XaPMVXahD5B9-Uy.xuO-2I2imNL
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 --field-trial-handle=1880,i,9364508247106260134,16425168768327660314,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "7574D7D3-115E-42F2-A18E-CDA200208921" "76146226-275F-4169-B543-964858205304" "6568" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://akirapowered84501.emlnk.com/lt.php?x=3DZy~GDLVnab5KCs-Nu4WOae1qEoiN9xvxk1XaPMVXahD5B9-Uy.xuO-2I2imNL
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 --field-trial-handle=1880,i,9364508247106260134,16425168768327660314,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6088 --field-trial-handle=1880,i,9364508247106260134,16425168768327660314,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6088 --field-trial-handle=1880,i,9364508247106260134,16425168768327660314,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8

Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: apphelp.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: c2r64.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: userenv.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: msasn1.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: cryptsp.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: rsaenh.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: gpapi.dll

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{F959DBBB-3867-41F2-8E5F-3B8BEFAA81B3}\InprocServer32

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	31 Browser Extensions	1 Process Injection	1 Masquerading	OS Credential Dumping	1 Process Discovery	Remote Services	Data from Local System	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	1 DLL Side-Loading	1 Process Injection	LSASS Memory	12 System Information Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 Registry Run Keys / Startup Folder	1 Registry Run Keys / Startup Folder	1 DLL Side-Loading	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 Extra Window Memory Injection	1 Extra Window Memory Injection	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction

Name	IP	Active	Malicious	Reputation
jsdelivr.map.fastly.net	151.101.65.229	true	false	high
star-mini.c10r.facebook.com	157.240.0.35	true	false	high
a.nel.cloudflare.com	35.190.80.1	true	false	high
scontent.fhan2-4.fna.fbcdn.net	42.114.77.145	true	false	high
moonito.net	104.21.16.1	true	false	high
systemcheckai.com	104.26.4.115	true	false	high
akirapowered84501.emlnk.com	54.235.205.181	true	true	unknown
scontent.xx.fbcdn.net	157.240.252.13	true	false	high
code.jquery.com	151.101.2.137	true	false	high
scontent-hou1-1.xx.fbcdn.net	157.240.24.13	true	false	high
challenges.cloudflare.com	104.18.95.41	true	false	high
www.google.com	172.217.16.196	true	false	high
akirapowered84501.activehosted.com	104.17.202.31	true	false	unknown
www.facebook.com	unknown	unknown	false	high
cdn.jsdelivr.net	unknown	unknown	false	high
198.187.3.20.in-addr.arpa	unknown	unknown	false	high
static.xx.fbcdn.net	unknown	unknown	false	high

Name	Malicious	Antivirus Detection	Reputation
https://systemcheckai.com/	true		unknown
https://systemcheckai.com/?__cf_chl_tk=0RIHzV06vLvMh8I5uIaM5gzGpcF5grXQCHZAqykR5cY-1736509452-1.0.1.1-MeAo3B16Fd1_7SjJAv6VzOspJOTkp.S8AKWOUxKbuNQ	true		unknown

IP	Domain	Country	ASN	ASN Name	Malicious
151.101.193.229	unknown	United States	54113	FASTLYUS	false
20.189.173.4	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
54.235.205.181	akirapowered84501.emlnk.com	United States	14618	AMAZON-AESUS	true
42.114.77.145	scontent.fhan2-4.fna.fbcdn.net	Viet Nam	18403	FPT-AS-APTheCorporationforFinancingPromotingTechnolo	false
157.240.0.6	unknown	United States	32934	FACEBOOKUS	false
172.67.73.68	unknown	United States	13335	CLOUDFLARENETUS	false
142.250.185.163	unknown	United States	15169	GOOGLEUS	false
104.17.202.31	akirapowered84501.activehosted.com	United States	13335	CLOUDFLARENETUS	false
151.101.66.137	unknown	United States	54113	FASTLYUS	false
35.190.80.1	a.nel.cloudflare.com	United States	15169	GOOGLEUS	false
157.240.252.13	scontent.xx.fbcdn.net	United States	32934	FACEBOOKUS	false
104.26.4.115	systemcheckai.com	United States	13335	CLOUDFLARENETUS	false
142.250.186.138	unknown	United States	15169	GOOGLEUS	false
52.113.194.132	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
104.21.16.1	moonito.net	United States	13335	CLOUDFLARENETUS	false
1.1.1.1	unknown	Australia	13335	CLOUDFLARENETUS	false
108.177.15.84	unknown	United States	15169	GOOGLEUS	false
172.217.16.206	unknown	United States	15169	GOOGLEUS	false
157.240.0.35	star-mini.c10r.facebook.com	United States	32934	FACEBOOKUS	false
104.26.5.115	unknown	United States	13335	CLOUDFLARENETUS	false
151.101.65.229	jsdelivr.map.fastly.net	United States	54113	FASTLYUS	false
104.18.95.41	challenges.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
216.58.206.42	unknown	United States	15169	GOOGLEUS	false
216.58.206.68	unknown	United States	15169	GOOGLEUS	false
151.101.2.137	code.jquery.com	United States	54113	FASTLYUS	false
157.240.251.9	unknown	United States	32934	FACEBOOKUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
172.217.16.196	www.google.com	United States	15169	GOOGLEUS	false
172.217.16.195	unknown	United States	15169	GOOGLEUS	false
157.240.251.35	unknown	United States	32934	FACEBOOKUS	false
157.240.24.13	scontent-hou1-1.xx.fbcdn.net	United States	32934	FACEBOOKUS	false

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1587479
Start date and time:	2025-01-10 12:43:26 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	17
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled
Analysis Mode:	stream
Analysis stop reason:	Timeout
Sample name:	5b118cb6-e85d-926b-b917-b9317aeed46c.eml
Detection:	MAL
Classification:	mal52.winEML@25/238@45/185
Cookbook Comments:	Found application associated with file extension: .eml

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Jan 10 10:44:10 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2673
Entropy (8bit):	3.994443192870937
Encrypted:	false
SSDEEP:
MD5:	9340AEB53DFF56080E21BCB18E0542FF
SHA1:	A3FECE3729414F344DE51B780B0E74857DEBDED7
SHA-256:	ED34B09B545F436CDE98332BD345E03E7AAD200F2873823F19A6601D890A18CB
SHA-512:	0F49175A1CD7E80579A8FF741B020E786A8F6701F51234295B83C9CAB5A4CD66D891F6FA314A3C8539C4F89ABB8642994973FA2AEFB2A8EC81A5CE6F5C6B0858
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,........Tc..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IZr]....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VZ.]....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VZ.]....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VZ.]..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VZ.]...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............\|P......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e..C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

File type:	RFC 822 mail, ASCII text, with very long lines (366), with CRLF line terminators
Entropy (8bit):	5.522983525976488
TrID:	E-Mail message (Var. 5) (54515/1) 100.00%
File name:	5b118cb6-e85d-926b-b917-b9317aeed46c.eml
File size:	27'842 bytes
MD5:	8899a38f624820b3345d3f3a7b03636e
SHA1:	bfeee49a7ac5432e68a87be81631c8d96bc295d1
SHA256:	470720569b33f4e1790b2bf8e40516555a669c4b41e043daf2646a556c0ecffc
SHA512:	727ae5b8a3a5ed6084b3688a689851b151ec09b6fc9d57fbd8ff0de60d0fdbcb1c1502f3f1fdc157fef083aa6a492232f03b94bb2774658592934df3c3ef0b06
SSDEEP:	384:SOOvkOIV45xRFk+X0hNQkMGz61To/LjKHpKeutDU8C:ysVMxRvX0h6kMGz61To/LjKHQeutDU8C
TLSH:	8FC2C603F7C01C12D9AF496094033B7DBB39A9C69B7649B064DB7B3E078DCE79A80648
File Content Preview:	Received: from PAWP189MB2611.EURP189.PROD.OUTLOOK.COM (2603:10a6:102:336::8).. by DB9P189MB1547.EURP189.PROD.OUTLOOK.COM with HTTPS; Fri, 10 Jan 2025.. 09:24:52 +0000..Received: from AM8P251CA0005.EURP251.PROD.OUTLOOK.COM (2603:10a6:20b:21b::10).. by PAWP

Subject:	Aviso de Problema de Cumplimiento: Resulvalo para Evitar la Desactivacin Permanente
From:	Account Notice <noreply@salesforce.com>
To:	"monica.montes@ahorramas.com" <monica.montes@ahorramas.com>
Cc:
BCC:
Date:	Fri, 10 Jan 2025 09:23:58 +0000
Communications:	No suele recibir correo electrnico de noreply@salesforce.com. Por qu es esto importante<https://aka.ms/LearnAboutSenderIdentification> Nos ponemos en contacto para informarle que su pgina ha sido suspendida temporalmente debido a una infraccin de los requisitos reglamentarios ms recientes relacionados con el contenido y la publicidad en lnea. facelo ook Aviso de Problema de Cumplimiento: Resulvalo para Evitar la Desactivacin Permanente Estimado/a Monica Montes, Nos ponemos en contacto para informarle que su pgina ha sido suspendida temporalmente debido a una infraccin de los requisitos reglamentarios ms recientes relacionados con el contenido y la publicidad en lnea. Como parte de nuestros esfuerzos continuos para garantizar el cumplimiento de las regulaciones vigentes de la UE, todas las pginas deben ajustarse a las directrices actualizadas sobre contenido y prcticas publicitarias. Lamentablemente, su pgina no cumple con los criterios establecidos y, por ello, ha sido suspendida temporalmente. Para evitar la desactivacin permanente de su pgina, le instamos a tomar las medidas necesarias. Si no recibimos una apelacin antes del 10 de enero de 2024, la suspensin ser definitiva y su pgina ser desactivada. Enviar una Apelacin <https://akirapowered84501.emlnk.com/lt.php?x=3DZy~GDLVnab5KCs-Nu4WOae1qEoiN9xvxk1XaPMVXahD5B9-Uy.xuO-2I2imNL> ... 415 Mission Street, 3rd Floor, San Francisco, CA 94105, United States
Attachments:

Key	Value
Received	from [10.245.64.98] ([10.245.64.98:58684] helo=na247-app1-4-ia7.ops.sfdc.net) by mx2-ia7-sp4.mta.salesforce.com (envelope-from <noreply@salesforce.com>) (ecelerity 4.7.0.20111 r(msys-ecelerity:tags/4.7.0-ga^0)) with ESMTPS (cipher=TLS_AES_256_GCM_SHA384 subject="/C=US/ST=California/L=San Francisco/O=salesforce.com, inc./OU=0:app;1:ia7;2:ia7-sp4;3:na247;4:prod/CN=na247-app1-4-ia7.ops.sfdc.net") id 4F/23-08329-E27E0876; Fri, 10 Jan 2025 09:23:58 +0000
Authentication-Results	spf=pass (sender IP is 13.110.246.181) smtp.mailfrom=salesforce.com; dkim=none (message not signed) header.d=none;dmarc=pass action=none header.from=salesforce.com;compauth=pass reason=100
Received-SPF	Pass (protection.outlook.com: domain of salesforce.com designates 13.110.246.181 as permitted sender) receiver=protection.outlook.com; client-ip=13.110.246.181; helo=smtp06-ia7-sp4.mta.salesforce.com; pr=E
Return-Path	noreply@salesforce.com
Authentication-Results-Original	mx2-ia7-sp4.mta.salesforce.com x-tls.subject="/C=US/ST=California/L=San Francisco/O=salesforce.com, inc./OU=0:app;1:ia7;2:ia7-sp4;3:na247;4:prod/CN=na247-app1-4-ia7.ops.sfdc.net"; auth=pass (cipher=TLS_AES_256_GCM_SHA384)
Date	Fri, 10 Jan 2025 09:23:58 +0000
From	Account Notice <noreply@salesforce.com>
To	"monica.montes@ahorramas.com" <monica.montes@ahorramas.com>
Message-ID	<IVSJN000000000000000000000000000000000000000000000SPV8R100C32GWzKtRA-bfKYHa0BwRA@sfdc.net>
Subject	Aviso de Problema de Cumplimiento: Resulvalo para Evitar la Desactivacin Permanente
Content-Type	multipart/alternative; boundary="----=_Part_5206_1131823143.1736501038091"
X-SFDC-LK	00DKd000008zmp6
X-SFDC-User	005Kd000005BZDE
X-Sender	postmaster@salesforce.com
X-mail_abuse_inquiries	http://www.salesforce.com/company/abuse.jsp
X-SFDC-TLS-NoRelay	1
X-SFDC-CORRELATION-ID	0000k176xlolkhxn
X-SFDC-Binding	1WrIRBV94myi25uB
X-SFDC-EmailCategory	networksNewUser
X-SFDC-EntityId	0DBKd000000Gs8l
X-SFDC-Interface	internal
X-EOPAttributedMessage	0
X-EOPTenantAttributedMessage	4eb911de-063e-41cb-bcf9-71aabf223544:0
X-MS-PublicTrafficType	Email
X-MS-TrafficTypeDiagnostic	AMS1EPF00000043:EE_\|PAWP189MB2611:EE_\|DB9P189MB1547:EE_
X-MS-Office365-Filtering-Correlation-Id	3c759c09-b1df-4a59-7e17-08dd315883f2
X-MS-Exchange-AtpMessageProperties	SA\|SL
X-Microsoft-Antispam	BCL:5;ARA:13230040\|4092899012\|29132699027\|3092899012\|13012899012\|12012899012\|3072899012\|13102899012\|2092899012\|5062899012\|6062899009\|5082899009\|8096899003;
X-Forefront-Antispam-Report	CIP:13.110.246.181;CTRY:US;LANG:es;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:smtp06-ia7-sp4.mta.salesforce.com;PTR:smtp06-ia7-sp4.mta.salesforce.com;CAT:NONE;SFTY:9.25;SFS:(13230040)(4092899012)(29132699027)(3092899012)(13012899012)(12012899012)(3072899012)(13102899012)(2092899012)(5062899012)(6062899009)(5082899009)(8096899003);DIR:INB;SFTY:9.25;
X-MS-Exchange-CrossTenant-OriginalArrivalTime	10 Jan 2025 09:23:59.4725 (UTC)
X-MS-Exchange-CrossTenant-Network-Message-Id	3c759c09-b1df-4a59-7e17-08dd315883f2
X-MS-Exchange-CrossTenant-Id	4eb911de-063e-41cb-bcf9-71aabf223544
X-MS-Exchange-CrossTenant-AuthSource	AMS1EPF00000043.eurprd04.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs	Anonymous
X-MS-Exchange-CrossTenant-FromEntityHeader	Internet
X-MS-Exchange-Transport-CrossTenantHeadersStamped	PAWP189MB2611
X-MS-Exchange-Transport-EndToEndLatency	00:00:53.3167937
X-MS-Exchange-Processed-By-BccFoldering	15.20.8314.015
X-Microsoft-Antispam-Mailbox-Delivery	ucf:0;jmr:0;auth:0;dest:I;ENG:(910001)(944506478)(944626604)(920097)(930097)(140003);
X-Microsoft-Antispam-Message-Info	Wu5J4gAXS6M6vRqMR3I4cgPGbbOv0BUB1kiu4CfHNhgNyEJKE+3a675UO+5vas8Qh8CR4KFjN4lJNn0t5yAAcfOUqNFDKzDCjRL2RavfoVDu/g/mjS20TzxBhVz9/GOegg36emutLdesAgGnMbxDQUC1uhattanRybm0Kk/Vohg1qV/Cc+mZNZN/65+59MFuQEhC5m96Yc//0sWtjFhsgLpLZ+tADQM+czNEKhlGGx7MN3ZQfi/RriulAMpz3+eCU/35YnR+F5U2qlCW1gk8LnVds9P+4uFg+P5KQHIH3hYS9newfdyOpliWvim+tts8h5T+YdPLsc5ivZe40yqkxscsfAH6fQ7H3YknHCErEiU8/j4J+bhUtekNv4dm/4iMDl/fiRsi/7Xh7t9+uFtaE0l0L/OoqyekZIDGlZUB0wpMPKHll+M+vOcNEwiXhqqWqPcyIWY/ZLzVBGMvPr7VO9TtfjCpj9GP3iPsYd3r5WlhW5+gEvM+w2TTMNhxeobE65lYS2Vj4H/l8sGRJsN1tyPtW2Vl5ZnIBUFBL+ZWU0fR3QddZ4xcnG9Fu6tPfcMKCkkzFi/ZYZhT/aDdNldNpkNYOQYcn+rU4s76bdQ4CfuG46hOuEz25Ep+wzhR1ZuBfuKE2zNKedtnAFLk0N7HxA6aYUr+R84NeFzDx80PiSDFuJj9azHRCEOw+UhmDKRIQeTW00u9ba7Co4buVS42DuxCWwcy4A3wyJ+ViloaIz8X28aPeWxnMWrevSbv5BP6QdxrQ+3bh5MALAacxhq38iHDh7tiNZdtTTNXeBTkRFAoStl8jl1eOcYwviUcYtskCTxZrajaZmJkpUu8JcsquHkx3BlxHE/ManvY0/PRPKyEU2lsf4txLygiLnvfVB1N7iEU2k+DH4EEXD8y9SOYYI3KSXlsTgWfpAIO0l8Ku/0r+9HrHEYCCNS+FhFLzlcIykQfZrYf7C1xmTD5ftIL6e+7E3LrZtgCnbV6kwYxEjJxkuHUDgMkwBj+p6N8+vUZlhG1Gym4wbyQCo7EYLGdRieL8glZu6qpBK3tY/Kl1adZ1vb8DfL/NG9TJZVT7iVw5OF04onubEn2Z/0yAV+Yg1OJwES69gc0oJ0FEYmwtOgUC5/ow9OYEplzsUxml8lWw3zVJvS1wRlByr4dZrh5n3qsWLiXMvn70XhuXOmzM6b11PrV6zaIjAt3VOKrvgGPRIBo43hrFbzmkswYJL8fGkwkldBajNGIIWI08Sw1kt3biJkwqQ8vBWADU5OsCVP+xLouyRXWvi/gUz6If2JWvEFOIYG0WLa8OluCYt84uo8z94mqZzom823MwmoK2gzd3yh9QhiDNnLbSkwFB/mtIg74+DhUuEQexpwmyisp4CIU3RUL63R7ToFodCcNUd8p1+ooDUa0h4ElofkO6bsZQcWIJfOHyhXHfvUXe/S/NtBCihMrwrimDb9Fel03nQHpV3Hl3o8Rah2yHW97CNYRLt5b/7epc2GK0ej/gE/mC+OENwHXmP5pl079GolYzh+qjog+dGtGHRWHlcsNbsQan0v0tD6WSLJoSf54RwP8MMx27Bweb/WR6KKsuAOYZW4ta7qTylMheZeRr17ETlEtAhgef5fU/OEEHn0kU7I3woW4jufOq+6FUTdBZ86plPqqz2CzCLIuTlVdg9tLL3IPlgTedUDfi9YLc8DXCrLJp+HeErTa7jnx5bAgeLsPwfc8pXWvSfSPtVWB/i5vCfR0hCV97Y4q+4AuUO/8gRwYl//gYAsIG1j9Wl5HTjPit5Pj7wTDVYdnlf4ltdyiNqhtLFisyBCm5Hx2UY03I3P1Wv4ZFbqWR3MI9uYE+FpiSUAVzXq5PUwgHO1pe8OBnyu/cOKXgOQ9DpKpJIdKaTwjSXxx6y+tcryXq/ztwr0E/lADKGogbxuCR2WLLCv2JLowL1xWdgMS7sg3hA02TP+ICj+4ma9sbiLYwads4DnxJAJIQ+m6HZu1ric3JLrcrsZ7HuANeJKj/1Dn+F0X7hjjHqs73Yl4dVklES57GNAgl2tBMpDre4XwVbCpmtrScCK0scWjqXIqR4MbwyiZX+ROYqxdnef+doDB1uUTu6VUGaEhz03D8FKGI+QtlMYYlZxUTd0rsTBOV0C8waCLb16Q9TGsllSAnN6bSV/bM3R8ffzemTMSnlzitx/Lw7mcNqGQ6jdWP/Xmne0bxZ2w365G888=
MIME-Version	1.0

Description:	Adversaries may abuse Internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality and customize aspects of Internet browsers. They can be installed directly or through a browser's app store and generally have access and permissions to everything that the browser can access.
Tactics:	Persistence
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Process: Process Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 5b118cb6-e85d-926b-b917-b9317aeed46c.eml

Overview

General Information

Detection

Signatures

Classification

Process Tree

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Software Vulnerabilities

Networking

System Summary

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

LLM Input / Output

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Chrome Cache Entry: 283

Chrome Cache Entry: 284

Chrome Cache Entry: 285

Chrome Cache Entry: 286

Chrome Cache Entry: 287

Chrome Cache Entry: 288

Chrome Cache Entry: 289

Chrome Cache Entry: 290

Chrome Cache Entry: 291

Chrome Cache Entry: 292

Chrome Cache Entry: 293

Chrome Cache Entry: 294

Chrome Cache Entry: 295

Chrome Cache Entry: 296

Chrome Cache Entry: 297

Chrome Cache Entry: 298

Chrome Cache Entry: 299

Chrome Cache Entry: 300

Chrome Cache Entry: 301

Chrome Cache Entry: 302

Chrome Cache Entry: 303

Chrome Cache Entry: 305

Chrome Cache Entry: 306

Chrome Cache Entry: 307

Chrome Cache Entry: 308

Chrome Cache Entry: 309

Chrome Cache Entry: 311

Windows Analysis Report
5b118cb6-e85d-926b-b917-b9317aeed46c.eml

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre