Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
Message.eml

Overview

General Information

Sample name:Message.eml
Analysis ID:1587997
MD5:c3c65d26f5393a2c3237ab2b10ebc7cb
SHA1:f6b30d1d7e4fcd73c94a0d42f20474861dd61003
SHA256:f9dd41c9a75bed0f428b47614a386ce570a4fec20743079e5316004a0793fdcd
Infos:

Detection

Score:48
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

AI detected landing page (webpage, office document or email)
AI detected potential phishing Email
Detected TCP or UDP traffic on non-standard ports
HTML body contains low number of good links
HTML body contains password input but no form action
HTML page contains hidden javascript code
HTML title does not match URL
Queries the volume information (name, serial number etc) of a device
Sigma detected: Office Autorun Keys Modification
Sigma detected: Suspicious Office Outbound Connections
Stores files to the Windows start menu directory
Suricata IDS alerts with low severity for network traffic

Classification

  • System is w10x64_ra
  • OUTLOOK.EXE (PID: 7100 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\user\Desktop\Message.eml" MD5: 91A5292942864110ED734005B7E005C0)
    • ai.exe (PID: 6368 cmdline: "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "5BCEF68C-C3A3-4958-9094-39DCD2D3605E" "AC0FA4E8-5A2A-463E-A6FD-714985C781E3" "7100" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx" MD5: EC652BEDD90E089D9406AFED89A8A8BD)
    • chrome.exe (PID: 6268 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.dropbox.com%2Fl%2Fscl%2FAACwmhVqeeBEY_BFL3aP_gtump8kxCNPLfc&data=05%7C02%7Cglay%40biolegend.com%7C20a7438dcde3472902d808dd319730f3%7Cfa246a9e8fe04eed9eec93652a25c4ee%7C0%7C0%7C638721247633388750%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=dDgdjVSL%2BN1BAJRYIccLqKImqW%2FY1lRx3DzI31CNY48%3D&reserved=0 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
      • chrome.exe (PID: 7088 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 --field-trial-handle=1968,i,14636689685429613013,1102863687240550866,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
  • cleanup
No yara matches
Source: Registry Key setAuthor: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 , EventID: 13, EventType: SetValue, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE, ProcessId: 7100, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Addins\OneNote.OutlookAddin\1
Source: Network ConnectionAuthor: X__Junior (Nextron Systems): Data: DestinationIp: 192.168.2.16, DestinationIsIpv6: false, DestinationPort: 49712, EventID: 3, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE, Initiated: true, ProcessId: 7100, Protocol: tcp, SourceIp: 184.28.90.27, SourceIsIpv6: false, SourcePort: 443
TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
2025-01-10T19:32:18.624654+010020283713Unknown Traffic192.168.2.1649713184.28.90.27443TCP
2025-01-10T19:32:18.625074+010020283713Unknown Traffic192.168.2.1649712184.28.90.27443TCP

Click to jump to signature section

Show All Signature Results

Phishing

barindex
Source: EmailJoe Sandbox AI: Email contains prominent button: 'open file'
Source: EmailJoe Sandbox AI: Detected potential phishing email: The sender email appears spoofed - mixing a personal Gmail address with Dropbox's domain. The filename follows a suspicious pattern (Scan_Receipt_date) commonly used in phishing. The URL structure and multiple redirects are suspicious and likely lead to a phishing page
Source: https://www.dropbox.com/scl/fi/nnnfss8flt6seo1vspfyr/Scan_Reciept_01102025.pdf?oref=e&r=ACV-bKew8Y2FnEMbrnKQOjqqQVb7IwiCceeMI7JYeZsVTzHiLtnEqE2G68h8flcb560q0qboaPUbmRiKULhkP5uzBKzVmVArxFTi62tGvPbptF6Te1wswM5WG-aVDrosNvj7F6dw3Mzapk8P7ixZUzEbhdi9HF3S-Id0HAYIW5gFEjTNTp--qTWRI2kSjFm9L25qdHlgwkvMlsCJ1yxxU2y0&sm=1&dl=0HTTP Parser: Number of links: 0
Source: https://www.dropbox.com/scl/fi/nnnfss8flt6seo1vspfyr/Scan_Reciept_01102025.pdf?oref=e&r=ACV-bKew8Y2FnEMbrnKQOjqqQVb7IwiCceeMI7JYeZsVTzHiLtnEqE2G68h8flcb560q0qboaPUbmRiKULhkP5uzBKzVmVArxFTi62tGvPbptF6Te1wswM5WG-aVDrosNvj7F6dw3Mzapk8P7ixZUzEbhdi9HF3S-Id0HAYIW5gFEjTNTp--qTWRI2kSjFm9L25qdHlgwkvMlsCJ1yxxU2y0&sm=1&dl=0HTTP Parser: <input type="password" .../> found but no <form action="...
Source: https://www.dropbox.com/scl/fi/nnnfss8flt6seo1vspfyr/Scan_Reciept_01102025.pdf?dl=0&oref=e&r=ACV-bKew8Y2FnEMbrnKQOjqqQVb7IwiCceeMI7JYeZsVTzHiLtnEqE2G68h8flcb560q0qboaPUbmRiKULhkP5uzBKzVmVArxFTi62tGvPbptF6Te1wswM5WG-aVDrosNvj7F6dw3Mzapk8P7ixZUzEbhdi9HF3S-Id0HAYIW5gFEjTNTp--qTWRI2kSjFm9L25qdHlgwkvMlsCJ1yxxU2y0&sm=1HTTP Parser: Base64 decoded: cbada8159063facdad9ea9a758a4prod
Source: https://www.dropbox.com/scl/fi/nnnfss8flt6seo1vspfyr/Scan_Reciept_01102025.pdf?oref=e&r=ACV-bKew8Y2FnEMbrnKQOjqqQVb7IwiCceeMI7JYeZsVTzHiLtnEqE2G68h8flcb560q0qboaPUbmRiKULhkP5uzBKzVmVArxFTi62tGvPbptF6Te1wswM5WG-aVDrosNvj7F6dw3Mzapk8P7ixZUzEbhdi9HF3S-Id0HAYIW5gFEjTNTp--qTWRI2kSjFm9L25qdHlgwkvMlsCJ1yxxU2y0&sm=1&dl=0HTTP Parser: Title: Sign In - Google Accounts does not match URL
Source: EmailClassification: Credential Stealer
Source: https://www.dropbox.com/scl/fi/nnnfss8flt6seo1vspfyr/Scan_Reciept_01102025.pdf?oref=e&r=ACV-bKew8Y2FnEMbrnKQOjqqQVb7IwiCceeMI7JYeZsVTzHiLtnEqE2G68h8flcb560q0qboaPUbmRiKULhkP5uzBKzVmVArxFTi62tGvPbptF6Te1wswM5WG-aVDrosNvj7F6dw3Mzapk8P7ixZUzEbhdi9HF3S-Id0HAYIW5gFEjTNTp--qTWRI2kSjFm9L25qdHlgwkvMlsCJ1yxxU2y0&sm=1&dl=0HTTP Parser: Iframe src: https://accounts.google.com/gsi/button?text=continue_with&width=350&logo_alignment=left&click_listener=()%3D%3E%7Bvar%20e%2Ct%3Bthis.hasPendingAuthFlow%26%26(null%3D%3D%3D(e%3Dthis.logger)%7C%7Cvoid%200%3D%3D%3De%7C%7Ce.logLoginCancel(!1))%2Cthis.hasPendingAuthFlow%3D!0%2Cnull%3D%3D%3D(t%3Dthis.logger)%7C%7Cvoid%200%3D%3D%3Dt%7C%7Ct.logLoginStart(!1)%7D&client_id=801668726815.apps.googleusercontent.com&iframe_id=gsi_966091_285272&as=m9YAfxxQ9GTmlEBnK%2F44YUtQsc6lORKXZ38Wswpy4T8&hl=en
Source: https://www.dropbox.com/scl/fi/nnnfss8flt6seo1vspfyr/Scan_Reciept_01102025.pdf?oref=e&r=ACV-bKew8Y2FnEMbrnKQOjqqQVb7IwiCceeMI7JYeZsVTzHiLtnEqE2G68h8flcb560q0qboaPUbmRiKULhkP5uzBKzVmVArxFTi62tGvPbptF6Te1wswM5WG-aVDrosNvj7F6dw3Mzapk8P7ixZUzEbhdi9HF3S-Id0HAYIW5gFEjTNTp--qTWRI2kSjFm9L25qdHlgwkvMlsCJ1yxxU2y0&sm=1&dl=0HTTP Parser: Iframe src: https://dropboxcaptcha.com
Source: https://www.dropbox.com/scl/fi/nnnfss8flt6seo1vspfyr/Scan_Reciept_01102025.pdf?oref=e&r=ACV-bKew8Y2FnEMbrnKQOjqqQVb7IwiCceeMI7JYeZsVTzHiLtnEqE2G68h8flcb560q0qboaPUbmRiKULhkP5uzBKzVmVArxFTi62tGvPbptF6Te1wswM5WG-aVDrosNvj7F6dw3Mzapk8P7ixZUzEbhdi9HF3S-Id0HAYIW5gFEjTNTp--qTWRI2kSjFm9L25qdHlgwkvMlsCJ1yxxU2y0&sm=1&dl=0HTTP Parser: Iframe src: https://accounts.google.com/gsi/button?text=continue_with&width=350&logo_alignment=left&click_listener=()%3D%3E%7Bvar%20e%2Ct%3Bthis.hasPendingAuthFlow%26%26(null%3D%3D%3D(e%3Dthis.logger)%7C%7Cvoid%200%3D%3D%3De%7C%7Ce.logLoginCancel(!1))%2Cthis.hasPendingAuthFlow%3D!0%2Cnull%3D%3D%3D(t%3Dthis.logger)%7C%7Cvoid%200%3D%3D%3Dt%7C%7Ct.logLoginStart(!1)%7D&client_id=801668726815.apps.googleusercontent.com&iframe_id=gsi_971812_42220&as=m9YAfxxQ9GTmlEBnK%2F44YUtQsc6lORKXZ38Wswpy4T8&hl=en
Source: https://www.dropbox.com/scl/fi/nnnfss8flt6seo1vspfyr/Scan_Reciept_01102025.pdf?oref=e&r=ACV-bKew8Y2FnEMbrnKQOjqqQVb7IwiCceeMI7JYeZsVTzHiLtnEqE2G68h8flcb560q0qboaPUbmRiKULhkP5uzBKzVmVArxFTi62tGvPbptF6Te1wswM5WG-aVDrosNvj7F6dw3Mzapk8P7ixZUzEbhdi9HF3S-Id0HAYIW5gFEjTNTp--qTWRI2kSjFm9L25qdHlgwkvMlsCJ1yxxU2y0&sm=1&dl=0HTTP Parser: Iframe src: https://dropboxcaptcha.com
Source: https://www.dropbox.com/scl/fi/nnnfss8flt6seo1vspfyr/Scan_Reciept_01102025.pdf?oref=e&r=ACV-bKew8Y2FnEMbrnKQOjqqQVb7IwiCceeMI7JYeZsVTzHiLtnEqE2G68h8flcb560q0qboaPUbmRiKULhkP5uzBKzVmVArxFTi62tGvPbptF6Te1wswM5WG-aVDrosNvj7F6dw3Mzapk8P7ixZUzEbhdi9HF3S-Id0HAYIW5gFEjTNTp--qTWRI2kSjFm9L25qdHlgwkvMlsCJ1yxxU2y0&sm=1&dl=0HTTP Parser: Iframe src: https://accounts.google.com/gsi/button?text=continue_with&width=350&logo_alignment=left&click_listener=()%3D%3E%7Bvar%20e%2Ct%3Bthis.hasPendingAuthFlow%26%26(null%3D%3D%3D(e%3Dthis.logger)%7C%7Cvoid%200%3D%3D%3De%7C%7Ce.logLoginCancel(!1))%2Cthis.hasPendingAuthFlow%3D!0%2Cnull%3D%3D%3D(t%3Dthis.logger)%7C%7Cvoid%200%3D%3D%3Dt%7C%7Ct.logLoginStart(!1)%7D&client_id=801668726815.apps.googleusercontent.com&iframe_id=gsi_971812_42220&as=m9YAfxxQ9GTmlEBnK%2F44YUtQsc6lORKXZ38Wswpy4T8&hl=en
Source: https://www.dropbox.com/scl/fi/nnnfss8flt6seo1vspfyr/Scan_Reciept_01102025.pdf?oref=e&r=ACV-bKew8Y2FnEMbrnKQOjqqQVb7IwiCceeMI7JYeZsVTzHiLtnEqE2G68h8flcb560q0qboaPUbmRiKULhkP5uzBKzVmVArxFTi62tGvPbptF6Te1wswM5WG-aVDrosNvj7F6dw3Mzapk8P7ixZUzEbhdi9HF3S-Id0HAYIW5gFEjTNTp--qTWRI2kSjFm9L25qdHlgwkvMlsCJ1yxxU2y0&sm=1&dl=0HTTP Parser: Iframe src: https://dropboxcaptcha.com
Source: https://www.dropbox.com/scl/fi/nnnfss8flt6seo1vspfyr/Scan_Reciept_01102025.pdf?oref=e&r=ACV-bKew8Y2FnEMbrnKQOjqqQVb7IwiCceeMI7JYeZsVTzHiLtnEqE2G68h8flcb560q0qboaPUbmRiKULhkP5uzBKzVmVArxFTi62tGvPbptF6Te1wswM5WG-aVDrosNvj7F6dw3Mzapk8P7ixZUzEbhdi9HF3S-Id0HAYIW5gFEjTNTp--qTWRI2kSjFm9L25qdHlgwkvMlsCJ1yxxU2y0&sm=1&dl=0HTTP Parser: Iframe src: https://accounts.google.com/gsi/button?text=continue_with&width=350&logo_alignment=left&click_listener=()%3D%3E%7Bvar%20e%2Ct%3Bthis.hasPendingAuthFlow%26%26(null%3D%3D%3D(e%3Dthis.logger)%7C%7Cvoid%200%3D%3D%3De%7C%7Ce.logLoginCancel(!1))%2Cthis.hasPendingAuthFlow%3D!0%2Cnull%3D%3D%3D(t%3Dthis.logger)%7C%7Cvoid%200%3D%3D%3Dt%7C%7Ct.logLoginStart(!1)%7D&client_id=801668726815.apps.googleusercontent.com&iframe_id=gsi_995098_526357&as=m9YAfxxQ9GTmlEBnK%2F44YUtQsc6lORKXZ38Wswpy4T8&hl=en
Source: https://www.dropbox.com/scl/fi/nnnfss8flt6seo1vspfyr/Scan_Reciept_01102025.pdf?oref=e&r=ACV-bKew8Y2FnEMbrnKQOjqqQVb7IwiCceeMI7JYeZsVTzHiLtnEqE2G68h8flcb560q0qboaPUbmRiKULhkP5uzBKzVmVArxFTi62tGvPbptF6Te1wswM5WG-aVDrosNvj7F6dw3Mzapk8P7ixZUzEbhdi9HF3S-Id0HAYIW5gFEjTNTp--qTWRI2kSjFm9L25qdHlgwkvMlsCJ1yxxU2y0&sm=1&dl=0HTTP Parser: <input type="password" .../> found
Source: https://www.dropbox.com/scl/fi/nnnfss8flt6seo1vspfyr/Scan_Reciept_01102025.pdf?oref=e&r=ACV-bKew8Y2FnEMbrnKQOjqqQVb7IwiCceeMI7JYeZsVTzHiLtnEqE2G68h8flcb560q0qboaPUbmRiKULhkP5uzBKzVmVArxFTi62tGvPbptF6Te1wswM5WG-aVDrosNvj7F6dw3Mzapk8P7ixZUzEbhdi9HF3S-Id0HAYIW5gFEjTNTp--qTWRI2kSjFm9L25qdHlgwkvMlsCJ1yxxU2y0&sm=1&dl=0HTTP Parser: No favicon
Source: https://www.dropbox.com/scl/fi/nnnfss8flt6seo1vspfyr/Scan_Reciept_01102025.pdf?oref=e&r=ACV-bKew8Y2FnEMbrnKQOjqqQVb7IwiCceeMI7JYeZsVTzHiLtnEqE2G68h8flcb560q0qboaPUbmRiKULhkP5uzBKzVmVArxFTi62tGvPbptF6Te1wswM5WG-aVDrosNvj7F6dw3Mzapk8P7ixZUzEbhdi9HF3S-Id0HAYIW5gFEjTNTp--qTWRI2kSjFm9L25qdHlgwkvMlsCJ1yxxU2y0&sm=1&dl=0HTTP Parser: No favicon
Source: https://www.dropbox.com/scl/fi/nnnfss8flt6seo1vspfyr/Scan_Reciept_01102025.pdf?oref=e&r=ACV-bKew8Y2FnEMbrnKQOjqqQVb7IwiCceeMI7JYeZsVTzHiLtnEqE2G68h8flcb560q0qboaPUbmRiKULhkP5uzBKzVmVArxFTi62tGvPbptF6Te1wswM5WG-aVDrosNvj7F6dw3Mzapk8P7ixZUzEbhdi9HF3S-Id0HAYIW5gFEjTNTp--qTWRI2kSjFm9L25qdHlgwkvMlsCJ1yxxU2y0&sm=1&dl=0HTTP Parser: No favicon
Source: https://www.dropbox.com/scl/fi/nnnfss8flt6seo1vspfyr/Scan_Reciept_01102025.pdf?oref=e&r=ACV-bKew8Y2FnEMbrnKQOjqqQVb7IwiCceeMI7JYeZsVTzHiLtnEqE2G68h8flcb560q0qboaPUbmRiKULhkP5uzBKzVmVArxFTi62tGvPbptF6Te1wswM5WG-aVDrosNvj7F6dw3Mzapk8P7ixZUzEbhdi9HF3S-Id0HAYIW5gFEjTNTp--qTWRI2kSjFm9L25qdHlgwkvMlsCJ1yxxU2y0&sm=1&dl=0HTTP Parser: No favicon
Source: https://www.dropbox.com/scl/fi/nnnfss8flt6seo1vspfyr/Scan_Reciept_01102025.pdf?oref=e&r=ACV-bKew8Y2FnEMbrnKQOjqqQVb7IwiCceeMI7JYeZsVTzHiLtnEqE2G68h8flcb560q0qboaPUbmRiKULhkP5uzBKzVmVArxFTi62tGvPbptF6Te1wswM5WG-aVDrosNvj7F6dw3Mzapk8P7ixZUzEbhdi9HF3S-Id0HAYIW5gFEjTNTp--qTWRI2kSjFm9L25qdHlgwkvMlsCJ1yxxU2y0&sm=1&dl=0HTTP Parser: No favicon
Source: https://www.dropbox.com/scl/fi/nnnfss8flt6seo1vspfyr/Scan_Reciept_01102025.pdf?oref=e&r=ACV-bKew8Y2FnEMbrnKQOjqqQVb7IwiCceeMI7JYeZsVTzHiLtnEqE2G68h8flcb560q0qboaPUbmRiKULhkP5uzBKzVmVArxFTi62tGvPbptF6Te1wswM5WG-aVDrosNvj7F6dw3Mzapk8P7ixZUzEbhdi9HF3S-Id0HAYIW5gFEjTNTp--qTWRI2kSjFm9L25qdHlgwkvMlsCJ1yxxU2y0&sm=1&dl=0HTTP Parser: No <meta name="author".. found
Source: https://www.dropbox.com/scl/fi/nnnfss8flt6seo1vspfyr/Scan_Reciept_01102025.pdf?oref=e&r=ACV-bKew8Y2FnEMbrnKQOjqqQVb7IwiCceeMI7JYeZsVTzHiLtnEqE2G68h8flcb560q0qboaPUbmRiKULhkP5uzBKzVmVArxFTi62tGvPbptF6Te1wswM5WG-aVDrosNvj7F6dw3Mzapk8P7ixZUzEbhdi9HF3S-Id0HAYIW5gFEjTNTp--qTWRI2kSjFm9L25qdHlgwkvMlsCJ1yxxU2y0&sm=1&dl=0HTTP Parser: No <meta name="author".. found
Source: https://www.dropbox.com/scl/fi/nnnfss8flt6seo1vspfyr/Scan_Reciept_01102025.pdf?oref=e&r=ACV-bKew8Y2FnEMbrnKQOjqqQVb7IwiCceeMI7JYeZsVTzHiLtnEqE2G68h8flcb560q0qboaPUbmRiKULhkP5uzBKzVmVArxFTi62tGvPbptF6Te1wswM5WG-aVDrosNvj7F6dw3Mzapk8P7ixZUzEbhdi9HF3S-Id0HAYIW5gFEjTNTp--qTWRI2kSjFm9L25qdHlgwkvMlsCJ1yxxU2y0&sm=1&dl=0HTTP Parser: No <meta name="author".. found
Source: https://www.dropbox.com/scl/fi/nnnfss8flt6seo1vspfyr/Scan_Reciept_01102025.pdf?oref=e&r=ACV-bKew8Y2FnEMbrnKQOjqqQVb7IwiCceeMI7JYeZsVTzHiLtnEqE2G68h8flcb560q0qboaPUbmRiKULhkP5uzBKzVmVArxFTi62tGvPbptF6Te1wswM5WG-aVDrosNvj7F6dw3Mzapk8P7ixZUzEbhdi9HF3S-Id0HAYIW5gFEjTNTp--qTWRI2kSjFm9L25qdHlgwkvMlsCJ1yxxU2y0&sm=1&dl=0HTTP Parser: No <meta name="author".. found
Source: https://www.dropbox.com/scl/fi/nnnfss8flt6seo1vspfyr/Scan_Reciept_01102025.pdf?oref=e&r=ACV-bKew8Y2FnEMbrnKQOjqqQVb7IwiCceeMI7JYeZsVTzHiLtnEqE2G68h8flcb560q0qboaPUbmRiKULhkP5uzBKzVmVArxFTi62tGvPbptF6Te1wswM5WG-aVDrosNvj7F6dw3Mzapk8P7ixZUzEbhdi9HF3S-Id0HAYIW5gFEjTNTp--qTWRI2kSjFm9L25qdHlgwkvMlsCJ1yxxU2y0&sm=1&dl=0HTTP Parser: No <meta name="author".. found
Source: https://www.dropbox.com/scl/fi/nnnfss8flt6seo1vspfyr/Scan_Reciept_01102025.pdf?oref=e&r=ACV-bKew8Y2FnEMbrnKQOjqqQVb7IwiCceeMI7JYeZsVTzHiLtnEqE2G68h8flcb560q0qboaPUbmRiKULhkP5uzBKzVmVArxFTi62tGvPbptF6Te1wswM5WG-aVDrosNvj7F6dw3Mzapk8P7ixZUzEbhdi9HF3S-Id0HAYIW5gFEjTNTp--qTWRI2kSjFm9L25qdHlgwkvMlsCJ1yxxU2y0&sm=1&dl=0HTTP Parser: No <meta name="author".. found
Source: https://www.dropbox.com/scl/fi/nnnfss8flt6seo1vspfyr/Scan_Reciept_01102025.pdf?oref=e&r=ACV-bKew8Y2FnEMbrnKQOjqqQVb7IwiCceeMI7JYeZsVTzHiLtnEqE2G68h8flcb560q0qboaPUbmRiKULhkP5uzBKzVmVArxFTi62tGvPbptF6Te1wswM5WG-aVDrosNvj7F6dw3Mzapk8P7ixZUzEbhdi9HF3S-Id0HAYIW5gFEjTNTp--qTWRI2kSjFm9L25qdHlgwkvMlsCJ1yxxU2y0&sm=1&dl=0HTTP Parser: No <meta name="author".. found
Source: https://www.dropbox.com/scl/fi/nnnfss8flt6seo1vspfyr/Scan_Reciept_01102025.pdf?oref=e&r=ACV-bKew8Y2FnEMbrnKQOjqqQVb7IwiCceeMI7JYeZsVTzHiLtnEqE2G68h8flcb560q0qboaPUbmRiKULhkP5uzBKzVmVArxFTi62tGvPbptF6Te1wswM5WG-aVDrosNvj7F6dw3Mzapk8P7ixZUzEbhdi9HF3S-Id0HAYIW5gFEjTNTp--qTWRI2kSjFm9L25qdHlgwkvMlsCJ1yxxU2y0&sm=1&dl=0HTTP Parser: No <meta name="author".. found
Source: https://www.dropbox.com/scl/fi/nnnfss8flt6seo1vspfyr/Scan_Reciept_01102025.pdf?oref=e&r=ACV-bKew8Y2FnEMbrnKQOjqqQVb7IwiCceeMI7JYeZsVTzHiLtnEqE2G68h8flcb560q0qboaPUbmRiKULhkP5uzBKzVmVArxFTi62tGvPbptF6Te1wswM5WG-aVDrosNvj7F6dw3Mzapk8P7ixZUzEbhdi9HF3S-Id0HAYIW5gFEjTNTp--qTWRI2kSjFm9L25qdHlgwkvMlsCJ1yxxU2y0&sm=1&dl=0HTTP Parser: No <meta name="copyright".. found
Source: https://www.dropbox.com/scl/fi/nnnfss8flt6seo1vspfyr/Scan_Reciept_01102025.pdf?oref=e&r=ACV-bKew8Y2FnEMbrnKQOjqqQVb7IwiCceeMI7JYeZsVTzHiLtnEqE2G68h8flcb560q0qboaPUbmRiKULhkP5uzBKzVmVArxFTi62tGvPbptF6Te1wswM5WG-aVDrosNvj7F6dw3Mzapk8P7ixZUzEbhdi9HF3S-Id0HAYIW5gFEjTNTp--qTWRI2kSjFm9L25qdHlgwkvMlsCJ1yxxU2y0&sm=1&dl=0HTTP Parser: No <meta name="copyright".. found
Source: https://www.dropbox.com/scl/fi/nnnfss8flt6seo1vspfyr/Scan_Reciept_01102025.pdf?oref=e&r=ACV-bKew8Y2FnEMbrnKQOjqqQVb7IwiCceeMI7JYeZsVTzHiLtnEqE2G68h8flcb560q0qboaPUbmRiKULhkP5uzBKzVmVArxFTi62tGvPbptF6Te1wswM5WG-aVDrosNvj7F6dw3Mzapk8P7ixZUzEbhdi9HF3S-Id0HAYIW5gFEjTNTp--qTWRI2kSjFm9L25qdHlgwkvMlsCJ1yxxU2y0&sm=1&dl=0HTTP Parser: No <meta name="copyright".. found
Source: https://www.dropbox.com/scl/fi/nnnfss8flt6seo1vspfyr/Scan_Reciept_01102025.pdf?oref=e&r=ACV-bKew8Y2FnEMbrnKQOjqqQVb7IwiCceeMI7JYeZsVTzHiLtnEqE2G68h8flcb560q0qboaPUbmRiKULhkP5uzBKzVmVArxFTi62tGvPbptF6Te1wswM5WG-aVDrosNvj7F6dw3Mzapk8P7ixZUzEbhdi9HF3S-Id0HAYIW5gFEjTNTp--qTWRI2kSjFm9L25qdHlgwkvMlsCJ1yxxU2y0&sm=1&dl=0HTTP Parser: No <meta name="copyright".. found
Source: https://www.dropbox.com/scl/fi/nnnfss8flt6seo1vspfyr/Scan_Reciept_01102025.pdf?oref=e&r=ACV-bKew8Y2FnEMbrnKQOjqqQVb7IwiCceeMI7JYeZsVTzHiLtnEqE2G68h8flcb560q0qboaPUbmRiKULhkP5uzBKzVmVArxFTi62tGvPbptF6Te1wswM5WG-aVDrosNvj7F6dw3Mzapk8P7ixZUzEbhdi9HF3S-Id0HAYIW5gFEjTNTp--qTWRI2kSjFm9L25qdHlgwkvMlsCJ1yxxU2y0&sm=1&dl=0HTTP Parser: No <meta name="copyright".. found
Source: https://www.dropbox.com/scl/fi/nnnfss8flt6seo1vspfyr/Scan_Reciept_01102025.pdf?oref=e&r=ACV-bKew8Y2FnEMbrnKQOjqqQVb7IwiCceeMI7JYeZsVTzHiLtnEqE2G68h8flcb560q0qboaPUbmRiKULhkP5uzBKzVmVArxFTi62tGvPbptF6Te1wswM5WG-aVDrosNvj7F6dw3Mzapk8P7ixZUzEbhdi9HF3S-Id0HAYIW5gFEjTNTp--qTWRI2kSjFm9L25qdHlgwkvMlsCJ1yxxU2y0&sm=1&dl=0HTTP Parser: No <meta name="copyright".. found
Source: https://www.dropbox.com/scl/fi/nnnfss8flt6seo1vspfyr/Scan_Reciept_01102025.pdf?oref=e&r=ACV-bKew8Y2FnEMbrnKQOjqqQVb7IwiCceeMI7JYeZsVTzHiLtnEqE2G68h8flcb560q0qboaPUbmRiKULhkP5uzBKzVmVArxFTi62tGvPbptF6Te1wswM5WG-aVDrosNvj7F6dw3Mzapk8P7ixZUzEbhdi9HF3S-Id0HAYIW5gFEjTNTp--qTWRI2kSjFm9L25qdHlgwkvMlsCJ1yxxU2y0&sm=1&dl=0HTTP Parser: No <meta name="copyright".. found
Source: https://www.dropbox.com/scl/fi/nnnfss8flt6seo1vspfyr/Scan_Reciept_01102025.pdf?oref=e&r=ACV-bKew8Y2FnEMbrnKQOjqqQVb7IwiCceeMI7JYeZsVTzHiLtnEqE2G68h8flcb560q0qboaPUbmRiKULhkP5uzBKzVmVArxFTi62tGvPbptF6Te1wswM5WG-aVDrosNvj7F6dw3Mzapk8P7ixZUzEbhdi9HF3S-Id0HAYIW5gFEjTNTp--qTWRI2kSjFm9L25qdHlgwkvMlsCJ1yxxU2y0&sm=1&dl=0HTTP Parser: No <meta name="copyright".. found
Source: C:\Program Files\Google\Chrome\Application\chrome.exeDirectory created: C:\Program Files\Google\Chrome\Application\Dictionaries
Source: unknownHTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49713 version: TLS 1.2
Source: unknownHTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49712 version: TLS 1.2
Source: unknownHTTPS traffic detected: 20.190.159.4:443 -> 192.168.2.16:49715 version: TLS 1.2
Source: unknownHTTPS traffic detected: 20.190.159.4:443 -> 192.168.2.16:49716 version: TLS 1.2
Source: unknownHTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.16:49718 version: TLS 1.2
Source: unknownHTTPS traffic detected: 20.190.159.4:443 -> 192.168.2.16:49719 version: TLS 1.2
Source: unknownHTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.16:50056 version: TLS 1.2
Source: chrome.exeMemory has grown: Private usage: 0MB later: 29MB
Source: global trafficTCP traffic: 192.168.2.16:49958 -> 35.157.212.223:3478
Source: Network trafficSuricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.16:49713 -> 184.28.90.27:443
Source: Network trafficSuricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.16:49712 -> 184.28.90.27:443
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: global trafficDNS traffic detected: DNS query: nam11.safelinks.protection.outlook.com
Source: global trafficDNS traffic detected: DNS query: www.dropbox.com
Source: global trafficDNS traffic detected: DNS query: cfl.dropboxstatic.com
Source: global trafficDNS traffic detected: DNS query: www.google.com
Source: global trafficDNS traffic detected: DNS query: d.dropbox.com
Source: global trafficDNS traffic detected: DNS query: c.contentsquare.net
Source: global trafficDNS traffic detected: DNS query: fp.dropbox.com
Source: global trafficDNS traffic detected: DNS query: use1-turn.fpjs.io
Source: global trafficDNS traffic detected: DNS query: dropboxcaptcha.com
Source: global trafficDNS traffic detected: DNS query: play.google.com
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49743
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50054
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50053
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50056
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50055
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50058
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50057
Source: unknownNetwork traffic detected: HTTP traffic on port 49743 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50059
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50061
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50060
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50062
Source: unknownNetwork traffic detected: HTTP traffic on port 50068 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50102 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50045 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49978
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49977
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49854
Source: unknownNetwork traffic detected: HTTP traffic on port 49841 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50085 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49851
Source: unknownNetwork traffic detected: HTTP traffic on port 50039 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50065
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50064
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50067
Source: unknownNetwork traffic detected: HTTP traffic on port 50056 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50066
Source: unknownNetwork traffic detected: HTTP traffic on port 49893 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50069
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50068
Source: unknownNetwork traffic detected: HTTP traffic on port 50074 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50070
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50072
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50071
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50074
Source: unknownNetwork traffic detected: HTTP traffic on port 49806 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49823 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50073
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49729
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49728
Source: unknownNetwork traffic detected: HTTP traffic on port 49978 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50080 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49724
Source: unknownNetwork traffic detected: HTTP traffic on port 49869 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49721
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49842
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49963
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49841
Source: unknownNetwork traffic detected: HTTP traffic on port 50034 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50040 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50075
Source: unknownNetwork traffic detected: HTTP traffic on port 50057 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50078
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50077
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50079
Source: unknownNetwork traffic detected: HTTP traffic on port 50096 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50081
Source: unknownNetwork traffic detected: HTTP traffic on port 50073 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50080
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50083
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50082
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50085
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49719
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49718
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49717
Source: unknownNetwork traffic detected: HTTP traffic on port 49904 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49715 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49716
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49715
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49713
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49712
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49832
Source: unknownNetwork traffic detected: HTTP traffic on port 50062 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49822 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50089
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50088
Source: unknownNetwork traffic detected: HTTP traffic on port 50079 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50051 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50094
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50093
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50096
Source: unknownNetwork traffic detected: HTTP traffic on port 50023 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49811 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49826
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49947
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49825
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49823
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49822
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50017
Source: unknownNetwork traffic detected: HTTP traffic on port 50061 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50017 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50055 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50078 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50049 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49939 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49713 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49893
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49890
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50021
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50020
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50023
Source: unknownNetwork traffic detected: HTTP traffic on port 49724 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50025
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50024
Source: unknownNetwork traffic detected: HTTP traffic on port 49911 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49851 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50021 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50030
Source: unknownNetwork traffic detected: HTTP traffic on port 50067 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50103 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49718 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49889
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50039
Source: unknownNetwork traffic detected: HTTP traffic on port 50038 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49761
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50031
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50034
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50033
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50036
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50035
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50038
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50037
Source: unknownNetwork traffic detected: HTTP traffic on port 50050 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49719 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49940 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50041
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50040
Source: unknownNetwork traffic detected: HTTP traffic on port 50066 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50104 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50083 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50089 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49999
Source: unknownNetwork traffic detected: HTTP traffic on port 49923 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49751
Source: unknownNetwork traffic detected: HTTP traffic on port 50033 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50043
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50042
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50045
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50044
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50047
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50046
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50049
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50048
Source: unknownNetwork traffic detected: HTTP traffic on port 50072 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50050
Source: unknownNetwork traffic detected: HTTP traffic on port 49934 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50052
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50051
Source: unknownNetwork traffic detected: HTTP traffic on port 50044 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49869
Source: unknownNetwork traffic detected: HTTP traffic on port 49890 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50036 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50042 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50059 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50094 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49912 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50071 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49826 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49717 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49889 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49900 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50105
Source: unknownNetwork traffic detected: HTTP traffic on port 50060 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50100
Source: unknownNetwork traffic detected: HTTP traffic on port 50077 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50102
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50101
Source: unknownNetwork traffic detected: HTTP traffic on port 49728 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50104
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50103
Source: unknownNetwork traffic detected: HTTP traffic on port 50025 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50053 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49999 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49901 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50088 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49924 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49712 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49947 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49729 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49793 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50099 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49963 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50031 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49751 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50043 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50100 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50037 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49793
Source: unknownNetwork traffic detected: HTTP traffic on port 50020 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50093 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50054 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50048 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49825 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50082 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50065 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50105 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49821
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49942
Source: unknownNetwork traffic detected: HTTP traffic on port 49842 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49940
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50098
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50099
Source: unknownNetwork traffic detected: HTTP traffic on port 50075 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50052 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49939
Source: unknownNetwork traffic detected: HTTP traffic on port 49810 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49942 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49977 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49936
Source: unknownNetwork traffic detected: HTTP traffic on port 50081 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49902 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49934
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49811
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49810
Source: unknownNetwork traffic detected: HTTP traffic on port 49925 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50064 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50035 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49919 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50070 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49721 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49936 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50098 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50046 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49806
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49925
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49924
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49923
Source: unknownNetwork traffic detected: HTTP traffic on port 49678 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49821 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49854 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50047 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49919
Source: unknownNetwork traffic detected: HTTP traffic on port 50024 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49912
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49911
Source: unknownNetwork traffic detected: HTTP traffic on port 49673 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50041 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49761 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50058 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49832 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50030 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49716 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49904
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49903
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49902
Source: unknownNetwork traffic detected: HTTP traffic on port 49903 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49901
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49900
Source: unknownNetwork traffic detected: HTTP traffic on port 50069 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50101 -> 443
Source: unknownHTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49713 version: TLS 1.2
Source: unknownHTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49712 version: TLS 1.2
Source: unknownHTTPS traffic detected: 20.190.159.4:443 -> 192.168.2.16:49715 version: TLS 1.2
Source: unknownHTTPS traffic detected: 20.190.159.4:443 -> 192.168.2.16:49716 version: TLS 1.2
Source: unknownHTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.16:49718 version: TLS 1.2
Source: unknownHTTPS traffic detected: 20.190.159.4:443 -> 192.168.2.16:49719 version: TLS 1.2
Source: unknownHTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.16:50056 version: TLS 1.2
Source: classification engineClassification label: mal48.winEML@21/6@44/254
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Program Files\Google\Chrome\Application\Dictionaries
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEFile created: C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEFile created: C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20250110T1332150042-7100.etl
Source: unknownProcess created: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\user\Desktop\Message.eml"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "5BCEF68C-C3A3-4958-9094-39DCD2D3605E" "AC0FA4E8-5A2A-463E-A6FD-714985C781E3" "7100" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.dropbox.com%2Fl%2Fscl%2FAACwmhVqeeBEY_BFL3aP_gtump8kxCNPLfc&data=05%7C02%7Cglay%40biolegend.com%7C20a7438dcde3472902d808dd319730f3%7Cfa246a9e8fe04eed9eec93652a25c4ee%7C0%7C0%7C638721247633388750%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=dDgdjVSL%2BN1BAJRYIccLqKImqW%2FY1lRx3DzI31CNY48%3D&reserved=0
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 --field-trial-handle=1968,i,14636689685429613013,1102863687240550866,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "5BCEF68C-C3A3-4958-9094-39DCD2D3605E" "AC0FA4E8-5A2A-463E-A6FD-714985C781E3" "7100" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.dropbox.com%2Fl%2Fscl%2FAACwmhVqeeBEY_BFL3aP_gtump8kxCNPLfc&data=05%7C02%7Cglay%40biolegend.com%7C20a7438dcde3472902d808dd319730f3%7Cfa246a9e8fe04eed9eec93652a25c4ee%7C0%7C0%7C638721247633388750%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=dDgdjVSL%2BN1BAJRYIccLqKImqW%2FY1lRx3DzI31CNY48%3D&reserved=0
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 --field-trial-handle=1968,i,14636689685429613013,1102863687240550866,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: apphelp.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: c2r64.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: userenv.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: msasn1.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: cryptsp.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: rsaenh.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: cryptbase.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: gpapi.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{F959DBBB-3867-41F2-8E5F-3B8BEFAA81B3}\InprocServer32
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEWindow found: window name: SysTabControl32
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Common
Source: C:\Program Files\Google\Chrome\Application\chrome.exeDirectory created: C:\Program Files\Google\Chrome\Application\Dictionaries
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information queried: ProcessInformation
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeQueries volume information: C:\Program Files (x86)\Microsoft Office\root\Office16\AI\WordCombinedFloatieLreOnline.onnx VolumeInformation
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid
ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire Infrastructure1
Drive-by Compromise
Windows Management Instrumentation21
Browser Extensions
1
Process Injection
3
Masquerading
OS Credential Dumping1
Process Discovery
Remote ServicesData from Local System2
Encrypted Channel
Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/Job1
Registry Run Keys / Startup Folder
1
Registry Run Keys / Startup Folder
1
Process Injection
LSASS Memory12
System Information Discovery
Remote Desktop ProtocolData from Removable Media1
Non-Standard Port
Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAt1
DLL Side-Loading
1
DLL Side-Loading
1
DLL Side-Loading
Security Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared Drive1
Non-Application Layer Protocol
Automated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCronLogin Hook1
Extra Window Memory Injection
1
Extra Window Memory Injection
NTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput Capture2
Application Layer Protocol
Traffic DuplicationData Destruction

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand
No Antivirus matches
No Antivirus matches
No Antivirus matches
No Antivirus matches
No Antivirus matches
NameIPActiveMaliciousAntivirus DetectionReputation
use1-turn.fpjs.io
18.196.235.131
truefalse
    high
    nam11.safelinks.eop-tm2.outlook.com
    104.47.58.156
    truefalse
      unknown
      c.ba.contentsquare.net
      34.249.87.52
      truefalse
        high
        play.google.com
        142.250.184.238
        truefalse
          high
          dropboxcaptcha.com
          143.204.95.12
          truefalse
            high
            www-env.dropbox-dns.com
            162.125.66.18
            truefalse
              high
              d-edge.v.dropbox.com
              162.125.1.20
              truefalse
                high
                www.google.com
                142.250.185.196
                truefalse
                  high
                  fp.dropbox.com
                  3.160.150.129
                  truefalse
                    high
                    nam11.safelinks.protection.outlook.com
                    unknown
                    unknownfalse
                      unknown
                      d.dropbox.com
                      unknown
                      unknownfalse
                        high
                        www.dropbox.com
                        unknown
                        unknownfalse
                          high
                          c.contentsquare.net
                          unknown
                          unknownfalse
                            high
                            cfl.dropboxstatic.com
                            unknown
                            unknownfalse
                              high
                              NameMaliciousAntivirus DetectionReputation
                              https://www.dropbox.com/scl/fi/nnnfss8flt6seo1vspfyr/Scan_Reciept_01102025.pdf?oref=e&r=ACV-bKew8Y2FnEMbrnKQOjqqQVb7IwiCceeMI7JYeZsVTzHiLtnEqE2G68h8flcb560q0qboaPUbmRiKULhkP5uzBKzVmVArxFTi62tGvPbptF6Te1wswM5WG-aVDrosNvj7F6dw3Mzapk8P7ixZUzEbhdi9HF3S-Id0HAYIW5gFEjTNTp--qTWRI2kSjFm9L25qdHlgwkvMlsCJ1yxxU2y0&sm=1&dl=0false
                                unknown
                                https://www.dropbox.com/scl/fi/nnnfss8flt6seo1vspfyr/Scan_Reciept_01102025.pdf?dl=0&oref=e&r=ACV-bKew8Y2FnEMbrnKQOjqqQVb7IwiCceeMI7JYeZsVTzHiLtnEqE2G68h8flcb560q0qboaPUbmRiKULhkP5uzBKzVmVArxFTi62tGvPbptF6Te1wswM5WG-aVDrosNvj7F6dw3Mzapk8P7ixZUzEbhdi9HF3S-Id0HAYIW5gFEjTNTp--qTWRI2kSjFm9L25qdHlgwkvMlsCJ1yxxU2y0&sm=1false
                                  unknown
                                  • No. of IPs < 25%
                                  • 25% < No. of IPs < 50%
                                  • 50% < No. of IPs < 75%
                                  • 75% < No. of IPs
                                  IPDomainCountryFlagASNASN NameMalicious
                                  216.58.212.142
                                  unknownUnited States
                                  15169GOOGLEUSfalse
                                  216.58.212.164
                                  unknownUnited States
                                  15169GOOGLEUSfalse
                                  173.194.76.84
                                  unknownUnited States
                                  15169GOOGLEUSfalse
                                  3.160.150.129
                                  fp.dropbox.comUnited States
                                  16509AMAZON-02USfalse
                                  2.16.168.101
                                  unknownEuropean Union
                                  20940AKAMAI-ASN1EUfalse
                                  142.250.185.202
                                  unknownUnited States
                                  15169GOOGLEUSfalse
                                  142.251.168.84
                                  unknownUnited States
                                  15169GOOGLEUSfalse
                                  104.47.58.156
                                  nam11.safelinks.eop-tm2.outlook.comUnited States
                                  8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                                  162.125.6.20
                                  unknownUnited States
                                  19679DROPBOXUSfalse
                                  52.109.89.19
                                  unknownUnited States
                                  8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                                  104.16.99.29
                                  unknownUnited States
                                  13335CLOUDFLARENETUSfalse
                                  52.113.194.132
                                  unknownUnited States
                                  8068MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                                  142.250.184.195
                                  unknownUnited States
                                  15169GOOGLEUSfalse
                                  142.250.186.35
                                  unknownUnited States
                                  15169GOOGLEUSfalse
                                  142.250.185.67
                                  unknownUnited States
                                  15169GOOGLEUSfalse
                                  1.1.1.1
                                  unknownAustralia
                                  13335CLOUDFLARENETUSfalse
                                  162.125.66.18
                                  www-env.dropbox-dns.comUnited States
                                  19679DROPBOXUSfalse
                                  216.58.212.132
                                  unknownUnited States
                                  15169GOOGLEUSfalse
                                  74.125.133.84
                                  unknownUnited States
                                  15169GOOGLEUSfalse
                                  13.89.179.11
                                  unknownUnited States
                                  8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                                  142.250.181.227
                                  unknownUnited States
                                  15169GOOGLEUSfalse
                                  64.233.167.84
                                  unknownUnited States
                                  15169GOOGLEUSfalse
                                  239.255.255.250
                                  unknownReserved
                                  unknownunknownfalse
                                  142.250.185.196
                                  www.google.comUnited States
                                  15169GOOGLEUSfalse
                                  142.250.185.174
                                  unknownUnited States
                                  15169GOOGLEUSfalse
                                  162.125.1.20
                                  d-edge.v.dropbox.comUnited States
                                  19679DROPBOXUSfalse
                                  184.28.90.27
                                  unknownUnited States
                                  16625AKAMAI-ASUSfalse
                                  35.157.212.223
                                  unknownUnited States
                                  16509AMAZON-02USfalse
                                  142.250.184.238
                                  play.google.comUnited States
                                  15169GOOGLEUSfalse
                                  143.204.95.12
                                  dropboxcaptcha.comUnited States
                                  16509AMAZON-02USfalse
                                  34.249.87.52
                                  c.ba.contentsquare.netUnited States
                                  16509AMAZON-02USfalse
                                  IP
                                  192.168.2.16
                                  192.168.2.7
                                  192.168.2.13
                                  Joe Sandbox version:42.0.0 Malachite
                                  Analysis ID:1587997
                                  Start date and time:2025-01-10 19:31:42 +01:00
                                  Joe Sandbox product:CloudBasic
                                  Overall analysis duration:
                                  Hypervisor based Inspection enabled:false
                                  Report type:full
                                  Cookbook file name:defaultwindowsinteractivecookbook.jbs
                                  Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                  Number of analysed new started processes analysed:15
                                  Number of new started drivers analysed:0
                                  Number of existing processes analysed:0
                                  Number of existing drivers analysed:0
                                  Number of injected processes analysed:0
                                  Technologies:
                                  • EGA enabled
                                  Analysis Mode:stream
                                  Analysis stop reason:Timeout
                                  Sample name:Message.eml
                                  Detection:MAL
                                  Classification:mal48.winEML@21/6@44/254
                                  Cookbook Comments:
                                  • Found application associated with file extension: .eml
                                  • Exclude process from analysis (whitelisted): dllhost.exe, SgrmBroker.exe, svchost.exe
                                  • Excluded IPs from analysis (whitelisted): 52.113.194.132, 52.109.89.19, 2.16.168.101, 2.16.168.119
                                  • Excluded domains from analysis (whitelisted): ecs.office.com, omex.cdn.office.net, fs.microsoft.com, weu-azsc-000.roaming.officeapps.live.com, prod.roaming1.live.com.akadns.net, s-0005-office.config.skype.com, eur.roaming1.live.com.akadns.net, ecs-office.s-0005.s-msedge.net, roaming.officeapps.live.com, osiprod-weu-buff-azsc-000.westeurope.cloudapp.azure.com, s-0005.s-msedge.net, ecs.office.trafficmanager.net, omex.cdn.office.net.akamaized.net, a1864.dscd.akamai.net
                                  • Not all processes where analyzed, report is missing behavior information
                                  • Report size getting too big, too many NtQueryAttributesFile calls found.
                                  • Report size getting too big, too many NtQueryValueKey calls found.
                                  • Report size getting too big, too many NtReadVirtualMemory calls found.
                                  • VT rate limit hit for: nam11.safelinks.eop-tm2.outlook.com
                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                  File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Jan 10 17:32:28 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                                  Category:dropped
                                  Size (bytes):2673
                                  Entropy (8bit):3.99162236594236
                                  Encrypted:false
                                  SSDEEP:
                                  MD5:8571E94EAFBE0F6B22C6C5FF8E0B5FDB
                                  SHA1:89278523759692A53FD67D83E84175F1B2EB491B
                                  SHA-256:BA4EAC7B391D094AE2CAF58187AB4AF6A7D76752EC3BF13F29AF7248FE6CC287
                                  SHA-512:F2B73833A2D0CCFB13BDD374F81756B35832E36CA65EB1A081C66CDBE9C41842F76D9186F57C7A47457D9B1F9CD4B851C7CD9A3943EA295810953189C241224D
                                  Malicious:false
                                  Reputation:unknown
                                  Preview:L..................F.@.. ...$+.,......g..c..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I*Z......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V*Z......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V*Z......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V*Z............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V*Z.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i....................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F
                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                  File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Jan 10 17:32:27 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                                  Category:dropped
                                  Size (bytes):2675
                                  Entropy (8bit):4.008280960403467
                                  Encrypted:false
                                  SSDEEP:
                                  MD5:EDFF7F74E7425A97EB127E2426B3AC8F
                                  SHA1:E9E033F45D93420F2A56E8778F737D3FEE535D82
                                  SHA-256:93A2899734467A79B30849FB5505C63C9B9C032FA40E683698EFEC2817DC70AC
                                  SHA-512:ED929459F6C9D532E345104888740C07A0BBDEB3F55B581223C2A307F47795E752FBE2400292D5417D5298A9D21D6DFE74E8E82573C9920C1C00B18EB229C98D
                                  Malicious:false
                                  Reputation:unknown
                                  Preview:L..................F.@.. ...$+.,......Y..c..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I*Z......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V*Z......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V*Z......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V*Z............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V*Z.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i....................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F
                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                  File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                                  Category:dropped
                                  Size (bytes):2689
                                  Entropy (8bit):4.019022382430834
                                  Encrypted:false
                                  SSDEEP:
                                  MD5:6E75F38131654351C300611450BE0D98
                                  SHA1:56E592B1CBD64A68C45B1B913EA7CB91FA8CFE2B
                                  SHA-256:FDED8A9522FD72EC05346987D9BE40239AD67197B33F3CFA19CFACB1B04321AC
                                  SHA-512:B687DF7CAED0D47F29A9B7D9526634135E0FF74F0FF01EFB8B6365F22C9A7C64E7550330CDCB91C6CFBBC0418DE0B9B2A74021481299A625A93ED9EA383DDED9
                                  Malicious:false
                                  Reputation:unknown
                                  Preview:L..................F.@.. ...$+.,.....Y.04...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I*Z......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V*Z......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V*Z......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V*Z............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VFW.E...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i....................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F
                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                  File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Jan 10 17:32:27 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                                  Category:dropped
                                  Size (bytes):2677
                                  Entropy (8bit):4.0041669460959035
                                  Encrypted:false
                                  SSDEEP:
                                  MD5:BF969B399AF400F4101B70256CFD5FFB
                                  SHA1:B81ED627BB4E9CF849B931699A3934D3BA5D477E
                                  SHA-256:6EAC870B07FC85E654ABDF30CD997A933200F0D342CEF4AFBF0F116F0FD41C6A
                                  SHA-512:C6B39C4A0793CEB0AC66AA31B9D60BAD505C52A49FE012BD8BCBC842CCBAC7C0FBFB0F367F13D144195ED8AC2FA063A586C4E5A6E5E22A3FEC7C4EFA18AB6B98
                                  Malicious:false
                                  Reputation:unknown
                                  Preview:L..................F.@.. ...$+.,.....7R..c..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I*Z......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V*Z......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V*Z......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V*Z............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V*Z.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i....................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F
                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                  File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Jan 10 17:32:28 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                                  Category:dropped
                                  Size (bytes):2677
                                  Entropy (8bit):3.9929765334426626
                                  Encrypted:false
                                  SSDEEP:
                                  MD5:186B4F41CC3B0E81D01B97961D18C1ED
                                  SHA1:467B6B96E644A825726D311009BF2CC534925975
                                  SHA-256:C08237F5A3579AC62FF69FCCD2C23819555ADC996E55AC7479AC2CB941561AE9
                                  SHA-512:13F806CE73D798C9010736426DAE7481846CBD17DD5270124854F618A317291688986D2A586D453719F31D3F3A38BF196FE0AC02C1387A1DB7703177CD0AE0E7
                                  Malicious:false
                                  Reputation:unknown
                                  Preview:L..................F.@.. ...$+.,.....h`..c..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I*Z......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V*Z......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V*Z......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V*Z............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V*Z.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i....................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F
                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                  File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Jan 10 17:32:27 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                                  Category:dropped
                                  Size (bytes):2679
                                  Entropy (8bit):4.004967513830108
                                  Encrypted:false
                                  SSDEEP:
                                  MD5:F301635F7DE58F7005C5FA61BD83BCE7
                                  SHA1:4782C6272C4CC9432F1A60B6C654DE9D2D51449B
                                  SHA-256:23F1D1C189A256D547DC8901A0E3D0998B02064E96939EB894443921DAA9851E
                                  SHA-512:CE070AE5A4BD6B212052A69C4E251DFE7EAC8D8E07CC6E1AA86DD741FBE83F9D8D5B3815432BD31FAFB46EA3599848F2E1C53BA4164C8287C1C340A81FD4E18A
                                  Malicious:false
                                  Reputation:unknown
                                  Preview:L..................F.@.. ...$+.,.....G..c..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I*Z......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V*Z......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V*Z......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V*Z............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V*Z.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i....................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F
                                  File type:Unicode text, UTF-8 (with BOM) text, with very long lines (397), with CRLF line terminators
                                  Entropy (8bit):5.978339683613671
                                  TrID:
                                  • Text - UTF-8 encoded (3003/1) 100.00%
                                  File name:Message.eml
                                  File size:20'565 bytes
                                  MD5:c3c65d26f5393a2c3237ab2b10ebc7cb
                                  SHA1:f6b30d1d7e4fcd73c94a0d42f20474861dd61003
                                  SHA256:f9dd41c9a75bed0f428b47614a386ce570a4fec20743079e5316004a0793fdcd
                                  SHA512:bfd10bc26ed6d7b8f893ebe58940904e0a8c1ca41150c755e8f7af11986700ff463dfe8a25e9ee6143c42da762dcca38f69a585e3b5eb6faa2660cfe00507929
                                  SSDEEP:192:YOFMmbEt5TJzE6Lrsdnz3+tuQbd7uHj5n5YelIYTQyTwrP2TKUiwFnEdKQT4kCER:tMmbEts7z3+Zh7usOISTRigCnC7Tf4
                                  TLSH:13927D41032948C965BA34ADB692AB82E3E31D4EE79394F1B4BE41239FCE44217377DD
                                  File Content Preview:..."Received: from IA0PR10MB7352.namprd10.prod.outlook.com (2603:10b6:208:40b::12).. by BYAPR10MB3703.namprd10.prod.outlook.com with HTTPS; Fri, 10 Jan 2025.. 16:52:42 +0000..Received: from CH2PR18CA0035.namprd18.prod.outlook.com (2603:10b6:610:55::15)..
                                  Subject:[External] Rachel Leheny shared "Scan_Reciept_01102025.pdf" with you
                                  From:"Rachel Leheny (via Dropbox)" <no-reply@dropbox.com>
                                  To:glay@biolegend.com
                                  Cc:
                                  BCC:
                                  Date:Fri, 10 Jan 2025 16:52:37 +0000
                                  Communications:
                                  • Caution: this message originated from outside the organization. [https://assets.dropbox.com/email/en/receiving-experience/folder.gif] Rachel Leheny (rachel.calcimedica@gmail.com) invited you to view the file "Scan_Reciept_01102025.pdf" on Dropbox. Open file<https://www.dropbox.com/l/scl/AACwmhVqeeBEY_BFL3aP_gtump8kxCNPLfc> Do more with your filesget the desktop and mobile apps. [https://assets.dropbox.com/email/en/receiving-experience/icon_gray_mobile.png]Dropbox for Mobile<https://www.dropbox.com/l/AAAUoB70bLos415hYoK6mvBJsFoFVTo_7B8/mobile>[https://assets.dropbox.com/email/en/receiving-experience/icon_gray_desktop.png]Dropbox for Desktop<https://www.dropbox.com/l/AAB2YirWVKzP0-fnweCTC-v1npjNQZWvNgI/install> Is there an issue? Report to Dropbox<https://www.dropbox.com/l/AABoXxqVSksO1LjuOLmcLrdByi4FPXzEoPE/report_abuse>
                                  Attachments:
                                    Key Value
                                    "Receivedfrom IA0PR10MB7352.namprd10.prod.outlook.com (2603:10b6:208:40b::12) by BYAPR10MB3703.namprd10.prod.outlook.com with HTTPS; Fri, 10 Jan 2025 16:52:42 +0000
                                    Receivedfrom a60-150.smtp-out.us-west-2.amazonses.com (54.240.60.150) by CH2PEPF0000013D.mail.protection.outlook.com (10.167.244.69) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.20.8335.7 via Frontend Transport; Fri, 10 Jan 2025 16:52:38 +0000
                                    Authentication-Resultsspf=pass (sender IP is 54.240.60.150) smtp.mailfrom=email.dropbox.com; dkim=pass (signature was verified) header.d=dropbox.com;dmarc=pass action=none header.from=dropbox.com;compauth=pass reason=100
                                    Received-SPFPass (protection.outlook.com: domain of email.dropbox.com designates 54.240.60.150 as permitted sender) receiver=protection.outlook.com; client-ip=54.240.60.150; helo=a60-150.smtp-out.us-west-2.amazonses.com; pr=C
                                    DKIM-Signaturev=1; a=rsa-sha256; q=dns/txt; c=relaxed/simple; s=7v7vs6w47njt4pimodk5mmttbegzsi6n; d=amazonses.com; t=1736527957; h=Content-Type:MIME-Version:From:To:CC:Subject:Date:Message-ID:Reply-To:Feedback-ID; bh=PT0cA53ZeTiAbc0Y+22FKTFGBrG9OjzW7RR41GlwRdE=; b=QazaO/KQ2WURSExPwAmxOAOf+xi6uQtdEePkjy9c2blTkc8q4+KTCtIJX0Ou1/M/ 5JWk8R9BwhCY3WJv6tfNwDS0vYa2xlZIX0CwnT5haLcoDWWikNJD4OIP2NBrC0/CGAY +kYQdqJ1xcSGWHFXxtnCULPVve2Ll/t5auBwIPUI=
                                    Content-Typemultipart/alternative; boundary="===============8321854954288470351=="
                                    From"Rachel Leheny (via Dropbox)" <no-reply@dropbox.com>
                                    Toglay@biolegend.com
                                    CC
                                    Subject[External] Rachel Leheny shared "Scan_Reciept_01102025.pdf" with you
                                    DateFri, 10 Jan 2025 16:52:37 +0000
                                    Message-ID<010101945121ce95-5f4f04ab-ca88-41d9-9f39-c274c2031aac-000000@us-west-2.amazonses.com>
                                    X-Dropbox-Message-ID10492165051103172506
                                    Reply-Torachel.calcimedica@gmail.com
                                    x-cid20004268
                                    Feedback-ID20004268::1.us-west-2.C1J9pRCK9rJULWC8wBKFbk8/mhlW6tSneJoML9ymcSA=:AmazonSES
                                    X-SES-Outgoing2025.01.10-54.240.60.150
                                    Return-Path010101945121ce95-5f4f04ab-ca88-41d9-9f39-c274c2031aac-000000@email.dropbox.com
                                    X-MS-Exchange-Organization-ExpirationStartTime10 Jan 2025 16:52:38.7533 (UTC)
                                    X-MS-Exchange-Organization-ExpirationStartTimeReasonOriginalSubmit
                                    X-MS-Exchange-Organization-ExpirationInterval1:00:00:00.0000000
                                    X-MS-Exchange-Organization-ExpirationIntervalReasonOriginalSubmit
                                    X-MS-Exchange-Organization-Network-Message-Id20a7438d-cde3-4729-02d8-08dd319730f3
                                    X-EOPAttributedMessage0
                                    X-EOPTenantAttributedMessagefa246a9e-8fe0-4eed-9eec-93652a25c4ee:0
                                    X-MS-Exchange-Organization-MessageDirectionalityIncoming
                                    X-MS-PublicTrafficTypeEmail
                                    X-MS-TrafficTypeDiagnosticCH2PEPF0000013D:EE_|IA0PR10MB7352:EE_|BYAPR10MB3703:EE_
                                    X-MS-Exchange-Organization-AuthSourceCH2PEPF0000013D.namprd02.prod.outlook.com
                                    X-MS-Exchange-Organization-AuthAsAnonymous
                                    X-MS-Office365-Filtering-Correlation-Id20a7438d-cde3-4729-02d8-08dd319730f3
                                    X-MS-Exchange-AtpMessagePropertiesSA|SL
                                    X-MS-Exchange-Organization-SCL1
                                    X-Microsoft-AntispamBCL:4;ARA:13230040|69100299015|1032899013|5062899012|32142699015|4092899012|5082899009|42003499006|13102899012|3092899012|13012899012|3072899012|2092899012|12012899012|2066899003|8096899003;
                                    X-Forefront-Antispam-ReportCIP:54.240.60.150;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:a60-150.smtp-out.us-west-2.amazonses.com;PTR:a60-150.smtp-out.us-west-2.amazonses.com;CAT:NONE;SFS:(13230040)(69100299015)(1032899013)(5062899012)(32142699015)(4092899012)(5082899009)(42003499006)(13102899012)(3092899012)(13012899012)(3072899012)(2092899012)(12012899012)(2066899003)(8096899003);DIR:INB;
                                    X-MS-Exchange-CrossTenant-OriginalArrivalTime10 Jan 2025 16:52:38.5658 (UTC)
                                    X-MS-Exchange-CrossTenant-Network-Message-Id20a7438d-cde3-4729-02d8-08dd319730f3
                                    X-MS-Exchange-CrossTenant-Idfa246a9e-8fe0-4eed-9eec-93652a25c4ee
                                    X-MS-Exchange-CrossTenant-AuthSourceCH2PEPF0000013D.namprd02.prod.outlook.com
                                    X-MS-Exchange-CrossTenant-AuthAsAnonymous
                                    X-MS-Exchange-CrossTenant-FromEntityHeaderInternet
                                    X-MS-Exchange-Transport-CrossTenantHeadersStampedIA0PR10MB7352
                                    X-MS-Exchange-Transport-EndToEndLatency00:00:04.3122596
                                    X-MS-Exchange-Processed-By-BccFoldering15.20.8335.010
                                    X-Microsoft-Antispam-Mailbox-Delivery ucf:0;jmr:0;auth:0;dest:I;ENG:(910001)(944506478)(944626604)(920097)(930097)(140003)(1420198);
                                    X-Microsoft-Antispam-Message-Info E5ugxh3SD7g5sNtL5NNMFth4ZZWlGyET4WXzLGgILGPuQFytXywbfa7Hvwx5Ml9ufZXT0RuU/LGa/inqcExuCBUOvrbjaTaEXYS1dHan/DIhpMS5WDNPjjYmhWHoJXhBaa037r3bUGIvdyEROK+sr35gCyJpo3SDM2sqiLZVowKlifD0HoA6aFIokEuCf5HPQr7C1JcfpZTWaWL0xsft4bg55I60ymo00bdTRqfJhe1cc265T12bHYG9tE3vqtNvTiO30eIiqmXjtlk6FeEqSwt5wNKdF4pxQWc3ccDnD70Rql5jv8WjwTxJSI2T1Pv+cjJ69tMdI2ndotTd1JO9cCrHt3rTA7KDF4KiFlpGZtIF7IpMecu9d89GI86qOi8pm72ODdoFaeRlFgdm6FrWHjlmmEspvZIDrOpszrFNs16e7ul+Lkqyu4UGVZj+yPcJDHz9PakP/YSl0Sbup6eyheyljOCE+Ynjp/EUt2KhAXLPYYRtMixTJg+tkQytE1oycK5Lnhqu1GeU/Vjawy3WC1tvDhPSluQ/YmmRm+Cz+A6ISFwUfEdNRwoXwDVkUBJrKlFjIQUkMYwCfVBgK9rD7ITJ9cBLl3N5r8rnpLfJOVxr84xfcWAxh3lZs4sDFPJ52firZxcC/4toPqgPUpKf0ZjcPe0CdsLukQJwTh2sdaAVlcUS2lj3lPoqbXUEcmFvEreI0RUNV2mIfqEtQ0Pz3B40j5bbd590rY8If8cv76xNSv4SBdYXXUqdDZMi+4hpINr3UfgHrQ09+8p0ESz205NKlaT2PCgPiRS0i14m6AprcQSpxIx08L4KBvHu+MG4YNDvMLqNhlfZZBo3JDUH21Femsq0TEs1hspb3bd5YYyFLGnvPBRMlxcxLj41Ld2MDESzHy3GwnyAt32FtgWv5eJY83mNttglF55raEzPge4afw+Lpi2qbMkYhMvneJiimRh+nAkvNhtuTBPLFSG++8kczKzZzTzL+O6su2LCY6WFdK6PcFXCDP8qCg/8nBqRRhFOz2B9gyd+TqTtAehfVqZEMxXj4WDQKhUB/JflTbtHlxBncnVOeSeqwvfbql7beVoqFsCoVpPEfKZriSeM/S8FGEak1UKnC5JfjkH0Jq/Oixq4UvKkQ4bda6etrqcDEGekGEQK20O3qoqfX41y0BXeegjJHwOagcbad3DqPNwBvuTedH8JuPgzxIMmzgGKBRvgW9pFYON9M/E8c79ODByaIlJUThSiUQX79pazS3NOgc6HsRGDgokgOTMYaqS+yG491+5/WYfIXPEVs0Q9dsztdfKnovrdW58wvGvmer9bAY4yU5l6ASlQnI9xqhww1/WBCeLpy04TbhjHTWevqnUfD5NY6OB9SK9c7wCqrKvhD+4CBEymkEYRHZv0IEWcoslPSDN2Ibedg5ZWYW1ereYIXCRm8AJaUJklbdZXWA2VrABX+z0rAs6f9ttjwOvWJUD6t3vOeFyvKNcceIkAINizDRiF2G7zJ1EPw9EK4c6Uv1F+PygJvW5jBJya6pj/mXks9G59m+4yRvWjyE4eB0tQCPqQAMybdGzvIi6ulQEKiZwkqYWW6nFdjZMmb4jFzdPYxf3TMNGUsmqdvnJ/3LDU51ZvXnWMPIgUPnJccrCeo3zNq0Hv6Cfj8wEpy0hSGmzGVZ6ytPv370CyX2onoTfz9u7WvWmvV3NeQnTmUXyOzNjfK48TUjVyro9+H4pWw2KbTSl3JoHDNnHPo36fdLrJWPnLsee6/LPK1DYQnHcXdQ+IJO47jZVrbaV1KXoeb5M6pkdnHgKrF5sfWVHIrmmcEzxdH3XMJME18R2dEStjpgvsTdgGBv+lOQLW0WlGezpu50zLXqIk7/0P5D46VllLMt2x/1oSxqdNve5tDHZc2wDL2CayNkzPum/fifTErNM+Fbno862oTmRsw9g16fPJWO8KwQufvULpBat3T1pu4mOhpkYuPR8RzBni+sVjnBSq7e0UL5n8dZFx9o27l6dTiQqxPOGBx4KADFwTslfot0KP7N3Vu9G+h8ZlFDw2pgCU3piWAgVQsjCBuh/5zPceHmsjtysSql+dDwS1M0c=
                                    MIME-Version1.0

                                    Icon Hash:46070c0a8e0c67d6