Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
phish_alert_iocp_v1.4.58.eml

Overview

General Information

Sample name:phish_alert_iocp_v1.4.58.eml
Analysis ID:1591061
MD5:a11a9a8b91e72ffc22ad0a6459c3a9bf
SHA1:3b57086b382ad4f216e5812d50b40e8de893f949
SHA256:ac27b0a384c304db3b8f142f55dbd4436d14488c9c3580be34ff5d9f17c6c5c7
Infos:

Detection

Score:52
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

AI detected suspicious Javascript
AI detected suspicious elements in Email content
AI detected suspicious elements in Email header
Queries the volume information (name, serial number etc) of a device
Sigma detected: Office Autorun Keys Modification
Sigma detected: Outlook Security Settings Updated - Registry
Stores files to the Windows start menu directory

Classification

Process Tree

  • System is w10x64_ra
  • OUTLOOK.EXE (PID: 6236 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\user\Desktop\phish_alert_iocp_v1.4.58.eml" MD5: 91A5292942864110ED734005B7E005C0)
    • ai.exe (PID: 6476 cmdline: "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "2A2CE53E-E8F9-4F3E-9396-5652480A7E55" "83222561-F2E2-4D54-AD0B-D0278C6A90CE" "6236" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx" MD5: EC652BEDD90E089D9406AFED89A8A8BD)
    • chrome.exe (PID: 6864 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\YG8ZBST6\Subscription_Renewal_Receipt_2025.htm MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)
      • chrome.exe (PID: 7116 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2004 --field-trial-handle=1996,i,9280952549708691234,896387258005253983,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)
  • cleanup

Yara Signatures

⊘No yara matches

Sigma Signatures

Sigma detected: Office Autorun Keys Modification
Source: Registry Key setAuthor: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 , EventID: 13, EventType: SetValue, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE, ProcessId: 6236, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Addins\OneNote.OutlookAddin\1
Sigma detected: Outlook Security Settings Updated - Registry
Source: Registry Key setAuthor: frack113: Data: Details: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\YG8ZBST6\, EventID: 13, EventType: SetValue, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE, ProcessId: 6236, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Security\OutlookSecureTempFolder

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Phishing

barindex
AI detected suspicious Javascript
Source: 0.0.id.script.csvJoe Sandbox AI: Detected suspicious JavaScript with source url: file:///C:/Users/user/AppData/Local/Microsoft/Wi... The script demonstrates a high-risk behavior by redirecting the user to an untrusted domain, which is a common tactic used in phishing and malware attacks. The use of a URL shortener or obfuscated domain further increases the suspicion. While the intent is not explicitly malicious, the redirection to an unknown domain poses a significant risk to the user's security and should be investigated further.
AI detected suspicious elements in Email content
Source: EmailJoe Sandbox AI: Detected potential phishing email: Sender domain 'subitoturbo.it' is suspicious and unrelated to Microsoft/Office 365. Subject line uses invoice number format typical of phishing attempts. Attachment has suspicious name pattern trying to appear as official receipt
AI detected suspicious elements in Email header
Source: EmailJoe Sandbox AI: Detected suspicious elements in Email header: Multiple authentication failures: SPF fail, DKIM fail, and DMARC fail. IP address 205.139.110.120 is not authorized to send for amazonses.com. Mismatched domains: Return-path shows amazonses.com but DKIM signature claims subitoturbo.it. Suspicious boundary string '00B0FEED_message_boundary' appears potentially crafted. While using Amazon SES infrastructure, the authentication failures suggest domain spoofing. Message is attempting to appear legitimate by using Amazon SES headers but fails all authentication checks. The combination of mixed domain usage and complete authentication failure is a strong indicator of malicious intent
Source: EmailClassification: Invoice Scam
Source: unknownHTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.17:49746 version: TLS 1.2
Source: unknownHTTPS traffic detected: 13.107.5.88:443 -> 192.168.2.17:49749 version: TLS 1.2
Source: chrome.exeMemory has grown: Private usage: 5MB later: 32MB
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownTCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknownTCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknownTCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknownTCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknownTCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknownTCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknownTCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownTCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknownTCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknownTCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknownTCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknownTCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknownTCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknownTCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknownTCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknownTCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknownTCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknownTCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknownTCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknownTCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknownTCP traffic detected without corresponding DNS query: 199.232.214.172
Source: unknownTCP traffic detected without corresponding DNS query: 199.232.214.172
Source: unknownTCP traffic detected without corresponding DNS query: 40.126.32.72
Source: unknownTCP traffic detected without corresponding DNS query: 40.126.32.72
Source: unknownTCP traffic detected without corresponding DNS query: 40.126.32.72
Source: unknownTCP traffic detected without corresponding DNS query: 13.107.5.88
Source: unknownTCP traffic detected without corresponding DNS query: 13.107.5.88
Source: unknownTCP traffic detected without corresponding DNS query: 13.107.5.88
Source: unknownTCP traffic detected without corresponding DNS query: 40.126.32.72
Source: unknownTCP traffic detected without corresponding DNS query: 40.126.32.72
Source: unknownTCP traffic detected without corresponding DNS query: 40.126.32.72
Source: unknownTCP traffic detected without corresponding DNS query: 13.107.5.88
Source: unknownTCP traffic detected without corresponding DNS query: 13.107.5.88
Source: unknownTCP traffic detected without corresponding DNS query: 13.107.5.88
Source: unknownTCP traffic detected without corresponding DNS query: 13.107.5.88
Source: global trafficDNS traffic detected: DNS query: f6p4fxqv.r.us-east-1.awstrack.me
Source: global trafficDNS traffic detected: DNS query: url.us.m.mimecastprotect.com
Source: global trafficDNS traffic detected: DNS query: www.google.com
Source: global trafficDNS traffic detected: DNS query: security-us.m.mimecastprotect.com
Source: unknownNetwork traffic detected: HTTP traffic on port 49733 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49744
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49743
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49742
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49741
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49740
Source: unknownNetwork traffic detected: HTTP traffic on port 49727 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49743 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49746 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49739
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49738
Source: unknownNetwork traffic detected: HTTP traffic on port 49736 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49737
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49736
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49735
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49734
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49733
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49732
Source: unknownNetwork traffic detected: HTTP traffic on port 49675 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49731
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49730
Source: unknownNetwork traffic detected: HTTP traffic on port 49732 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49724 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49742 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49728 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49749 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49729
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49728
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49727
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49726
Source: unknownNetwork traffic detected: HTTP traffic on port 49718 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49725
Source: unknownNetwork traffic detected: HTTP traffic on port 49735 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49724
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49723
Source: unknownNetwork traffic detected: HTTP traffic on port 49739 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49731 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49725 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49741 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49729 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49748 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49745 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49719 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49719
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49718
Source: unknownNetwork traffic detected: HTTP traffic on port 49751 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49680 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49738 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49734 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49730 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49751
Source: unknownNetwork traffic detected: HTTP traffic on port 49726 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49740 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49744 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49723 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49749
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49748
Source: unknownNetwork traffic detected: HTTP traffic on port 49737 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49746
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49745
Source: unknownHTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.17:49746 version: TLS 1.2
Source: unknownHTTPS traffic detected: 13.107.5.88:443 -> 192.168.2.17:49749 version: TLS 1.2
Source: classification engineClassification label: mal52.winEML@18/20@14/111
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEFile created: C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEFile created: C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20250114T1054420409-6236.etl
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEFile read: C:\Users\desktop.ini
Source: unknownProcess created: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\user\Desktop\phish_alert_iocp_v1.4.58.eml"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "2A2CE53E-E8F9-4F3E-9396-5652480A7E55" "83222561-F2E2-4D54-AD0B-D0278C6A90CE" "6236" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\YG8ZBST6\Subscription_Renewal_Receipt_2025.htm
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2004 --field-trial-handle=1996,i,9280952549708691234,896387258005253983,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "2A2CE53E-E8F9-4F3E-9396-5652480A7E55" "83222561-F2E2-4D54-AD0B-D0278C6A90CE" "6236" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\YG8ZBST6\Subscription_Renewal_Receipt_2025.htm
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2004 --field-trial-handle=1996,i,9280952549708691234,896387258005253983,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: apphelp.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: c2r64.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: userenv.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: msasn1.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: cryptsp.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: rsaenh.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: cryptbase.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: gpapi.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{F959DBBB-3867-41F2-8E5F-3B8BEFAA81B3}\InprocServer32
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEWindow found: window name: SysTabControl32
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Common
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEFile Volume queried: C:\Windows\SysWOW64 FullSizeInformation
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information queried: ProcessInformation
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeQueries volume information: C:\Program Files (x86)\Microsoft Office\root\Office16\AI\WordCombinedFloatieLreOnline.onnx VolumeInformation
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management Instrumentation21
Browser Extensions		1
Process Injection		1
Masquerading		OS Credential Dumping1
Process Discovery		Remote ServicesData from Local System2
Encrypted Channel		Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/Job1
DLL Side-Loading		1
DLL Side-Loading		1
Process Injection		LSASS Memory1
File and Directory Discovery		Remote Desktop ProtocolData from Removable Media1
Non-Application Layer Protocol		Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAt1
Registry Run Keys / Startup Folder		1
Registry Run Keys / Startup Folder		1
DLL Side-Loading		Security Account Manager13
System Information Discovery		SMB/Windows Admin SharesData from Network Shared Drive2
Application Layer Protocol		Automated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCronLogin Hook1
Extra Window Memory Injection		1
Extra Window Memory Injection		NTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput CaptureProtocol ImpersonationTraffic DuplicationData Destruction

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

⊘No Antivirus matches

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

NameIPActiveMaliciousAntivirus DetectionReputation
url.us.m.mimecastprotect.com
205.139.111.113
truefalse
    		high
    security-us.m.mimecastprotect.com
    		170.10.132.89
    		truefalse
      		high
      www.google.com
      		142.250.185.228
      		truefalse
        		high
        baconredirects-elb-1w79jy7i6g0wf-1154668140.us-east-1.elb.amazonaws.com
        		50.16.174.40
        		truefalse
          		high
          f6p4fxqv.r.us-east-1.awstrack.me
          		unknown
          		unknowntrue
            		unknown

            Contacted URLs

            NameMaliciousAntivirus DetectionReputation
            https://security-us.m.mimecastprotect.com/ttpwp/#/block?key=fRMHSX39Z8t6fgtT9PrSxII4-ulVWK950GyfRx3h7lYzJnbC972HfD_7l9AZXE-kNje2_t1mLRks_AJ3WgtF1ZlJxHuP8cm_SOtlMcCASobVRPWrt_s1g7zc8WiVCdIefalse
              		unknown

              World Map of Contacted IPs

              • No. of IPs < 25%
              • 25% < No. of IPs < 50%
              • 50% < No. of IPs < 75%
              • 75% < No. of IPs

              Public IPs

              IPDomainCountryFlagASNASN NameMalicious
              52.113.194.132
              		unknownUnited States
              		8068MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
              20.42.73.30
              		unknownUnited States
              		8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
              142.250.185.67
              		unknownUnited States
              		15169GOOGLEUSfalse
              142.250.185.228
              		www.google.comUnited States
              		15169GOOGLEUSfalse
              205.139.111.113
              		url.us.m.mimecastprotect.comUnited States
              		30031MIMECAST-USfalse
              52.109.89.119
              		unknownUnited States
              		8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
              170.10.132.89
              		security-us.m.mimecastprotect.comUnited States
              		30031MIMECAST-USfalse
              52.109.68.129
              		unknownUnited States
              		8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
              2.16.168.119
              		unknownEuropean Union
              		20940AKAMAI-ASN1EUfalse
              34.193.195.38
              		unknownUnited States
              		14618AMAZON-AESUSfalse
              239.255.255.250
              		unknownReserved
              		unknownunknownfalse
              52.109.28.46
              		unknownUnited States
              		8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
              142.250.185.195
              		unknownUnited States
              		15169GOOGLEUSfalse
              142.250.186.142
              		unknownUnited States
              		15169GOOGLEUSfalse
              170.10.128.89
              		unknownUnited States
              		30031MIMECAST-USfalse
              64.233.184.84
              		unknownUnited States
              		15169GOOGLEUSfalse
              50.16.174.40
              		baconredirects-elb-1w79jy7i6g0wf-1154668140.us-east-1.elb.amazonaws.comUnited States
              		14618AMAZON-AESUSfalse

              Private

              IP
              192.168.2.17

              General Information

              Joe Sandbox version:42.0.0 Malachite
              Analysis ID:1591061
              Start date and time:2025-01-14 16:54:12 +01:00
              Joe Sandbox product:CloudBasic
              Overall analysis duration:
              Hypervisor based Inspection enabled:false
              Report type:full
              Cookbook file name:defaultwindowsinteractivecookbook.jbs
              Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
              Number of analysed new started processes analysed:20
              Number of new started drivers analysed:0
              Number of existing processes analysed:0
              Number of existing drivers analysed:0
              Number of injected processes analysed:0
              Technologies:
              • EGA enabled
              Analysis Mode:stream
              Analysis stop reason:Timeout
              Sample name:phish_alert_iocp_v1.4.58.eml
              Detection:MAL
              Classification:mal52.winEML@18/20@14/111
              Cookbook Comments:
              • Found application associated with file extension: .eml

              Warnings

              • Exclude process from analysis (whitelisted): dllhost.exe
              • Excluded IPs from analysis (whitelisted): 52.109.28.46, 52.113.194.132, 52.109.68.129, 2.16.168.119, 2.16.168.101
              • Excluded domains from analysis (whitelisted): ecs.office.com, omex.cdn.office.net, prod.configsvc1.live.com.akadns.net, osiprod-frc-buff-azsc-000.francecentral.cloudapp.azure.com, ctldl.windowsupdate.com, prod.roaming1.live.com.akadns.net, s-0005-office.config.skype.com, eur.roaming1.live.com.akadns.net, ecs-office.s-0005.s-msedge.net, roaming.officeapps.live.com, s-0005.s-msedge.net, config.officeapps.live.com, frc-azsc-000.roaming.officeapps.live.com, officeclient.microsoft.com, ecs.office.trafficmanager.net, omex.cdn.office.net.akamaized.net, europe.configsvc1.live.com.akadns.net, uks-azsc-config.officeapps.live.com, a1864.dscd.akamai.net
              • Not all processes where analyzed, report is missing behavior information
              • Report size getting too big, too many NtQueryAttributesFile calls found.
              • Report size getting too big, too many NtQueryValueKey calls found.
              • Report size getting too big, too many NtSetValueKey calls found.
              • VT rate limit hit for: f6p4fxqv.r.us-east-1.awstrack.me

              Created / dropped Files

              C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20250114T1054420409-6236.etl

              Download File
              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
              File Type:data
              Category:modified
              Size (bytes):102400
              Entropy (8bit):4.4687036487874545
              Encrypted:false
              SSDEEP:
              MD5:577C11098B2F01A855262D4540E12B7D
              SHA1:F7AAE6DB74BD9D1609DDA12774E5FCA1240D8E58
              SHA-256:397873DCB99C2A3FD7FBF92B1B2966431228302B497427B94416A4A021DD5E06
              SHA-512:87CA22783BFE301E8FC5701BAA09BB31CCCB9EC2E8E2443D6EA0762D999F296A9506AAC60E46C117F01291C8FADF6EB6860F83DA244C0259C3F5BA4C74732A66
              Malicious:false
              Reputation:unknown
              Preview:............................................................................d...`...\...[....f..................eJ..............Zb..2...................................,...@.t.z.r.e.s...d.l.l.,.-.1.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.1.1.1...........................................................P.w..Y..........[....f..........v.2._.O.U.T.L.O.O.K.:.1.8.5.c.:.e.e.2.f.1.0.f.d.7.7.0.8.4.0.5.5.b.c.0.0.3.4.2.4.4.1.2.7.9.9.2.0...C.:.\.U.s.e.r.s.\.t.o.r.r.e.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.O.u.t.l.o.o.k. .L.o.g.g.i.n.g.\.O.U.T.L.O.O.K._.1.6._.0._.1.6.8.2.7._.2.0.1.3.0.-.2.0.2.5.0.1.1.4.T.1.0.5.4.4.2.0.4.0.9.-.6.2.3.6...e.t.l...........P.P.`...\...[....f..................................................................................................................................................................................................................................................................................................

              C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

              Download File
              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
              File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Jan 14 14:55:01 2025, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
              Category:dropped
              Size (bytes):2677
              Entropy (8bit):3.9900082376289148
              Encrypted:false
              SSDEEP:
              MD5:130F06502F05635687895B83214DCBA1
              SHA1:23442F1D9847BB1307C586254C495C5D8E282595
              SHA-256:6F116FF0736310C23FCC27DA3858EBFD3B4043F23AE5CE128D5BFA1710643AAD
              SHA-512:DDD962ECC888BE737B8917734DC8D68B0B635C9FCAF3E8FA391885A5FFEA4B97E4F02FF5ACB3E6387F3B26E23C2DDA205FAAF419ACB72DAA526A4931495E129B
              Malicious:false
              Reputation:unknown
              Preview:L..................F.@.. ...$+.,.....SX..f......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.I.Z.~....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Z.~....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.V.Z.~....M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.V.Z.~...........................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V.Z.~...........................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............[s#.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

              C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

              Download File
              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
              File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Jan 14 14:55:01 2025, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
              Category:dropped
              Size (bytes):2679
              Entropy (8bit):4.002951584893912
              Encrypted:false
              SSDEEP:
              MD5:797BDB02A3F78C5E5B29F763D041C42B
              SHA1:784BFF3C6BDB6B8A3EFBBE18CF03C8D3D1C59584
              SHA-256:C119D246E6658CDC8AC1C831E7579D46E21C87F7B6E65EA7A8BFC4096B19E849
              SHA-512:529CC1DCBC36E08EDE2418C5F72D79B8304E998574FBC35B63D29C7C75A46375960A9251F84E923E656B1F68825B3BA0C4E303A97CED41AD4E7454C560F4C333
              Malicious:false
              Reputation:unknown
              Preview:L..................F.@.. ...$+.,.....L-..f......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.I.Z.~....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Z.~....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.V.Z.~....M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.V.Z.~...........................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V.Z.~...........................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............[s#.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

              C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

              Download File
              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
              File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:54:41 2023, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
              Category:dropped
              Size (bytes):2693
              Entropy (8bit):4.016707748002485
              Encrypted:false
              SSDEEP:
              MD5:8F2FDEC118E4ECB148A379F865318C4E
              SHA1:9918285F75FB916BC4F2F739182AA674E8249467
              SHA-256:A5B8370EE9EBFDEABC27CDF416089A20836F2524AA2BDE77E90380DFB6103BA1
              SHA-512:48B2C029C7082D88FA379C7A89EFCFB067AC51B21513983FB9CA62F3F69D3CEE0B81CAA665033310CB74D76FBB299B1ABA1A9570781672FB32160ABABDD02ED5
              Malicious:false
              Reputation:unknown
              Preview:L..................F.@.. ...$+.,.....v. ;.......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.I.Z.~....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Z.~....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.V.Z.~....M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.V.Z.~...........................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.VFW.N...........................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............[s#.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

              C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

              Download File
              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
              File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Jan 14 14:55:00 2025, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
              Category:dropped
              Size (bytes):2681
              Entropy (8bit):4.003454479245118
              Encrypted:false
              SSDEEP:
              MD5:B375E5375024C9511CA4A96460F5465F
              SHA1:254FAFEA22843925F6F747E669A7D7BA9D2422F1
              SHA-256:E81EF30F1A4E5FB9BF2237819DCB03B604AC2ACAE261FA663995A37A5DA948BA
              SHA-512:DCE245C53BEB7211950B55D90F817DE1CD5DE2D375240027343698CD7EAD4034ABE1A5409B665C5D2147DA21C208081D17EFFB5A0CDF946FDAA7981970A2A48E
              Malicious:false
              Reputation:unknown
              Preview:L..................F.@.. ...$+.,.....X'..f......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.I.Z.~....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Z.~....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.V.Z.~....M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.V.Z.~...........................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V.Z.~...........................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............[s#.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

              C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

              Download File
              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
              File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Jan 14 14:55:01 2025, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
              Category:dropped
              Size (bytes):2681
              Entropy (8bit):3.9902700203033
              Encrypted:false
              SSDEEP:
              MD5:4A309C5FF9A035A7A672D96F94174D97
              SHA1:FA2D77CD4A8996A4EBE5B489DE12196343F4CEB8
              SHA-256:DEFF0C208960C7CF42DE366112C517DE955889C6DE6F57B3C43B9C326788E3C6
              SHA-512:1D44178486B2719F6B9C01BA18A74AE95B1E474276831651F865E143072EE319DAF8668042C8B700A0C5DD64254B49F5D74AD43EDF8449C502748EFEF956A1BA
              Malicious:false
              Reputation:unknown
              Preview:L..................F.@.. ...$+.,....A.C..f......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.I.Z.~....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Z.~....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.V.Z.~....M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.V.Z.~...........................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V.Z.~...........................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............[s#.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

              C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

              Download File
              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
              File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Jan 14 14:55:00 2025, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
              Category:dropped
              Size (bytes):2683
              Entropy (8bit):4.004912089866997
              Encrypted:false
              SSDEEP:
              MD5:13A9A876ED812F5296503A7C9BC68602
              SHA1:4E75C147C57ECA80AED79631C1179DC529B56266
              SHA-256:143621ED5332E38B96043C0B0B33413795DCEA8504FB6AF57A71100A680889FA
              SHA-512:95F59A3F632A5C723765662031E69F0A11109761876B6A4AAF431ADF4DDCEB4885DE4C16F9391EA16F1A76CD862442E8306E6BA48B0A6E7F98DF0E668856E3BD
              Malicious:false
              Reputation:unknown
              Preview:L..................F.@.. ...$+.,.........f......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.I.Z.~....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Z.~....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.V.Z.~....M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.V.Z.~...........................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V.Z.~...........................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............[s#.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

              C:\Users\user\Documents\Outlook Files\Outlook Data File - NoEmail.pst

              Download File
              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
              File Type:Microsoft Outlook email folder (>=2003)
              Category:dropped
              Size (bytes):271360
              Entropy (8bit):2.613198068646672
              Encrypted:false
              SSDEEP:
              MD5:69F40DB1370671B11240EC865887C7C1
              SHA1:E5C34CF9B8DF0B9D71BACA68EFD77AF3805EA67A
              SHA-256:722CEF5A99EFB8226C10372C11EB404A10627676DEC20C17323F435727D7D962
              SHA-512:AC677BE9139AE7CDC9D47805BD70548B7673802FC4017A15B211034CCDD824059FBC1221603F693AAD11ACA58100999F8195898C7DE89ADCBA06D487D85D89ED
              Malicious:true
              Reputation:unknown
              Preview:!BDNWv`.SM......\.......@U......[.......a................@...........@...@...................................@...........................................................................$.......D.......T..............K...............Y...........................................................................................................................................................................................................................................................................................H.......,..}8H......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

              C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp

              Download File
              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
              File Type:data
              Category:dropped
              Size (bytes):131072
              Entropy (8bit):3.029034354083107
              Encrypted:false
              SSDEEP:
              MD5:0B042B81A747FD7C736201209B39C069
              SHA1:6D286B3661AD9803BE270F2F98635799CE587A02
              SHA-256:C2F055453D33F69843E152983BC9B9C7EB2C1490EF4537B56557AB9F13D3FCBF
              SHA-512:061ABC0B675273743CB6062B2CF2F5888D4381DBA7B67AC697859C6BA1AB23DBB29B673ED0A81B0126A528B85ACDCEAE8AE83092661457C8FAF80B8FF136DEA3
              Malicious:true
              Reputation:unknown
              Preview:.w.E0...d.......\.......f.......B............#...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................[G....[........p..C...e.......\.......f....................#.!BDNWv`.SM......\.......@U......[.......a................@...........@...@...................................@...........................................................................$.......D.......T..............K...............Y...............................................................................................................................................................

              Chrome Cache Entry: 101

              Download File
              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
              File Type:ASCII text, with very long lines (65536), with no line terminators
              Category:downloaded
              Size (bytes):410447
              Entropy (8bit):4.969948893141297
              Encrypted:false
              SSDEEP:
              MD5:0AF2F9447CC29B13B5986BB0B2DF1201
              SHA1:18A26C55CB12A8CB5A40738D63EBBADFF9C9E157
              SHA-256:DD23B2D3B699647A55640F98703B96CF76473C19969E11AB05653DBDF5ABCE0C
              SHA-512:2FBAED69A7952BF59AA5EBD987A736AB90F1C1E1547886C8634768EEC6CFB02D0A733ECFC2F0935DC2E7A44D87071044EEC39F2005D1EBBC0F97B6BCC8486B8C
              Malicious:false
              Reputation:unknown
              URL:https://security-us.m.mimecastprotect.com/ttpwp/resources/styles.5257ca6e429949972959.js
              Preview:(window.webpackJsonp=window.webpackJsonp||[]).push([[4],{3:function(n,e,o){n.exports=o("lEuh")},JPst:function(n,e,o){"use strict";n.exports=function(n){var e=[];return e.toString=function(){return this.map(function(e){var o=n(e);return e[2]?"@media ".concat(e[2]," {").concat(o,"}"):o}).join("")},e.i=function(n,o,t){"string"==typeof n&&(n=[[null,n,""]]);var a={};if(t)for(var r=0;r<this.length;r++){var c=this[r][0];null!=c&&(a[c]=!0)}for(var l=0;l<n.length;l++){var i=[].concat(n[l]);t&&a[i[0]]||(o&&(i[2]=i[2]?"".concat(o," and ").concat(i[2]):o),e.push(i))}},e}},LboF:function(n,e,o){"use strict";var t,a=function(){var n={};return function(e){if(void 0===n[e]){var o=document.querySelector(e);if(window.HTMLIFrameElement&&o instanceof window.HTMLIFrameElement)try{o=o.contentDocument.head}catch(t){o=null}n[e]=o}return n[e]}}(),r=[];function c(n){for(var e=-1,o=0;o<r.length;o++)if(r[o].identifier===n){e=o;break}return e}function l(n,e){for(var o={},t=[],a=0;a<n.length;a++){var l=n[a],i=e.base

              Chrome Cache Entry: 104

              Download File
              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
              File Type:HTML document, ASCII text, with very long lines (2088)
              Category:downloaded
              Size (bytes):3447
              Entropy (8bit):5.385539600942633
              Encrypted:false
              SSDEEP:
              MD5:C286C6FD6BFE7C3FAF59157B7AA0FD39
              SHA1:25D2FF78EB12EF3DB2A3907E8D2CE39C1C5505D9
              SHA-256:1062224668A272A46FF501E338702C675FF7EF413009FF3FA8E5D42BA37A90C4
              SHA-512:55F60ECBE7A0CDC251D8291F9EA40E55CE8B5C0845D1A49476926E1C711882CEF897414C860E95DE43E27282232CC57727203C8F6E5F029D4163BECACD81BB4F
              Malicious:false
              Reputation:unknown
              URL:https://security-us.m.mimecastprotect.com/ttpwp
              Preview:<!doctype html>.<html lang="en">.<head>. <meta charset="utf-8">. <meta http-equiv="X-UA-Compatible" content="IE=edge">. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=no, maximum-scale=1, minimum-scale=1">. <title>Mimecast TTP Web Portal</title>. <meta name="apple-mobile-web-app-capable" content="yes">. [if lte IE 10]> <link rel="icon" href="/ttpwp/resources/images/favicon.ico" /> <![endif]-->. <link rel="shortcut icon" href="/ttpwp/resources/images/favicon.ico" />. <link rel="apple-touch-icon" sizes="152x152" href="/ttpwp/resources/images/favicon-mobile.png" />. <link rel="apple-touch-icon-precomposed" sizes="152x152" href="/ttpwp/resources/images/favicon-mobile.png" />. . . <script>window.mimecast = {"branding":{"defaultBranding":{"defaultConfiguration":{"knowledgeBase":{"href":"https://community.mimecast.com/docs/DOC-241","label":"LOGIN_HOME_LNK"},"home":{"href":"http://www.mimec

              Chrome Cache Entry: 86

              Download File
              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
              File Type:Web Open Font Format (Version 2), TrueType, length 37608, version 1.0
              Category:downloaded
              Size (bytes):37608
              Entropy (8bit):7.9930739048349935
              Encrypted:true
              SSDEEP:
              MD5:E5231978386520AFD0019A8F5D007882
              SHA1:5E06725A18323ED9372E3E488D4F6DF1A56B3091
              SHA-256:71BF29B23EAACC10ACE4DB7E3711FD8F16F199F8F5F8FF5895A0BB0C13546509
              SHA-512:D5EEE91E55BFE7FB220705545D6E767C1A969F4E313F1991C220F4EAA05A7ABC83EE9E6B804D1DF90C1779591F587E1FD58230E120CDA529F8C98BC337E4D3D3
              Malicious:false
              Reputation:unknown
              URL:https://security-us.m.mimecastprotect.com/ttpwp/resources/mimecast-icons.bb1a2cd16db9345fc437.woff2?25417273
              Preview:wOF2............../..............................T.V..N...x..S..~..6.$..x. ..2..U.C..T'.a..!..*.{.1...l.$......|...(.U...=A.1...PkY..N..*..t.+P`..Kp.:n......p......~.......-....`;D.vu.p.N.t......]u....m....Hln..a.x..N.gl...'[`..V..L{.....f.9.l..sw7....M.....B..n.M.6.....z..(...)..}>...... .A.KG}.Q...Z.....G.w\K........a..,.F...3....Z.i)-..<l.eEu.eY.e6..66].VY.5.n.....\_..W....J.ARC.{....u...r.H-...x.A-j.z........?...0..K..EU...v...YC..y.?J.{.._..L60.R..%...X...j..B]E..U.w.?.....J....dD..9.'.r....o.....X.l.^@>...wj?w.7S<G3ch..%..2Hr....&.....K..Q..l;.......f..O2$..}H K......s...~.m..t|..+.........'..,S...H{@.X.S.E....p.g..|.{E....Vi7...u.:K...r.3s~.....d..........(tC.......D....f....higI..9.q...Y.....J.F.....X...2c./......dM.K........1....&.. L.A,I....gL....2.i.Rd.8.h.0w....=.@.b.Q..@AP.}K?.$.....k..."...D..5....#...3r.eY@(p.........&....\...@..q..1......F k<....=....9G.f*..........y..N..[..._5.....U.@..|}..u.k2..7...).#y.................d..B

              Chrome Cache Entry: 87

              Download File
              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
              File Type:ASCII text, with very long lines (1492), with no line terminators
              Category:dropped
              Size (bytes):1492
              Entropy (8bit):5.1504605464747675
              Encrypted:false
              SSDEEP:
              MD5:3AD4DE7EFFAAC3D0048EF54F8491451F
              SHA1:B807DD524C22B9F6241B1EF14AD6902D5C9D9215
              SHA-256:6C36E59711DF161A3D7A2D6FB3E5C17A8767A2F42AEADD9BF166830FDB8ACD5E
              SHA-512:B605EE47C436722BD21C501299EE1A6D96CC34D582003D6DD539AEE7A91E4EC78BFB6194E2226179627A5152DE16A7ADA2462BA5856F1FAF2647A65D24AB9CBE
              Malicious:false
              Reputation:unknown
              Preview:!function(e){function r(r){for(var n,l,p=r[0],f=r[1],i=r[2],c=0,s=[];c<p.length;c++)l=p[c],Object.prototype.hasOwnProperty.call(o,l)&&o[l]&&s.push(o[l][0]),o[l]=0;for(n in f)Object.prototype.hasOwnProperty.call(f,n)&&(e[n]=f[n]);for(a&&a(r);s.length;)s.shift()();return u.push.apply(u,i||[]),t()}function t(){for(var e,r=0;r<u.length;r++){for(var t=u[r],n=!0,p=1;p<t.length;p++)0!==o[t[p]]&&(n=!1);n&&(u.splice(r--,1),e=l(l.s=t[0]))}return e}var n={},o={0:0},u=[];function l(r){if(n[r])return n[r].exports;var t=n[r]={i:r,l:!1,exports:{}};return e[r].call(t.exports,t,t.exports,l),t.l=!0,t.exports}l.m=e,l.c=n,l.d=function(e,r,t){l.o(e,r)||Object.defineProperty(e,r,{enumerable:!0,get:t})},l.r=function(e){"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(e,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(e,"__esModule",{value:!0})},l.t=function(e,r){if(1&r&&(e=l(e)),8&r)return e;if(4&r&&"object"==typeof e&&e&&e.__esModule)return e;var t=Object.create(null);if(l.r(t

              Chrome Cache Entry: 91

              Download File
              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
              File Type:ASCII text, with very long lines (65536), with no line terminators
              Category:downloaded
              Size (bytes):95292
              Entropy (8bit):5.328593318442354
              Encrypted:false
              SSDEEP:
              MD5:A792F7BBECA0147C515D7ECAA5479B83
              SHA1:B6B6AB4BA9403B8934E36EF587C612F86180D18B
              SHA-256:FA9682F24595628BABEF9DAC52F38DCB373C4EBA5E555339CC0666B67EEADDAE
              SHA-512:0A2968A420037FB82EB1B8153F687E686DB8A3DCA21EC759ACCEFE3D3C07ED84B045407B36440EFE38F1B0C20655B8389338EE6A286A882D236E74BCD53181FE
              Malicious:false
              Reputation:unknown
              URL:https://security-us.m.mimecastprotect.com/ttpwp/resources/polyfills.5257ca6e429949972959.js
              Preview:(window.webpackJsonp=window.webpackJsonp||[]).push([[2],{"0TWp":function(e,t,n){"use strict";var r,i,o=this&&this.__spreadArray||function(e,t,n){if(n||2===arguments.length)for(var r,i=0,o=t.length;i<o;i++)!r&&i in t||(r||(r=Array.prototype.slice.call(t,0,i)),r[i]=t[i]);return e.concat(r||Array.prototype.slice.call(t))};void 0===(i="function"==typeof(r=function(){!function(e){var t=e.performance;function n(e){t&&t.mark&&t.mark(e)}function r(e,n){t&&t.measure&&t.measure(e,n)}n("Zone");var i=e.__Zone_symbol_prefix||"__zone_symbol__";function o(e){return i+e}var a=!0===e[o("forceDuplicateZoneCheck")];if(e.Zone){if(a||"function"!=typeof e.Zone.__symbol__)throw new Error("Zone already loaded.");return e.Zone}var s=function(){function t(e,t){this._parent=e,this._name=t?t.name||"unnamed":"<root>",this._properties=t&&t.properties||{},this._zoneDelegate=new l(this,this._parent&&this._parent._zoneDelegate,t)}return t.assertZonePatched=function(){if(e.Promise!==R.ZoneAwarePromise)throw new Error("

              Chrome Cache Entry: 93

              Download File
              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
              File Type:MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
              Category:dropped
              Size (bytes):1150
              Entropy (8bit):3.28732561467651
              Encrypted:false
              SSDEEP:
              MD5:44385673EEF386EC121603CD302FD05F
              SHA1:C15A6D61054FFB16D8DF4DA943B545349FC82631
              SHA-256:069E8A1E31ABA074CC28BC9D6D54C67495BD42A02115DC232BE7C8D9F83E40A8
              SHA-512:E80C43BE006B5EEB66F98192B177163E92B75A5CD0AAA880ADE24A67DB7A1F29A0CB958B158244DB47386CDC775DD025E0FC1F97E3D7ADCDDB76D347F3073DA7
              Malicious:false
              Reputation:unknown
              Preview:............ .h.......(....... ..... .........................................................................................................|kW.|kW.................................................|kW.|kW.|kW.|kW.|kW.|kW.....|kW.|kW2............................|kW.|kW.|kW.|kW.|kW.|kW.....|kW.|kW.|kWX....................|kW.|kW.|kW.........|kW.|kW.|kW.|kW.|kW.|kW.|kW<................|kWm|kW.|kW.........|kW.|kW.|kWg|kW.|kW.|kW.|kW.|kW.................|kW.|kW.|kW.|kW.|kW.|kWn....|kW.|kW.|kW.|kW.|kWr....................|kWn|kW.|kW.|kWU........|kW.|kW.|kW.|kW.|kW.|kW.....................|kW||kWe............|kW.|kW.|kW.|kW.|kW.|kW=....................|kW.|kWa|kW.|kW.|kW.|kW{|kW.|kW.|kW}|kW.|kW.................|kW)|kW.|kW.|kW.|kW.|kW.|kW`............|kWy|kW.................|kWW|kW.|kW.|kW.|kW.|kW.|kW`............|kWN|kW.................|kW`|kW.|kW.|kW.|kW.|kW.|kW`|kW.|kWb|kW.|kW.|kW.................|kW.|kW&|kWS|kW.|kW.|kW.|kW.|kW.|kW.|kW~|kW@|kW ................................|kW.|kW.|kW.|k

              Chrome Cache Entry: 94

              Download File
              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
              File Type:JSON data
              Category:downloaded
              Size (bytes):17152
              Entropy (8bit):5.391244405499397
              Encrypted:false
              SSDEEP:
              MD5:BEC66575E1C280E5041EFB0665141845
              SHA1:42893859EA2DE523193BD7CBD4173E52E9B402C1
              SHA-256:0367BF9BDDF7F8747008FA412393A70E505BBFB63A0F6CEF23D319EE932B786A
              SHA-512:4CC37916CC3757F86895A707A13CE9290C49A4A968E3AD056D23590D2B405EFB73668BF54BAA60BC750C59526A71E73EF4C534FA321B83D8141F2D1BA27C0E17
              Malicious:false
              Reputation:unknown
              URL:https://security-us.m.mimecastprotect.com/ttpwp/resources/languages/en.json
              Preview:{"DECISION_WILL_BE_LOGGED":"Your decision will be logged for tracking and audit purposes.","IN_PRIVATE_BROWSER_MODE_WARNING":"Please leave {{browser}} to complete device enrollment.","IN_PRIVATE_CHROME":"Incognito mode","IN_PRIVATE_FIREFOX":"Private Browsing","IN_PRIVATE_SAFARI":"Private Browsing","IN_PRIVATE_IE":"InPrivate mode","COMPATIBILITY_VIEW":"Compatibility View","IN_PRIVATE_EDGE":"InPrivate mode","DISABLED_COOKIE_ERROR":"<strong>Cookies are required.</strong> To continue, please allow cookies in your browser and try again.","ACCESS_DENIED_MESSAGE_COMPONENT":{"TITLE":"Sorry, you don.t have permission to access this page","DESCRIPTION":"If you need access, please contact your administrator.","LINK_1":"Go to the login page"},"$I18N_ACCOUNT_SWITCH_BAR":{"VIEWING_ACCOUNT":"Viewing account"},"$I18N_ASIDE_RECIPIENTS":{"SEARCH_PLACEHOLDER":"Search recipients","COLUMNS":{"EMAIL":"Recipients","STATUS":"Message Status"},"STATUS":{"DELIVERY":"Pending Delivery","DELIVERED":"Delivered","H

              Chrome Cache Entry: 95

              Download File
              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
              File Type:HTML document, ASCII text
              Category:dropped
              Size (bytes):180
              Entropy (8bit):4.755948041571961
              Encrypted:false
              SSDEEP:
              MD5:B574A8D3BC4C6A4FE57E89008E9645A3
              SHA1:471EBF49ADD18D605FD24F188DD460F165DDEF45
              SHA-256:3237A8FE51F94BBF3E3E38E4A8E0DC1A643F5DFB5C49D265A8B456CD646D6FCC
              SHA-512:011CB4A90C3B5A4D467B8765A51121CC2AAE9F5C1B570DC82D73D3B12B32F63928F6BD9BE96C5410212392A13DA287154D729A1E0D21AF3E13CCB07F2DD11224
              Malicious:false
              Reputation:unknown
              Preview:<!DOCTYPE html>.<html>.<head>. <title></title>.</head>.<body>.<h1>Error 404</h1>.<h2>Sorry, page not found.</h2>.<p>We could not find the page you requested.</p>.</body>.</html>

              Chrome Cache Entry: 96

              Download File
              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
              File Type:ASCII text, with very long lines (65536), with no line terminators
              Category:dropped
              Size (bytes):1042084
              Entropy (8bit):5.585805715375964
              Encrypted:false
              SSDEEP:
              MD5:5F0D3A7E853059D6E1BF72263336A1B6
              SHA1:1D2860B87C7C0DFBC8A4BB72733BFA811108826D
              SHA-256:C1C6725B64EE8DDB255DE008BDFFB528CB91B10DE40B67737E0B6DD9C47C6096
              SHA-512:2C56B00157F0C55DA7DCEE2319799C01C4F21F3E88A6A5CB9BBF168A86B89C525CF45ACAC4267DDB0E41F6F77BF4F0FD2CDB9909D245E927F428BAD8581D213D
              Malicious:false
              Reputation:unknown
              Preview:(window.webpackJsonp=window.webpackJsonp||[]).push([[1],{"+br3":function(e,t,n){!function(e){"use strict";e.defineLocale("eu",{months:"urtarrila_otsaila_martxoa_apirila_maiatza_ekaina_uztaila_abuztua_iraila_urria_azaroa_abendua".split("_"),monthsShort:"urt._ots._mar._api._mai._eka._uzt._abu._ira._urr._aza._abe.".split("_"),monthsParseExact:!0,weekdays:"igandea_astelehena_asteartea_asteazkena_osteguna_ostirala_larunbata".split("_"),weekdaysShort:"ig._al._ar._az._og._ol._lr.".split("_"),weekdaysMin:"ig_al_ar_az_og_ol_lr".split("_"),weekdaysParseExact:!0,longDateFormat:{LT:"HH:mm",LTS:"HH:mm:ss",L:"YYYY-MM-DD",LL:"YYYY[ko] MMMM[ren] D[a]",LLL:"YYYY[ko] MMMM[ren] D[a] HH:mm",LLLL:"dddd, YYYY[ko] MMMM[ren] D[a] HH:mm",l:"YYYY-M-D",ll:"YYYY[ko] MMM D[a]",lll:"YYYY[ko] MMM D[a] HH:mm",llll:"ddd, YYYY[ko] MMM D[a] HH:mm"},calendar:{sameDay:"[gaur] LT[etan]",nextDay:"[bihar] LT[etan]",nextWeek:"dddd LT[etan]",lastDay:"[atzo] LT[etan]",lastWeek:"[aurreko] dddd LT[etan]",sameElse:"L"},relativeTim

              Chrome Cache Entry: 98

              Download File
              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
              File Type:Web Open Font Format (Version 2), TrueType, length 137104, version 331.-31196
              Category:downloaded
              Size (bytes):137104
              Entropy (8bit):7.998265825794848
              Encrypted:true
              SSDEEP:
              MD5:DBF1FC91F1BEEC2915123257EA4D58EF
              SHA1:D2A6D5D31334F6D0831F1C17D26E23FE0AA6A8DB
              SHA-256:8D4D29042C23B5FCBED3AF690421776DE0F8AD3D308D66E24A9D80BCC8CCB522
              SHA-512:72E9CCB5CE2D88AAC739B513B95DFB7667CF80B617510AAFEB2C72345C7CDC3459B7002C4A46AFD967AFC1E3CAB091E078EA9CB6437550B4C7990009799128A2
              Malicious:false
              Reputation:unknown
              URL:https://security-us.m.mimecastprotect.com/ttpwp/resources/fa-solid-900.54dfc8f551be346014e4.woff2
              Preview:wOF2...............P...4.K.$....................?FFTM....`........h..9.6.$..|..... ......=[...D...66U..n2..s.O7..-.n......^...O...R..'@.......d"...Iv".kZ.......(..A...b.Te..!d.I......f.*...{.})2.W.lo....a^......S..K..^A.t..z.7.[s.....&9H.}k...rU4.rt..u..'......o............FsD!....)FE*Rh....Q2.4@...3df..i...q5pU.(7W7m........x\...o.(...!....O5n........J...^s.5.~...3=""B}...z...#&.....oX.~}.]H..yF.I.j.H.DJ..o.-...i.. }......\k.u.h...o..b-y..\7..S: ...#4...O./...=H.s@...S..YV.Z_...'......."..\4...N....... \.....b.?.=...6^&..E.a.....".W..\..P t..&<...>......u...B.q.....^VB....T..2.....S..*.H.p.(y..t..5...>4....U...q...C....A..b......E.....y."...P.......{wMr...0....CR~..l..j.O.M.-.%Ip......*..........6D..L(5l..u......'4..Z..L...ZQ&V.F....-g+..+..V.Cn.....l.&B.f.X.L.lh......5...T....Z.5?...t..e.]...2H...Vd.. ..A..C...D...%.B]..C..8@..j.h.U......:j...B..m]......6..;.;Wv..'$I7.B...p....@.6.T!.?.F{.*.R...*C[...../U....j..[U.......3N.'f........4_./6..x...

              Chrome Cache Entry: 99

              Download File
              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
              File Type:GIF image data, version 89a, 1 x 1
              Category:dropped
              Size (bytes):43
              Entropy (8bit):3.0314906788435274
              Encrypted:false
              SSDEEP:
              MD5:325472601571F31E1BF00674C368D335
              SHA1:2DAEAA8B5F19F0BC209D976C02BD6ACB51B00B0A
              SHA-256:B1442E85B03BDCAF66DC58C7ABB98745DD2687D86350BE9A298A1D9382AC849B
              SHA-512:717EA0FF7F3F624C268ECCB244E24EC1305AB21557ABB3D6F1A7E183FF68A2D28F13D1D2AF926C9EF6D1FB16DD8CBE34CD98CACF79091DDDC7874DCEE21ECFDC
              Malicious:false
              Reputation:unknown
              Preview:GIF89a.............!.......,...........D..;

              Static File Info

              General

              File type:RFC 822 mail, ASCII text, with very long lines (468), with CRLF line terminators
              Entropy (8bit):5.931055647113997
              TrID:
              • E-Mail message (Var. 5) (54515/1) 100.00%
              File name:phish_alert_iocp_v1.4.58.eml
              File size:14'463 bytes
              MD5:a11a9a8b91e72ffc22ad0a6459c3a9bf
              SHA1:3b57086b382ad4f216e5812d50b40e8de893f949
              SHA256:ac27b0a384c304db3b8f142f55dbd4436d14488c9c3580be34ff5d9f17c6c5c7
              SHA512:f9f2162016a601054fde6e3ff0a3572ce404c4e340da7000c51c09822de730631b5ee7bedae15541138f3d2717aab26d7b99e5edd3f13b6f7960b896e46c541a
              SSDEEP:192:iwZGAcG/sCNt32lUJntm0XMcCMCLz0pQ3yt3ebW1oM0yvo22/NnPc+PcmjPaVs09:zfbJMcDDD2my6h1e9D9/e
              TLSH:26522DD29DAB103A7A59B2ED5913BC12533234D381EB94C4FA2D92492FCD2DD9B121CB
              File Content Preview:Received: from IA0PR22MB4161.namprd22.prod.outlook.com.. (2603:10b6:208:48e::5) by CH2PR22MB1782.namprd22.prod.outlook.com with.. HTTPS; Tue, 14 Jan 2025 14:15:25 +0000..arc-seal: i=1; s=201903; d=dkim.mimecast.com; t=1736864121;.. a=rsa-sha256;.cv=none;.

              Static Mail

              General

              Subject:Your Office 365 Subscription Has Been Renewed INV-0056jkheC
              From:"info@subitoturbo.it" <info@subitoturbo.it>
              To:Greg Poma <Greg_Poma@liparifoods.com>
              Cc:
              BCC:
              Date:Mon, 13 Jan 2025 17:12:07 -0500
              Communications:
              Attachments:
              • Subscription_Renewal_Receipt_2025.htm

              Headers

              Key Value
              ReceivedTue, 14 Jan 2025 09:15:25 -0500
              arc-seali=1; s=201903; d=dkim.mimecast.com; t=1736864121; a=rsa-sha256; cv=none; b=Ub4mSrKIlSJqEOBYcwAet+7qi87OdFhClG2NFN6nKxGbSYOWiM9sHJdZ4boUlTzBz82P0H 14yaVwfT6V6nw3pdgJZYZ+0BhPhagZSdWw30NGT3w5GgS+Pw3YcxunhRG2QcRWcaLBn2+x RcOs9DFvICHJKhGnEzQjn8b7aIpOG4x3VGOEF+xVS7PozFbPnXfnkOWXqfCBGhZIDl8xKJ fMzAp1X3MiaLgG649Ld4mCFilBq4QYo3Iqk2ZoSN/KuBJUqejHJ3rcrRmhSE2WkYohaJ7b yuEFhSkleZ1cLgMeJ49A5iqBt/kJVDHfrQxFYMAZXn8hOg7VcjtabQsVbNwp7w==
              arc-message-signaturei=1; a=rsa-sha256; c=relaxed/relaxed; d=dkim.mimecast.com; s=201903; t=1736864121; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding:dkim-signature; bh=lYyIzj8Gx28dD/ZdLf02OstOieM3OljtM/jrEYqtobQ=; b=IVZyYGsOVkyr0zJz6xnS9Z8wihGDY9DNpNHTfvNywPb8axVKRdEuMjuH4Y3x8kLWDVfWRW cBWxR8QEfKWbGCZl2SFtZsI6ZudRze4OV56TSnUQoXTiB4PE5zGC6XihZGI2iBthT15jfK eLHJjpeZm0sRVk9mBjvLEQZDUnDlSZZGGZEaQB6kHarpd6+tymvXsQDXGfy6W1v5UO72Np TGtJxLToVDsI3SnfRJQmLJwTAtUr9xGoj5PTebmk8NOU/s6tmTd/Z1WJI/KMMe0/Y/EIb/ DvucPaoyU6n7ICg1xVjf1IDZ2hV4aqpUFdCTokv+8clayb9tA1lJ/Lo55EFx5A==
              arc-authentication-resultsi=1; relay.mimecast.com; dkim=pass header.d=subitoturbo.it header.s=skv3ul72xiwjnf653m6punmzwcygjrnt header.b=2B3sKoEG; dkim=pass header.d=amazonses.com header.s=ug7nbtf4gccmlpwj322ax3p6ow6yfsug header.b=C5QraCSp; dmarc=none; spf=pass (relay.mimecast.com: domain of 0100019461b96477-e5c6f6dd-2fc3-48ed-9744-fd271e292521-000000@amazonses.com designates 54.240.9.12 as permitted sender) smtp.mailfrom=0100019461b96477-e5c6f6dd-2fc3-48ed-9744-fd271e292521-000000@amazonses.com
              authentication-resultsspf=fail (sender IP is 205.139.110.120) smtp.mailfrom=amazonses.com; dkim=fail (body hash did not verify) header.d=subitoturbo.it;dmarc=fail action=none header.from=subitoturbo.it;compauth=none reason=405
              received-spfFail (protection.outlook.com: domain of amazonses.com does not designate 205.139.110.120 as permitted sender) receiver=protection.outlook.com; client-ip=205.139.110.120; helo=us-smtp-inbound-delivery-1.mimecast.com;
              ARC-Message-Signaturei=1; a=rsa-sha256; c=relaxed/relaxed; d=dkim.mimecast.com; s=201903; t=1736864121; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding:dkim-signature; bh=lYyIzj8Gx28dD/ZdLf02OstOieM3OljtM/jrEYqtobQ=; b=IVZyYGsOVkyr0zJz6xnS9Z8wihGDY9DNpNHTfvNywPb8axVKRdEuMjuH4Y3x8kLWDVfWRW cBWxR8QEfKWbGCZl2SFtZsI6ZudRze4OV56TSnUQoXTiB4PE5zGC6XihZGI2iBthT15jfK eLHJjpeZm0sRVk9mBjvLEQZDUnDlSZZGGZEaQB6kHarpd6+tymvXsQDXGfy6W1v5UO72Np TGtJxLToVDsI3SnfRJQmLJwTAtUr9xGoj5PTebmk8NOU/s6tmTd/Z1WJI/KMMe0/Y/EIb/ DvucPaoyU6n7ICg1xVjf1IDZ2hV4aqpUFdCTokv+8clayb9tA1lJ/Lo55EFx5A==
              ARC-Seali=1; s=201903; d=dkim.mimecast.com; t=1736864121; a=rsa-sha256; cv=none; b=Ub4mSrKIlSJqEOBYcwAet+7qi87OdFhClG2NFN6nKxGbSYOWiM9sHJdZ4boUlTzBz82P0H 14yaVwfT6V6nw3pdgJZYZ+0BhPhagZSdWw30NGT3w5GgS+Pw3YcxunhRG2QcRWcaLBn2+x RcOs9DFvICHJKhGnEzQjn8b7aIpOG4x3VGOEF+xVS7PozFbPnXfnkOWXqfCBGhZIDl8xKJ fMzAp1X3MiaLgG649Ld4mCFilBq4QYo3Iqk2ZoSN/KuBJUqejHJ3rcrRmhSE2WkYohaJ7b yuEFhSkleZ1cLgMeJ49A5iqBt/kJVDHfrQxFYMAZXn8hOg7VcjtabQsVbNwp7w==
              ARC-Authentication-Resultsi=1; relay.mimecast.com; dkim=pass header.d=subitoturbo.it header.s=skv3ul72xiwjnf653m6punmzwcygjrnt header.b=2B3sKoEG; dkim=pass header.d=amazonses.com header.s=ug7nbtf4gccmlpwj322ax3p6ow6yfsug header.b=C5QraCSp; dmarc=none; spf=pass (relay.mimecast.com: domain of 0100019461b96477-e5c6f6dd-2fc3-48ed-9744-fd271e292521-000000@amazonses.com designates 54.240.9.12 as permitted sender) smtp.mailfrom=0100019461b96477-e5c6f6dd-2fc3-48ed-9744-fd271e292521-000000@amazonses.com
              authentication-results-originalrelay.mimecast.com; dkim=pass header.d=subitoturbo.it header.s=skv3ul72xiwjnf653m6punmzwcygjrnt header.b=2B3sKoEG; dkim=pass header.d=amazonses.com header.s=ug7nbtf4gccmlpwj322ax3p6ow6yfsug header.b=C5QraCSp; dmarc=none; spf=pass (relay.mimecast.com: domain of 0100019461b96477-e5c6f6dd-2fc3-48ed-9744-fd271e292521-000000@amazonses.com designates 54.240.9.12 as permitted sender) smtp.mailfrom=0100019461b96477-e5c6f6dd-2fc3-48ed-9744-fd271e292521-000000@amazonses.com
              x-mc-uniquekmAycD4zMtGRzr65Q0kvgA-1
              X-Mimecast-MFC-AGG-IDkmAycD4zMtGRzr65Q0kvgA
              dkim-signaturev=1; a=rsa-sha256; q=dns/txt; c=relaxed/simple; s=ug7nbtf4gccmlpwj322ax3p6ow6yfsug; d=amazonses.com; t=1736806327; h=Content-Type:Content-Transfer-Encoding:From:To:Subject:Message-ID:Date:MIME-Version:Feedback-ID; bh=nJLoRATnp2bS5NKnTDm+Ia0Tvnjnlkyphvx035auUag=; b=C5QraCSpmnLRBN8IDkUooBOFc+P4wWYdZxWBb9himCkojKgMXbih+r5Mt0JxIFdT kV0C1Ke6bEBjsLp4jHZjjQdXltq4cERMjyjEIaNb3ghM8OphK5gfoYg5AQkGaDjx3Ws psWSDrctF28BIVYM6etur5mla1eY2fgbuImYjrww=
              DKIM-Signaturev=1; a=rsa-sha256; q=dns/txt; c=relaxed/simple; s=ug7nbtf4gccmlpwj322ax3p6ow6yfsug; d=amazonses.com; t=1736806327; h=Content-Type:Content-Transfer-Encoding:From:To:Subject:Message-ID:Date:MIME-Version:Feedback-ID; bh=nJLoRATnp2bS5NKnTDm+Ia0Tvnjnlkyphvx035auUag=; b=C5QraCSpmnLRBN8IDkUooBOFc+P4wWYdZxWBb9himCkojKgMXbih+r5Mt0JxIFdT kV0C1Ke6bEBjsLp4jHZjjQdXltq4cERMjyjEIaNb3ghM8OphK5gfoYg5AQkGaDjx3Ws psWSDrctF28BIVYM6etur5mla1eY2fgbuImYjrww=
              X-Ma4-Nodefalse
              X-Msmail-PriorityHigh
              ImportanceHigh
              feedback-id ::1.us-east-1.Sq9mu6vRfwHCY05zgzLiCvMYMG/zoPqBFWxD/Hy+7LM=:AmazonSES
              x-ses-outgoing2025.01.13-54.240.9.12
              x-mimecast-spam-score22
              X-Mimecast-MFC-PROC-ID CT9MdKPew56JshJc5r1gfCJE_huLqEBxu-q-6r4mRaY_1736806327
              x-mimecast-impersonation-protectPolicy=Impersonation Protection Definition - Mimecast Best Practices 8/11/2022;Similar Internal Domain=false;Similar Monitored External Domain=false;Custom External Domain=false;Mimecast External Domain=false;Newly Observed Domain=false;Internal User Name=false;Custom Display Name List=false;Reply-to Address Mismatch=false;Targeted Threat Dictionary=false;Mimecast Threat Dictionary=false;Custom Threat Dictionary=false
              X-Mimecast-Impersonation-ProtectPolicy=Impersonation Protection Definition - Mimecast Best Practices 8/11/2022;Similar Internal Domain=false;Similar Monitored External Domain=false;Custom External Domain=false;Mimecast External Domain=false;Newly Observed Domain=false;Internal User Name=false;Custom Display Name List=false;Reply-to Address Mismatch=false;Targeted Threat Dictionary=false;Mimecast Threat Dictionary=false;Custom Threat Dictionary=false
              Return-Path 0100019461b96477-e5c6f6dd-2fc3-48ed-9744-fd271e292521-000000@amazonses.com
              X-MS-Exchange-Organization-ExpirationStartTime14 Jan 2025 14:15:22.4121 (UTC)
              X-MS-Exchange-Organization-ExpirationStartTimeReasonOriginalSubmit
              X-MS-Exchange-Organization-ExpirationInterval1:00:00:00.0000000
              X-MS-Exchange-Organization-ExpirationIntervalReasonOriginalSubmit
              X-MS-Exchange-Organization-Network-Message-Id cc3b26ad-7361-4251-9d65-08dd34a5e21a
              x-eopattributedmessage0
              x-eoptenantattributedmessage178ea659-8905-4dba-b8db-765aad744ae2:0
              X-MS-Exchange-Organization-MessageDirectionalityIncoming
              x-ms-publictraffictypeEmail
              x-ms-traffictypediagnostic DS1PEPF00017096:EE_|IA0PR22MB4161:EE_|CH2PR22MB1782:EE_
              x-ms-exchange-organization-authsource DS1PEPF00017096.namprd05.prod.outlook.com
              x-ms-exchange-organization-authasAnonymous
              x-ms-office365-filtering-correlation-id cc3b26ad-7361-4251-9d65-08dd34a5e21a
              X-MS-Exchange-Organization-SCL-1
              x-microsoft-antispam BCL:0;ARA:13230040|32142699015|12012899012|31092699021|2092899012;
              x-forefront-antispam-report CIP:205.139.110.120;CTRY:US;LANG:en;SCL:-1;SRV:;IPV:CAL;SFV:SKN;H:us-smtp-inbound-delivery-1.mimecast.com;PTR:us-smtp-inbound-delivery-1.mimecast.com;CAT:NONE;SFS:(13230040)(32142699015)(12012899012)(31092699021)(2092899012);DIR:INB;
              x-ms-exchange-crosstenant-originalarrivaltime14 Jan 2025 14:15:22.2871 (UTC)
              x-ms-exchange-crosstenant-network-message-id cc3b26ad-7361-4251-9d65-08dd34a5e21a
              x-ms-exchange-crosstenant-id178ea659-8905-4dba-b8db-765aad744ae2
              x-ms-exchange-crosstenant-authsource DS1PEPF00017096.namprd05.prod.outlook.com
              x-ms-exchange-crosstenant-authasAnonymous
              x-ms-exchange-crosstenant-fromentityheaderInternet
              x-ms-exchange-transport-crosstenantheadersstampedIA0PR22MB4161
              x-ms-exchange-transport-endtoendlatency00:00:02.8047374
              x-ms-exchange-processed-by-bccfoldering15.20.8335.015
              X-Microsoft-Antispam-Mailbox-Delivery ucf:0;jmr:0;auth:0;dest:I;ENG:(910001)(944506478)(944626604)(920097)(930097)(140003);
              X-Microsoft-Antispam-Message-Info fPKA3Ap2IKtqzpWGzh+YolMPGmCVi/P/vngI9O2URzQHELeMdg8kcjwmRBKWYfSRol27ihmPSmfBvUSXiubHkh0ruadaEcOVoSyUsX6muKClAFDV0gwGP4lxy5OrXvhKpJ+6hxj4Ove0hSJCDnLx+Dcv2saxFpIc9Z4hdvIjNGcXyB09lF1L5emOlYr9jhfaX8Zfq3gFXHr6wJZ3DVtRmcWNJdUrRMDXM3y1+hOv+SZQvVw2HRUN8aS+QxLkcsSqO9D7USdlJmYFMy3/umvV+AOhbI9YX3uw8giBzNOGcmVKZCeXWlrWTIZEsVUbtamlOUyxZI71Y9jdwTNe7F0RRkPN5tqep7nZFE8o0iAUBCY/Uu1KGNGrzuORummF3nolH18sVa89FlH/sDcJ7tWtx3DzJ7DdCFMzhT7OJtqwDFhgfC9DvrZWbI6a2P2uAIzsemeHSFWfZK/BuAZAlqCm+g8sORvwBQMh+LjXoayVu/CBF2YdX8JHseQKU1AYeiqxXaXmWH6B916uKL4jU9i6ubzNV7od6FptwMNSobYWlKtpRfpMUBKDCM+QhNtb4Tmf/6LOXnr9Vt/IbNLvHwaiTx2Nuowa+iR9DgnWJeWpepPc2u27zD7/wRG7RIqUMzCXdFXpZIRsTf36qLX0yWW7EtWA/2mV3bWf7m0w1SX+xEcavZTIJOYD/ULui8sR04BlQytMwcFT4ApHanS/bjaaOQiphVMSDqqRNDTpE5WLw22RNapbuJhAT9PGQ38WZKlukr/kpi519F4PITnseAkSkKfERQVZO4aftJvVV00QXPSJIvcTpbjio8sTsLadOdW3+R3GIobar/uzjwU3OC9alWVwEQSfDjMb3X6KxIPBka1HAMQkykzRVgbQyIno0FoosgkI1tMsXWX+wD62hsbgqFIZCrotYGjh4KdwWHef9DVVTq48fXBn0Zs0+hfxhHcuPG8ZYdxZ4kPhSTcPRa9zqb3edbQ7fW4BiooP2w0C8aEHhXp7w/V+MI5TIolFX0wHXjej9OoJN4id27cmmegueFVi4b6R2K4OSBfdg2quVRs48H5qyZMCgG/ld+bXXC8PyECG0HFKAWFmZWyqxY7Qm0OIr+caho3ixirodfbQNj/+gM3n+gD17u0fMIs/gjMf6M5gccNenahu8xqnrplrKdxtCf/SPm0/INfD0VUnJLfHtwecLOtmIAvHWuG9DzXq6rOZ+Q3kHYb9gATmL4EL8KGajoCWpZuK4pBLqKrxMdQUstZvZ7IhsOe3qi/YFHByO7KyAML+g1+eOBOAG0cDWwl3jigxHYqwEVYixk4WaK2cSzM+BXY9CVpCBlBhq8HRCQZO0btvK5u8Uq2nqexnUqJ92qzVhbiRU5kGhVSn9jv8CXZINBewCCjGZwIdap9V/7tnMPXva1pWMaweVtyFuLsyMKHgTKbq4iurTDE6T1gFb6N6NCjMefcForjzpZyGtnxJS+2DJ2qB24DRBmW2OsN2v/6uitlAddlbGghyOfvPenqavFEShqJQdGr+CnjjhA+L4rO5t2p3HtLiHtd6KzDGmM5MxyeW4aDNe6FwBnGLSGBiaNOKLAm7M47xNaD5ZBWNmJjz09NAvFYW3LKaku2KBR6Mnb9DbWzxftD4jtrPtaUmwQDPrWP24/LPkngHQIyOpbyjE0FMEWQw6kiLspmAZmhoskuAVGpw7hCz6bhvzgAgQa62QrWcAkxDwihRmDMUf+dG+uIUjeZpHIaEHfksOZ7/rC1vw169cddLqQdqsi/eQ+LcFFhKbts305wNWzWLAS0NK2YUWmZYAJ4jWrmP9MQ8psZ2vD+/rOtzi5942v0VmRKD5P1gVzYYgpLFgnjFZyu0uCrEnFJ3SlQWIg==
              x-ms-exchange-organization-originalclientipaddress205.139.110.120
              x-ms-exchange-organization-originalserveripaddress10.167.18.100
              X-Priority1
              X-MSMail-PriorityHigh
              Thread-IndexAQHbZo7BwaqFvuPn/kKMvyl4ZQn4LQ==
              Message-ID <0100019461b96477-e5c6f6dd-2fc3-48ed-9744-fd271e292521-000000@email.amazonses.com>
              From"info@subitoturbo.it" <info@subitoturbo.it>
              ToGreg Poma <Greg_Poma@liparifoods.com>
              SubjectYour Office 365 Subscription Has Been Renewed INV-0056jkheC
              DateMon, 13 Jan 2025 17:12:07 -0500
              MIME-Version1.0
              Content-typeMultipart/mixed; charset="us-ascii"; boundary="00B0FEED_message_boundary"
              Content-DescriptionMultipart message

              File Icon

              Icon Hash:46070c0a8e0c67d6